973 files changed, 75255 insertions, 23359 deletions

diff --git a/Documentation/DocBook/80211.tmpl b/Documentation/DocBook/80211.tmpl
new file mode 100644
index 000000000000..19a1210c2530
--- /dev/null
+++ b/Documentation/DocBook/80211.tmpl
@@ -0,0 +1,495 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
+        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
+<set>
+  <setinfo>
+    <title>The 802.11 subsystems &ndash; for kernel developers</title>
+    <subtitle>
+      Explaining wireless 802.11 networking in the Linux kernel
+    </subtitle>
+
+    <copyright>
+      <year>2007-2009</year>
+      <holder>Johannes Berg</holder>
+    </copyright>
+
+    <authorgroup>
+      <author>
+        <firstname>Johannes</firstname>
+        <surname>Berg</surname>
+        <affiliation>
+          <address><email>johannes@sipsolutions.net</email></address>
+        </affiliation>
+      </author>
+    </authorgroup>
+
+    <legalnotice>
+      <para>
+        This documentation is free software; you can redistribute
+        it and/or modify it under the terms of the GNU General Public
+        License version 2 as published by the Free Software Foundation.
+      </para>
+      <para>
+        This documentation is distributed in the hope that it will be
+        useful, but WITHOUT ANY WARRANTY; without even the implied
+        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+        See the GNU General Public License for more details.
+      </para>
+      <para>
+        You should have received a copy of the GNU General Public
+        License along with this documentation; if not, write to the Free
+        Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+        MA 02111-1307 USA
+      </para>
+      <para>
+        For more details see the file COPYING in the source
+        distribution of Linux.
+      </para>
+    </legalnotice>
+
+    <abstract>
+      <para>
+        These books attempt to give a description of the
+        various subsystems that play a role in 802.11 wireless
+        networking in Linux. Since these books are for kernel
+        developers they attempts to document the structures
+        and functions used in the kernel as well as giving a
+        higher-level overview.
+      </para>
+      <para>
+        The reader is expected to be familiar with the 802.11
+        standard as published by the IEEE in 802.11-2007 (or
+        possibly later versions). References to this standard
+        will be given as "802.11-2007 8.1.5".
+      </para>
+    </abstract>
+  </setinfo>
+  <book id="cfg80211-developers-guide">
+    <bookinfo>
+      <title>The cfg80211 subsystem</title>
+
+      <abstract>
+!Pinclude/net/cfg80211.h Introduction
+      </abstract>
+    </bookinfo>
+      <chapter>
+      <title>Device registration</title>
+!Pinclude/net/cfg80211.h Device registration
+!Finclude/net/cfg80211.h ieee80211_band
+!Finclude/net/cfg80211.h ieee80211_channel_flags
+!Finclude/net/cfg80211.h ieee80211_channel
+!Finclude/net/cfg80211.h ieee80211_rate_flags
+!Finclude/net/cfg80211.h ieee80211_rate
+!Finclude/net/cfg80211.h ieee80211_sta_ht_cap
+!Finclude/net/cfg80211.h ieee80211_supported_band
+!Finclude/net/cfg80211.h cfg80211_signal_type
+!Finclude/net/cfg80211.h wiphy_params_flags
+!Finclude/net/cfg80211.h wiphy_flags
+!Finclude/net/cfg80211.h wiphy
+!Finclude/net/cfg80211.h wireless_dev
+!Finclude/net/cfg80211.h wiphy_new
+!Finclude/net/cfg80211.h wiphy_register
+!Finclude/net/cfg80211.h wiphy_unregister
+!Finclude/net/cfg80211.h wiphy_free
+
+!Finclude/net/cfg80211.h wiphy_name
+!Finclude/net/cfg80211.h wiphy_dev
+!Finclude/net/cfg80211.h wiphy_priv
+!Finclude/net/cfg80211.h priv_to_wiphy
+!Finclude/net/cfg80211.h set_wiphy_dev
+!Finclude/net/cfg80211.h wdev_priv
+      </chapter>
+      <chapter>
+      <title>Actions and configuration</title>
+!Pinclude/net/cfg80211.h Actions and configuration
+!Finclude/net/cfg80211.h cfg80211_ops
+!Finclude/net/cfg80211.h vif_params
+!Finclude/net/cfg80211.h key_params
+!Finclude/net/cfg80211.h survey_info_flags
+!Finclude/net/cfg80211.h survey_info
+!Finclude/net/cfg80211.h beacon_parameters
+!Finclude/net/cfg80211.h plink_actions
+!Finclude/net/cfg80211.h station_parameters
+!Finclude/net/cfg80211.h station_info_flags
+!Finclude/net/cfg80211.h rate_info_flags
+!Finclude/net/cfg80211.h rate_info
+!Finclude/net/cfg80211.h station_info
+!Finclude/net/cfg80211.h monitor_flags
+!Finclude/net/cfg80211.h mpath_info_flags
+!Finclude/net/cfg80211.h mpath_info
+!Finclude/net/cfg80211.h bss_parameters
+!Finclude/net/cfg80211.h ieee80211_txq_params
+!Finclude/net/cfg80211.h cfg80211_crypto_settings
+!Finclude/net/cfg80211.h cfg80211_auth_request
+!Finclude/net/cfg80211.h cfg80211_assoc_request
+!Finclude/net/cfg80211.h cfg80211_deauth_request
+!Finclude/net/cfg80211.h cfg80211_disassoc_request
+!Finclude/net/cfg80211.h cfg80211_ibss_params
+!Finclude/net/cfg80211.h cfg80211_connect_params
+!Finclude/net/cfg80211.h cfg80211_pmksa
+!Finclude/net/cfg80211.h cfg80211_send_rx_auth
+!Finclude/net/cfg80211.h cfg80211_send_auth_timeout
+!Finclude/net/cfg80211.h __cfg80211_auth_canceled
+!Finclude/net/cfg80211.h cfg80211_send_rx_assoc
+!Finclude/net/cfg80211.h cfg80211_send_assoc_timeout
+!Finclude/net/cfg80211.h cfg80211_send_deauth
+!Finclude/net/cfg80211.h __cfg80211_send_deauth
+!Finclude/net/cfg80211.h cfg80211_send_disassoc
+!Finclude/net/cfg80211.h __cfg80211_send_disassoc
+!Finclude/net/cfg80211.h cfg80211_ibss_joined
+!Finclude/net/cfg80211.h cfg80211_connect_result
+!Finclude/net/cfg80211.h cfg80211_roamed
+!Finclude/net/cfg80211.h cfg80211_disconnected
+!Finclude/net/cfg80211.h cfg80211_ready_on_channel
+!Finclude/net/cfg80211.h cfg80211_remain_on_channel_expired
+!Finclude/net/cfg80211.h cfg80211_new_sta
+!Finclude/net/cfg80211.h cfg80211_rx_mgmt
+!Finclude/net/cfg80211.h cfg80211_mgmt_tx_status
+!Finclude/net/cfg80211.h cfg80211_cqm_rssi_notify
+!Finclude/net/cfg80211.h cfg80211_michael_mic_failure
+      </chapter>
+      <chapter>
+      <title>Scanning and BSS list handling</title>
+!Pinclude/net/cfg80211.h Scanning and BSS list handling
+!Finclude/net/cfg80211.h cfg80211_ssid
+!Finclude/net/cfg80211.h cfg80211_scan_request
+!Finclude/net/cfg80211.h cfg80211_scan_done
+!Finclude/net/cfg80211.h cfg80211_bss
+!Finclude/net/cfg80211.h cfg80211_inform_bss_frame
+!Finclude/net/cfg80211.h cfg80211_inform_bss
+!Finclude/net/cfg80211.h cfg80211_unlink_bss
+!Finclude/net/cfg80211.h cfg80211_find_ie
+!Finclude/net/cfg80211.h ieee80211_bss_get_ie
+      </chapter>
+      <chapter>
+      <title>Utility functions</title>
+!Pinclude/net/cfg80211.h Utility functions
+!Finclude/net/cfg80211.h ieee80211_channel_to_frequency
+!Finclude/net/cfg80211.h ieee80211_frequency_to_channel
+!Finclude/net/cfg80211.h ieee80211_get_channel
+!Finclude/net/cfg80211.h ieee80211_get_response_rate
+!Finclude/net/cfg80211.h ieee80211_hdrlen
+!Finclude/net/cfg80211.h ieee80211_get_hdrlen_from_skb
+!Finclude/net/cfg80211.h ieee80211_radiotap_iterator
+      </chapter>
+      <chapter>
+      <title>Data path helpers</title>
+!Pinclude/net/cfg80211.h Data path helpers
+!Finclude/net/cfg80211.h ieee80211_data_to_8023
+!Finclude/net/cfg80211.h ieee80211_data_from_8023
+!Finclude/net/cfg80211.h ieee80211_amsdu_to_8023s
+!Finclude/net/cfg80211.h cfg80211_classify8021d
+      </chapter>
+      <chapter>
+      <title>Regulatory enforcement infrastructure</title>
+!Pinclude/net/cfg80211.h Regulatory enforcement infrastructure
+!Finclude/net/cfg80211.h regulatory_hint
+!Finclude/net/cfg80211.h wiphy_apply_custom_regulatory
+!Finclude/net/cfg80211.h freq_reg_info
+      </chapter>
+      <chapter>
+      <title>RFkill integration</title>
+!Pinclude/net/cfg80211.h RFkill integration
+!Finclude/net/cfg80211.h wiphy_rfkill_set_hw_state
+!Finclude/net/cfg80211.h wiphy_rfkill_start_polling
+!Finclude/net/cfg80211.h wiphy_rfkill_stop_polling
+      </chapter>
+      <chapter>
+      <title>Test mode</title>
+!Pinclude/net/cfg80211.h Test mode
+!Finclude/net/cfg80211.h cfg80211_testmode_alloc_reply_skb
+!Finclude/net/cfg80211.h cfg80211_testmode_reply
+!Finclude/net/cfg80211.h cfg80211_testmode_alloc_event_skb
+!Finclude/net/cfg80211.h cfg80211_testmode_event
+      </chapter>
+  </book>
+  <book id="mac80211-developers-guide">
+    <bookinfo>
+      <title>The mac80211 subsystem</title>
+      <abstract>
+!Pinclude/net/mac80211.h Introduction
+!Pinclude/net/mac80211.h Warning
+      </abstract>
+    </bookinfo>
+
+    <toc></toc>
+
+  <!--
+  Generally, this document shall be ordered by increasing complexity.
+  It is important to note that readers should be able to read only
+  the first few sections to get a working driver and only advanced
+  usage should require reading the full document.
+  -->
+
+    <part>
+      <title>The basic mac80211 driver interface</title>
+      <partintro>
+        <para>
+          You should read and understand the information contained
+          within this part of the book while implementing a driver.
+          In some chapters, advanced usage is noted, that may be
+          skipped at first.
+        </para>
+        <para>
+          This part of the book only covers station and monitor mode
+          functionality, additional information required to implement
+          the other modes is covered in the second part of the book.
+        </para>
+      </partintro>
+
+      <chapter id="basics">
+        <title>Basic hardware handling</title>
+        <para>TBD</para>
+        <para>
+          This chapter shall contain information on getting a hw
+          struct allocated and registered with mac80211.
+        </para>
+        <para>
+          Since it is required to allocate rates/modes before registering
+          a hw struct, this chapter shall also contain information on setting
+          up the rate/mode structs.
+        </para>
+        <para>
+          Additionally, some discussion about the callbacks and
+          the general programming model should be in here, including
+          the definition of ieee80211_ops which will be referred to
+          a lot.
+        </para>
+        <para>
+          Finally, a discussion of hardware capabilities should be done
+          with references to other parts of the book.
+        </para>
+  <!-- intentionally multiple !F lines to get proper order -->
+!Finclude/net/mac80211.h ieee80211_hw
+!Finclude/net/mac80211.h ieee80211_hw_flags
+!Finclude/net/mac80211.h SET_IEEE80211_DEV
+!Finclude/net/mac80211.h SET_IEEE80211_PERM_ADDR
+!Finclude/net/mac80211.h ieee80211_ops
+!Finclude/net/mac80211.h ieee80211_alloc_hw
+!Finclude/net/mac80211.h ieee80211_register_hw
+!Finclude/net/mac80211.h ieee80211_get_tx_led_name
+!Finclude/net/mac80211.h ieee80211_get_rx_led_name
+!Finclude/net/mac80211.h ieee80211_get_assoc_led_name
+!Finclude/net/mac80211.h ieee80211_get_radio_led_name
+!Finclude/net/mac80211.h ieee80211_unregister_hw
+!Finclude/net/mac80211.h ieee80211_free_hw
+      </chapter>
+
+      <chapter id="phy-handling">
+        <title>PHY configuration</title>
+        <para>TBD</para>
+        <para>
+          This chapter should describe PHY handling including
+          start/stop callbacks and the various structures used.
+        </para>
+!Finclude/net/mac80211.h ieee80211_conf
+!Finclude/net/mac80211.h ieee80211_conf_flags
+      </chapter>
+
+      <chapter id="iface-handling">
+        <title>Virtual interfaces</title>
+        <para>TBD</para>
+        <para>
+          This chapter should describe virtual interface basics
+          that are relevant to the driver (VLANs, MGMT etc are not.)
+          It should explain the use of the add_iface/remove_iface
+          callbacks as well as the interface configuration callbacks.
+        </para>
+        <para>Things related to AP mode should be discussed there.</para>
+        <para>
+          Things related to supporting multiple interfaces should be
+          in the appropriate chapter, a BIG FAT note should be here about
+          this though and the recommendation to allow only a single
+          interface in STA mode at first!
+        </para>
+!Finclude/net/mac80211.h ieee80211_vif
+      </chapter>
+
+      <chapter id="rx-tx">
+        <title>Receive and transmit processing</title>
+        <sect1>
+          <title>what should be here</title>
+          <para>TBD</para>
+          <para>
+            This should describe the receive and transmit
+            paths in mac80211/the drivers as well as
+            transmit status handling.
+          </para>
+        </sect1>
+        <sect1>
+          <title>Frame format</title>
+!Pinclude/net/mac80211.h Frame format
+        </sect1>
+        <sect1>
+          <title>Packet alignment</title>
+!Pnet/mac80211/rx.c Packet alignment
+        </sect1>
+        <sect1>
+          <title>Calling into mac80211 from interrupts</title>
+!Pinclude/net/mac80211.h Calling mac80211 from interrupts
+        </sect1>
+        <sect1>
+          <title>functions/definitions</title>
+!Finclude/net/mac80211.h ieee80211_rx_status
+!Finclude/net/mac80211.h mac80211_rx_flags
+!Finclude/net/mac80211.h ieee80211_tx_info
+!Finclude/net/mac80211.h ieee80211_rx
+!Finclude/net/mac80211.h ieee80211_rx_irqsafe
+!Finclude/net/mac80211.h ieee80211_tx_status
+!Finclude/net/mac80211.h ieee80211_tx_status_irqsafe
+!Finclude/net/mac80211.h ieee80211_rts_get
+!Finclude/net/mac80211.h ieee80211_rts_duration
+!Finclude/net/mac80211.h ieee80211_ctstoself_get
+!Finclude/net/mac80211.h ieee80211_ctstoself_duration
+!Finclude/net/mac80211.h ieee80211_generic_frame_duration
+!Finclude/net/mac80211.h ieee80211_wake_queue
+!Finclude/net/mac80211.h ieee80211_stop_queue
+!Finclude/net/mac80211.h ieee80211_wake_queues
+!Finclude/net/mac80211.h ieee80211_stop_queues
+        </sect1>
+      </chapter>
+
+      <chapter id="filters">
+        <title>Frame filtering</title>
+!Pinclude/net/mac80211.h Frame filtering
+!Finclude/net/mac80211.h ieee80211_filter_flags
+      </chapter>
+    </part>
+
+    <part id="advanced">
+      <title>Advanced driver interface</title>
+      <partintro>
+        <para>
+         Information contained within this part of the book is
+         of interest only for advanced interaction of mac80211
+         with drivers to exploit more hardware capabilities and
+         improve performance.
+        </para>
+      </partintro>
+
+      <chapter id="hardware-crypto-offload">
+        <title>Hardware crypto acceleration</title>
+!Pinclude/net/mac80211.h Hardware crypto acceleration
+  <!-- intentionally multiple !F lines to get proper order -->
+!Finclude/net/mac80211.h set_key_cmd
+!Finclude/net/mac80211.h ieee80211_key_conf
+!Finclude/net/mac80211.h ieee80211_key_flags
+      </chapter>
+
+      <chapter id="powersave">
+        <title>Powersave support</title>
+!Pinclude/net/mac80211.h Powersave support
+      </chapter>
+
+      <chapter id="beacon-filter">
+        <title>Beacon filter support</title>
+!Pinclude/net/mac80211.h Beacon filter support
+!Finclude/net/mac80211.h ieee80211_beacon_loss
+      </chapter>
+
+      <chapter id="qos">
+        <title>Multiple queues and QoS support</title>
+        <para>TBD</para>
+!Finclude/net/mac80211.h ieee80211_tx_queue_params
+      </chapter>
+
+      <chapter id="AP">
+        <title>Access point mode support</title>
+        <para>TBD</para>
+        <para>Some parts of the if_conf should be discussed here instead</para>
+        <para>
+          Insert notes about VLAN interfaces with hw crypto here or
+          in the hw crypto chapter.
+        </para>
+!Finclude/net/mac80211.h ieee80211_get_buffered_bc
+!Finclude/net/mac80211.h ieee80211_beacon_get
+      </chapter>
+
+      <chapter id="multi-iface">
+        <title>Supporting multiple virtual interfaces</title>
+        <para>TBD</para>
+        <para>
+          Note: WDS with identical MAC address should almost always be OK
+        </para>
+        <para>
+          Insert notes about having multiple virtual interfaces with
+          different MAC addresses here, note which configurations are
+          supported by mac80211, add notes about supporting hw crypto
+          with it.
+        </para>
+      </chapter>
+
+      <chapter id="hardware-scan-offload">
+        <title>Hardware scan offload</title>
+        <para>TBD</para>
+!Finclude/net/mac80211.h ieee80211_scan_completed
+      </chapter>
+    </part>
+
+    <part id="rate-control">
+      <title>Rate control interface</title>
+      <partintro>
+        <para>TBD</para>
+        <para>
+         This part of the book describes the rate control algorithm
+         interface and how it relates to mac80211 and drivers.
+        </para>
+      </partintro>
+      <chapter id="dummy">
+        <title>dummy chapter</title>
+        <para>TBD</para>
+      </chapter>
+    </part>
+
+    <part id="internal">
+      <title>Internals</title>
+      <partintro>
+        <para>TBD</para>
+        <para>
+         This part of the book describes mac80211 internals.
+        </para>
+      </partintro>
+
+      <chapter id="key-handling">
+        <title>Key handling</title>
+        <sect1>
+          <title>Key handling basics</title>
+!Pnet/mac80211/key.c Key handling basics
+        </sect1>
+        <sect1>
+          <title>MORE TBD</title>
+          <para>TBD</para>
+        </sect1>
+      </chapter>
+
+      <chapter id="rx-processing">
+        <title>Receive processing</title>
+        <para>TBD</para>
+      </chapter>
+
+      <chapter id="tx-processing">
+        <title>Transmit processing</title>
+        <para>TBD</para>
+      </chapter>
+
+      <chapter id="sta-info">
+        <title>Station info handling</title>
+        <sect1>
+          <title>Programming information</title>
+!Fnet/mac80211/sta_info.h sta_info
+!Fnet/mac80211/sta_info.h ieee80211_sta_info_flags
+        </sect1>
+        <sect1>
+          <title>STA information lifetime rules</title>
+!Pnet/mac80211/sta_info.c STA information lifetime rules
+        </sect1>
+      </chapter>
+
+      <chapter id="synchronisation">
+        <title>Synchronisation</title>
+        <para>TBD</para>
+        <para>Locking, lots of RCU</para>
+      </chapter>
+    </part>
+  </book>
+</set>
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 34929f24c284..8b6e00a71034 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -12,7 +12,7 @@ DOCBOOKS := z8530book.xml mcabook.xml device-drivers.xml \
             kernel-api.xml filesystems.xml lsm.xml usb.xml kgdb.xml \
             gadget.xml libata.xml mtdnand.xml librs.xml rapidio.xml \
             genericirq.xml s390-drivers.xml uio-howto.xml scsi.xml \
-            mac80211.xml debugobjects.xml sh.xml regulator.xml \
+            80211.xml debugobjects.xml sh.xml regulator.xml \
             alsa-driver-api.xml writing-an-alsa-driver.xml \
             tracepoint.xml media.xml drm.xml
 
diff --git a/Documentation/DocBook/mac80211.tmpl b/Documentation/DocBook/mac80211.tmpl
deleted file mode 100644
index affb15a344a1..000000000000
--- a/Documentation/DocBook/mac80211.tmpl
+++ /dev/null
@@ -1,337 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
-        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
-
-<book id="mac80211-developers-guide">
-  <bookinfo>
-    <title>The mac80211 subsystem for kernel developers</title>
-
-    <authorgroup>
-      <author>
-        <firstname>Johannes</firstname>
-        <surname>Berg</surname>
-        <affiliation>
-          <address><email>johannes@sipsolutions.net</email></address>
-        </affiliation>
-      </author>
-    </authorgroup>
-
-    <copyright>
-      <year>2007-2009</year>
-      <holder>Johannes Berg</holder>
-    </copyright>
-
-    <legalnotice>
-      <para>
-        This documentation is free software; you can redistribute
-        it and/or modify it under the terms of the GNU General Public
-        License version 2 as published by the Free Software Foundation.
-      </para>
-
-      <para>
-        This documentation is distributed in the hope that it will be
-        useful, but WITHOUT ANY WARRANTY; without even the implied
-        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-        See the GNU General Public License for more details.
-      </para>
-
-      <para>
-        You should have received a copy of the GNU General Public
-        License along with this documentation; if not, write to the Free
-        Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-        MA 02111-1307 USA
-      </para>
-
-      <para>
-        For more details see the file COPYING in the source
-        distribution of Linux.
-      </para>
-    </legalnotice>
-
-    <abstract>
-!Pinclude/net/mac80211.h Introduction
-!Pinclude/net/mac80211.h Warning
-    </abstract>
-  </bookinfo>
-
-  <toc></toc>
-
-<!--
-Generally, this document shall be ordered by increasing complexity.
-It is important to note that readers should be able to read only
-the first few sections to get a working driver and only advanced
-usage should require reading the full document.
--->
-
-  <part>
-    <title>The basic mac80211 driver interface</title>
-    <partintro>
-      <para>
-        You should read and understand the information contained
-        within this part of the book while implementing a driver.
-        In some chapters, advanced usage is noted, that may be
-        skipped at first.
-      </para>
-      <para>
-        This part of the book only covers station and monitor mode
-        functionality, additional information required to implement
-        the other modes is covered in the second part of the book.
-      </para>
-    </partintro>
-
-    <chapter id="basics">
-      <title>Basic hardware handling</title>
-      <para>TBD</para>
-      <para>
-        This chapter shall contain information on getting a hw
-        struct allocated and registered with mac80211.
-      </para>
-      <para>
-        Since it is required to allocate rates/modes before registering
-        a hw struct, this chapter shall also contain information on setting
-        up the rate/mode structs.
-      </para>
-      <para>
-        Additionally, some discussion about the callbacks and
-        the general programming model should be in here, including
-        the definition of ieee80211_ops which will be referred to
-        a lot.
-      </para>
-      <para>
-        Finally, a discussion of hardware capabilities should be done
-        with references to other parts of the book.
-      </para>
-<!-- intentionally multiple !F lines to get proper order -->
-!Finclude/net/mac80211.h ieee80211_hw
-!Finclude/net/mac80211.h ieee80211_hw_flags
-!Finclude/net/mac80211.h SET_IEEE80211_DEV
-!Finclude/net/mac80211.h SET_IEEE80211_PERM_ADDR
-!Finclude/net/mac80211.h ieee80211_ops
-!Finclude/net/mac80211.h ieee80211_alloc_hw
-!Finclude/net/mac80211.h ieee80211_register_hw
-!Finclude/net/mac80211.h ieee80211_get_tx_led_name
-!Finclude/net/mac80211.h ieee80211_get_rx_led_name
-!Finclude/net/mac80211.h ieee80211_get_assoc_led_name
-!Finclude/net/mac80211.h ieee80211_get_radio_led_name
-!Finclude/net/mac80211.h ieee80211_unregister_hw
-!Finclude/net/mac80211.h ieee80211_free_hw
-    </chapter>
-
-    <chapter id="phy-handling">
-      <title>PHY configuration</title>
-      <para>TBD</para>
-      <para>
-        This chapter should describe PHY handling including
-        start/stop callbacks and the various structures used.
-      </para>
-!Finclude/net/mac80211.h ieee80211_conf
-!Finclude/net/mac80211.h ieee80211_conf_flags
-    </chapter>
-
-    <chapter id="iface-handling">
-      <title>Virtual interfaces</title>
-      <para>TBD</para>
-      <para>
-        This chapter should describe virtual interface basics
-        that are relevant to the driver (VLANs, MGMT etc are not.)
-        It should explain the use of the add_iface/remove_iface
-        callbacks as well as the interface configuration callbacks.
-      </para>
-      <para>Things related to AP mode should be discussed there.</para>
-      <para>
-        Things related to supporting multiple interfaces should be
-        in the appropriate chapter, a BIG FAT note should be here about
-        this though and the recommendation to allow only a single
-        interface in STA mode at first!
-      </para>
-!Finclude/net/mac80211.h ieee80211_vif
-    </chapter>
-
-    <chapter id="rx-tx">
-      <title>Receive and transmit processing</title>
-      <sect1>
-        <title>what should be here</title>
-        <para>TBD</para>
-        <para>
-          This should describe the receive and transmit
-          paths in mac80211/the drivers as well as
-          transmit status handling.
-        </para>
-      </sect1>
-      <sect1>
-        <title>Frame format</title>
-!Pinclude/net/mac80211.h Frame format
-      </sect1>
-      <sect1>
-        <title>Packet alignment</title>
-!Pnet/mac80211/rx.c Packet alignment
-      </sect1>
-      <sect1>
-        <title>Calling into mac80211 from interrupts</title>
-!Pinclude/net/mac80211.h Calling mac80211 from interrupts
-      </sect1>
-      <sect1>
-        <title>functions/definitions</title>
-!Finclude/net/mac80211.h ieee80211_rx_status
-!Finclude/net/mac80211.h mac80211_rx_flags
-!Finclude/net/mac80211.h ieee80211_tx_info
-!Finclude/net/mac80211.h ieee80211_rx
-!Finclude/net/mac80211.h ieee80211_rx_irqsafe
-!Finclude/net/mac80211.h ieee80211_tx_status
-!Finclude/net/mac80211.h ieee80211_tx_status_irqsafe
-!Finclude/net/mac80211.h ieee80211_rts_get
-!Finclude/net/mac80211.h ieee80211_rts_duration
-!Finclude/net/mac80211.h ieee80211_ctstoself_get
-!Finclude/net/mac80211.h ieee80211_ctstoself_duration
-!Finclude/net/mac80211.h ieee80211_generic_frame_duration
-!Finclude/net/mac80211.h ieee80211_wake_queue
-!Finclude/net/mac80211.h ieee80211_stop_queue
-!Finclude/net/mac80211.h ieee80211_wake_queues
-!Finclude/net/mac80211.h ieee80211_stop_queues
-      </sect1>
-    </chapter>
-
-    <chapter id="filters">
-      <title>Frame filtering</title>
-!Pinclude/net/mac80211.h Frame filtering
-!Finclude/net/mac80211.h ieee80211_filter_flags
-    </chapter>
-  </part>
-
-  <part id="advanced">
-    <title>Advanced driver interface</title>
-    <partintro>
-      <para>
-       Information contained within this part of the book is
-       of interest only for advanced interaction of mac80211
-       with drivers to exploit more hardware capabilities and
-       improve performance.
-      </para>
-    </partintro>
-
-    <chapter id="hardware-crypto-offload">
-      <title>Hardware crypto acceleration</title>
-!Pinclude/net/mac80211.h Hardware crypto acceleration
-<!-- intentionally multiple !F lines to get proper order -->
-!Finclude/net/mac80211.h set_key_cmd
-!Finclude/net/mac80211.h ieee80211_key_conf
-!Finclude/net/mac80211.h ieee80211_key_alg
-!Finclude/net/mac80211.h ieee80211_key_flags
-    </chapter>
-
-    <chapter id="powersave">
-      <title>Powersave support</title>
-!Pinclude/net/mac80211.h Powersave support
-    </chapter>
-
-    <chapter id="beacon-filter">
-      <title>Beacon filter support</title>
-!Pinclude/net/mac80211.h Beacon filter support
-!Finclude/net/mac80211.h ieee80211_beacon_loss
-    </chapter>
-
-    <chapter id="qos">
-      <title>Multiple queues and QoS support</title>
-      <para>TBD</para>
-!Finclude/net/mac80211.h ieee80211_tx_queue_params
-    </chapter>
-
-    <chapter id="AP">
-      <title>Access point mode support</title>
-      <para>TBD</para>
-      <para>Some parts of the if_conf should be discussed here instead</para>
-      <para>
-        Insert notes about VLAN interfaces with hw crypto here or
-        in the hw crypto chapter.
-      </para>
-!Finclude/net/mac80211.h ieee80211_get_buffered_bc
-!Finclude/net/mac80211.h ieee80211_beacon_get
-    </chapter>
-
-    <chapter id="multi-iface">
-      <title>Supporting multiple virtual interfaces</title>
-      <para>TBD</para>
-      <para>
-        Note: WDS with identical MAC address should almost always be OK
-      </para>
-      <para>
-        Insert notes about having multiple virtual interfaces with
-        different MAC addresses here, note which configurations are
-        supported by mac80211, add notes about supporting hw crypto
-        with it.
-      </para>
-    </chapter>
-
-    <chapter id="hardware-scan-offload">
-      <title>Hardware scan offload</title>
-      <para>TBD</para>
-!Finclude/net/mac80211.h ieee80211_scan_completed
-    </chapter>
-  </part>
-
-  <part id="rate-control">
-    <title>Rate control interface</title>
-    <partintro>
-      <para>TBD</para>
-      <para>
-       This part of the book describes the rate control algorithm
-       interface and how it relates to mac80211 and drivers.
-      </para>
-    </partintro>
-    <chapter id="dummy">
-      <title>dummy chapter</title>
-      <para>TBD</para>
-    </chapter>
-  </part>
-
-  <part id="internal">
-    <title>Internals</title>
-    <partintro>
-      <para>TBD</para>
-      <para>
-       This part of the book describes mac80211 internals.
-      </para>
-    </partintro>
-
-    <chapter id="key-handling">
-      <title>Key handling</title>
-      <sect1>
-        <title>Key handling basics</title>
-!Pnet/mac80211/key.c Key handling basics
-      </sect1>
-      <sect1>
-        <title>MORE TBD</title>
-        <para>TBD</para>
-      </sect1>
-    </chapter>
-
-    <chapter id="rx-processing">
-      <title>Receive processing</title>
-      <para>TBD</para>
-    </chapter>
-
-    <chapter id="tx-processing">
-      <title>Transmit processing</title>
-      <para>TBD</para>
-    </chapter>
-
-    <chapter id="sta-info">
-      <title>Station info handling</title>
-      <sect1>
-        <title>Programming information</title>
-!Fnet/mac80211/sta_info.h sta_info
-!Fnet/mac80211/sta_info.h ieee80211_sta_info_flags
-      </sect1>
-      <sect1>
-        <title>STA information lifetime rules</title>
-!Pnet/mac80211/sta_info.c STA information lifetime rules
-      </sect1>
-    </chapter>
-
-    <chapter id="synchronisation">
-      <title>Synchronisation</title>
-      <para>TBD</para>
-      <para>Locking, lots of RCU</para>
-    </chapter>
-  </part>
-</book>
diff --git a/Documentation/networking/dccp.txt b/Documentation/networking/dccp.txt
index a62fdf7a6bff..271d524a4c8d 100644
--- a/Documentation/networking/dccp.txt
+++ b/Documentation/networking/dccp.txt
@@ -1,18 +1,20 @@
 DCCP protocol
-============
+=============
 
 
 Contents
 ========
-
 - Introduction
 - Missing features
 - Socket options
+- Sysctl variables
+- IOCTLs
+- Other tunables
 - Notes
 
+
 Introduction
 ============
-
 Datagram Congestion Control Protocol (DCCP) is an unreliable, connection
 oriented protocol designed to solve issues present in UDP and TCP, particularly
 for real-time and multimedia (streaming) traffic.
@@ -29,9 +31,9 @@ It has a base protocol and pluggable congestion control IDs (CCIDs).
 DCCP is a Proposed Standard (RFC 2026), and the homepage for DCCP as a protocol
 is at http://www.ietf.org/html.charters/dccp-charter.html
 
+
 Missing features
 ================
-
 The Linux DCCP implementation does not currently support all the features that are
 specified in RFCs 4340...42.
 
@@ -45,7 +47,6 @@ http://linux-net.osdl.org/index.php/DCCP_Testing#Experimental_DCCP_source_tree
 
 Socket options
 ==============
-
 DCCP_SOCKOPT_SERVICE sets the service. The specification mandates use of
 service codes (RFC 4340, sec. 8.1.2); if this socket option is not set,
 the socket will fall back to 0 (which means that no meaningful service code
@@ -112,6 +113,7 @@ DCCP_SOCKOPT_CCID_TX_INFO
 On unidirectional connections it is useful to close the unused half-connection
 via shutdown (SHUT_WR or SHUT_RD): this will reduce per-packet processing costs.
 
+
 Sysctl variables
 ================
 Several DCCP default parameters can be managed by the following sysctls
@@ -155,15 +157,30 @@ sync_ratelimit = 125 ms
         sequence-invalid packets on the same socket (RFC 4340, 7.5.4). The unit
         of this parameter is milliseconds; a value of 0 disables rate-limiting.
 
+
 IOCTLS
 ======
 FIONREAD
         Works as in udp(7): returns in the `int' argument pointer the size of
         the next pending datagram in bytes, or 0 when no datagram is pending.
 
+
+Other tunables
+==============
+Per-route rto_min support
+        CCID-2 supports the RTAX_RTO_MIN per-route setting for the minimum value
+        of the RTO timer. This setting can be modified via the 'rto_min' option
+        of iproute2; for example:
+                > ip route change 10.0.0.0/24   rto_min 250j dev wlan0
+                > ip route add    10.0.0.254/32 rto_min 800j dev wlan0
+                > ip route show dev wlan0
+        CCID-3 also supports the rto_min setting: it is used to define the lower
+        bound for the expiry of the nofeedback timer. This can be useful on LANs
+        with very low RTTs (e.g., loopback, Gbit ethernet).
+
+
 Notes
 =====
-
 DCCP does not travel through NAT successfully at present on many boxes. This is
 because the checksum covers the pseudo-header as per TCP and UDP. Linux NAT
 support for DCCP has been added.
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index f350c69b2bb4..c7165f4cb792 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1014,6 +1014,12 @@ conf/interface/*:
 accept_ra - BOOLEAN
         Accept Router Advertisements; autoconfigure using them.
 
+        Possible values are:
+                0 Do not accept Router Advertisements.
+                1 Accept Router Advertisements if forwarding is disabled.
+                2 Overrule forwarding behaviour. Accept Router Advertisements
+                  even if forwarding is enabled.
+
         Functional default: enabled if local forwarding is disabled.
                             disabled if local forwarding is enabled.
 
@@ -1075,7 +1081,12 @@ forwarding - BOOLEAN
         Note: It is recommended to have the same setting on all
         interfaces; mixed router/host scenarios are rather uncommon.
 
-        FALSE:
+        Possible values are:
+                0 Forwarding disabled
+                1 Forwarding enabled
+                2 Forwarding enabled (Hybrid Mode)
+
+        FALSE (0):
 
         By default, Host behaviour is assumed.  This means:
 
@@ -1085,18 +1096,24 @@ forwarding - BOOLEAN
            Advertisements (and do autoconfiguration).
         4. If accept_redirects is TRUE (default), accept Redirects.
 
-        TRUE:
+        TRUE (1):
 
         If local forwarding is enabled, Router behaviour is assumed.
         This means exactly the reverse from the above:
 
         1. IsRouter flag is set in Neighbour Advertisements.
         2. Router Solicitations are not sent.
-        3. Router Advertisements are ignored.
+        3. Router Advertisements are ignored unless accept_ra is 2.
         4. Redirects are ignored.
 
-        Default: FALSE if global forwarding is disabled (default),
-                 otherwise TRUE.
+        TRUE (2):
+
+        Hybrid mode. Same behaviour as TRUE, except for:
+
+        2. Router Solicitations are being sent when necessary.
+
+        Default: 0 (disabled) if global forwarding is disabled (default),
+                 otherwise 1 (enabled).
 
 hop_limit - INTEGER
         Default Hop Limit to set.
diff --git a/Documentation/networking/phonet.txt b/Documentation/networking/phonet.txt
index 6e8ce09f9c73..cf76608a2d35 100644
--- a/Documentation/networking/phonet.txt
+++ b/Documentation/networking/phonet.txt
@@ -112,6 +112,22 @@ However, connect() and getpeername() are not supported, as they did
 not seem useful with Phonet usages (could be added easily).
 
 
+Resource subscription
+---------------------
+
+A Phonet datagram socket can be subscribed to any number of 8-bits
+Phonet resources, as follow:
+
+  uint32_t res = 0xXX;
+  ioctl(fd, SIOCPNADDRESOURCE, &res);
+
+Subscription is similarly cancelled using the SIOCPNDELRESOURCE I/O
+control request, or when the socket is closed.
+
+Note that no more than one socket can be subcribed to any given
+resource at a time. If not, ioctl() will return EBUSY.
+
+
 Phonet Pipe protocol
 --------------------
 
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index e8c8f4f06c67..98097d8cb910 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -172,15 +172,19 @@ struct skb_shared_hwtstamps {
 };
 
 Time stamps for outgoing packets are to be generated as follows:
-- In hard_start_xmit(), check if skb_tx(skb)->hardware is set no-zero.
-  If yes, then the driver is expected to do hardware time stamping.
+- In hard_start_xmit(), check if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)
+  is set no-zero. If yes, then the driver is expected to do hardware time
+  stamping.
 - If this is possible for the skb and requested, then declare
-  that the driver is doing the time stamping by setting the field
-  skb_tx(skb)->in_progress non-zero. You might want to keep a pointer
-  to the associated skb for the next step and not free the skb. A driver
-  not supporting hardware time stamping doesn't do that. A driver must
-  never touch sk_buff::tstamp! It is used to store software generated
-  time stamps by the network subsystem.
+  that the driver is doing the time stamping by setting the flag
+  SKBTX_IN_PROGRESS in skb_shinfo(skb)->tx_flags , e.g. with
+
+      skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+
+  You might want to keep a pointer to the associated skb for the next step
+  and not free the skb. A driver not supporting hardware time stamping doesn't
+  do that. A driver must never touch sk_buff::tstamp! It is used to store
+  software generated time stamps by the network subsystem.
 - As soon as the driver has sent the packet and/or obtained a
   hardware time stamp for it, it passes the time stamp back by
   calling skb_hwtstamp_tx() with the original skb, the raw
@@ -191,6 +195,6 @@ Time stamps for outgoing packets are to be generated as follows:
   this would occur at a later time in the processing pipeline than other
   software time stamping and therefore could lead to unexpected deltas
   between time stamps.
-- If the driver did not call set skb_tx(skb)->in_progress, then
+- If the driver did not set the SKBTX_IN_PROGRESS flag (see above), then
   dev_hard_start_xmit() checks whether software time stamping
   is wanted as fallback and potentially generates the time stamp.
diff --git a/MAINTAINERS b/MAINTAINERS
index 44e659530910..3168d0cbd358 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1120,6 +1120,13 @@ W:	http://wireless.kernel.org/en/users/Drivers/ar9170
 S:      Maintained
 F:      drivers/net/wireless/ath/ar9170/
 
+CARL9170 LINUX COMMUNITY WIRELESS DRIVER
+M:      Christian Lamparter <chunkeey@googlemail.com>
+L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/en/users/Drivers/carl9170
+S:      Maintained
+F:      drivers/net/wireless/ath/carl9170/
+
 ATK0110 HWMON DRIVER
 M:      Luca Tettamanti <kronos.it@gmail.com>
 L:      lm-sensors@lm-sensors.org
@@ -1398,6 +1405,13 @@ L:	linux-scsi@vger.kernel.org
 S:      Supported
 F:      drivers/scsi/bfa/
 
+BROCADE BNA 10 GIGABIT ETHERNET DRIVER
+M:      Rasesh Mody <rmody@brocade.com>
+M:      Debashis Dutt <ddutt@brocade.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/bna/
+
 BSG (block layer generic sg v4 driver)
 M:      FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
 L:      linux-scsi@vger.kernel.org
@@ -2881,6 +2895,12 @@ M:	Brian King <brking@us.ibm.com>
 S:      Supported
 F:      drivers/scsi/ipr.*
 
+IBM Power Virtual Ethernet Device Driver
+M:      Santiago Leon <santil@linux.vnet.ibm.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ibmveth.*
+
 IBM ServeRAID RAID DRIVER
 P:      Jack Hammer
 M:      Dave Jeffery <ipslinux@adaptec.com>
@@ -4328,13 +4348,12 @@ F:	Documentation/filesystems/dlmfs.txt
 F:      fs/ocfs2/
 
 ORINOCO DRIVER
-M:      Pavel Roskin <proski@gnu.org>
-M:      David Gibson <hermes@gibson.dropbear.id.au>
 L:      linux-wireless@vger.kernel.org
 L:      orinoco-users@lists.sourceforge.net
 L:      orinoco-devel@lists.sourceforge.net
+W:      http://linuxwireless.org/en/users/Drivers/orinoco
 W:      http://www.nongnu.org/orinoco/
-S:      Maintained
+S:      Orphan
 F:      drivers/net/wireless/orinoco/
 
 OSD LIBRARY and FILESYSTEM
@@ -6400,7 +6419,7 @@ S:	Maintained
 F:      drivers/input/misc/wistron_btns.c
 
 WL1251 WIRELESS DRIVER
-M:      Kalle Valo <kalle.valo@iki.fi>
+M:      Kalle Valo <kvalo@adurom.com>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
@@ -6415,6 +6434,7 @@ W:	http://wireless.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
 S:      Maintained
 F:      drivers/net/wireless/wl12xx/wl1271*
+F:      include/linux/wl12xx.h
 
 WL3501 WIRELESS PCMCIA CARD DRIVER
 M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
@@ -6559,6 +6579,20 @@ M:	"Maciej W. Rozycki" <macro@linux-mips.org>
 S:      Maintained
 F:      drivers/serial/zs.*
 
+GRE DEMULTIPLEXER DRIVER
+M:      Dmitry Kozlov <xeb@mail.ru>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      net/ipv4/gre.c
+F:      include/net/gre.h
+
+PPTP DRIVER
+M:      Dmitry Kozlov <xeb@mail.ru>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/pptp.c
+W:      http://sourceforge.net/projects/accel-pptp
+
 THE REST
 M:      Linus Torvalds <torvalds@linux-foundation.org>
 L:      linux-kernel@vger.kernel.org
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index dd3af2be13be..7ea1eb4a26b4 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -25,7 +25,7 @@
 #include <linux/spi/ads7846.h>
 #include <linux/regulator/machine.h>
 #include <linux/i2c/twl.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/nand.h>
 #include <linux/leds.h>
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index 9a5eb87425fc..ce28a851dcd3 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -14,7 +14,7 @@
 #include <linux/input.h>
 #include <linux/input/matrix_keypad.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/i2c.h>
 #include <linux/i2c/twl.h>
 #include <linux/clk.h>
diff --git a/arch/arm/mach-omap2/board-zoom-peripherals.c b/arch/arm/mach-omap2/board-zoom-peripherals.c
index 6b3984964cc5..6aa0728fa15d 100644
--- a/arch/arm/mach-omap2/board-zoom-peripherals.c
+++ b/arch/arm/mach-omap2/board-zoom-peripherals.c
@@ -16,6 +16,8 @@
 #include <linux/gpio.h>
 #include <linux/i2c/twl.h>
 #include <linux/regulator/machine.h>
+#include <linux/regulator/fixed.h>
+#include <linux/wl12xx.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
@@ -27,6 +29,9 @@
 #include "mux.h"
 #include "hsmmc.h"
 
+#define OMAP_ZOOM_WLAN_PMENA_GPIO       (101)
+#define OMAP_ZOOM_WLAN_IRQ_GPIO         (162)
+
 /* Zoom2 has Qwerty keyboard*/
 static int board_keymap[] = {
         KEY(0, 0, KEY_E),
@@ -106,6 +111,11 @@ static struct regulator_consumer_supply zoom_vmmc2_supply = {
         .supply         = "vmmc",
 };
 
+static struct regulator_consumer_supply zoom_vmmc3_supply = {
+        .supply         = "vmmc",
+        .dev_name       = "mmci-omap-hs.2",
+};
+
 /* VMMC1 for OMAP VDD_MMC1 (i/o) and MMC1 card */
 static struct regulator_init_data zoom_vmmc1 = {
         .constraints = {
@@ -151,6 +161,38 @@ static struct regulator_init_data zoom_vsim = {
         .consumer_supplies      = &zoom_vsim_supply,
 };
 
+static struct regulator_init_data zoom_vmmc3 = {
+        .constraints = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+        },
+        .num_consumer_supplies  = 1,
+        .consumer_supplies = &zoom_vmmc3_supply,
+};
+
+static struct fixed_voltage_config zoom_vwlan = {
+        .supply_name            = "vwl1271",
+        .microvolts             = 1800000, /* 1.8V */
+        .gpio                   = OMAP_ZOOM_WLAN_PMENA_GPIO,
+        .startup_delay          = 70000, /* 70msec */
+        .enable_high            = 1,
+        .enabled_at_boot        = 0,
+        .init_data              = &zoom_vmmc3,
+};
+
+static struct platform_device omap_vwlan_device = {
+        .name           = "reg-fixed-voltage",
+        .id             = 1,
+        .dev = {
+                .platform_data  = &zoom_vwlan,
+        },
+};
+
+struct wl12xx_platform_data omap_zoom_wlan_data __initdata = {
+        .irq = OMAP_GPIO_IRQ(OMAP_ZOOM_WLAN_IRQ_GPIO),
+        /* ZOOM ref clock is 26 MHz */
+        .board_ref_clock = 1,
+};
+
 static struct omap2_hsmmc_info mmc[] __initdata = {
         {
                 .name           = "external",
@@ -168,6 +210,14 @@ static struct omap2_hsmmc_info mmc[] __initdata = {
                 .nonremovable   = true,
                 .power_saving   = true,
         },
+        {
+                .name           = "wl1271",
+                .mmc            = 3,
+                .wires          = 4,
+                .gpio_wp        = -EINVAL,
+                .gpio_cd        = -EINVAL,
+                .nonremovable   = true,
+        },
         {}      /* Terminator */
 };
 
@@ -279,7 +329,11 @@ static void enable_board_wakeup_source(void)
 
 void __init zoom_peripherals_init(void)
 {
+        if (wl12xx_set_platform_data(&omap_zoom_wlan_data))
+                pr_err("error setting wl12xx data\n");
+
         omap_i2c_init();
+        platform_device_register(&omap_vwlan_device);
         usb_musb_init(&musb_board_data);
         enable_board_wakeup_source();
 }
diff --git a/arch/s390/include/asm/qdio.h b/arch/s390/include/asm/qdio.h
index 2ba630276295..46e96bc1f5a1 100644
--- a/arch/s390/include/asm/qdio.h
+++ b/arch/s390/include/asm/qdio.h
@@ -360,6 +360,7 @@ struct qdio_initialize {
         unsigned int no_output_qs;
         qdio_handler_t *input_handler;
         qdio_handler_t *output_handler;
+        void (*queue_start_poll) (struct ccw_device *, int, unsigned long);
         unsigned long int_parm;
         void **input_sbal_addr_array;
         void **output_sbal_addr_array;
@@ -377,11 +378,13 @@ struct qdio_initialize {
 extern int qdio_allocate(struct qdio_initialize *);
 extern int qdio_establish(struct qdio_initialize *);
 extern int qdio_activate(struct ccw_device *);
-
-extern int do_QDIO(struct ccw_device *cdev, unsigned int callflags,
-                   int q_nr, unsigned int bufnr, unsigned int count);
-extern int qdio_shutdown(struct ccw_device*, int);
+extern int do_QDIO(struct ccw_device *, unsigned int, int, unsigned int,
+                   unsigned int);
+extern int qdio_start_irq(struct ccw_device *, int);
+extern int qdio_stop_irq(struct ccw_device *, int);
+extern int qdio_get_next_buffers(struct ccw_device *, int, int *, int *);
+extern int qdio_shutdown(struct ccw_device *, int);
 extern int qdio_free(struct ccw_device *);
-extern int qdio_get_ssqd_desc(struct ccw_device *dev, struct qdio_ssqd_desc*);
+extern int qdio_get_ssqd_desc(struct ccw_device *, struct qdio_ssqd_desc *);
 
 #endif /* __QDIO_H__ */
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 8717809787fb..5d86bb803e94 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -444,8 +444,8 @@ static inline void fs_kfree_skb (struct sk_buff * skb)
 #define ROUND_NEAREST 3
 /********** make rate (not quite as much fun as Horizon) **********/
 
-static unsigned int make_rate (unsigned int rate, int r,
-                               u16 * bits, unsigned int * actual) 
+static int make_rate(unsigned int rate, int r,
+                      u16 *bits, unsigned int *actual)
 {
         unsigned char exp = -1; /* hush gcc */
         unsigned int man = -1;  /* hush gcc */
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 54720baa7363..a95790452a68 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1645,10 +1645,8 @@ static int hrz_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
     unsigned short d = 0;
     char * s = skb->data;
     if (*s++ == 'D') {
-      for (i = 0; i < 4; ++i) {
-        d = (d<<4) | ((*s <= '9') ? (*s - '0') : (*s - 'a' + 10));
-        ++s;
-      }
+        for (i = 0; i < 4; ++i)
+                d = (d << 4) | hex_to_bin(*s++);
       PRINTK (KERN_INFO, "debug bitmap is now %hx", debug = d);
     }
   }
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ee9ddeb53417..8b358d7d958f 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -220,7 +220,7 @@ static u16 get_desc (IADEV *dev, struct ia_vcc *iavcc) {
   while (!desc_num || (dev->desc_tbl[desc_num -1]).timestamp) {
      dev->ffL.tcq_rd += 2;
      if (dev->ffL.tcq_rd > dev->ffL.tcq_ed) 
-     dev->ffL.tcq_rd = dev->ffL.tcq_st;
+        dev->ffL.tcq_rd = dev->ffL.tcq_st;
      if (dev->ffL.tcq_rd == dev->host_tcq_wr) 
         return 0xFFFF; 
      desc_num = *(u_short *)(dev->seg_ram + dev->ffL.tcq_rd);
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 33f8421c71cc..18fdd9703b48 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -8,7 +8,6 @@
 
 #include <linux/bug.h>
 #include <linux/device.h>
-#include <linux/ethtool.h>
 #include <linux/firewire.h>
 #include <linux/firewire-constants.h>
 #include <linux/highmem.h>
@@ -1361,17 +1360,6 @@ static int fwnet_change_mtu(struct net_device *net, int new_mtu)
         return 0;
 }
 
-static void fwnet_get_drvinfo(struct net_device *net,
-                              struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, KBUILD_MODNAME);
-        strcpy(info->bus_info, "ieee1394");
-}
-
-static const struct ethtool_ops fwnet_ethtool_ops = {
-        .get_drvinfo = fwnet_get_drvinfo,
-};
-
 static const struct net_device_ops fwnet_netdev_ops = {
         .ndo_open       = fwnet_open,
         .ndo_stop       = fwnet_stop,
@@ -1390,7 +1378,6 @@ static void fwnet_init_dev(struct net_device *net)
         net->hard_header_len    = FWNET_HLEN;
         net->type               = ARPHRD_IEEE1394;
         net->tx_queue_len       = 10;
-        SET_ETHTOOL_OPS(net, &fwnet_ethtool_ops);
 }
 
 /* caller must hold fwnet_device_mutex */
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index bc289e367e30..63403822330e 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -58,7 +58,6 @@
 #include <linux/tcp.h>
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
-#include <linux/ethtool.h>
 #include <asm/uaccess.h>
 #include <asm/delay.h>
 #include <asm/unaligned.h>
@@ -173,8 +172,6 @@ static netdev_tx_t ether1394_tx(struct sk_buff *skb,
                                 struct net_device *dev);
 static void ether1394_iso(struct hpsb_iso *iso);
 
-static const struct ethtool_ops ethtool_ops;
-
 static int ether1394_write(struct hpsb_host *host, int srcid, int destid,
                            quadlet_t *data, u64 addr, size_t len, u16 flags);
 static void ether1394_add_host(struct hpsb_host *host);
@@ -525,8 +522,6 @@ static void ether1394_init_dev(struct net_device *dev)
         dev->header_ops         = &ether1394_header_ops;
         dev->netdev_ops         = &ether1394_netdev_ops;
 
-        SET_ETHTOOL_OPS(dev, &ethtool_ops);
-
         dev->watchdog_timeo     = ETHER1394_TIMEOUT;
         dev->flags              = IFF_BROADCAST | IFF_MULTICAST;
         dev->features           = NETIF_F_HIGHDMA;
@@ -1695,17 +1690,6 @@ fail:
         return NETDEV_TX_OK;
 }
 
-static void ether1394_get_drvinfo(struct net_device *dev,
-                                  struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, driver_name);
-        strcpy(info->bus_info, "ieee1394"); /* FIXME provide more detail? */
-}
-
-static const struct ethtool_ops ethtool_ops = {
-        .get_drvinfo = ether1394_get_drvinfo
-};
-
 static int __init ether1394_init_module(void)
 {
         int err;
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 2978bdaa6b88..e54e79d4e2c1 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -1515,8 +1515,13 @@ static int decodeFVteln(char *teln, unsigned long *bmaskp, int *activep)
         while (*s) {
                 int digit1 = 0;
                 int digit2 = 0;
-                if (!isdigit(*s)) return -3;
-                while (isdigit(*s)) { digit1 = digit1*10 + (*s - '0'); s++; }
+                char *endp;
+
+                digit1 = simple_strtoul(s, &endp, 10);
+                if (s == endp)
+                        return -3;
+                s = endp;
+
                 if (digit1 <= 0 || digit1 > 30) return -4;
                 if (*s == 0 || *s == ',' || *s == ' ') {
                         bmask |= (1 << digit1);
@@ -1526,8 +1531,12 @@ static int decodeFVteln(char *teln, unsigned long *bmaskp, int *activep)
                 }
                 if (*s != '-') return -5;
                 s++;
-                if (!isdigit(*s)) return -3;
-                while (isdigit(*s)) { digit2 = digit2*10 + (*s - '0'); s++; }
+
+                digit2 = simple_strtoul(s, &endp, 10);
+                if (s == endp)
+                        return -3;
+                s = endp;
+
                 if (digit2 <= 0 || digit2 > 30) return -4;
                 if (*s == 0 || *s == ',' || *s == ' ') {
                         if (digit1 > digit2)
diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c
index 70cf6bac7a5a..48e6d220f62c 100644
--- a/drivers/isdn/divert/isdn_divert.c
+++ b/drivers/isdn/divert/isdn_divert.c
@@ -77,7 +77,7 @@ static void deflect_timer_expire(ulong arg)
 
      case DEFLECT_ALERT:
        cs->ics.command = ISDN_CMD_REDIR; /* protocol */
-       strcpy(cs->ics.parm.setup.phone,cs->deflect_dest);
+       strlcpy(cs->ics.parm.setup.phone, cs->deflect_dest, sizeof(cs->ics.parm.setup.phone));
        strcpy(cs->ics.parm.setup.eazmsn,"Testtext delayed");
        divert_if.ll_cmd(&cs->ics);
        spin_lock_irqsave(&divert_lock, flags);
@@ -251,7 +251,7 @@ int deflect_extern_action(u_char cmd, ulong callid, char *to_nr)
 
      case 2: /* redir */
        del_timer(&cs->timer); 
-       strcpy(cs->ics.parm.setup.phone, to_nr);
+       strlcpy(cs->ics.parm.setup.phone, to_nr, sizeof(cs->ics.parm.setup.phone));
        strcpy(cs->ics.parm.setup.eazmsn, "Testtext manual");
        ic.command = ISDN_CMD_REDIR;
        if ((i = divert_if.ll_cmd(&ic)))
@@ -480,7 +480,7 @@ static int isdn_divert_icall(isdn_ctrl *ic)
                if (!cs->timer.expires)
                  { strcpy(ic->parm.setup.eazmsn,"Testtext direct");
                    ic->parm.setup.screen = dv->rule.screen;
-                   strcpy(ic->parm.setup.phone,dv->rule.to_nr);
+                   strlcpy(ic->parm.setup.phone, dv->rule.to_nr, sizeof(ic->parm.setup.phone));
                    cs->akt_state = DEFLECT_AUTODEL; /* delete after timeout */
                    cs->timer.expires = jiffies + (HZ * AUTODEL_TIME);
                    retval = 5; 
diff --git a/drivers/isdn/hisax/hfc_sx.c b/drivers/isdn/hisax/hfc_sx.c
index be5faf4aa868..5aa138eb0b3c 100644
--- a/drivers/isdn/hisax/hfc_sx.c
+++ b/drivers/isdn/hisax/hfc_sx.c
@@ -234,13 +234,14 @@ read_fifo(struct IsdnCardState *cs, u_char fifo, int trans_max)
           count++;
           if (count > trans_max) 
             count = trans_max; /* limit length */
-            if ((skb = dev_alloc_skb(count))) {
-              dst = skb_put(skb, count);
-              while (count--) 
+          skb = dev_alloc_skb(count);
+          if (skb) {
+            dst = skb_put(skb, count);
+            while (count--)
                 *dst++ = Read_hfc(cs, HFCSX_FIF_DRD);
-              return(skb);
-            }
-            else return(NULL); /* no memory */
+            return skb;
+          } else
+                return NULL; /* no memory */
         }
 
         do {
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 51dc60da333b..c463162843ba 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -14,7 +14,7 @@
 #include <linux/isdn.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include "isdn_common.h"
 #include "isdn_tty.h"
 #ifdef CONFIG_ISDN_AUDIO
@@ -28,6 +28,7 @@
 
 /* Prototypes */
 
+static DEFINE_MUTEX(modem_info_mutex);
 static int isdn_tty_edit_at(const char *, int, modem_info *);
 static void isdn_tty_check_esc(const u_char *, u_char, int, int *, u_long *);
 static void isdn_tty_modem_reset_regs(modem_info *, int);
@@ -1354,14 +1355,14 @@ isdn_tty_tiocmget(struct tty_struct *tty, struct file *file)
         if (tty->flags & (1 << TTY_IO_ERROR))
                 return -EIO;
 
-        lock_kernel();
+        mutex_lock(&modem_info_mutex);
 #ifdef ISDN_DEBUG_MODEM_IOCTL
         printk(KERN_DEBUG "ttyI%d ioctl TIOCMGET\n", info->line);
 #endif
 
         control = info->mcr;
         status = info->msr;
-        unlock_kernel();
+        mutex_unlock(&modem_info_mutex);
         return ((control & UART_MCR_RTS) ? TIOCM_RTS : 0)
             | ((control & UART_MCR_DTR) ? TIOCM_DTR : 0)
             | ((status & UART_MSR_DCD) ? TIOCM_CAR : 0)
@@ -1385,7 +1386,7 @@ isdn_tty_tiocmset(struct tty_struct *tty, struct file *file,
         printk(KERN_DEBUG "ttyI%d ioctl TIOCMxxx: %x %x\n", info->line, set, clear);
 #endif
 
-        lock_kernel();
+        mutex_lock(&modem_info_mutex);
         if (set & TIOCM_RTS)
                 info->mcr |= UART_MCR_RTS;
         if (set & TIOCM_DTR) {
@@ -1407,7 +1408,7 @@ isdn_tty_tiocmset(struct tty_struct *tty, struct file *file,
                         isdn_tty_modem_hup(info, 1);
                 }
         }
-        unlock_kernel();
+        mutex_unlock(&modem_info_mutex);
         return 0;
 }
 
@@ -3515,7 +3516,7 @@ isdn_tty_parse_at(modem_info * info)
 {
         atemu *m = &info->emu;
         char *p;
-        char ds[40];
+        char ds[ISDN_MSNLEN];
 
 #ifdef ISDN_DEBUG_AT
         printk(KERN_DEBUG "AT: '%s'\n", m->mdmcmd);
@@ -3594,7 +3595,7 @@ isdn_tty_parse_at(modem_info * info)
                                                 break;
                                         case '3':
                                                 p++;
-                                                sprintf(ds, "\r\n%d", info->emu.charge);
+                                                snprintf(ds, sizeof(ds), "\r\n%d", info->emu.charge);
                                                 isdn_tty_at_cout(ds, info);
                                                 break;
                                         default:;
diff --git a/drivers/isdn/mISDN/dsp_cmx.c b/drivers/isdn/mISDN/dsp_cmx.c
index 713ef2b805a2..76d9e673b4e1 100644
--- a/drivers/isdn/mISDN/dsp_cmx.c
+++ b/drivers/isdn/mISDN/dsp_cmx.c
@@ -1237,6 +1237,7 @@ dsp_cmx_receive(struct dsp *dsp, struct sk_buff *skb)
                         if (dsp->cmx_delay)
                                 dsp->rx_W = (dsp->rx_R + dsp->cmx_delay)
                                         & CMX_BUFF_MASK;
+                        else
                                 dsp->rx_W = (dsp->rx_R + (dsp_poll >> 1))
                                         & CMX_BUFF_MASK;
                 } else {
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 22f38e48ac4e..5b59796ed250 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -972,7 +972,7 @@ channel_dctrl(struct dchannel *dch, struct mISDN_ctrl_req *cq)
                 if (debug & DEBUG_L1OIP_SOCKET)
                         printk(KERN_DEBUG "%s: got new ip address from user "
                                 "space.\n", __func__);
-                        l1oip_socket_open(hc);
+                l1oip_socket_open(hc);
                 break;
         case MISDN_CTRL_UNSETPEER:
                 if (debug & DEBUG_L1OIP_SOCKET)
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index b159bd59e64e..a5b632e67552 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/mISDNif.h>
 #include <linux/kthread.h>
-#include <linux/smp_lock.h>
 #include "core.h"
 
 static u_int    *debug;
@@ -205,13 +204,7 @@ mISDNStackd(void *data)
         struct mISDNstack *st = data;
         int err = 0;
 
-#ifdef CONFIG_SMP
-        lock_kernel();
-#endif
         sigfillset(&current->blocked);
-#ifdef CONFIG_SMP
-        unlock_kernel();
-#endif
         if (*debug & DEBUG_MSG_THREAD)
                 printk(KERN_DEBUG "mISDNStackd %s started\n",
                     dev_name(&st->dev->dev));
diff --git a/drivers/isdn/pcbit/edss1.c b/drivers/isdn/pcbit/edss1.c
index d5920ae22d73..80c9c16fd5ef 100644
--- a/drivers/isdn/pcbit/edss1.c
+++ b/drivers/isdn/pcbit/edss1.c
@@ -33,7 +33,7 @@
 #include "callbacks.h"
 
 
-char * isdn_state_table[] = {
+const char * const isdn_state_table[] = {
   "Closed",
   "Call initiated",
   "Overlap sending",
diff --git a/drivers/isdn/pcbit/edss1.h b/drivers/isdn/pcbit/edss1.h
index 0b64f97015d8..39f8346e28c5 100644
--- a/drivers/isdn/pcbit/edss1.h
+++ b/drivers/isdn/pcbit/edss1.h
@@ -90,7 +90,7 @@ struct fsm_timer_entry {
         unsigned long timeout;          /* in seconds */
 };
 
-extern char * isdn_state_table[];
+extern const char * const isdn_state_table[];
 
 void pcbit_fsm_event(struct pcbit_dev *, struct pcbit_chan *,
                      unsigned short event, struct callb_data *);
diff --git a/drivers/net/3c503.c b/drivers/net/3c503.c
index baac246561b9..4777a1cbcd8d 100644
--- a/drivers/net/3c503.c
+++ b/drivers/net/3c503.c
@@ -337,10 +337,10 @@ el2_probe1(struct net_device *dev, int ioaddr)
     /* Finish setting the board's parameters. */
     ei_status.stop_page = EL2_MB1_STOP_PG;
     ei_status.word16 = wordlength;
-    ei_status.reset_8390 = &el2_reset_8390;
-    ei_status.get_8390_hdr = &el2_get_8390_hdr;
-    ei_status.block_input = &el2_block_input;
-    ei_status.block_output = &el2_block_output;
+    ei_status.reset_8390 = el2_reset_8390;
+    ei_status.get_8390_hdr = el2_get_8390_hdr;
+    ei_status.block_input = el2_block_input;
+    ei_status.block_output = el2_block_output;
 
     if (dev->irq == 2)
         dev->irq = 9;
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 3bba835f1a21..cdf7226a7c43 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -662,7 +662,9 @@ static int corkscrew_setup(struct net_device *dev, int ioaddr,
                 pr_warning(" *** Warning: this IRQ is unlikely to work! ***\n");
 
         {
-                char *ram_split[] = { "5:3", "3:1", "1:1", "3:5" };
+                static const char * const ram_split[] = {
+                        "5:3", "3:1", "1:1", "3:5"
+                };
                 __u32 config;
                 EL3WINDOW(3);
                 vp->available_media = inw(ioaddr + Wn3_Options);
@@ -734,7 +736,7 @@ static int corkscrew_open(struct net_device *dev)
                 init_timer(&vp->timer);
                 vp->timer.expires = jiffies + media_tbl[dev->if_port].wait;
                 vp->timer.data = (unsigned long) dev;
-                vp->timer.function = &corkscrew_timer;  /* timer handler */
+                vp->timer.function = corkscrew_timer;   /* timer handler */
                 add_timer(&vp->timer);
         } else
                 dev->if_port = vp->default_media;
diff --git a/drivers/net/3c523.c b/drivers/net/3c523.c
index a7b0e5e43a52..ca00f0a11217 100644
--- a/drivers/net/3c523.c
+++ b/drivers/net/3c523.c
@@ -463,7 +463,7 @@ static int __init do_elmc_probe(struct net_device *dev)
 
         /* we didn't find any 3c523 in the slots we checked for */
         if (slot == MCA_NOTFOUND)
-                return ((base_addr || irq) ? -ENXIO : -ENODEV);
+                return (base_addr || irq) ? -ENXIO : -ENODEV;
 
         mca_set_adapter_name(slot, "3Com 3c523 Etherlink/MC");
         mca_set_adapter_procfn(slot, (MCA_ProcFn) elmc_getinfo, dev);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index fa42103b2874..ed964964fe1f 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1742,7 +1742,7 @@ vortex_open(struct net_device *dev)
 
         /* Use the now-standard shared IRQ implementation. */
         if ((retval = request_irq(dev->irq, vp->full_bus_master_rx ?
-                                &boomerang_interrupt : &vortex_interrupt, IRQF_SHARED, dev->name, dev))) {
+                                boomerang_interrupt : vortex_interrupt, IRQF_SHARED, dev->name, dev))) {
                 pr_err("%s: Could not reserve IRQ %d\n", dev->name, dev->irq);
                 goto err;
         }
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 4a4f6b81e32d..237d4ea5a416 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -561,7 +561,7 @@ rx_status_loop:
                 if (cp_rx_csum_ok(status))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                 skb_put(skb, len);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..ef683a993dce 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2515,6 +2515,18 @@ config S6GMAC
 
 source "drivers/net/stmmac/Kconfig"
 
+config PCH_GBE
+        tristate "PCH Gigabit Ethernet"
+        depends on PCI
+        ---help---
+          This is a gigabit ethernet driver for Topcliff PCH.
+          Topcliff PCH is the platform controller hub that is used in Intel's
+          general embedded platform.
+          Topcliff PCH has Gigabit Ethernet interface.
+          Using this interface, it is able to access system devices connected
+          to Gigabit Ethernet.
+          This driver enables Gigabit Ethernet function.
+
 endif # NETDEV_1000
 
 #
@@ -2869,6 +2881,20 @@ config QLGE
           To compile this driver as a module, choose M here: the module
           will be called qlge.
 
+config BNA
+        tristate "Brocade 1010/1020 10Gb Ethernet Driver support"
+        depends on PCI
+        ---help---
+          This driver supports Brocade 1010/1020 10Gb CEE capable Ethernet
+          cards.
+          To compile this driver as a module, choose M here: the module
+          will be called bna.
+
+          For general information and support, go to the Brocade support
+          website at:
+
+          <http://support.brocade.com>
+
 source "drivers/net/sfc/Kconfig"
 
 source "drivers/net/benet/Kconfig"
@@ -3202,6 +3228,17 @@ config PPPOE
           which contains instruction on how to use this driver (under 
           the heading "Kernel mode PPPoE").
 
+config PPTP
+        tristate "PPP over IPv4 (PPTP) (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && PPP && NET_IPGRE_DEMUX
+        help
+          Support for PPP over IPv4.(Point-to-Point Tunneling Protocol)
+
+          This driver requires pppd plugin to work in client mode or
+          modified pptpd (poptop) to work in server mode.
+          See http://accel-pptp.sourceforge.net/ for information how to
+          utilize this module.
+
 config PPPOATM
         tristate "PPP over ATM"
         depends on ATM && PPP
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 3e8f150c4b14..b8bf93d4a132 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -34,6 +34,7 @@ obj-$(CONFIG_ENIC) += enic/
 obj-$(CONFIG_JME) += jme.o
 obj-$(CONFIG_BE2NET) += benet/
 obj-$(CONFIG_VMXNET3) += vmxnet3/
+obj-$(CONFIG_BNA) += bna/
 
 gianfar_driver-objs := gianfar.o \
                 gianfar_ethtool.o \
@@ -162,6 +163,7 @@ obj-$(CONFIG_PPP_BSDCOMP) += bsd_comp.o
 obj-$(CONFIG_PPP_MPPE) += ppp_mppe.o
 obj-$(CONFIG_PPPOE) += pppox.o pppoe.o
 obj-$(CONFIG_PPPOL2TP) += pppox.o
+obj-$(CONFIG_PPTP) += pppox.o pptp.o
 
 obj-$(CONFIG_SLIP) += slip.o
 obj-$(CONFIG_SLHC) += slhc.o
@@ -296,3 +298,4 @@ obj-$(CONFIG_WIMAX) += wimax/
 obj-$(CONFIG_CAIF) += caif/
 
 obj-$(CONFIG_OCTEON_MGMT_ETHERNET) += octeon/
+obj-$(CONFIG_PCH_GBE) += pch_gbe/
diff --git a/drivers/net/acenic.c b/drivers/net/acenic.c
index b9a591604e5b..41d9911202d0 100644
--- a/drivers/net/acenic.c
+++ b/drivers/net/acenic.c
@@ -2033,7 +2033,7 @@ static void ace_rx_int(struct net_device *dev, u32 rxretprd, u32 rxretcsm)
                         skb->csum = htons(csum);
                         skb->ip_summed = CHECKSUM_COMPLETE;
                 } else {
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
                 }
 
                 /* send it up */
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 585c25f4b60c..58a0ab4923ee 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -396,7 +396,7 @@ static int amd8111e_set_coalesce(struct net_device * dev, enum coal_mode cmod)
                         event_count = coal_conf->rx_event_count;
                         if( timeout > MAX_TIMEOUT ||
                                         event_count > MAX_EVENT_COUNT )
-                        return -EINVAL;
+                                return -EINVAL;
 
                         timeout = timeout * DELAY_TIMER_CONV;
                         writel(VAL0|STINTEN, mmio+INTEN0);
@@ -409,7 +409,7 @@ static int amd8111e_set_coalesce(struct net_device * dev, enum coal_mode cmod)
                         event_count = coal_conf->tx_event_count;
                         if( timeout > MAX_TIMEOUT ||
                                         event_count > MAX_EVENT_COUNT )
-                        return -EINVAL;
+                                return -EINVAL;
 
 
                         timeout = timeout * DELAY_TIMER_CONV;
@@ -903,18 +903,18 @@ static int amd8111e_read_mib(void __iomem *mmio, u8 MIB_COUNTER)
 }
 
 /*
-This function reads the mib registers and returns the hardware statistics. It  updates previous internal driver statistics with new values.
-*/
-static struct net_device_stats *amd8111e_get_stats(struct net_device * dev)
+ * This function reads the mib registers and returns the hardware statistics.
+ * It updates previous internal driver statistics with new values.
+ */
+static struct net_device_stats *amd8111e_get_stats(struct net_device *dev)
 {
         struct amd8111e_priv *lp = netdev_priv(dev);
         void __iomem *mmio = lp->mmio;
         unsigned long flags;
-        /* struct net_device_stats *prev_stats = &lp->prev_stats; */
-        struct net_device_stats* new_stats = &lp->stats;
+        struct net_device_stats *new_stats = &dev->stats;
 
-        if(!lp->opened)
-                return &lp->stats;
+        if (!lp->opened)
+                return new_stats;
         spin_lock_irqsave (&lp->lock, flags);
 
         /* stats.rx_packets */
diff --git a/drivers/net/amd8111e.h b/drivers/net/amd8111e.h
index ac36eb6981e3..b5926af03a7e 100644
--- a/drivers/net/amd8111e.h
+++ b/drivers/net/amd8111e.h
@@ -787,7 +787,6 @@ struct amd8111e_priv{
         struct vlan_group               *vlgrp;
 #endif
         char opened;
-        struct net_device_stats stats;
         unsigned int drv_rx_errors;
         struct amd8111e_coalesce_conf coal_conf;
 
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 0362c8d31a08..10d0dba572c2 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -244,7 +244,7 @@ static int ipddp_delete(struct ipddp_route *rt)
         }
 
         spin_unlock_bh(&ipddp_route_lock);
-        return (-ENOENT);
+        return -ENOENT;
 }
 
 /*
@@ -259,10 +259,10 @@ static struct ipddp_route* __ipddp_find_route(struct ipddp_route *rt)
                 if(f->ip == rt->ip &&
                    f->at.s_net == rt->at.s_net &&
                    f->at.s_node == rt->at.s_node)
-                        return (f);
+                        return f;
         }
 
-        return (NULL);
+        return NULL;
 }
 
 static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -279,7 +279,7 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         switch(cmd)
         {
                 case SIOCADDIPDDPRT:
-                        return (ipddp_create(&rcp));
+                        return ipddp_create(&rcp);
 
                 case SIOCFINDIPDDPRT:
                         spin_lock_bh(&ipddp_route_lock);
@@ -297,7 +297,7 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                 return -ENOENT;
 
                 case SIOCDELIPDDPRT:
-                        return (ipddp_delete(&rcp));
+                        return ipddp_delete(&rcp);
 
                 default:
                         return -EINVAL;
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index adc07551739e..e69eead12ec7 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -727,7 +727,7 @@ static int sendup_buffer (struct net_device *dev)
 
         if (ltc->command != LT_RCVLAP) {
                 printk("unknown command 0x%02x from ltpc card\n",ltc->command);
-                return(-1);
+                return -1;
         }
         dnode = ltc->dnode;
         snode = ltc->snode;
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 8c496fb1ac9e..62f21106efec 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -300,8 +300,6 @@ am79c961_open(struct net_device *dev)
         struct dev_priv *priv = netdev_priv(dev);
         int ret;
 
-        memset (&priv->stats, 0, sizeof (priv->stats));
-
         ret = request_irq(dev->irq, am79c961_interrupt, 0, dev->name, dev);
         if (ret)
                 return ret;
@@ -347,8 +345,7 @@ am79c961_close(struct net_device *dev)
  */
 static struct net_device_stats *am79c961_getstats (struct net_device *dev)
 {
-        struct dev_priv *priv = netdev_priv(dev);
-        return &priv->stats;
+        return &dev->stats;
 }
 
 static void am79c961_mc_hash(char *addr, unsigned short *hash)
@@ -510,14 +507,14 @@ am79c961_rx(struct net_device *dev, struct dev_priv *priv)
 
                 if ((status & (RMD_ERR|RMD_STP|RMD_ENP)) != (RMD_STP|RMD_ENP)) {
                         am_writeword (dev, hdraddr + 2, RMD_OWN);
-                        priv->stats.rx_errors ++;
+                        dev->stats.rx_errors++;
                         if (status & RMD_ERR) {
                                 if (status & RMD_FRAM)
-                                        priv->stats.rx_frame_errors ++;
+                                        dev->stats.rx_frame_errors++;
                                 if (status & RMD_CRC)
-                                        priv->stats.rx_crc_errors ++;
+                                        dev->stats.rx_crc_errors++;
                         } else if (status & RMD_STP)
-                                priv->stats.rx_length_errors ++;
+                                dev->stats.rx_length_errors++;
                         continue;
                 }
 
@@ -531,12 +528,12 @@ am79c961_rx(struct net_device *dev, struct dev_priv *priv)
                         am_writeword(dev, hdraddr + 2, RMD_OWN);
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_rx(skb);
-                        priv->stats.rx_bytes += len;
-                        priv->stats.rx_packets ++;
+                        dev->stats.rx_bytes += len;
+                        dev->stats.rx_packets++;
                 } else {
                         am_writeword (dev, hdraddr + 2, RMD_OWN);
                         printk (KERN_WARNING "%s: memory squeeze, dropping packet.\n", dev->name);
-                        priv->stats.rx_dropped ++;
+                        dev->stats.rx_dropped++;
                         break;
                 }
         } while (1);
@@ -565,7 +562,7 @@ am79c961_tx(struct net_device *dev, struct dev_priv *priv)
                 if (status & TMD_ERR) {
                         u_int status2;
 
-                        priv->stats.tx_errors ++;
+                        dev->stats.tx_errors++;
 
                         status2 = am_readword (dev, hdraddr + 6);
 
@@ -575,18 +572,18 @@ am79c961_tx(struct net_device *dev, struct dev_priv *priv)
                         am_writeword (dev, hdraddr + 6, 0);
 
                         if (status2 & TST_RTRY)
-                                priv->stats.collisions += 16;
+                                dev->stats.collisions += 16;
                         if (status2 & TST_LCOL)
-                                priv->stats.tx_window_errors ++;
+                                dev->stats.tx_window_errors++;
                         if (status2 & TST_LCAR)
-                                priv->stats.tx_carrier_errors ++;
+                                dev->stats.tx_carrier_errors++;
                         if (status2 & TST_UFLO)
-                                priv->stats.tx_fifo_errors ++;
+                                dev->stats.tx_fifo_errors++;
                         continue;
                 }
-                priv->stats.tx_packets ++;
+                dev->stats.tx_packets++;
                 len = am_readword (dev, hdraddr + 4);
-                priv->stats.tx_bytes += -len;
+                dev->stats.tx_bytes += -len;
         } while (priv->txtail != priv->txhead);
 
         netif_wake_queue(dev);
@@ -616,7 +613,7 @@ am79c961_interrupt(int irq, void *dev_id)
                 }
                 if (status & CSR0_MISS) {
                         handled = 1;
-                        priv->stats.rx_dropped ++;
+                        dev->stats.rx_dropped++;
                 }
                 if (status & CSR0_CERR) {
                         handled = 1;
diff --git a/drivers/net/arm/am79c961a.h b/drivers/net/arm/am79c961a.h
index 483009fe6ec2..fd634d32756b 100644
--- a/drivers/net/arm/am79c961a.h
+++ b/drivers/net/arm/am79c961a.h
@@ -130,7 +130,6 @@
 #define ISALED0_LNKST   0x8000
 
 struct dev_priv {
-    struct net_device_stats stats;
     unsigned long       rxbuffer[RX_BUFFERS];
     unsigned long       txbuffer[TX_BUFFERS];
     unsigned char       txhead;
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 4a5ec9470aa1..5a77001b6d10 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -175,8 +175,6 @@ struct ep93xx_priv
         struct net_device       *dev;
         struct napi_struct      napi;
 
-        struct net_device_stats stats;
-
         struct mii_if_info      mii;
         u8                      mdc_divisor;
 };
@@ -230,12 +228,6 @@ static void ep93xx_mdio_write(struct net_device *dev, int phy_id, int reg, int d
                 pr_info("mdio write timed out\n");
 }
 
-static struct net_device_stats *ep93xx_get_stats(struct net_device *dev)
-{
-        struct ep93xx_priv *ep = netdev_priv(dev);
-        return &(ep->stats);
-}
-
 static int ep93xx_rx(struct net_device *dev, int processed, int budget)
 {
         struct ep93xx_priv *ep = netdev_priv(dev);
@@ -267,15 +259,15 @@ static int ep93xx_rx(struct net_device *dev, int processed, int budget)
                         pr_crit("entry mismatch %.8x %.8x\n", rstat0, rstat1);
 
                 if (!(rstat0 & RSTAT0_RWE)) {
-                        ep->stats.rx_errors++;
+                        dev->stats.rx_errors++;
                         if (rstat0 & RSTAT0_OE)
-                                ep->stats.rx_fifo_errors++;
+                                dev->stats.rx_fifo_errors++;
                         if (rstat0 & RSTAT0_FE)
-                                ep->stats.rx_frame_errors++;
+                                dev->stats.rx_frame_errors++;
                         if (rstat0 & (RSTAT0_RUNT | RSTAT0_EDATA))
-                                ep->stats.rx_length_errors++;
+                                dev->stats.rx_length_errors++;
                         if (rstat0 & RSTAT0_CRCE)
-                                ep->stats.rx_crc_errors++;
+                                dev->stats.rx_crc_errors++;
                         goto err;
                 }
 
@@ -300,10 +292,10 @@ static int ep93xx_rx(struct net_device *dev, int processed, int budget)
 
                         netif_receive_skb(skb);
 
-                        ep->stats.rx_packets++;
-                        ep->stats.rx_bytes += length;
+                        dev->stats.rx_packets++;
+                        dev->stats.rx_bytes += length;
                 } else {
-                        ep->stats.rx_dropped++;
+                        dev->stats.rx_dropped++;
                 }
 
 err:
@@ -359,7 +351,7 @@ static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
         int entry;
 
         if (unlikely(skb->len > MAX_PKT_SIZE)) {
-                ep->stats.tx_dropped++;
+                dev->stats.tx_dropped++;
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
@@ -415,17 +407,17 @@ static void ep93xx_tx_complete(struct net_device *dev)
                 if (tstat0 & TSTAT0_TXWE) {
                         int length = ep->descs->tdesc[entry].tdesc1 & 0xfff;
 
-                        ep->stats.tx_packets++;
-                        ep->stats.tx_bytes += length;
+                        dev->stats.tx_packets++;
+                        dev->stats.tx_bytes += length;
                 } else {
-                        ep->stats.tx_errors++;
+                        dev->stats.tx_errors++;
                 }
 
                 if (tstat0 & TSTAT0_OW)
-                        ep->stats.tx_window_errors++;
+                        dev->stats.tx_window_errors++;
                 if (tstat0 & TSTAT0_TXU)
-                        ep->stats.tx_fifo_errors++;
-                ep->stats.collisions += (tstat0 >> 16) & 0x1f;
+                        dev->stats.tx_fifo_errors++;
+                dev->stats.collisions += (tstat0 >> 16) & 0x1f;
 
                 ep->tx_clean_pointer = (entry + 1) & (TX_QUEUE_ENTRIES - 1);
                 if (ep->tx_pending == TX_QUEUE_ENTRIES)
@@ -758,7 +750,6 @@ static const struct net_device_ops ep93xx_netdev_ops = {
         .ndo_open               = ep93xx_open,
         .ndo_stop               = ep93xx_close,
         .ndo_start_xmit         = ep93xx_xmit,
-        .ndo_get_stats          = ep93xx_get_stats,
         .ndo_do_ioctl           = ep93xx_ioctl,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_change_mtu         = eth_change_mtu,
diff --git a/drivers/net/arm/ether1.c b/drivers/net/arm/ether1.c
index b17ab5153f51..b00781c02d5d 100644
--- a/drivers/net/arm/ether1.c
+++ b/drivers/net/arm/ether1.c
@@ -68,7 +68,6 @@ static int ether1_open(struct net_device *dev);
 static int ether1_sendpacket(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t ether1_interrupt(int irq, void *dev_id);
 static int ether1_close(struct net_device *dev);
-static struct net_device_stats *ether1_getstats(struct net_device *dev);
 static void ether1_setmulticastlist(struct net_device *dev);
 static void ether1_timeout(struct net_device *dev);
 
@@ -649,8 +648,6 @@ ether1_open (struct net_device *dev)
         if (request_irq(dev->irq, ether1_interrupt, 0, "ether1", dev))
                 return -EAGAIN;
 
-        memset (&priv(dev)->stats, 0, sizeof (struct net_device_stats));
-
         if (ether1_init_for_open (dev)) {
                 free_irq (dev->irq, dev);
                 return -EAGAIN;
@@ -673,7 +670,7 @@ ether1_timeout(struct net_device *dev)
         if (ether1_init_for_open (dev))
                 printk (KERN_ERR "%s: unable to restart interface\n", dev->name);
 
-        priv(dev)->stats.tx_errors++;
+        dev->stats.tx_errors++;
         netif_wake_queue(dev);
 }
 
@@ -802,21 +799,21 @@ again:
 
         while (nop.nop_status & STAT_COMPLETE) {
                 if (nop.nop_status & STAT_OK) {
-                        priv(dev)->stats.tx_packets ++;
-                        priv(dev)->stats.collisions += (nop.nop_status & STAT_COLLISIONS);
+                        dev->stats.tx_packets++;
+                        dev->stats.collisions += (nop.nop_status & STAT_COLLISIONS);
                 } else {
-                        priv(dev)->stats.tx_errors ++;
+                        dev->stats.tx_errors++;
 
                         if (nop.nop_status & STAT_COLLAFTERTX)
-                                priv(dev)->stats.collisions ++;
+                                dev->stats.collisions++;
                         if (nop.nop_status & STAT_NOCARRIER)
-                                priv(dev)->stats.tx_carrier_errors ++;
+                                dev->stats.tx_carrier_errors++;
                         if (nop.nop_status & STAT_TXLOSTCTS)
                                 printk (KERN_WARNING "%s: cts lost\n", dev->name);
                         if (nop.nop_status & STAT_TXSLOWDMA)
-                                priv(dev)->stats.tx_fifo_errors ++;
+                                dev->stats.tx_fifo_errors++;
                         if (nop.nop_status & STAT_COLLEXCESSIVE)
-                                priv(dev)->stats.collisions += 16;
+                                dev->stats.collisions += 16;
                 }
 
                 if (nop.nop_link == caddr) {
@@ -879,13 +876,13 @@ ether1_recv_done (struct net_device *dev)
 
                                 skb->protocol = eth_type_trans (skb, dev);
                                 netif_rx (skb);
-                                priv(dev)->stats.rx_packets ++;
+                                dev->stats.rx_packets++;
                         } else
-                                priv(dev)->stats.rx_dropped ++;
+                                dev->stats.rx_dropped++;
                 } else {
                         printk(KERN_WARNING "%s: %s\n", dev->name,
                                 (rbd.rbd_status & RBD_EOF) ? "oversized packet" : "acnt not valid");
-                        priv(dev)->stats.rx_dropped ++;
+                        dev->stats.rx_dropped++;
                 }
 
                 nexttail = ether1_readw(dev, priv(dev)->rx_tail, rfd_t, rfd_link, NORMALIRQS);
@@ -939,7 +936,7 @@ ether1_interrupt (int irq, void *dev_id)
                                 printk (KERN_WARNING "%s: RU went not ready: RU suspended\n", dev->name);
                                 ether1_writew(dev, SCB_CMDRXRESUME, SCB_ADDR, scb_t, scb_command, NORMALIRQS);
                                 writeb(CTRL_CA, REG_CONTROL);
-                                priv(dev)->stats.rx_dropped ++; /* we suspended due to lack of buffer space */
+                                dev->stats.rx_dropped++;        /* we suspended due to lack of buffer space */
                         } else
                                 printk(KERN_WARNING "%s: RU went not ready: %04X\n", dev->name,
                                         ether1_readw(dev, SCB_ADDR, scb_t, scb_status, NORMALIRQS));
@@ -962,12 +959,6 @@ ether1_close (struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *
-ether1_getstats (struct net_device *dev)
-{
-        return &priv(dev)->stats;
-}
-
 /*
  * Set or clear the multicast filter for this adaptor.
  * num_addrs == -1      Promiscuous mode, receive all packets.
@@ -994,7 +985,6 @@ static const struct net_device_ops ether1_netdev_ops = {
         .ndo_open               = ether1_open,
         .ndo_stop               = ether1_close,
         .ndo_start_xmit         = ether1_sendpacket,
-        .ndo_get_stats          = ether1_getstats,
         .ndo_set_multicast_list = ether1_setmulticastlist,
         .ndo_tx_timeout         = ether1_timeout,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/arm/ether1.h b/drivers/net/arm/ether1.h
index c8a4b2389d85..3a5830ab3dc7 100644
--- a/drivers/net/arm/ether1.h
+++ b/drivers/net/arm/ether1.h
@@ -38,7 +38,6 @@
 
 struct ether1_priv {
         void __iomem *base;
-        struct net_device_stats stats;
         unsigned int tx_link;
         unsigned int tx_head;
         volatile unsigned int tx_tail;
diff --git a/drivers/net/arm/ether3.c b/drivers/net/arm/ether3.c
index 1361b7367c28..44a8746f4014 100644
--- a/drivers/net/arm/ether3.c
+++ b/drivers/net/arm/ether3.c
@@ -81,7 +81,6 @@ static int	ether3_open (struct net_device *dev);
 static int      ether3_sendpacket (struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t ether3_interrupt (int irq, void *dev_id);
 static int      ether3_close (struct net_device *dev);
-static struct net_device_stats *ether3_getstats (struct net_device *dev);
 static void     ether3_setmulticastlist (struct net_device *dev);
 static void     ether3_timeout(struct net_device *dev);
 
@@ -323,8 +322,6 @@ ether3_init_for_open(struct net_device *dev)
 {
         int i;
 
-        memset(&priv(dev)->stats, 0, sizeof(struct net_device_stats));
-
         /* Reset the chip */
         ether3_outw(CFG2_RESET, REG_CONFIG2);
         udelay(4);
@@ -442,15 +439,6 @@ ether3_close(struct net_device *dev)
 }
 
 /*
- * Get the current statistics.  This may be called with the card open or
- * closed.
- */
-static struct net_device_stats *ether3_getstats(struct net_device *dev)
-{
-        return &priv(dev)->stats;
-}
-
-/*
  * Set or clear promiscuous/multicast mode filter for this adaptor.
  *
  * We don't attempt any packet filtering.  The card may have a SEEQ 8004
@@ -490,7 +478,7 @@ static void ether3_timeout(struct net_device *dev)
         local_irq_restore(flags);
 
         priv(dev)->regs.config2 |= CFG2_CTRLO;
-        priv(dev)->stats.tx_errors += 1;
+        dev->stats.tx_errors += 1;
         ether3_outw(priv(dev)->regs.config2, REG_CONFIG2);
         priv(dev)->tx_head = priv(dev)->tx_tail = 0;
 
@@ -509,7 +497,7 @@ ether3_sendpacket(struct sk_buff *skb, struct net_device *dev)
 
         if (priv(dev)->broken) {
                 dev_kfree_skb(skb);
-                priv(dev)->stats.tx_dropped ++;
+                dev->stats.tx_dropped++;
                 netif_start_queue(dev);
                 return NETDEV_TX_OK;
         }
@@ -673,7 +661,7 @@ if (next_ptr < RX_START || next_ptr >= RX_END) {
                         } else
                                 goto dropping;
                 } else {
-                        struct net_device_stats *stats = &priv(dev)->stats;
+                        struct net_device_stats *stats = &dev->stats;
                         ether3_outw(next_ptr >> 8, REG_RECVEND);
                         if (status & RXSTAT_OVERSIZE)     stats->rx_over_errors ++;
                         if (status & RXSTAT_CRCERROR)     stats->rx_crc_errors ++;
@@ -685,14 +673,14 @@ if (next_ptr < RX_START || next_ptr >= RX_END) {
         while (-- maxcnt);
 
 done:
-        priv(dev)->stats.rx_packets += received;
+        dev->stats.rx_packets += received;
         priv(dev)->rx_head = next_ptr;
         /*
          * If rx went off line, then that means that the buffer may be full.  We
          * have dropped at least one packet.
          */
         if (!(ether3_inw(REG_STATUS) & STAT_RXON)) {
-                priv(dev)->stats.rx_dropped ++;
+                dev->stats.rx_dropped++;
                 ether3_outw(next_ptr, REG_RECVPTR);
                 ether3_outw(priv(dev)->regs.command | CMD_RXON, REG_COMMAND);
         }
@@ -710,7 +698,7 @@ dropping:{
                 last_warned = jiffies;
                 printk("%s: memory squeeze, dropping packet.\n", dev->name);
         }
-        priv(dev)->stats.rx_dropped ++;
+        dev->stats.rx_dropped++;
         goto done;
         }
 }
@@ -743,13 +731,13 @@ static void ether3_tx(struct net_device *dev)
                  * Update errors
                  */
                 if (!(status & (TXSTAT_BABBLED | TXSTAT_16COLLISIONS)))
-                        priv(dev)->stats.tx_packets++;
+                        dev->stats.tx_packets++;
                 else {
-                        priv(dev)->stats.tx_errors ++;
+                        dev->stats.tx_errors++;
                         if (status & TXSTAT_16COLLISIONS)
-                                priv(dev)->stats.collisions += 16;
+                                dev->stats.collisions += 16;
                         if (status & TXSTAT_BABBLED)
-                                priv(dev)->stats.tx_fifo_errors ++;
+                                dev->stats.tx_fifo_errors++;
                 }
 
                 tx_tail = (tx_tail + 1) & 15;
@@ -773,7 +761,6 @@ static const struct net_device_ops ether3_netdev_ops = {
         .ndo_open               = ether3_open,
         .ndo_stop               = ether3_close,
         .ndo_start_xmit         = ether3_sendpacket,
-        .ndo_get_stats          = ether3_getstats,
         .ndo_set_multicast_list = ether3_setmulticastlist,
         .ndo_tx_timeout         = ether3_timeout,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/arm/ether3.h b/drivers/net/arm/ether3.h
index 1921a3a07da7..2db63b08bdf3 100644
--- a/drivers/net/arm/ether3.h
+++ b/drivers/net/arm/ether3.h
@@ -164,7 +164,6 @@ struct dev_priv {
     unsigned char tx_head;              /* buffer nr to insert next packet       */
     unsigned char tx_tail;              /* buffer nr of transmitting packet      */
     unsigned int rx_head;               /* address to fetch next packet from     */
-    struct net_device_stats stats;
     struct timer_list timer;
     int broken;                         /* 0 = ok, 1 = something went wrong      */
 };
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index b57d7dee389a..3134e5326231 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -362,7 +362,7 @@ static void *slow_memcpy( void *dst, const void *src, size_t len )
                 *cto++ = *cfrom++;
                 MFPDELAY();
         }
-        return( dst );
+        return dst;
 }
 
 
@@ -449,7 +449,7 @@ static noinline int __init addr_accessible(volatile void *regp, int wordflag,
         vbr[2] = save_berr;
         local_irq_restore(flags);
 
-        return( ret );
+        return ret;
 }
 
 static const struct net_device_ops lance_netdev_ops = {
@@ -526,7 +526,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
         goto probe_ok;
 
   probe_fail:
-        return( 0 );
+        return 0;
 
   probe_ok:
         lp = netdev_priv(dev);
@@ -556,7 +556,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
                 if (request_irq(IRQ_AUTO_5, lance_interrupt, IRQ_TYPE_PRIO,
                             "PAM/Riebl-ST Ethernet", dev)) {
                         printk( "Lance: request for irq %d failed\n", IRQ_AUTO_5 );
-                        return( 0 );
+                        return 0;
                 }
                 dev->irq = (unsigned short)IRQ_AUTO_5;
         }
@@ -568,12 +568,12 @@ static unsigned long __init lance_probe1( struct net_device *dev,
                 unsigned long irq = atari_register_vme_int();
                 if (!irq) {
                         printk( "Lance: request for VME interrupt failed\n" );
-                        return( 0 );
+                        return 0;
                 }
                 if (request_irq(irq, lance_interrupt, IRQ_TYPE_PRIO,
                             "Riebl-VME Ethernet", dev)) {
                         printk( "Lance: request for irq %ld failed\n", irq );
-                        return( 0 );
+                        return 0;
                 }
                 dev->irq = irq;
         }
@@ -637,7 +637,7 @@ static unsigned long __init lance_probe1( struct net_device *dev,
         /* XXX MSch */
         dev->watchdog_timeo = TX_TIMEOUT;
 
-        return( 1 );
+        return 1;
 }
 
 
@@ -666,7 +666,7 @@ static int lance_open( struct net_device *dev )
                 DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
                                           dev->name, i, DREG ));
                 DREG = CSR0_STOP;
-                return( -EIO );
+                return -EIO;
         }
         DREG = CSR0_IDON;
         DREG = CSR0_STRT;
@@ -676,7 +676,7 @@ static int lance_open( struct net_device *dev )
 
         DPRINTK( 2, ( "%s: LANCE is open, csr0 %04x\n", dev->name, DREG ));
 
-        return( 0 );
+        return 0;
 }
 
 
@@ -1126,13 +1126,13 @@ static int lance_set_mac_address( struct net_device *dev, void *addr )
         int i;
 
         if (lp->cardtype != OLD_RIEBL && lp->cardtype != NEW_RIEBL)
-                return( -EOPNOTSUPP );
+                return -EOPNOTSUPP;
 
         if (netif_running(dev)) {
                 /* Only possible while card isn't started */
                 DPRINTK( 1, ( "%s: hwaddr can be set only while card isn't open.\n",
                                           dev->name ));
-                return( -EIO );
+                return -EIO;
         }
 
         memcpy( dev->dev_addr, saddr->sa_data, dev->addr_len );
@@ -1142,7 +1142,7 @@ static int lance_set_mac_address( struct net_device *dev, void *addr )
         /* set also the magic for future sessions */
         *RIEBL_MAGIC_ADDR = RIEBL_MAGIC;
 
-        return( 0 );
+        return 0;
 }
 
 
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index 52abbbdf8a08..ef4115b897bf 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -559,7 +559,6 @@ struct atl1c_adapter {
         struct napi_struct  napi;
         struct atl1c_hw        hw;
         struct atl1c_hw_stats  hw_stats;
-        struct net_device_stats net_stats;
         struct mii_if_info  mii;    /* MII interface info */
         u16 rx_buffer_len;
 
diff --git a/drivers/net/atl1c/atl1c_hw.c b/drivers/net/atl1c/atl1c_hw.c
index d8501f060957..919080b2c3a5 100644
--- a/drivers/net/atl1c/atl1c_hw.c
+++ b/drivers/net/atl1c/atl1c_hw.c
@@ -480,7 +480,7 @@ int atl1c_phy_reset(struct atl1c_hw *hw)
                 atl1c_write_phy_reg(hw, MII_DBG_DATA, 0x929D);
         }
         if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c_b2
-                || hw->nic_type == athr_l2c || hw->nic_type == athr_l2c) {
+                || hw->nic_type == athr_l2c) {
                 atl1c_write_phy_reg(hw, MII_DBG_ADDR, 0x29);
                 atl1c_write_phy_reg(hw, MII_DBG_DATA, 0xB6DD);
         }
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index c7b8ef507ebd..553230eb365c 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -1562,7 +1562,7 @@ static struct net_device_stats *atl1c_get_stats(struct net_device *netdev)
 {
         struct atl1c_adapter *adapter = netdev_priv(netdev);
         struct atl1c_hw_stats  *hw_stats = &adapter->hw_stats;
-        struct net_device_stats *net_stats = &adapter->net_stats;
+        struct net_device_stats *net_stats = &netdev->stats;
 
         atl1c_update_hw_stats(adapter);
         net_stats->rx_packets = hw_stats->rx_ok;
@@ -1590,7 +1590,7 @@ static struct net_device_stats *atl1c_get_stats(struct net_device *netdev)
         net_stats->tx_aborted_errors = hw_stats->tx_abort_col;
         net_stats->tx_window_errors  = hw_stats->tx_late_col;
 
-        return &adapter->net_stats;
+        return net_stats;
 }
 
 static inline void atl1c_clear_phy_int(struct atl1c_adapter *adapter)
@@ -1700,7 +1700,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
 
                 /* link event */
                 if (status & (ISR_GPHY | ISR_MANUAL)) {
-                        adapter->net_stats.tx_carrier_errors++;
+                        netdev->stats.tx_carrier_errors++;
                         atl1c_link_chg_event(adapter);
                         break;
                 }
@@ -1719,7 +1719,7 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
          * cannot figure out if the packet is fragmented or not,
          * so we tell the KERNEL CHECKSUM_NONE
          */
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 }
 
 static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter, const int ringid)
diff --git a/drivers/net/atl1e/atl1e_main.c b/drivers/net/atl1e/atl1e_main.c
index 1acea5774e89..56ace3fbe40d 100644
--- a/drivers/net/atl1e/atl1e_main.c
+++ b/drivers/net/atl1e/atl1e_main.c
@@ -1331,7 +1331,7 @@ static inline void atl1e_rx_checksum(struct atl1e_adapter *adapter,
         u16 pkt_flags;
         u16 err_flags;
 
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
         pkt_flags = prrs->pkt_flag;
         err_flags = prrs->err_flag;
         if (((pkt_flags & RRS_IS_IPV4) || (pkt_flags & RRS_IS_IPV6)) &&
@@ -2316,7 +2316,7 @@ static int __devinit atl1e_probe(struct pci_dev *pdev,
         netif_napi_add(netdev, &adapter->napi, atl1e_clean, 64);
 
         init_timer(&adapter->phy_config_timer);
-        adapter->phy_config_timer.function = &atl1e_phy_config;
+        adapter->phy_config_timer.function = atl1e_phy_config;
         adapter->phy_config_timer.data = (unsigned long) adapter;
 
         /* get user settings */
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index c73be2848319..b8c053f76878 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -1811,7 +1811,7 @@ static void atl1_rx_checksum(struct atl1_adapter *adapter,
          * the higher layers and let it be sorted out there.
          */
 
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         if (unlikely(rrd->pkt_flg & PACKET_FLAG_ERR)) {
                 if (rrd->err_flg & (ERR_FLAG_CRC | ERR_FLAG_TRUNC |
@@ -2100,9 +2100,9 @@ static u16 atl1_tpd_avail(struct atl1_tpd_ring *tpd_ring)
 {
         u16 next_to_clean = atomic_read(&tpd_ring->next_to_clean);
         u16 next_to_use = atomic_read(&tpd_ring->next_to_use);
-        return ((next_to_clean > next_to_use) ?
+        return (next_to_clean > next_to_use) ?
                 next_to_clean - next_to_use - 1 :
-                tpd_ring->count + next_to_clean - next_to_use - 1);
+                tpd_ring->count + next_to_clean - next_to_use - 1;
 }
 
 static int atl1_tso(struct atl1_adapter *adapter, struct sk_buff *skb,
@@ -3043,7 +3043,7 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
         netif_carrier_off(netdev);
         netif_stop_queue(netdev);
 
-        setup_timer(&adapter->phy_config_timer, &atl1_phy_config,
+        setup_timer(&adapter->phy_config_timer, atl1_phy_config,
                     (unsigned long)adapter);
         adapter->phy_timer_pending = false;
 
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index 8da87383fb39..29c0265ccc5d 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -51,10 +51,10 @@
 
 #define ATL2_DRV_VERSION "2.2.3"
 
-static char atl2_driver_name[] = "atl2";
+static const char atl2_driver_name[] = "atl2";
 static const char atl2_driver_string[] = "Atheros(R) L2 Ethernet Driver";
-static char atl2_copyright[] = "Copyright (c) 2007 Atheros Corporation.";
-static char atl2_driver_version[] = ATL2_DRV_VERSION;
+static const char atl2_copyright[] = "Copyright (c) 2007 Atheros Corporation.";
+static const char atl2_driver_version[] = ATL2_DRV_VERSION;
 
 MODULE_AUTHOR("Atheros Corporation <xiong.huang@atheros.com>, Chris Snook <csnook@redhat.com>");
 MODULE_DESCRIPTION("Atheros Fast Ethernet Network Driver");
@@ -1444,11 +1444,11 @@ static int __devinit atl2_probe(struct pci_dev *pdev,
         atl2_check_options(adapter);
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &atl2_watchdog;
+        adapter->watchdog_timer.function = atl2_watchdog;
         adapter->watchdog_timer.data = (unsigned long) adapter;
 
         init_timer(&adapter->phy_config_timer);
-        adapter->phy_config_timer.function = &atl2_phy_config;
+        adapter->phy_config_timer.function = atl2_phy_config;
         adapter->phy_config_timer.data = (unsigned long) adapter;
 
         INIT_WORK(&adapter->reset_task, atl2_reset_task);
diff --git a/drivers/net/atp.c b/drivers/net/atp.c
index bd2f9d331dac..dfd96b20547f 100644
--- a/drivers/net/atp.c
+++ b/drivers/net/atp.c
@@ -445,7 +445,7 @@ static int net_open(struct net_device *dev)
         init_timer(&lp->timer);
         lp->timer.expires = jiffies + TIMED_CHECKER;
         lp->timer.data = (unsigned long)dev;
-        lp->timer.function = &atp_timed_checker;    /* timer handler */
+        lp->timer.function = atp_timed_checker;    /* timer handler */
         add_timer(&lp->timer);
 
         netif_start_queue(dev);
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 15ae6df2ff00..43489f89c142 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -13,7 +13,7 @@
  *  converted to use linux-2.6.x's PHY framework
  *
  * Author: MontaVista Software, Inc.
- *              ppopov@mvista.com or source@mvista.com
+ *              ppopov@mvista.com or source@mvista.com
  *
  * ########################################################################
  *
@@ -34,6 +34,8 @@
  *
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/capability.h>
 #include <linux/dma-mapping.h>
 #include <linux/module.h>
@@ -56,11 +58,11 @@
 #include <linux/crc32.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
+#include <linux/cpu.h>
+#include <linux/io.h>
 
-#include <asm/cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/irq.h>
-#include <asm/io.h>
 #include <asm/processor.h>
 
 #include <au1000.h>
@@ -152,11 +154,11 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
 
         spin_lock_irqsave(&aup->lock, flags);
 
-        if(force_reset || (!aup->mac_enabled)) {
-                *aup->enable = MAC_EN_CLOCK_ENABLE;
+        if (force_reset || (!aup->mac_enabled)) {
+                writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
                 au_sync_delay(2);
-                *aup->enable = (MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
-                                | MAC_EN_CLOCK_ENABLE);
+                writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
+                                | MAC_EN_CLOCK_ENABLE), &aup->enable);
                 au_sync_delay(2);
 
                 aup->mac_enabled = 1;
@@ -171,12 +173,12 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
 static int au1000_mdio_read(struct net_device *dev, int phy_addr, int reg)
 {
         struct au1000_private *aup = netdev_priv(dev);
-        volatile u32 *const mii_control_reg = &aup->mac->mii_control;
-        volatile u32 *const mii_data_reg = &aup->mac->mii_data;
+        u32 *const mii_control_reg = &aup->mac->mii_control;
+        u32 *const mii_data_reg = &aup->mac->mii_data;
         u32 timedout = 20;
         u32 mii_control;
 
-        while (*mii_control_reg & MAC_MII_BUSY) {
+        while (readl(mii_control_reg) & MAC_MII_BUSY) {
                 mdelay(1);
                 if (--timedout == 0) {
                         netdev_err(dev, "read_MII busy timeout!!\n");
@@ -187,29 +189,29 @@ static int au1000_mdio_read(struct net_device *dev, int phy_addr, int reg)
         mii_control = MAC_SET_MII_SELECT_REG(reg) |
                 MAC_SET_MII_SELECT_PHY(phy_addr) | MAC_MII_READ;
 
-        *mii_control_reg = mii_control;
+        writel(mii_control, mii_control_reg);
 
         timedout = 20;
-        while (*mii_control_reg & MAC_MII_BUSY) {
+        while (readl(mii_control_reg) & MAC_MII_BUSY) {
                 mdelay(1);
                 if (--timedout == 0) {
                         netdev_err(dev, "mdio_read busy timeout!!\n");
                         return -1;
                 }
         }
-        return (int)*mii_data_reg;
+        return readl(mii_data_reg);
 }
 
 static void au1000_mdio_write(struct net_device *dev, int phy_addr,
                               int reg, u16 value)
 {
         struct au1000_private *aup = netdev_priv(dev);
-        volatile u32 *const mii_control_reg = &aup->mac->mii_control;
-        volatile u32 *const mii_data_reg = &aup->mac->mii_data;
+        u32 *const mii_control_reg = &aup->mac->mii_control;
+        u32 *const mii_data_reg = &aup->mac->mii_data;
         u32 timedout = 20;
         u32 mii_control;
 
-        while (*mii_control_reg & MAC_MII_BUSY) {
+        while (readl(mii_control_reg) & MAC_MII_BUSY) {
                 mdelay(1);
                 if (--timedout == 0) {
                         netdev_err(dev, "mdio_write busy timeout!!\n");
@@ -220,18 +222,22 @@ static void au1000_mdio_write(struct net_device *dev, int phy_addr,
         mii_control = MAC_SET_MII_SELECT_REG(reg) |
                 MAC_SET_MII_SELECT_PHY(phy_addr) | MAC_MII_WRITE;
 
-        *mii_data_reg = value;
-        *mii_control_reg = mii_control;
+        writel(value, mii_data_reg);
+        writel(mii_control, mii_control_reg);
 }
 
 static int au1000_mdiobus_read(struct mii_bus *bus, int phy_addr, int regnum)
 {
         /* WARNING: bus->phy_map[phy_addr].attached_dev == dev does
-         * _NOT_ hold (e.g. when PHY is accessed through other MAC's MII bus) */
+         * _NOT_ hold (e.g. when PHY is accessed through other MAC's MII bus)
+         */
         struct net_device *const dev = bus->priv;
 
-        au1000_enable_mac(dev, 0); /* make sure the MAC associated with this
-                             * mii_bus is enabled */
+        /* make sure the MAC associated with this
+         * mii_bus is enabled
+         */
+        au1000_enable_mac(dev, 0);
+
         return au1000_mdio_read(dev, phy_addr, regnum);
 }
 
@@ -240,8 +246,11 @@ static int au1000_mdiobus_write(struct mii_bus *bus, int phy_addr, int regnum,
 {
         struct net_device *const dev = bus->priv;
 
-        au1000_enable_mac(dev, 0); /* make sure the MAC associated with this
-                             * mii_bus is enabled */
+        /* make sure the MAC associated with this
+         * mii_bus is enabled
+         */
+        au1000_enable_mac(dev, 0);
+
         au1000_mdio_write(dev, phy_addr, regnum, value);
         return 0;
 }
@@ -250,28 +259,37 @@ static int au1000_mdiobus_reset(struct mii_bus *bus)
 {
         struct net_device *const dev = bus->priv;
 
-        au1000_enable_mac(dev, 0); /* make sure the MAC associated with this
-                             * mii_bus is enabled */
+        /* make sure the MAC associated with this
+         * mii_bus is enabled
+         */
+        au1000_enable_mac(dev, 0);
+
         return 0;
 }
 
 static void au1000_hard_stop(struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
+        u32 reg;
 
         netif_dbg(aup, drv, dev, "hard stop\n");
 
-        aup->mac->control &= ~(MAC_RX_ENABLE | MAC_TX_ENABLE);
+        reg = readl(&aup->mac->control);
+        reg &= ~(MAC_RX_ENABLE | MAC_TX_ENABLE);
+        writel(reg, &aup->mac->control);
         au_sync_delay(10);
 }
 
 static void au1000_enable_rx_tx(struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
+        u32 reg;
 
         netif_dbg(aup, hw, dev, "enable_rx_tx\n");
 
-        aup->mac->control |= (MAC_RX_ENABLE | MAC_TX_ENABLE);
+        reg = readl(&aup->mac->control);
+        reg |= (MAC_RX_ENABLE | MAC_TX_ENABLE);
+        writel(reg, &aup->mac->control);
         au_sync_delay(10);
 }
 
@@ -281,6 +299,7 @@ au1000_adjust_link(struct net_device *dev)
         struct au1000_private *aup = netdev_priv(dev);
         struct phy_device *phydev = aup->phy_dev;
         unsigned long flags;
+        u32 reg;
 
         int status_change = 0;
 
@@ -312,14 +331,15 @@ au1000_adjust_link(struct net_device *dev)
                 /* switching duplex mode requires to disable rx and tx! */
                 au1000_hard_stop(dev);
 
-                if (DUPLEX_FULL == phydev->duplex)
-                        aup->mac->control = ((aup->mac->control
-                                             | MAC_FULL_DUPLEX)
-                                             & ~MAC_DISABLE_RX_OWN);
-                else
-                        aup->mac->control = ((aup->mac->control
-                                              & ~MAC_FULL_DUPLEX)
-                                             | MAC_DISABLE_RX_OWN);
+                reg = readl(&aup->mac->control);
+                if (DUPLEX_FULL == phydev->duplex) {
+                        reg |= MAC_FULL_DUPLEX;
+                        reg &= ~MAC_DISABLE_RX_OWN;
+                } else {
+                        reg &= ~MAC_FULL_DUPLEX;
+                        reg |= MAC_DISABLE_RX_OWN;
+                }
+                writel(reg, &aup->mac->control);
                 au_sync_delay(1);
 
                 au1000_enable_rx_tx(dev);
@@ -353,10 +373,11 @@ au1000_adjust_link(struct net_device *dev)
         }
 }
 
-static int au1000_mii_probe (struct net_device *dev)
+static int au1000_mii_probe(struct net_device *dev)
 {
         struct au1000_private *const aup = netdev_priv(dev);
         struct phy_device *phydev = NULL;
+        int phy_addr;
 
         if (aup->phy_static_config) {
                 BUG_ON(aup->mac_id < 0 || aup->mac_id > 1);
@@ -366,42 +387,46 @@ static int au1000_mii_probe (struct net_device *dev)
                 else
                         netdev_info(dev, "using PHY-less setup\n");
                 return 0;
-        } else {
-                int phy_addr;
-
-                /* find the first (lowest address) PHY on the current MAC's MII bus */
-                for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++)
-                        if (aup->mii_bus->phy_map[phy_addr]) {
-                                phydev = aup->mii_bus->phy_map[phy_addr];
-                                if (!aup->phy_search_highest_addr)
-                                        break; /* break out with first one found */
-                        }
-
-                if (aup->phy1_search_mac0) {
-                        /* try harder to find a PHY */
-                        if (!phydev && (aup->mac_id == 1)) {
-                                /* no PHY found, maybe we have a dual PHY? */
-                                dev_info(&dev->dev, ": no PHY found on MAC1, "
-                                        "let's see if it's attached to MAC0...\n");
-
-                                /* find the first (lowest address) non-attached PHY on
-                                 * the MAC0 MII bus */
-                                for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++) {
-                                        struct phy_device *const tmp_phydev =
-                                                        aup->mii_bus->phy_map[phy_addr];
-
-                                        if (aup->mac_id == 1)
-                                                break;
-
-                                        if (!tmp_phydev)
-                                                continue; /* no PHY here... */
+        }
 
-                                        if (tmp_phydev->attached_dev)
-                                                continue; /* already claimed by MAC0 */
+        /* find the first (lowest address) PHY
+         * on the current MAC's MII bus
+         */
+        for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++)
+                if (aup->mii_bus->phy_map[phy_addr]) {
+                        phydev = aup->mii_bus->phy_map[phy_addr];
+                        if (!aup->phy_search_highest_addr)
+                                /* break out with first one found */
+                                break;
+                }
 
-                                        phydev = tmp_phydev;
-                                        break; /* found it */
-                                }
+        if (aup->phy1_search_mac0) {
+                /* try harder to find a PHY */
+                if (!phydev && (aup->mac_id == 1)) {
+                        /* no PHY found, maybe we have a dual PHY? */
+                        dev_info(&dev->dev, ": no PHY found on MAC1, "
+                                "let's see if it's attached to MAC0...\n");
+
+                        /* find the first (lowest address) non-attached
+                         * PHY on the MAC0 MII bus
+                         */
+                        for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++) {
+                                struct phy_device *const tmp_phydev =
+                                        aup->mii_bus->phy_map[phy_addr];
+
+                                if (aup->mac_id == 1)
+                                        break;
+
+                                /* no PHY here... */
+                                if (!tmp_phydev)
+                                        continue;
+
+                                /* already claimed by MAC0 */
+                                if (tmp_phydev->attached_dev)
+                                        continue;
+
+                                phydev = tmp_phydev;
+                                break; /* found it */
                         }
                 }
         }
@@ -452,20 +477,20 @@ static int au1000_mii_probe (struct net_device *dev)
  * has the virtual and dma address of a buffer suitable for
  * both, receive and transmit operations.
  */
-static db_dest_t *au1000_GetFreeDB(struct au1000_private *aup)
+static struct db_dest *au1000_GetFreeDB(struct au1000_private *aup)
 {
-        db_dest_t *pDB;
+        struct db_dest *pDB;
         pDB = aup->pDBfree;
 
-        if (pDB) {
+        if (pDB)
                 aup->pDBfree = pDB->pnext;
-        }
+
         return pDB;
 }
 
-void au1000_ReleaseDB(struct au1000_private *aup, db_dest_t *pDB)
+void au1000_ReleaseDB(struct au1000_private *aup, struct db_dest *pDB)
 {
-        db_dest_t *pDBfree = aup->pDBfree;
+        struct db_dest *pDBfree = aup->pDBfree;
         if (pDBfree)
                 pDBfree->pnext = pDB;
         aup->pDBfree = pDB;
@@ -478,9 +503,9 @@ static void au1000_reset_mac_unlocked(struct net_device *dev)
 
         au1000_hard_stop(dev);
 
-        *aup->enable = MAC_EN_CLOCK_ENABLE;
+        writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
         au_sync_delay(2);
-        *aup->enable = 0;
+        writel(0, &aup->enable);
         au_sync_delay(2);
 
         aup->tx_full = 0;
@@ -507,7 +532,7 @@ static void au1000_reset_mac(struct net_device *dev)
 
         spin_lock_irqsave(&aup->lock, flags);
 
-        au1000_reset_mac_unlocked (dev);
+        au1000_reset_mac_unlocked(dev);
 
         spin_unlock_irqrestore(&aup->lock, flags);
 }
@@ -524,11 +549,13 @@ au1000_setup_hw_rings(struct au1000_private *aup, u32 rx_base, u32 tx_base)
 
         for (i = 0; i < NUM_RX_DMA; i++) {
                 aup->rx_dma_ring[i] =
-                        (volatile rx_dma_t *) (rx_base + sizeof(rx_dma_t)*i);
+                        (struct rx_dma *)
+                                        (rx_base + sizeof(struct rx_dma)*i);
         }
         for (i = 0; i < NUM_TX_DMA; i++) {
                 aup->tx_dma_ring[i] =
-                        (volatile tx_dma_t *) (tx_base + sizeof(tx_dma_t)*i);
+                        (struct tx_dma *)
+                                        (tx_base + sizeof(struct tx_dma)*i);
         }
 }
 
@@ -616,18 +643,21 @@ static int au1000_init(struct net_device *dev)
 
         spin_lock_irqsave(&aup->lock, flags);
 
-        aup->mac->control = 0;
+        writel(0, &aup->mac->control);
         aup->tx_head = (aup->tx_dma_ring[0]->buff_stat & 0xC) >> 2;
         aup->tx_tail = aup->tx_head;
         aup->rx_head = (aup->rx_dma_ring[0]->buff_stat & 0xC) >> 2;
 
-        aup->mac->mac_addr_high = dev->dev_addr[5]<<8 | dev->dev_addr[4];
-        aup->mac->mac_addr_low = dev->dev_addr[3]<<24 | dev->dev_addr[2]<<16 |
-                dev->dev_addr[1]<<8 | dev->dev_addr[0];
+        writel(dev->dev_addr[5]<<8 | dev->dev_addr[4],
+                                        &aup->mac->mac_addr_high);
+        writel(dev->dev_addr[3]<<24 | dev->dev_addr[2]<<16 |
+                dev->dev_addr[1]<<8 | dev->dev_addr[0],
+                                        &aup->mac->mac_addr_low);
 
-        for (i = 0; i < NUM_RX_DMA; i++) {
+
+        for (i = 0; i < NUM_RX_DMA; i++)
                 aup->rx_dma_ring[i]->buff_stat |= RX_DMA_ENABLE;
-        }
+
         au_sync();
 
         control = MAC_RX_ENABLE | MAC_TX_ENABLE;
@@ -643,8 +673,8 @@ static int au1000_init(struct net_device *dev)
                 control |= MAC_FULL_DUPLEX;
         }
 
-        aup->mac->control = control;
-        aup->mac->vlan1_tag = 0x8100; /* activate vlan support */
+        writel(control, &aup->mac->control);
+        writel(0x8100, &aup->mac->vlan1_tag); /* activate vlan support */
         au_sync();
 
         spin_unlock_irqrestore(&aup->lock, flags);
@@ -681,9 +711,9 @@ static int au1000_rx(struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
         struct sk_buff *skb;
-        volatile rx_dma_t *prxd;
+        struct rx_dma *prxd;
         u32 buff_stat, status;
-        db_dest_t *pDB;
+        struct db_dest *pDB;
         u32     frmlen;
 
         netif_dbg(aup, rx_status, dev, "au1000_rx head %d\n", aup->rx_head);
@@ -713,24 +743,26 @@ static int au1000_rx(struct net_device *dev)
                         netif_rx(skb);  /* pass the packet to upper layers */
                 } else {
                         if (au1000_debug > 4) {
+                                pr_err("rx_error(s):");
                                 if (status & RX_MISSED_FRAME)
-                                        printk("rx miss\n");
+                                        pr_cont(" miss");
                                 if (status & RX_WDOG_TIMER)
-                                        printk("rx wdog\n");
+                                        pr_cont(" wdog");
                                 if (status & RX_RUNT)
-                                        printk("rx runt\n");
+                                        pr_cont(" runt");
                                 if (status & RX_OVERLEN)
-                                        printk("rx overlen\n");
+                                        pr_cont(" overlen");
                                 if (status & RX_COLL)
-                                        printk("rx coll\n");
+                                        pr_cont(" coll");
                                 if (status & RX_MII_ERROR)
-                                        printk("rx mii error\n");
+                                        pr_cont(" mii error");
                                 if (status & RX_CRC_ERROR)
-                                        printk("rx crc error\n");
+                                        pr_cont(" crc error");
                                 if (status & RX_LEN_ERROR)
-                                        printk("rx len error\n");
+                                        pr_cont(" len error");
                                 if (status & RX_U_CNTRL_FRAME)
-                                        printk("rx u control frame\n");
+                                        pr_cont(" u control frame");
+                                pr_cont("\n");
                         }
                 }
                 prxd->buff_stat = (u32)(pDB->dma_addr | RX_DMA_ENABLE);
@@ -753,7 +785,8 @@ static void au1000_update_tx_stats(struct net_device *dev, u32 status)
                 if (!aup->phy_dev || (DUPLEX_FULL == aup->phy_dev->duplex)) {
                         if (status & (TX_JAB_TIMEOUT | TX_UNDERRUN)) {
                                 /* any other tx errors are only valid
-                                 * in half duplex mode */
+                                 * in half duplex mode
+                                 */
                                 ps->tx_errors++;
                                 ps->tx_aborted_errors++;
                         }
@@ -774,7 +807,7 @@ static void au1000_update_tx_stats(struct net_device *dev, u32 status)
 static void au1000_tx_ack(struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
-        volatile tx_dma_t *ptxd;
+        struct tx_dma *ptxd;
 
         ptxd = aup->tx_dma_ring[aup->tx_tail];
 
@@ -854,7 +887,7 @@ static int au1000_close(struct net_device *dev)
 
         spin_lock_irqsave(&aup->lock, flags);
 
-        au1000_reset_mac_unlocked (dev);
+        au1000_reset_mac_unlocked(dev);
 
         /* stop the device */
         netif_stop_queue(dev);
@@ -873,9 +906,9 @@ static netdev_tx_t au1000_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
         struct net_device_stats *ps = &dev->stats;
-        volatile tx_dma_t *ptxd;
+        struct tx_dma *ptxd;
         u32 buff_stat;
-        db_dest_t *pDB;
+        struct db_dest *pDB;
         int i;
 
         netif_dbg(aup, tx_queued, dev, "tx: aup %x len=%d, data=%p, head %d\n",
@@ -902,9 +935,9 @@ static netdev_tx_t au1000_tx(struct sk_buff *skb, struct net_device *dev)
         pDB = aup->tx_db_inuse[aup->tx_head];
         skb_copy_from_linear_data(skb, (void *)pDB->vaddr, skb->len);
         if (skb->len < ETH_ZLEN) {
-                for (i = skb->len; i < ETH_ZLEN; i++) {
+                for (i = skb->len; i < ETH_ZLEN; i++)
                         ((char *)pDB->vaddr)[i] = 0;
-                }
+
                 ptxd->len = ETH_ZLEN;
         } else
                 ptxd->len = skb->len;
@@ -935,15 +968,16 @@ static void au1000_tx_timeout(struct net_device *dev)
 static void au1000_multicast_list(struct net_device *dev)
 {
         struct au1000_private *aup = netdev_priv(dev);
+        u32 reg;
 
-        netif_dbg(aup, drv, dev, "au1000_multicast_list: flags=%x\n", dev->flags);
-
+        netif_dbg(aup, drv, dev, "%s: flags=%x\n", __func__, dev->flags);
+        reg = readl(&aup->mac->control);
         if (dev->flags & IFF_PROMISC) {                 /* Set promiscuous. */
-                aup->mac->control |= MAC_PROMISCUOUS;
+                reg |= MAC_PROMISCUOUS;
         } else if ((dev->flags & IFF_ALLMULTI)  ||
                            netdev_mc_count(dev) > MULTICAST_FILTER_LIMIT) {
-                aup->mac->control |= MAC_PASS_ALL_MULTI;
-                aup->mac->control &= ~MAC_PROMISCUOUS;
+                reg |= MAC_PASS_ALL_MULTI;
+                reg &= ~MAC_PROMISCUOUS;
                 netdev_info(dev, "Pass all multicast\n");
         } else {
                 struct netdev_hw_addr *ha;
@@ -953,11 +987,12 @@ static void au1000_multicast_list(struct net_device *dev)
                 netdev_for_each_mc_addr(ha, dev)
                         set_bit(ether_crc(ETH_ALEN, ha->addr)>>26,
                                         (long *)mc_filter);
-                aup->mac->multi_hash_high = mc_filter[1];
-                aup->mac->multi_hash_low = mc_filter[0];
-                aup->mac->control &= ~MAC_PROMISCUOUS;
-                aup->mac->control |= MAC_HASH_MODE;
+                writel(mc_filter[1], &aup->mac->multi_hash_high);
+                writel(mc_filter[0], &aup->mac->multi_hash_low);
+                reg &= ~MAC_PROMISCUOUS;
+                reg |= MAC_HASH_MODE;
         }
+        writel(reg, &aup->mac->control);
 }
 
 static int au1000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
@@ -991,7 +1026,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         struct au1000_private *aup = NULL;
         struct au1000_eth_platform_data *pd;
         struct net_device *dev = NULL;
-        db_dest_t *pDB, *pDBfree;
+        struct db_dest *pDB, *pDBfree;
         int irq, i, err = 0;
         struct resource *base, *macen;
 
@@ -1016,13 +1051,15 @@ static int __devinit au1000_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        if (!request_mem_region(base->start, resource_size(base), pdev->name)) {
+        if (!request_mem_region(base->start, resource_size(base),
+                                                        pdev->name)) {
                 dev_err(&pdev->dev, "failed to request memory region for base registers\n");
                 err = -ENXIO;
                 goto out;
         }
 
-        if (!request_mem_region(macen->start, resource_size(macen), pdev->name)) {
+        if (!request_mem_region(macen->start, resource_size(macen),
+                                                        pdev->name)) {
                 dev_err(&pdev->dev, "failed to request memory region for MAC enable register\n");
                 err = -ENXIO;
                 goto err_request;
@@ -1040,10 +1077,12 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         aup = netdev_priv(dev);
 
         spin_lock_init(&aup->lock);
-        aup->msg_enable = (au1000_debug < 4 ? AU1000_DEF_MSG_ENABLE : au1000_debug);
+        aup->msg_enable = (au1000_debug < 4 ?
+                                AU1000_DEF_MSG_ENABLE : au1000_debug);
 
-        /* Allocate the data buffers */
-        /* Snooping works fine with eth on all au1xxx */
+        /* Allocate the data buffers
+         * Snooping works fine with eth on all au1xxx
+         */
         aup->vaddr = (u32)dma_alloc_noncoherent(NULL, MAX_BUF_SIZE *
                                                 (NUM_TX_BUFFS + NUM_RX_BUFFS),
                                                 &aup->dma_addr, 0);
@@ -1054,15 +1093,17 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         }
 
         /* aup->mac is the base address of the MAC's registers */
-        aup->mac = (volatile mac_reg_t *)ioremap_nocache(base->start, resource_size(base));
+        aup->mac = (struct mac_reg *)
+                        ioremap_nocache(base->start, resource_size(base));
         if (!aup->mac) {
                 dev_err(&pdev->dev, "failed to ioremap MAC registers\n");
                 err = -ENXIO;
                 goto err_remap1;
         }
 
-        /* Setup some variables for quick register address access */
-        aup->enable = (volatile u32 *)ioremap_nocache(macen->start, resource_size(macen));
+        /* Setup some variables for quick register address access */
+        aup->enable = (u32 *)ioremap_nocache(macen->start,
+                                                resource_size(macen));
         if (!aup->enable) {
                 dev_err(&pdev->dev, "failed to ioremap MAC enable register\n");
                 err = -ENXIO;
@@ -1078,12 +1119,13 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         /* set a random MAC now in case platform_data doesn't provide one */
         random_ether_addr(dev->dev_addr);
 
-        *aup->enable = 0;
+        writel(0, &aup->enable);
         aup->mac_enabled = 0;
 
         pd = pdev->dev.platform_data;
         if (!pd) {
-                dev_info(&pdev->dev, "no platform_data passed, PHY search on MAC0\n");
+                dev_info(&pdev->dev, "no platform_data passed,"
+                                        " PHY search on MAC0\n");
                 aup->phy1_search_mac0 = 1;
         } else {
                 if (is_valid_ether_addr(pd->mac))
@@ -1098,8 +1140,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         }
 
         if (aup->phy_busid && aup->phy_busid > 0) {
-                dev_err(&pdev->dev, "MAC0-associated PHY attached 2nd MACs MII"
-                                "bus not supported yet\n");
+                dev_err(&pdev->dev, "MAC0-associated PHY attached 2nd MACs MII bus not supported yet\n");
                 err = -ENODEV;
                 goto err_mdiobus_alloc;
         }
@@ -1151,17 +1192,17 @@ static int __devinit au1000_probe(struct platform_device *pdev)
 
         for (i = 0; i < NUM_RX_DMA; i++) {
                 pDB = au1000_GetFreeDB(aup);
-                if (!pDB) {
+                if (!pDB)
                         goto err_out;
-                }
+
                 aup->rx_dma_ring[i]->buff_stat = (unsigned)pDB->dma_addr;
                 aup->rx_db_inuse[i] = pDB;
         }
         for (i = 0; i < NUM_TX_DMA; i++) {
                 pDB = au1000_GetFreeDB(aup);
-                if (!pDB) {
+                if (!pDB)
                         goto err_out;
-                }
+
                 aup->tx_dma_ring[i]->buff_stat = (unsigned)pDB->dma_addr;
                 aup->tx_dma_ring[i]->len = 0;
                 aup->tx_db_inuse[i] = pDB;
@@ -1188,7 +1229,8 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         netdev_info(dev, "Au1xx0 Ethernet found at 0x%lx, irq %d\n",
                         (unsigned long)base->start, irq);
         if (version_printed++ == 0)
-                printk("%s version %s %s\n", DRV_NAME, DRV_VERSION, DRV_AUTHOR);
+                pr_info("%s version %s %s\n",
+                                        DRV_NAME, DRV_VERSION, DRV_AUTHOR);
 
         return 0;
 
@@ -1197,7 +1239,8 @@ err_out:
                 mdiobus_unregister(aup->mii_bus);
 
         /* here we should have a valid dev plus aup-> register addresses
-         * so we can reset the mac properly.*/
+         * so we can reset the mac properly.
+         */
         au1000_reset_mac(dev);
 
         for (i = 0; i < NUM_RX_DMA; i++) {
diff --git a/drivers/net/au1000_eth.h b/drivers/net/au1000_eth.h
index d06ec008fbf1..6229c774552c 100644
--- a/drivers/net/au1000_eth.h
+++ b/drivers/net/au1000_eth.h
@@ -44,34 +44,34 @@
  * Data Buffer Descriptor. Data buffers must be aligned on 32 byte
  * boundary for both, receive and transmit.
  */
-typedef struct db_dest {
+struct db_dest {
         struct db_dest *pnext;
-        volatile u32 *vaddr;
+        u32 *vaddr;
         dma_addr_t dma_addr;
-} db_dest_t;
+};
 
 /*
  * The transmit and receive descriptors are memory
  * mapped registers.
  */
-typedef struct tx_dma {
+struct tx_dma {
         u32 status;
         u32 buff_stat;
         u32 len;
         u32 pad;
-} tx_dma_t;
+};
 
-typedef struct rx_dma {
+struct rx_dma {
         u32 status;
         u32 buff_stat;
         u32 pad[2];
-} rx_dma_t;
+};
 
 
 /*
  * MAC control registers, memory mapped.
  */
-typedef struct mac_reg {
+struct mac_reg {
         u32 control;
         u32 mac_addr_high;
         u32 mac_addr_low;
@@ -82,16 +82,16 @@ typedef struct mac_reg {
         u32 flow_control;
         u32 vlan1_tag;
         u32 vlan2_tag;
-} mac_reg_t;
+};
 
 
 struct au1000_private {
-        db_dest_t *pDBfree;
-        db_dest_t db[NUM_RX_BUFFS+NUM_TX_BUFFS];
-        volatile rx_dma_t *rx_dma_ring[NUM_RX_DMA];
-        volatile tx_dma_t *tx_dma_ring[NUM_TX_DMA];
-        db_dest_t *rx_db_inuse[NUM_RX_DMA];
-        db_dest_t *tx_db_inuse[NUM_TX_DMA];
+        struct db_dest *pDBfree;
+        struct db_dest db[NUM_RX_BUFFS+NUM_TX_BUFFS];
+        struct rx_dma *rx_dma_ring[NUM_RX_DMA];
+        struct tx_dma *tx_dma_ring[NUM_TX_DMA];
+        struct db_dest *rx_db_inuse[NUM_RX_DMA];
+        struct db_dest *tx_db_inuse[NUM_TX_DMA];
         u32 rx_head;
         u32 tx_head;
         u32 tx_tail;
@@ -99,7 +99,9 @@ struct au1000_private {
 
         int mac_id;
 
-        int mac_enabled;       /* whether MAC is currently enabled and running (req. for mdio) */
+        int mac_enabled;       /* whether MAC is currently enabled and running
+                                * (req. for mdio)
+                                */
 
         int old_link;          /* used by au1000_adjust_link */
         int old_speed;
@@ -117,9 +119,11 @@ struct au1000_private {
         int phy_busid;
         int phy_irq;
 
-        /* These variables are just for quick access to certain regs addresses. */
-        volatile mac_reg_t *mac;  /* mac registers                      */
-        volatile u32 *enable;     /* address of MAC Enable Register     */
+        /* These variables are just for quick access
+         * to certain regs addresses.
+         */
+        struct mac_reg *mac;  /* mac registers                      */
+        u32 *enable;     /* address of MAC Enable Register     */
 
         u32 vaddr;                /* virtual address of rx/tx buffers   */
         dma_addr_t dma_addr;      /* dma address of rx/tx buffers       */
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1e620e287ae0..8e7c8a8e61c7 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -818,7 +818,7 @@ static int b44_rx(struct b44 *bp, int budget)
                                                          copy_skb->data, len);
                         skb = copy_skb;
                 }
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 skb->protocol = eth_type_trans(skb, bp->dev);
                 netif_receive_skb(skb);
                 received++;
diff --git a/drivers/net/bcm63xx_enet.c b/drivers/net/bcm63xx_enet.c
index 0d2c5da08937..ecfef240a303 100644
--- a/drivers/net/bcm63xx_enet.c
+++ b/drivers/net/bcm63xx_enet.c
@@ -293,22 +293,22 @@ static int bcm_enet_receive_queue(struct net_device *dev, int budget)
                 /* if the packet does not have start of packet _and_
                  * end of packet flag set, then just recycle it */
                 if ((len_stat & DMADESC_ESOP_MASK) != DMADESC_ESOP_MASK) {
-                        priv->stats.rx_dropped++;
+                        dev->stats.rx_dropped++;
                         continue;
                 }
 
                 /* recycle packet if it's marked as bad */
                 if (unlikely(len_stat & DMADESC_ERR_MASK)) {
-                        priv->stats.rx_errors++;
+                        dev->stats.rx_errors++;
 
                         if (len_stat & DMADESC_OVSIZE_MASK)
-                                priv->stats.rx_length_errors++;
+                                dev->stats.rx_length_errors++;
                         if (len_stat & DMADESC_CRC_MASK)
-                                priv->stats.rx_crc_errors++;
+                                dev->stats.rx_crc_errors++;
                         if (len_stat & DMADESC_UNDER_MASK)
-                                priv->stats.rx_frame_errors++;
+                                dev->stats.rx_frame_errors++;
                         if (len_stat & DMADESC_OV_MASK)
-                                priv->stats.rx_fifo_errors++;
+                                dev->stats.rx_fifo_errors++;
                         continue;
                 }
 
@@ -324,7 +324,7 @@ static int bcm_enet_receive_queue(struct net_device *dev, int budget)
                         nskb = netdev_alloc_skb_ip_align(dev, len);
                         if (!nskb) {
                                 /* forget packet, just rearm desc */
-                                priv->stats.rx_dropped++;
+                                dev->stats.rx_dropped++;
                                 continue;
                         }
 
@@ -342,8 +342,8 @@ static int bcm_enet_receive_queue(struct net_device *dev, int budget)
 
                 skb_put(skb, len);
                 skb->protocol = eth_type_trans(skb, dev);
-                priv->stats.rx_packets++;
-                priv->stats.rx_bytes += len;
+                dev->stats.rx_packets++;
+                dev->stats.rx_bytes += len;
                 netif_receive_skb(skb);
 
         } while (--budget > 0);
@@ -403,7 +403,7 @@ static int bcm_enet_tx_reclaim(struct net_device *dev, int force)
                 spin_unlock(&priv->tx_lock);
 
                 if (desc->len_stat & DMADESC_UNDER_MASK)
-                        priv->stats.tx_errors++;
+                        dev->stats.tx_errors++;
 
                 dev_kfree_skb(skb);
                 released++;
@@ -563,8 +563,8 @@ static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!priv->tx_desc_count)
                 netif_stop_queue(dev);
 
-        priv->stats.tx_bytes += skb->len;
-        priv->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
         ret = NETDEV_TX_OK;
 
 out_unlock:
@@ -798,7 +798,7 @@ static int bcm_enet_open(struct net_device *dev)
                 snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT,
                          priv->mac_id ? "1" : "0", priv->phy_id);
 
-                phydev = phy_connect(dev, phy_id, &bcm_enet_adjust_phy_link, 0,
+                phydev = phy_connect(dev, phy_id, bcm_enet_adjust_phy_link, 0,
                                      PHY_INTERFACE_MODE_MII);
 
                 if (IS_ERR(phydev)) {
@@ -1141,17 +1141,6 @@ static int bcm_enet_stop(struct net_device *dev)
 }
 
 /*
- * core request to return device rx/tx stats
- */
-static struct net_device_stats *bcm_enet_get_stats(struct net_device *dev)
-{
-        struct bcm_enet_priv *priv;
-
-        priv = netdev_priv(dev);
-        return &priv->stats;
-}
-
-/*
  * ethtool callbacks
  */
 struct bcm_enet_stats {
@@ -1163,16 +1152,18 @@ struct bcm_enet_stats {
 
 #define GEN_STAT(m) sizeof(((struct bcm_enet_priv *)0)->m),             \
                      offsetof(struct bcm_enet_priv, m)
+#define DEV_STAT(m) sizeof(((struct net_device_stats *)0)->m),          \
+                     offsetof(struct net_device_stats, m)
 
 static const struct bcm_enet_stats bcm_enet_gstrings_stats[] = {
-        { "rx_packets", GEN_STAT(stats.rx_packets), -1 },
-        { "tx_packets", GEN_STAT(stats.tx_packets), -1 },
-        { "rx_bytes", GEN_STAT(stats.rx_bytes), -1 },
-        { "tx_bytes", GEN_STAT(stats.tx_bytes), -1 },
-        { "rx_errors", GEN_STAT(stats.rx_errors), -1 },
-        { "tx_errors", GEN_STAT(stats.tx_errors), -1 },
-        { "rx_dropped", GEN_STAT(stats.rx_dropped), -1 },
-        { "tx_dropped", GEN_STAT(stats.tx_dropped), -1 },
+        { "rx_packets", DEV_STAT(rx_packets), -1 },
+        { "tx_packets", DEV_STAT(tx_packets), -1 },
+        { "rx_bytes", DEV_STAT(rx_bytes), -1 },
+        { "tx_bytes", DEV_STAT(tx_bytes), -1 },
+        { "rx_errors", DEV_STAT(rx_errors), -1 },
+        { "tx_errors", DEV_STAT(tx_errors), -1 },
+        { "rx_dropped", DEV_STAT(rx_dropped), -1 },
+        { "tx_dropped", DEV_STAT(tx_dropped), -1 },
 
         { "rx_good_octets", GEN_STAT(mib.rx_gd_octets), ETH_MIB_RX_GD_OCTETS},
         { "rx_good_pkts", GEN_STAT(mib.rx_gd_pkts), ETH_MIB_RX_GD_PKTS },
@@ -1328,7 +1319,11 @@ static void bcm_enet_get_ethtool_stats(struct net_device *netdev,
                 char *p;
 
                 s = &bcm_enet_gstrings_stats[i];
-                p = (char *)priv + s->stat_offset;
+                if (s->mib_reg == -1)
+                        p = (char *)&netdev->stats;
+                else
+                        p = (char *)priv;
+                p += s->stat_offset;
                 data[i] = (s->sizeof_stat == sizeof(u64)) ?
                         *(u64 *)p : *(u32 *)p;
         }
@@ -1605,7 +1600,6 @@ static const struct net_device_ops bcm_enet_ops = {
         .ndo_open               = bcm_enet_open,
         .ndo_stop               = bcm_enet_stop,
         .ndo_start_xmit         = bcm_enet_start_xmit,
-        .ndo_get_stats          = bcm_enet_get_stats,
         .ndo_set_mac_address    = bcm_enet_set_mac_address,
         .ndo_set_multicast_list = bcm_enet_set_multicast_list,
         .ndo_do_ioctl           = bcm_enet_ioctl,
diff --git a/drivers/net/bcm63xx_enet.h b/drivers/net/bcm63xx_enet.h
index bd3684d42d74..0e3048b788c2 100644
--- a/drivers/net/bcm63xx_enet.h
+++ b/drivers/net/bcm63xx_enet.h
@@ -274,7 +274,6 @@ struct bcm_enet_priv {
         int pause_tx;
 
         /* stats */
-        struct net_device_stats stats;
         struct bcm_enet_mib_counters mib;
 
         /* after mib interrupt, mib registers update is done in this
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 53306bf3f401..4faf6961dcec 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -414,6 +414,20 @@ static inline void be_check_sriov_fn_type(struct be_adapter *adapter)
         adapter->is_virtfn = (data != 0xAA);
 }
 
+static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
+{
+        u32 addr;
+
+        addr = jhash(adapter->netdev->dev_addr, ETH_ALEN, 0);
+
+        mac[5] = (u8)(addr & 0xFF);
+        mac[4] = (u8)((addr >> 8) & 0xFF);
+        mac[3] = (u8)((addr >> 16) & 0xFF);
+        mac[2] = 0xC9;
+        mac[1] = 0x00;
+        mac[0] = 0x00;
+}
+
 extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
                 u16 num_popped);
 extern void be_link_status_update(struct be_adapter *adapter, bool link_up);
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 34abcc9403d6..0db28b411e87 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -98,9 +98,9 @@ static void be_async_link_state_process(struct be_adapter *adapter,
 
 static inline bool is_link_state_evt(u32 trailer)
 {
-        return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
+        return ((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
                 ASYNC_TRAILER_EVENT_CODE_MASK) ==
-                                ASYNC_EVENT_CODE_LINK_STATE);
+                                ASYNC_EVENT_CODE_LINK_STATE;
 }
 
 static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 13f0abbc5205..d92063420c25 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -91,6 +91,9 @@ static const struct be_ethtool_stat et_stats[] = {
         {PORTSTAT_INFO(rx_non_rss_packets)},
         {PORTSTAT_INFO(rx_ipv4_packets)},
         {PORTSTAT_INFO(rx_ipv6_packets)},
+        {PORTSTAT_INFO(rx_switched_unicast_packets)},
+        {PORTSTAT_INFO(rx_switched_multicast_packets)},
+        {PORTSTAT_INFO(rx_switched_broadcast_packets)},
         {PORTSTAT_INFO(tx_unicastframes)},
         {PORTSTAT_INFO(tx_multicastframes)},
         {PORTSTAT_INFO(tx_broadcastframes)},
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 6eda7a022256..43a3a574e2e0 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -365,11 +365,6 @@ static void be_rx_eqd_update(struct be_adapter *adapter)
         rx_eq->cur_eqd = eqd;
 }
 
-static struct net_device_stats *be_get_stats(struct net_device *dev)
-{
-        return &dev->stats;
-}
-
 static u32 be_calc_rate(u64 bytes, unsigned long ticks)
 {
         u64 rate = bytes;
@@ -1026,7 +1021,7 @@ static void be_rx_compl_process(struct be_adapter *adapter,
         skb_fill_rx_data(adapter, skb, rxcp, num_rcvd);
 
         if (do_pkt_csum(rxcp, adapter->rx_csum))
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
         else
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
@@ -2084,6 +2079,47 @@ static int be_setup_wol(struct be_adapter *adapter, bool enable)
         return status;
 }
 
+/*
+ * Generate a seed MAC address from the PF MAC Address using jhash.
+ * MAC Address for VFs are assigned incrementally starting from the seed.
+ * These addresses are programmed in the ASIC by the PF and the VF driver
+ * queries for the MAC address during its probe.
+ */
+static inline int be_vf_eth_addr_config(struct be_adapter *adapter)
+{
+        u32 vf = 0;
+        int status;
+        u8 mac[ETH_ALEN];
+
+        be_vf_eth_addr_generate(adapter, mac);
+
+        for (vf = 0; vf < num_vfs; vf++) {
+                status = be_cmd_pmac_add(adapter, mac,
+                                        adapter->vf_cfg[vf].vf_if_handle,
+                                        &adapter->vf_cfg[vf].vf_pmac_id);
+                if (status)
+                        dev_err(&adapter->pdev->dev,
+                                "Mac address add failed for VF %d\n", vf);
+                else
+                        memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
+
+                mac[5] += 1;
+        }
+        return status;
+}
+
+static inline void be_vf_eth_addr_rem(struct be_adapter *adapter)
+{
+        u32 vf;
+
+        for (vf = 0; vf < num_vfs; vf++) {
+                if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
+                        be_cmd_pmac_del(adapter,
+                                        adapter->vf_cfg[vf].vf_if_handle,
+                                        adapter->vf_cfg[vf].vf_pmac_id);
+        }
+}
+
 static int be_setup(struct be_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
@@ -2143,10 +2179,20 @@ static int be_setup(struct be_adapter *adapter)
         if (status != 0)
                 goto rx_qs_destroy;
 
+        if (be_physfn(adapter)) {
+                status = be_vf_eth_addr_config(adapter);
+                if (status)
+                        goto mcc_q_destroy;
+        }
+
         adapter->link_speed = -1;
 
         return 0;
 
+mcc_q_destroy:
+        if (be_physfn(adapter))
+                be_vf_eth_addr_rem(adapter);
+        be_mcc_queues_destroy(adapter);
 rx_qs_destroy:
         be_rx_queues_destroy(adapter);
 tx_qs_destroy:
@@ -2163,6 +2209,9 @@ do_none:
 
 static int be_clear(struct be_adapter *adapter)
 {
+        if (be_physfn(adapter))
+                be_vf_eth_addr_rem(adapter);
+
         be_mcc_queues_destroy(adapter);
         be_rx_queues_destroy(adapter);
         be_tx_queues_destroy(adapter);
@@ -2390,7 +2439,6 @@ static struct net_device_ops be_netdev_ops = {
         .ndo_open               = be_open,
         .ndo_stop               = be_close,
         .ndo_start_xmit         = be_xmit,
-        .ndo_get_stats          = be_get_stats,
         .ndo_set_rx_mode        = be_set_multicast_list,
         .ndo_set_mac_address    = be_mac_addr_set,
         .ndo_change_mtu         = be_change_mtu,
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 012613fde3f4..7a0e4156fade 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -803,15 +803,14 @@ static void bfin_dump_hwtamp(char *s, ktime_t *hw, ktime_t *ts, struct timecompa
 static void bfin_tx_hwtstamp(struct net_device *netdev, struct sk_buff *skb)
 {
         struct bfin_mac_local *lp = netdev_priv(netdev);
-        union skb_shared_tx *shtx = skb_tx(skb);
 
-        if (shtx->hardware) {
+        if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
                 int timeout_cnt = MAX_TIMEOUT_CNT;
 
                 /* When doing time stamping, keep the connection to the socket
                  * a while longer
                  */
-                shtx->in_progress = 1;
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
 
                 /*
                  * The timestamping is done at the EMAC module's MII/RMII interface
@@ -991,7 +990,6 @@ static int bfin_mac_hard_start_xmit(struct sk_buff *skb,
         struct bfin_mac_local *lp = netdev_priv(dev);
         u16 *data;
         u32 data_align = (unsigned long)(skb->data) & 0x3;
-        union skb_shared_tx *shtx = skb_tx(skb);
 
         current_tx_ptr->skb = skb;
 
@@ -1005,7 +1003,7 @@ static int bfin_mac_hard_start_xmit(struct sk_buff *skb,
                  * of this field are the length of the packet payload in bytes and the higher
                  * 4 bits are the timestamping enable field.
                  */
-                if (shtx->hardware)
+                if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)
                         *data |= 0x1000;
 
                 current_tx_ptr->desc_a.start_addr = (u32)data;
@@ -1015,7 +1013,7 @@ static int bfin_mac_hard_start_xmit(struct sk_buff *skb,
         } else {
                 *((u16 *)(current_tx_ptr->packet)) = (u16)(skb->len);
                 /* enable timestamping for the sent packet */
-                if (shtx->hardware)
+                if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)
                         *((u16 *)(current_tx_ptr->packet)) |= 0x1000;
                 memcpy((u8 *)(current_tx_ptr->packet + 2), skb->data,
                         skb->len);
diff --git a/drivers/net/bmac.c b/drivers/net/bmac.c
index 959add2410bf..a1b8c8b8010b 100644
--- a/drivers/net/bmac.c
+++ b/drivers/net/bmac.c
@@ -1233,15 +1233,8 @@ static void bmac_reset_and_enable(struct net_device *dev)
         }
         spin_unlock_irqrestore(&bp->lock, flags);
 }
-static void bmac_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
-{
-        struct bmac_data *bp = netdev_priv(dev);
-        strcpy(info->driver, "bmac");
-        strcpy(info->bus_info, dev_name(&bp->mdev->ofdev.dev));
-}
 
 static const struct ethtool_ops bmac_ethtool_ops = {
-        .get_drvinfo            = bmac_get_drvinfo,
         .get_link               = ethtool_op_get_link,
 };
 
@@ -1588,7 +1581,7 @@ bmac_proc_info(char *buffer, char **start, off_t offset, int length)
         int i;
 
         if (bmac_devs == NULL)
-                return (-ENOSYS);
+                return -ENOSYS;
 
         len += sprintf(buffer, "BMAC counters & registers\n");
 
diff --git a/drivers/net/bna/Makefile b/drivers/net/bna/Makefile
new file mode 100644
index 000000000000..a5d604de7fea
--- /dev/null
+++ b/drivers/net/bna/Makefile
@@ -0,0 +1,11 @@
+#
+# Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+# All rights reserved.
+#
+
+obj-$(CONFIG_BNA) += bna.o
+
+bna-objs := bnad.o bnad_ethtool.o bna_ctrl.o bna_txrx.o
+bna-objs += bfa_ioc.o bfa_ioc_ct.o bfa_cee.o cna_fwimg.o
+
+EXTRA_CFLAGS := -Idrivers/net/bna
diff --git a/drivers/net/bna/bfa_cee.c b/drivers/net/bna/bfa_cee.c
new file mode 100644
index 000000000000..f7b789a3b217
--- /dev/null
+++ b/drivers/net/bna/bfa_cee.c
@@ -0,0 +1,291 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#include "bfa_defs_cna.h"
+#include "cna.h"
+#include "bfa_cee.h"
+#include "bfi_cna.h"
+#include "bfa_ioc.h"
+
+#define bfa_ioc_portid(__ioc) ((__ioc)->port_id)
+#define bfa_lpuid(__arg) bfa_ioc_portid(&(__arg)->ioc)
+
+static void bfa_cee_format_lldp_cfg(struct bfa_cee_lldp_cfg *lldp_cfg);
+static void bfa_cee_format_cee_cfg(void *buffer);
+
+static void
+bfa_cee_format_cee_cfg(void *buffer)
+{
+        struct bfa_cee_attr *cee_cfg = buffer;
+        bfa_cee_format_lldp_cfg(&cee_cfg->lldp_remote);
+}
+
+static void
+bfa_cee_stats_swap(struct bfa_cee_stats *stats)
+{
+        u32 *buffer = (u32 *)stats;
+        int i;
+
+        for (i = 0; i < (sizeof(struct bfa_cee_stats) / sizeof(u32));
+                i++) {
+                buffer[i] = ntohl(buffer[i]);
+        }
+}
+
+static void
+bfa_cee_format_lldp_cfg(struct bfa_cee_lldp_cfg *lldp_cfg)
+{
+        lldp_cfg->time_to_live =
+                        ntohs(lldp_cfg->time_to_live);
+        lldp_cfg->enabled_system_cap =
+                        ntohs(lldp_cfg->enabled_system_cap);
+}
+
+/**
+ * bfa_cee_attr_meminfo()
+ *
+ * @brief Returns the size of the DMA memory needed by CEE attributes
+ *
+ * @param[in] void
+ *
+ * @return Size of DMA region
+ */
+static u32
+bfa_cee_attr_meminfo(void)
+{
+        return roundup(sizeof(struct bfa_cee_attr), BFA_DMA_ALIGN_SZ);
+}
+/**
+ * bfa_cee_stats_meminfo()
+ *
+ * @brief Returns the size of the DMA memory needed by CEE stats
+ *
+ * @param[in] void
+ *
+ * @return Size of DMA region
+ */
+static u32
+bfa_cee_stats_meminfo(void)
+{
+        return roundup(sizeof(struct bfa_cee_stats), BFA_DMA_ALIGN_SZ);
+}
+
+/**
+ * bfa_cee_get_attr_isr()
+ *
+ * @brief CEE ISR for get-attributes responses from f/w
+ *
+ * @param[in] cee - Pointer to the CEE module
+ *            status - Return status from the f/w
+ *
+ * @return void
+ */
+static void
+bfa_cee_get_attr_isr(struct bfa_cee *cee, enum bfa_status status)
+{
+        cee->get_attr_status = status;
+        if (status == BFA_STATUS_OK) {
+                memcpy(cee->attr, cee->attr_dma.kva,
+                    sizeof(struct bfa_cee_attr));
+                bfa_cee_format_cee_cfg(cee->attr);
+        }
+        cee->get_attr_pending = false;
+        if (cee->cbfn.get_attr_cbfn)
+                cee->cbfn.get_attr_cbfn(cee->cbfn.get_attr_cbarg, status);
+}
+
+/**
+ * bfa_cee_get_attr_isr()
+ *
+ * @brief CEE ISR for get-stats responses from f/w
+ *
+ * @param[in] cee - Pointer to the CEE module
+ *            status - Return status from the f/w
+ *
+ * @return void
+ */
+static void
+bfa_cee_get_stats_isr(struct bfa_cee *cee, enum bfa_status status)
+{
+        cee->get_stats_status = status;
+        if (status == BFA_STATUS_OK) {
+                memcpy(cee->stats, cee->stats_dma.kva,
+                        sizeof(struct bfa_cee_stats));
+                bfa_cee_stats_swap(cee->stats);
+        }
+        cee->get_stats_pending = false;
+        if (cee->cbfn.get_stats_cbfn)
+                cee->cbfn.get_stats_cbfn(cee->cbfn.get_stats_cbarg, status);
+}
+
+/**
+ * bfa_cee_get_attr_isr()
+ *
+ * @brief CEE ISR for reset-stats responses from f/w
+ *
+ * @param[in] cee - Pointer to the CEE module
+ *            status - Return status from the f/w
+ *
+ * @return void
+ */
+static void
+bfa_cee_reset_stats_isr(struct bfa_cee *cee, enum bfa_status status)
+{
+        cee->reset_stats_status = status;
+        cee->reset_stats_pending = false;
+        if (cee->cbfn.reset_stats_cbfn)
+                cee->cbfn.reset_stats_cbfn(cee->cbfn.reset_stats_cbarg, status);
+}
+/**
+ * bfa_nw_cee_meminfo()
+ *
+ * @brief Returns the size of the DMA memory needed by CEE module
+ *
+ * @param[in] void
+ *
+ * @return Size of DMA region
+ */
+u32
+bfa_nw_cee_meminfo(void)
+{
+        return bfa_cee_attr_meminfo() + bfa_cee_stats_meminfo();
+}
+
+/**
+ * bfa_nw_cee_mem_claim()
+ *
+ * @brief Initialized CEE DMA Memory
+ *
+ * @param[in] cee CEE module pointer
+ *            dma_kva Kernel Virtual Address of CEE DMA Memory
+ *            dma_pa  Physical Address of CEE DMA Memory
+ *
+ * @return void
+ */
+void
+bfa_nw_cee_mem_claim(struct bfa_cee *cee, u8 *dma_kva, u64 dma_pa)
+{
+        cee->attr_dma.kva = dma_kva;
+        cee->attr_dma.pa = dma_pa;
+        cee->stats_dma.kva = dma_kva + bfa_cee_attr_meminfo();
+        cee->stats_dma.pa = dma_pa + bfa_cee_attr_meminfo();
+        cee->attr = (struct bfa_cee_attr *) dma_kva;
+        cee->stats = (struct bfa_cee_stats *)
+                (dma_kva + bfa_cee_attr_meminfo());
+}
+
+/**
+ * bfa_cee_isrs()
+ *
+ * @brief Handles Mail-box interrupts for CEE module.
+ *
+ * @param[in] Pointer to the CEE module data structure.
+ *
+ * @return void
+ */
+
+static void
+bfa_cee_isr(void *cbarg, struct bfi_mbmsg *m)
+{
+        union bfi_cee_i2h_msg_u *msg;
+        struct bfi_cee_get_rsp *get_rsp;
+        struct bfa_cee *cee = (struct bfa_cee *) cbarg;
+        msg = (union bfi_cee_i2h_msg_u *) m;
+        get_rsp = (struct bfi_cee_get_rsp *) m;
+        switch (msg->mh.msg_id) {
+        case BFI_CEE_I2H_GET_CFG_RSP:
+                bfa_cee_get_attr_isr(cee, get_rsp->cmd_status);
+                break;
+        case BFI_CEE_I2H_GET_STATS_RSP:
+                bfa_cee_get_stats_isr(cee, get_rsp->cmd_status);
+                break;
+        case BFI_CEE_I2H_RESET_STATS_RSP:
+                bfa_cee_reset_stats_isr(cee, get_rsp->cmd_status);
+                break;
+        default:
+                BUG_ON(1);
+        }
+}
+
+/**
+ * bfa_cee_hbfail()
+ *
+ * @brief CEE module heart-beat failure handler.
+ *
+ * @param[in] Pointer to the CEE module data structure.
+ *
+ * @return void
+ */
+
+static void
+bfa_cee_hbfail(void *arg)
+{
+        struct bfa_cee *cee;
+        cee = (struct bfa_cee *) arg;
+
+        if (cee->get_attr_pending == true) {
+                cee->get_attr_status = BFA_STATUS_FAILED;
+                cee->get_attr_pending  = false;
+                if (cee->cbfn.get_attr_cbfn) {
+                        cee->cbfn.get_attr_cbfn(cee->cbfn.get_attr_cbarg,
+                            BFA_STATUS_FAILED);
+                }
+        }
+        if (cee->get_stats_pending == true) {
+                cee->get_stats_status = BFA_STATUS_FAILED;
+                cee->get_stats_pending  = false;
+                if (cee->cbfn.get_stats_cbfn) {
+                        cee->cbfn.get_stats_cbfn(cee->cbfn.get_stats_cbarg,
+                            BFA_STATUS_FAILED);
+                }
+        }
+        if (cee->reset_stats_pending == true) {
+                cee->reset_stats_status = BFA_STATUS_FAILED;
+                cee->reset_stats_pending  = false;
+                if (cee->cbfn.reset_stats_cbfn) {
+                        cee->cbfn.reset_stats_cbfn(cee->cbfn.reset_stats_cbarg,
+                            BFA_STATUS_FAILED);
+                }
+        }
+}
+
+/**
+ * bfa_nw_cee_attach()
+ *
+ * @brief CEE module-attach API
+ *
+ * @param[in] cee - Pointer to the CEE module data structure
+ *            ioc - Pointer to the ioc module data structure
+ *            dev - Pointer to the device driver module data structure
+ *                  The device driver specific mbox ISR functions have
+ *                  this pointer as one of the parameters.
+ *
+ * @return void
+ */
+void
+bfa_nw_cee_attach(struct bfa_cee *cee, struct bfa_ioc *ioc,
+                void *dev)
+{
+        BUG_ON(!(cee != NULL));
+        cee->dev = dev;
+        cee->ioc = ioc;
+
+        bfa_nw_ioc_mbox_regisr(cee->ioc, BFI_MC_CEE, bfa_cee_isr, cee);
+        bfa_ioc_hbfail_init(&cee->hbfail, bfa_cee_hbfail, cee);
+        bfa_nw_ioc_hbfail_register(cee->ioc, &cee->hbfail);
+}
diff --git a/drivers/net/bna/bfa_cee.h b/drivers/net/bna/bfa_cee.h
new file mode 100644
index 000000000000..20543d15b64f
--- /dev/null
+++ b/drivers/net/bna/bfa_cee.h
@@ -0,0 +1,64 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __BFA_CEE_H__
+#define __BFA_CEE_H__
+
+#include "bfa_defs_cna.h"
+#include "bfa_ioc.h"
+
+typedef void (*bfa_cee_get_attr_cbfn_t) (void *dev, enum bfa_status status);
+typedef void (*bfa_cee_get_stats_cbfn_t) (void *dev, enum bfa_status status);
+typedef void (*bfa_cee_reset_stats_cbfn_t) (void *dev, enum bfa_status status);
+typedef void (*bfa_cee_hbfail_cbfn_t) (void *dev, enum bfa_status status);
+
+struct bfa_cee_cbfn {
+        bfa_cee_get_attr_cbfn_t    get_attr_cbfn;
+        void *get_attr_cbarg;
+        bfa_cee_get_stats_cbfn_t   get_stats_cbfn;
+        void *get_stats_cbarg;
+        bfa_cee_reset_stats_cbfn_t reset_stats_cbfn;
+        void *reset_stats_cbarg;
+};
+
+struct bfa_cee {
+        void *dev;
+        bool get_attr_pending;
+        bool get_stats_pending;
+        bool reset_stats_pending;
+        enum bfa_status get_attr_status;
+        enum bfa_status get_stats_status;
+        enum bfa_status reset_stats_status;
+        struct bfa_cee_cbfn cbfn;
+        struct bfa_ioc_hbfail_notify hbfail;
+        struct bfa_cee_attr *attr;
+        struct bfa_cee_stats *stats;
+        struct bfa_dma attr_dma;
+        struct bfa_dma stats_dma;
+        struct bfa_ioc *ioc;
+        struct bfa_mbox_cmd get_cfg_mb;
+        struct bfa_mbox_cmd get_stats_mb;
+        struct bfa_mbox_cmd reset_stats_mb;
+};
+
+u32 bfa_nw_cee_meminfo(void);
+void bfa_nw_cee_mem_claim(struct bfa_cee *cee, u8 *dma_kva,
+        u64 dma_pa);
+void bfa_nw_cee_attach(struct bfa_cee *cee, struct bfa_ioc *ioc, void *dev);
+
+#endif /* __BFA_CEE_H__ */
diff --git a/drivers/net/bna/bfa_defs.h b/drivers/net/bna/bfa_defs.h
new file mode 100644
index 000000000000..29c1b8de2c2d
--- /dev/null
+++ b/drivers/net/bna/bfa_defs.h
@@ -0,0 +1,243 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __BFA_DEFS_H__
+#define __BFA_DEFS_H__
+
+#include "cna.h"
+#include "bfa_defs_status.h"
+#include "bfa_defs_mfg_comm.h"
+
+#define BFA_STRING_32   32
+#define BFA_VERSION_LEN 64
+
+/**
+ * ---------------------- adapter definitions ------------
+ */
+
+/**
+ * BFA adapter level attributes.
+ */
+enum {
+        BFA_ADAPTER_SERIAL_NUM_LEN = STRSZ(BFA_MFG_SERIALNUM_SIZE),
+                                        /*
+                                         *!< adapter serial num length
+                                         */
+        BFA_ADAPTER_MODEL_NAME_LEN  = 16,  /*!< model name length */
+        BFA_ADAPTER_MODEL_DESCR_LEN = 128, /*!< model description length */
+        BFA_ADAPTER_MFG_NAME_LEN    = 8,   /*!< manufacturer name length */
+        BFA_ADAPTER_SYM_NAME_LEN    = 64,  /*!< adapter symbolic name length */
+        BFA_ADAPTER_OS_TYPE_LEN     = 64,  /*!< adapter os type length */
+};
+
+struct bfa_adapter_attr {
+        char            manufacturer[BFA_ADAPTER_MFG_NAME_LEN];
+        char            serial_num[BFA_ADAPTER_SERIAL_NUM_LEN];
+        u32     card_type;
+        char            model[BFA_ADAPTER_MODEL_NAME_LEN];
+        char            model_descr[BFA_ADAPTER_MODEL_DESCR_LEN];
+        u64             pwwn;
+        char            node_symname[FC_SYMNAME_MAX];
+        char            hw_ver[BFA_VERSION_LEN];
+        char            fw_ver[BFA_VERSION_LEN];
+        char            optrom_ver[BFA_VERSION_LEN];
+        char            os_type[BFA_ADAPTER_OS_TYPE_LEN];
+        struct bfa_mfg_vpd vpd;
+        struct mac mac;
+
+        u8              nports;
+        u8              max_speed;
+        u8              prototype;
+        char            asic_rev;
+
+        u8              pcie_gen;
+        u8              pcie_lanes_orig;
+        u8              pcie_lanes;
+        u8              cna_capable;
+
+        u8              is_mezz;
+        u8              trunk_capable;
+};
+
+/**
+ * ---------------------- IOC definitions ------------
+ */
+
+enum {
+        BFA_IOC_DRIVER_LEN      = 16,
+        BFA_IOC_CHIP_REV_LEN    = 8,
+};
+
+/**
+ * Driver and firmware versions.
+ */
+struct bfa_ioc_driver_attr {
+        char            driver[BFA_IOC_DRIVER_LEN];     /*!< driver name */
+        char            driver_ver[BFA_VERSION_LEN];    /*!< driver version */
+        char            fw_ver[BFA_VERSION_LEN];        /*!< firmware version */
+        char            bios_ver[BFA_VERSION_LEN];      /*!< bios version */
+        char            efi_ver[BFA_VERSION_LEN];       /*!< EFI version */
+        char            ob_ver[BFA_VERSION_LEN];        /*!< openboot version */
+};
+
+/**
+ * IOC PCI device attributes
+ */
+struct bfa_ioc_pci_attr {
+        u16     vendor_id;      /*!< PCI vendor ID */
+        u16     device_id;      /*!< PCI device ID */
+        u16     ssid;           /*!< subsystem ID */
+        u16     ssvid;          /*!< subsystem vendor ID */
+        u32     pcifn;          /*!< PCI device function */
+        u32     rsvd;           /* padding */
+        char            chip_rev[BFA_IOC_CHIP_REV_LEN];  /*!< chip revision */
+};
+
+/**
+ * IOC states
+ */
+enum bfa_ioc_state {
+        BFA_IOC_RESET           = 1,    /*!< IOC is in reset state */
+        BFA_IOC_SEMWAIT         = 2,    /*!< Waiting for IOC h/w semaphore */
+        BFA_IOC_HWINIT          = 3,    /*!< IOC h/w is being initialized */
+        BFA_IOC_GETATTR         = 4,    /*!< IOC is being configured */
+        BFA_IOC_OPERATIONAL     = 5,    /*!< IOC is operational */
+        BFA_IOC_INITFAIL        = 6,    /*!< IOC hardware failure */
+        BFA_IOC_HBFAIL          = 7,    /*!< IOC heart-beat failure */
+        BFA_IOC_DISABLING       = 8,    /*!< IOC is being disabled */
+        BFA_IOC_DISABLED        = 9,    /*!< IOC is disabled */
+        BFA_IOC_FWMISMATCH      = 10,   /*!< IOC f/w different from drivers */
+};
+
+/**
+ * IOC firmware stats
+ */
+struct bfa_fw_ioc_stats {
+        u32     enable_reqs;
+        u32     disable_reqs;
+        u32     get_attr_reqs;
+        u32     dbg_sync;
+        u32     dbg_dump;
+        u32     unknown_reqs;
+};
+
+/**
+ * IOC driver stats
+ */
+struct bfa_ioc_drv_stats {
+        u32     ioc_isrs;
+        u32     ioc_enables;
+        u32     ioc_disables;
+        u32     ioc_hbfails;
+        u32     ioc_boots;
+        u32     stats_tmos;
+        u32     hb_count;
+        u32     disable_reqs;
+        u32     enable_reqs;
+        u32     disable_replies;
+        u32     enable_replies;
+};
+
+/**
+ * IOC statistics
+ */
+struct bfa_ioc_stats {
+        struct bfa_ioc_drv_stats drv_stats; /*!< driver IOC stats */
+        struct bfa_fw_ioc_stats fw_stats;  /*!< firmware IOC stats */
+};
+
+enum bfa_ioc_type {
+        BFA_IOC_TYPE_FC         = 1,
+        BFA_IOC_TYPE_FCoE       = 2,
+        BFA_IOC_TYPE_LL         = 3,
+};
+
+/**
+ * IOC attributes returned in queries
+ */
+struct bfa_ioc_attr {
+        enum bfa_ioc_type ioc_type;
+        enum bfa_ioc_state              state;          /*!< IOC state      */
+        struct bfa_adapter_attr adapter_attr;   /*!< HBA attributes */
+        struct bfa_ioc_driver_attr driver_attr; /*!< driver attr    */
+        struct bfa_ioc_pci_attr pci_attr;
+        u8                              port_id;        /*!< port number    */
+        u8                              rsvd[7];        /*!< 64bit align    */
+};
+
+/**
+ * ---------------------- mfg definitions ------------
+ */
+
+/**
+ * Checksum size
+ */
+#define BFA_MFG_CHKSUM_SIZE                     16
+
+#define BFA_MFG_PARTNUM_SIZE                    14
+#define BFA_MFG_SUPPLIER_ID_SIZE                10
+#define BFA_MFG_SUPPLIER_PARTNUM_SIZE           20
+#define BFA_MFG_SUPPLIER_SERIALNUM_SIZE         20
+#define BFA_MFG_SUPPLIER_REVISION_SIZE          4
+
+#pragma pack(1)
+
+/**
+ * @brief BFA adapter manufacturing block definition.
+ *
+ * All numerical fields are in big-endian format.
+ */
+struct bfa_mfg_block {
+        u8              version;        /*!< manufacturing block version */
+        u8              mfg_sig[3];     /*!< characters 'M', 'F', 'G' */
+        u16     mfgsize;        /*!< mfg block size */
+        u16     u16_chksum;     /*!< old u16 checksum */
+        char            brcd_serialnum[STRSZ(BFA_MFG_SERIALNUM_SIZE)];
+        char            brcd_partnum[STRSZ(BFA_MFG_PARTNUM_SIZE)];
+        u8              mfg_day;        /*!< manufacturing day */
+        u8              mfg_month;      /*!< manufacturing month */
+        u16     mfg_year;       /*!< manufacturing year */
+        u64             mfg_wwn;        /*!< wwn base for this adapter */
+        u8              num_wwn;        /*!< number of wwns assigned */
+        u8              mfg_speeds;     /*!< speeds allowed for this adapter */
+        u8              rsv[2];
+        char            supplier_id[STRSZ(BFA_MFG_SUPPLIER_ID_SIZE)];
+        char            supplier_partnum[STRSZ(BFA_MFG_SUPPLIER_PARTNUM_SIZE)];
+        char
+                supplier_serialnum[STRSZ(BFA_MFG_SUPPLIER_SERIALNUM_SIZE)];
+        char
+                supplier_revision[STRSZ(BFA_MFG_SUPPLIER_REVISION_SIZE)];
+        mac_t           mfg_mac;        /*!< mac address */
+        u8              num_mac;        /*!< number of mac addresses */
+        u8              rsv2;
+        u32     mfg_type;       /*!< card type */
+        u8              rsv3[108];
+        u8              md5_chksum[BFA_MFG_CHKSUM_SIZE]; /*!< md5 checksum */
+};
+
+#pragma pack()
+
+/**
+ * ---------------------- pci definitions ------------
+ */
+
+#define bfa_asic_id_ct(devid)                   \
+        ((devid) == PCI_DEVICE_ID_BROCADE_CT || \
+        (devid) == PCI_DEVICE_ID_BROCADE_CT_FC)
+
+#endif /* __BFA_DEFS_H__ */
diff --git a/drivers/net/bna/bfa_defs_cna.h b/drivers/net/bna/bfa_defs_cna.h
new file mode 100644
index 000000000000..7e0a9187bdd5
--- /dev/null
+++ b/drivers/net/bna/bfa_defs_cna.h
@@ -0,0 +1,223 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __BFA_DEFS_CNA_H__
+#define __BFA_DEFS_CNA_H__
+
+#include "bfa_defs.h"
+
+/**
+ * @brief
+ * FC physical port statistics.
+ */
+struct bfa_port_fc_stats {
+        u64     secs_reset;     /*!< Seconds since stats is reset */
+        u64     tx_frames;      /*!< Tx frames                  */
+        u64     tx_words;       /*!< Tx words                   */
+        u64     tx_lip;         /*!< Tx LIP                     */
+        u64     tx_nos;         /*!< Tx NOS                     */
+        u64     tx_ols;         /*!< Tx OLS                     */
+        u64     tx_lr;          /*!< Tx LR                      */
+        u64     tx_lrr;         /*!< Tx LRR                     */
+        u64     rx_frames;      /*!< Rx frames                  */
+        u64     rx_words;       /*!< Rx words                   */
+        u64     lip_count;      /*!< Rx LIP                     */
+        u64     nos_count;      /*!< Rx NOS                     */
+        u64     ols_count;      /*!< Rx OLS                     */
+        u64     lr_count;       /*!< Rx LR                      */
+        u64     lrr_count;      /*!< Rx LRR                     */
+        u64     invalid_crcs;   /*!< Rx CRC err frames          */
+        u64     invalid_crc_gd_eof; /*!< Rx CRC err good EOF frames */
+        u64     undersized_frm; /*!< Rx undersized frames       */
+        u64     oversized_frm;  /*!< Rx oversized frames        */
+        u64     bad_eof_frm;    /*!< Rx frames with bad EOF     */
+        u64     error_frames;   /*!< Errored frames             */
+        u64     dropped_frames; /*!< Dropped frames             */
+        u64     link_failures;  /*!< Link Failure (LF) count    */
+        u64     loss_of_syncs;  /*!< Loss of sync count         */
+        u64     loss_of_signals; /*!< Loss of signal count      */
+        u64     primseq_errs;   /*!< Primitive sequence protocol err. */
+        u64     bad_os_count;   /*!< Invalid ordered sets       */
+        u64     err_enc_out;    /*!< Encoding err nonframe_8b10b */
+        u64     err_enc;        /*!< Encoding err frame_8b10b   */
+};
+
+/**
+ * @brief
+ * Eth Physical Port statistics.
+ */
+struct bfa_port_eth_stats {
+        u64     secs_reset;     /*!< Seconds since stats is reset */
+        u64     frame_64;       /*!< Frames 64 bytes            */
+        u64     frame_65_127;   /*!< Frames 65-127 bytes        */
+        u64     frame_128_255;  /*!< Frames 128-255 bytes       */
+        u64     frame_256_511;  /*!< Frames 256-511 bytes       */
+        u64     frame_512_1023; /*!< Frames 512-1023 bytes      */
+        u64     frame_1024_1518; /*!< Frames 1024-1518 bytes    */
+        u64     frame_1519_1522; /*!< Frames 1519-1522 bytes    */
+        u64     tx_bytes;       /*!< Tx bytes                   */
+        u64     tx_packets;      /*!< Tx packets                */
+        u64     tx_mcast_packets; /*!< Tx multicast packets     */
+        u64     tx_bcast_packets; /*!< Tx broadcast packets     */
+        u64     tx_control_frame; /*!< Tx control frame         */
+        u64     tx_drop;        /*!< Tx drops                   */
+        u64     tx_jabber;      /*!< Tx jabber                  */
+        u64     tx_fcs_error;   /*!< Tx FCS errors              */
+        u64     tx_fragments;   /*!< Tx fragments               */
+        u64     rx_bytes;       /*!< Rx bytes                   */
+        u64     rx_packets;     /*!< Rx packets                 */
+        u64     rx_mcast_packets; /*!< Rx multicast packets     */
+        u64     rx_bcast_packets; /*!< Rx broadcast packets     */
+        u64     rx_control_frames; /*!< Rx control frames       */
+        u64     rx_unknown_opcode; /*!< Rx unknown opcode       */
+        u64     rx_drop;        /*!< Rx drops                   */
+        u64     rx_jabber;      /*!< Rx jabber                  */
+        u64     rx_fcs_error;   /*!< Rx FCS errors              */
+        u64     rx_alignment_error; /*!< Rx alignment errors    */
+        u64     rx_frame_length_error; /*!< Rx frame len errors */
+        u64     rx_code_error;  /*!< Rx code errors             */
+        u64     rx_fragments;   /*!< Rx fragments               */
+        u64     rx_pause;       /*!< Rx pause                   */
+        u64     rx_zero_pause;  /*!< Rx zero pause              */
+        u64     tx_pause;       /*!< Tx pause                   */
+        u64     tx_zero_pause;  /*!< Tx zero pause              */
+        u64     rx_fcoe_pause;  /*!< Rx FCoE pause              */
+        u64     rx_fcoe_zero_pause; /*!< Rx FCoE zero pause     */
+        u64     tx_fcoe_pause;  /*!< Tx FCoE pause              */
+        u64     tx_fcoe_zero_pause; /*!< Tx FCoE zero pause     */
+};
+
+/**
+ * @brief
+ *              Port statistics.
+ */
+union bfa_port_stats_u {
+        struct bfa_port_fc_stats fc;
+        struct bfa_port_eth_stats eth;
+};
+
+#pragma pack(1)
+
+#define BFA_CEE_LLDP_MAX_STRING_LEN (128)
+#define BFA_CEE_DCBX_MAX_PRIORITY       (8)
+#define BFA_CEE_DCBX_MAX_PGID           (8)
+
+#define BFA_CEE_LLDP_SYS_CAP_OTHER      0x0001
+#define BFA_CEE_LLDP_SYS_CAP_REPEATER   0x0002
+#define BFA_CEE_LLDP_SYS_CAP_MAC_BRIDGE 0x0004
+#define BFA_CEE_LLDP_SYS_CAP_WLAN_AP    0x0008
+#define BFA_CEE_LLDP_SYS_CAP_ROUTER     0x0010
+#define BFA_CEE_LLDP_SYS_CAP_TELEPHONE  0x0020
+#define BFA_CEE_LLDP_SYS_CAP_DOCSIS_CD  0x0040
+#define BFA_CEE_LLDP_SYS_CAP_STATION    0x0080
+#define BFA_CEE_LLDP_SYS_CAP_CVLAN      0x0100
+#define BFA_CEE_LLDP_SYS_CAP_SVLAN      0x0200
+#define BFA_CEE_LLDP_SYS_CAP_TPMR       0x0400
+
+/* LLDP string type */
+struct bfa_cee_lldp_str {
+        u8 sub_type;
+        u8 len;
+        u8 rsvd[2];
+        u8 value[BFA_CEE_LLDP_MAX_STRING_LEN];
+};
+
+/* LLDP paramters */
+struct bfa_cee_lldp_cfg {
+        struct bfa_cee_lldp_str chassis_id;
+        struct bfa_cee_lldp_str port_id;
+        struct bfa_cee_lldp_str port_desc;
+        struct bfa_cee_lldp_str sys_name;
+        struct bfa_cee_lldp_str sys_desc;
+        struct bfa_cee_lldp_str mgmt_addr;
+        u16 time_to_live;
+        u16 enabled_system_cap;
+};
+
+enum bfa_cee_dcbx_version {
+        DCBX_PROTOCOL_PRECEE    = 1,
+        DCBX_PROTOCOL_CEE       = 2,
+};
+
+enum bfa_cee_lls {
+        /* LLS is down because the TLV not sent by the peer */
+        CEE_LLS_DOWN_NO_TLV = 0,
+        /* LLS is down as advertised by the peer */
+        CEE_LLS_DOWN    = 1,
+        CEE_LLS_UP      = 2,
+};
+
+/* CEE/DCBX parameters */
+struct bfa_cee_dcbx_cfg {
+        u8 pgid[BFA_CEE_DCBX_MAX_PRIORITY];
+        u8 pg_percentage[BFA_CEE_DCBX_MAX_PGID];
+        u8 pfc_primap; /* bitmap of priorties with PFC enabled */
+        u8 fcoe_primap; /* bitmap of priorities used for FcoE traffic */
+        u8 iscsi_primap; /* bitmap of priorities used for iSCSI traffic */
+        u8 dcbx_version; /* operating version:CEE or preCEE */
+        u8 lls_fcoe; /* FCoE Logical Link Status */
+        u8 lls_lan; /* LAN Logical Link Status */
+        u8 rsvd[2];
+};
+
+/* CEE status */
+/* Making this to tri-state for the benefit of port list command */
+enum bfa_cee_status {
+        CEE_UP = 0,
+        CEE_PHY_UP = 1,
+        CEE_LOOPBACK = 2,
+        CEE_PHY_DOWN = 3,
+};
+
+/* CEE Query */
+struct bfa_cee_attr {
+        u8      cee_status;
+        u8 error_reason;
+        struct bfa_cee_lldp_cfg lldp_remote;
+        struct bfa_cee_dcbx_cfg dcbx_remote;
+        mac_t src_mac;
+        u8 link_speed;
+        u8 nw_priority;
+        u8 filler[2];
+};
+
+/* LLDP/DCBX/CEE Statistics */
+struct bfa_cee_stats {
+        u32     lldp_tx_frames;         /*!< LLDP Tx Frames */
+        u32     lldp_rx_frames;         /*!< LLDP Rx Frames */
+        u32     lldp_rx_frames_invalid; /*!< LLDP Rx Frames invalid */
+        u32     lldp_rx_frames_new;     /*!< LLDP Rx Frames new */
+        u32     lldp_tlvs_unrecognized; /*!< LLDP Rx unrecognized TLVs */
+        u32     lldp_rx_shutdown_tlvs;  /*!< LLDP Rx shutdown TLVs */
+        u32     lldp_info_aged_out;     /*!< LLDP remote info aged out */
+        u32     dcbx_phylink_ups;       /*!< DCBX phy link ups */
+        u32     dcbx_phylink_downs;     /*!< DCBX phy link downs */
+        u32     dcbx_rx_tlvs;           /*!< DCBX Rx TLVs */
+        u32     dcbx_rx_tlvs_invalid;   /*!< DCBX Rx TLVs invalid */
+        u32     dcbx_control_tlv_error; /*!< DCBX control TLV errors */
+        u32     dcbx_feature_tlv_error; /*!< DCBX feature TLV errors */
+        u32     dcbx_cee_cfg_new;       /*!< DCBX new CEE cfg rcvd */
+        u32     cee_status_down;        /*!< CEE status down */
+        u32     cee_status_up;          /*!< CEE status up */
+        u32     cee_hw_cfg_changed;     /*!< CEE hw cfg changed */
+        u32     cee_rx_invalid_cfg;     /*!< CEE invalid cfg */
+};
+
+#pragma pack()
+
+#endif  /* __BFA_DEFS_CNA_H__ */
diff --git a/drivers/net/bna/bfa_defs_mfg_comm.h b/drivers/net/bna/bfa_defs_mfg_comm.h
new file mode 100644
index 000000000000..987978fcb3fe
--- /dev/null
+++ b/drivers/net/bna/bfa_defs_mfg_comm.h
@@ -0,0 +1,244 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BFA_DEFS_MFG_COMM_H__
+#define __BFA_DEFS_MFG_COMM_H__
+
+#include "cna.h"
+
+/**
+ * Manufacturing block version
+ */
+#define BFA_MFG_VERSION                         2
+#define BFA_MFG_VERSION_UNINIT                  0xFF
+
+/**
+ * Manufacturing block encrypted version
+ */
+#define BFA_MFG_ENC_VER                         2
+
+/**
+ * Manufacturing block version 1 length
+ */
+#define BFA_MFG_VER1_LEN                        128
+
+/**
+ * Manufacturing block header length
+ */
+#define BFA_MFG_HDR_LEN                         4
+
+#define BFA_MFG_SERIALNUM_SIZE                  11
+#define STRSZ(_n)                               (((_n) + 4) & ~3)
+
+/**
+ * Manufacturing card type
+ */
+enum {
+        BFA_MFG_TYPE_CB_MAX  = 825,      /*!< Crossbow card type max    */
+        BFA_MFG_TYPE_FC8P2   = 825,      /*!< 8G 2port FC card          */
+        BFA_MFG_TYPE_FC8P1   = 815,      /*!< 8G 1port FC card          */
+        BFA_MFG_TYPE_FC4P2   = 425,      /*!< 4G 2port FC card          */
+        BFA_MFG_TYPE_FC4P1   = 415,      /*!< 4G 1port FC card          */
+        BFA_MFG_TYPE_CNA10P2 = 1020,     /*!< 10G 2port CNA card        */
+        BFA_MFG_TYPE_CNA10P1 = 1010,     /*!< 10G 1port CNA card        */
+        BFA_MFG_TYPE_JAYHAWK = 804,      /*!< Jayhawk mezz card         */
+        BFA_MFG_TYPE_WANCHESE = 1007,    /*!< Wanchese mezz card        */
+        BFA_MFG_TYPE_ASTRA    = 807,     /*!< Astra mezz card           */
+        BFA_MFG_TYPE_LIGHTNING_P0 = 902, /*!< Lightning mezz card - old */
+        BFA_MFG_TYPE_LIGHTNING = 1741,   /*!< Lightning mezz card       */
+        BFA_MFG_TYPE_INVALID = 0,        /*!< Invalid card type         */
+};
+
+#pragma pack(1)
+
+/**
+ * Check if 1-port card
+ */
+#define bfa_mfg_is_1port(type) (( \
+        (type) == BFA_MFG_TYPE_FC8P1 || \
+        (type) == BFA_MFG_TYPE_FC4P1 || \
+        (type) == BFA_MFG_TYPE_CNA10P1))
+
+/**
+ * Check if Mezz card
+ */
+#define bfa_mfg_is_mezz(type) (( \
+        (type) == BFA_MFG_TYPE_JAYHAWK || \
+        (type) == BFA_MFG_TYPE_WANCHESE || \
+        (type) == BFA_MFG_TYPE_ASTRA || \
+        (type) == BFA_MFG_TYPE_LIGHTNING_P0 || \
+        (type) == BFA_MFG_TYPE_LIGHTNING))
+
+/**
+ * Check if card type valid
+ */
+#define bfa_mfg_is_card_type_valid(type) (( \
+        (type) == BFA_MFG_TYPE_FC8P2 || \
+        (type) == BFA_MFG_TYPE_FC8P1 || \
+        (type) == BFA_MFG_TYPE_FC4P2 || \
+        (type) == BFA_MFG_TYPE_FC4P1 || \
+        (type) == BFA_MFG_TYPE_CNA10P2 || \
+        (type) == BFA_MFG_TYPE_CNA10P1 || \
+        bfa_mfg_is_mezz(type)))
+
+/**
+ * Check if the card having old wwn/mac handling
+ */
+#define bfa_mfg_is_old_wwn_mac_model(type) (( \
+        (type) == BFA_MFG_TYPE_FC8P2 || \
+        (type) == BFA_MFG_TYPE_FC8P1 || \
+        (type) == BFA_MFG_TYPE_FC4P2 || \
+        (type) == BFA_MFG_TYPE_FC4P1 || \
+        (type) == BFA_MFG_TYPE_CNA10P2 || \
+        (type) == BFA_MFG_TYPE_CNA10P1 || \
+        (type) == BFA_MFG_TYPE_JAYHAWK || \
+        (type) == BFA_MFG_TYPE_WANCHESE))
+
+#define bfa_mfg_increment_wwn_mac(m, i)                         \
+do {                                                            \
+        u32 t = ((m)[0] << 16) | ((m)[1] << 8) | (m)[2];        \
+        t += (i);                                               \
+        (m)[0] = (t >> 16) & 0xFF;                              \
+        (m)[1] = (t >> 8) & 0xFF;                               \
+        (m)[2] = t & 0xFF;                                      \
+} while (0)
+
+#define bfa_mfg_adapter_prop_init_flash(card_type, prop)        \
+do {                                                            \
+        switch ((card_type)) {                                  \
+        case BFA_MFG_TYPE_FC8P2:                                \
+        case BFA_MFG_TYPE_JAYHAWK:                              \
+        case BFA_MFG_TYPE_ASTRA:                                \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 2) |          \
+                        BFI_ADAPTER_SETP(SPEED, 8);             \
+                break;                                          \
+        case BFA_MFG_TYPE_FC8P1:                                \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 1) |          \
+                        BFI_ADAPTER_SETP(SPEED, 8);             \
+                break;                                          \
+        case BFA_MFG_TYPE_FC4P2:                                \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 2) |          \
+                        BFI_ADAPTER_SETP(SPEED, 4);             \
+                break;                                          \
+        case BFA_MFG_TYPE_FC4P1:                                \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 1) |          \
+                        BFI_ADAPTER_SETP(SPEED, 4);             \
+                break;                                          \
+        case BFA_MFG_TYPE_CNA10P2:                              \
+        case BFA_MFG_TYPE_WANCHESE:                             \
+        case BFA_MFG_TYPE_LIGHTNING_P0:                         \
+        case BFA_MFG_TYPE_LIGHTNING:                            \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 2);           \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 10);          \
+                break;                                          \
+        case BFA_MFG_TYPE_CNA10P1:                              \
+                (prop) = BFI_ADAPTER_SETP(NPORTS, 1);           \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 10);          \
+                break;                                          \
+        default:                                                \
+                (prop) = BFI_ADAPTER_UNSUPP;                    \
+        }                                                       \
+} while (0)
+
+enum {
+        CB_GPIO_TTV     = (1),          /*!< TTV debug capable cards    */
+        CB_GPIO_FC8P2   = (2),          /*!< 8G 2port FC card           */
+        CB_GPIO_FC8P1   = (3),          /*!< 8G 1port FC card           */
+        CB_GPIO_FC4P2   = (4),          /*!< 4G 2port FC card           */
+        CB_GPIO_FC4P1   = (5),          /*!< 4G 1port FC card           */
+        CB_GPIO_DFLY    = (6),          /*!< 8G 2port FC mezzanine card */
+        CB_GPIO_PROTO   = (1 << 7)      /*!< 8G 2port FC prototypes     */
+};
+
+#define bfa_mfg_adapter_prop_init_gpio(gpio, card_type, prop)   \
+do {                                                            \
+        if ((gpio) & CB_GPIO_PROTO) {                           \
+                (prop) |= BFI_ADAPTER_PROTO;                    \
+                (gpio) &= ~CB_GPIO_PROTO;                       \
+        }                                                       \
+        switch ((gpio)) {                                       \
+        case CB_GPIO_TTV:                                       \
+                (prop) |= BFI_ADAPTER_TTV;                      \
+        case CB_GPIO_DFLY:                                      \
+        case CB_GPIO_FC8P2:                                     \
+                (prop) |= BFI_ADAPTER_SETP(NPORTS, 2);          \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 8);           \
+                (card_type) = BFA_MFG_TYPE_FC8P2;               \
+                break;                                          \
+        case CB_GPIO_FC8P1:                                     \
+                (prop) |= BFI_ADAPTER_SETP(NPORTS, 1);          \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 8);           \
+                (card_type) = BFA_MFG_TYPE_FC8P1;               \
+                break;                                          \
+        case CB_GPIO_FC4P2:                                     \
+                (prop) |= BFI_ADAPTER_SETP(NPORTS, 2);          \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 4);           \
+                (card_type) = BFA_MFG_TYPE_FC4P2;               \
+                break;                                          \
+        case CB_GPIO_FC4P1:                                     \
+                (prop) |= BFI_ADAPTER_SETP(NPORTS, 1);          \
+                (prop) |= BFI_ADAPTER_SETP(SPEED, 4);           \
+                (card_type) = BFA_MFG_TYPE_FC4P1;               \
+                break;                                          \
+        default:                                                \
+                (prop) |= BFI_ADAPTER_UNSUPP;                   \
+                (card_type) = BFA_MFG_TYPE_INVALID;             \
+        }                                                       \
+} while (0)
+
+/**
+ * VPD data length
+ */
+#define BFA_MFG_VPD_LEN                 512
+#define BFA_MFG_VPD_LEN_INVALID         0
+
+#define BFA_MFG_VPD_PCI_HDR_OFF         137
+#define BFA_MFG_VPD_PCI_VER_MASK        0x07    /*!< version mask 3 bits */
+#define BFA_MFG_VPD_PCI_VDR_MASK        0xf8    /*!< vendor mask 5 bits */
+
+/**
+ * VPD vendor tag
+ */
+enum {
+        BFA_MFG_VPD_UNKNOWN     = 0,     /*!< vendor unknown            */
+        BFA_MFG_VPD_IBM         = 1,     /*!< vendor IBM                */
+        BFA_MFG_VPD_HP          = 2,     /*!< vendor HP                 */
+        BFA_MFG_VPD_DELL        = 3,     /*!< vendor DELL               */
+        BFA_MFG_VPD_PCI_IBM     = 0x08,  /*!< PCI VPD IBM               */
+        BFA_MFG_VPD_PCI_HP      = 0x10,  /*!< PCI VPD HP                */
+        BFA_MFG_VPD_PCI_DELL    = 0x20,  /*!< PCI VPD DELL              */
+        BFA_MFG_VPD_PCI_BRCD    = 0xf8,  /*!< PCI VPD Brocade           */
+};
+
+/**
+ * @brief BFA adapter flash vpd data definition.
+ *
+ * All numerical fields are in big-endian format.
+ */
+struct bfa_mfg_vpd {
+        u8              version;        /*!< vpd data version */
+        u8              vpd_sig[3];     /*!< characters 'V', 'P', 'D' */
+        u8              chksum;         /*!< u8 checksum */
+        u8              vendor;         /*!< vendor */
+        u8      len;            /*!< vpd data length excluding header */
+        u8      rsv;
+        u8              data[BFA_MFG_VPD_LEN];  /*!< vpd data */
+};
+
+#pragma pack()
+
+#endif /* __BFA_DEFS_MFG_H__ */
diff --git a/drivers/net/bna/bfa_defs_status.h b/drivers/net/bna/bfa_defs_status.h
new file mode 100644
index 000000000000..af951126375c
--- /dev/null
+++ b/drivers/net/bna/bfa_defs_status.h
@@ -0,0 +1,216 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BFA_DEFS_STATUS_H__
+#define __BFA_DEFS_STATUS_H__
+
+/**
+ * API status return values
+ *
+ * NOTE: The error msgs are auto generated from the comments. Only singe line
+ * comments are supported
+ */
+enum bfa_status {
+        BFA_STATUS_OK           = 0,
+        BFA_STATUS_FAILED       = 1,
+        BFA_STATUS_EINVAL       = 2,
+        BFA_STATUS_ENOMEM       = 3,
+        BFA_STATUS_ENOSYS       = 4,
+        BFA_STATUS_ETIMER       = 5,
+        BFA_STATUS_EPROTOCOL    = 6,
+        BFA_STATUS_ENOFCPORTS   = 7,
+        BFA_STATUS_NOFLASH      = 8,
+        BFA_STATUS_BADFLASH     = 9,
+        BFA_STATUS_SFP_UNSUPP   = 10,
+        BFA_STATUS_UNKNOWN_VFID = 11,
+        BFA_STATUS_DATACORRUPTED = 12,
+        BFA_STATUS_DEVBUSY      = 13,
+        BFA_STATUS_ABORTED      = 14,
+        BFA_STATUS_NODEV        = 15,
+        BFA_STATUS_HDMA_FAILED  = 16,
+        BFA_STATUS_FLASH_BAD_LEN = 17,
+        BFA_STATUS_UNKNOWN_LWWN = 18,
+        BFA_STATUS_UNKNOWN_RWWN = 19,
+        BFA_STATUS_FCPT_LS_RJT  = 20,
+        BFA_STATUS_VPORT_EXISTS = 21,
+        BFA_STATUS_VPORT_MAX    = 22,
+        BFA_STATUS_UNSUPP_SPEED = 23,
+        BFA_STATUS_INVLD_DFSZ   = 24,
+        BFA_STATUS_CNFG_FAILED  = 25,
+        BFA_STATUS_CMD_NOTSUPP  = 26,
+        BFA_STATUS_NO_ADAPTER   = 27,
+        BFA_STATUS_LINKDOWN     = 28,
+        BFA_STATUS_FABRIC_RJT   = 29,
+        BFA_STATUS_UNKNOWN_VWWN = 30,
+        BFA_STATUS_NSLOGIN_FAILED = 31,
+        BFA_STATUS_NO_RPORTS    = 32,
+        BFA_STATUS_NSQUERY_FAILED = 33,
+        BFA_STATUS_PORT_OFFLINE = 34,
+        BFA_STATUS_RPORT_OFFLINE = 35,
+        BFA_STATUS_TGTOPEN_FAILED = 36,
+        BFA_STATUS_BAD_LUNS     = 37,
+        BFA_STATUS_IO_FAILURE   = 38,
+        BFA_STATUS_NO_FABRIC    = 39,
+        BFA_STATUS_EBADF        = 40,
+        BFA_STATUS_EINTR        = 41,
+        BFA_STATUS_EIO          = 42,
+        BFA_STATUS_ENOTTY       = 43,
+        BFA_STATUS_ENXIO        = 44,
+        BFA_STATUS_EFOPEN       = 45,
+        BFA_STATUS_VPORT_WWN_BP = 46,
+        BFA_STATUS_PORT_NOT_DISABLED = 47,
+        BFA_STATUS_BADFRMHDR    = 48,
+        BFA_STATUS_BADFRMSZ     = 49,
+        BFA_STATUS_MISSINGFRM   = 50,
+        BFA_STATUS_LINKTIMEOUT  = 51,
+        BFA_STATUS_NO_FCPIM_NEXUS = 52,
+        BFA_STATUS_CHECKSUM_FAIL = 53,
+        BFA_STATUS_GZME_FAILED  = 54,
+        BFA_STATUS_SCSISTART_REQD = 55,
+        BFA_STATUS_IOC_FAILURE  = 56,
+        BFA_STATUS_INVALID_WWN  = 57,
+        BFA_STATUS_MISMATCH     = 58,
+        BFA_STATUS_IOC_ENABLED  = 59,
+        BFA_STATUS_ADAPTER_ENABLED = 60,
+        BFA_STATUS_IOC_NON_OP   = 61,
+        BFA_STATUS_ADDR_MAP_FAILURE = 62,
+        BFA_STATUS_SAME_NAME    = 63,
+        BFA_STATUS_PENDING      = 64,
+        BFA_STATUS_8G_SPD       = 65,
+        BFA_STATUS_4G_SPD       = 66,
+        BFA_STATUS_AD_IS_ENABLE = 67,
+        BFA_STATUS_EINVAL_TOV   = 68,
+        BFA_STATUS_EINVAL_QDEPTH = 69,
+        BFA_STATUS_VERSION_FAIL = 70,
+        BFA_STATUS_DIAG_BUSY    = 71,
+        BFA_STATUS_BEACON_ON    = 72,
+        BFA_STATUS_BEACON_OFF   = 73,
+        BFA_STATUS_LBEACON_ON   = 74,
+        BFA_STATUS_LBEACON_OFF  = 75,
+        BFA_STATUS_PORT_NOT_INITED = 76,
+        BFA_STATUS_RPSC_ENABLED = 77,
+        BFA_STATUS_ENOFSAVE     = 78,
+        BFA_STATUS_BAD_FILE             = 79,
+        BFA_STATUS_RLIM_EN              = 80,
+        BFA_STATUS_RLIM_DIS             = 81,
+        BFA_STATUS_IOC_DISABLED  = 82,
+        BFA_STATUS_ADAPTER_DISABLED  = 83,
+        BFA_STATUS_BIOS_DISABLED  = 84,
+        BFA_STATUS_AUTH_ENABLED  = 85,
+        BFA_STATUS_AUTH_DISABLED  = 86,
+        BFA_STATUS_ERROR_TRL_ENABLED  = 87,
+        BFA_STATUS_ERROR_QOS_ENABLED  = 88,
+        BFA_STATUS_NO_SFP_DEV = 89,
+        BFA_STATUS_MEMTEST_FAILED = 90,
+        BFA_STATUS_INVALID_DEVID = 91,
+        BFA_STATUS_QOS_ENABLED = 92,
+        BFA_STATUS_QOS_DISABLED = 93,
+        BFA_STATUS_INCORRECT_DRV_CONFIG = 94,
+        BFA_STATUS_REG_FAIL = 95,
+        BFA_STATUS_IM_INV_CODE = 96,
+        BFA_STATUS_IM_INV_VLAN = 97,
+        BFA_STATUS_IM_INV_ADAPT_NAME = 98,
+        BFA_STATUS_IM_LOW_RESOURCES = 99,
+        BFA_STATUS_IM_VLANID_IS_PVID = 100,
+        BFA_STATUS_IM_VLANID_EXISTS = 101,
+        BFA_STATUS_IM_FW_UPDATE_FAIL = 102,
+        BFA_STATUS_PORTLOG_ENABLED = 103,
+        BFA_STATUS_PORTLOG_DISABLED = 104,
+        BFA_STATUS_FILE_NOT_FOUND = 105,
+        BFA_STATUS_QOS_FC_ONLY = 106,
+        BFA_STATUS_RLIM_FC_ONLY = 107,
+        BFA_STATUS_CT_SPD = 108,
+        BFA_STATUS_LEDTEST_OP = 109,
+        BFA_STATUS_CEE_NOT_DN = 110,
+        BFA_STATUS_10G_SPD = 111,
+        BFA_STATUS_IM_INV_TEAM_NAME = 112,
+        BFA_STATUS_IM_DUP_TEAM_NAME = 113,
+        BFA_STATUS_IM_ADAPT_ALREADY_IN_TEAM = 114,
+        BFA_STATUS_IM_ADAPT_HAS_VLANS = 115,
+        BFA_STATUS_IM_PVID_MISMATCH = 116,
+        BFA_STATUS_IM_LINK_SPEED_MISMATCH = 117,
+        BFA_STATUS_IM_MTU_MISMATCH = 118,
+        BFA_STATUS_IM_RSS_MISMATCH = 119,
+        BFA_STATUS_IM_HDS_MISMATCH = 120,
+        BFA_STATUS_IM_OFFLOAD_MISMATCH = 121,
+        BFA_STATUS_IM_PORT_PARAMS = 122,
+        BFA_STATUS_IM_PORT_NOT_IN_TEAM = 123,
+        BFA_STATUS_IM_CANNOT_REM_PRI = 124,
+        BFA_STATUS_IM_MAX_PORTS_REACHED = 125,
+        BFA_STATUS_IM_LAST_PORT_DELETE = 126,
+        BFA_STATUS_IM_NO_DRIVER = 127,
+        BFA_STATUS_IM_MAX_VLANS_REACHED = 128,
+        BFA_STATUS_TOMCAT_SPD_NOT_ALLOWED = 129,
+        BFA_STATUS_NO_MINPORT_DRIVER = 130,
+        BFA_STATUS_CARD_TYPE_MISMATCH = 131,
+        BFA_STATUS_BAD_ASICBLK = 132,
+        BFA_STATUS_NO_DRIVER = 133,
+        BFA_STATUS_INVALID_MAC = 134,
+        BFA_STATUS_IM_NO_VLAN = 135,
+        BFA_STATUS_IM_ETH_LB_FAILED = 136,
+        BFA_STATUS_IM_PVID_REMOVE = 137,
+        BFA_STATUS_IM_PVID_EDIT = 138,
+        BFA_STATUS_CNA_NO_BOOT = 139,
+        BFA_STATUS_IM_PVID_NON_ZERO = 140,
+        BFA_STATUS_IM_INETCFG_LOCK_FAILED = 141,
+        BFA_STATUS_IM_GET_INETCFG_FAILED = 142,
+        BFA_STATUS_IM_NOT_BOUND = 143,
+        BFA_STATUS_INSUFFICIENT_PERMS = 144,
+        BFA_STATUS_IM_INV_VLAN_NAME = 145,
+        BFA_STATUS_CMD_NOTSUPP_CNA = 146,
+        BFA_STATUS_IM_PASSTHRU_EDIT = 147,
+        BFA_STATUS_IM_BIND_FAILED = 148,
+        BFA_STATUS_IM_UNBIND_FAILED = 149,
+        BFA_STATUS_IM_PORT_IN_TEAM = 150,
+        BFA_STATUS_IM_VLAN_NOT_FOUND = 151,
+        BFA_STATUS_IM_TEAM_NOT_FOUND = 152,
+        BFA_STATUS_IM_TEAM_CFG_NOT_ALLOWED = 153,
+        BFA_STATUS_PBC = 154,
+        BFA_STATUS_DEVID_MISSING = 155,
+        BFA_STATUS_BAD_FWCFG = 156,
+        BFA_STATUS_CREATE_FILE = 157,
+        BFA_STATUS_INVALID_VENDOR = 158,
+        BFA_STATUS_SFP_NOT_READY = 159,
+        BFA_STATUS_FLASH_UNINIT = 160,
+        BFA_STATUS_FLASH_EMPTY = 161,
+        BFA_STATUS_FLASH_CKFAIL = 162,
+        BFA_STATUS_TRUNK_UNSUPP = 163,
+        BFA_STATUS_TRUNK_ENABLED = 164,
+        BFA_STATUS_TRUNK_DISABLED  = 165,
+        BFA_STATUS_TRUNK_ERROR_TRL_ENABLED = 166,
+        BFA_STATUS_BOOT_CODE_UPDATED = 167,
+        BFA_STATUS_BOOT_VERSION = 168,
+        BFA_STATUS_CARDTYPE_MISSING = 169,
+        BFA_STATUS_INVALID_CARDTYPE = 170,
+        BFA_STATUS_NO_TOPOLOGY_FOR_CNA = 171,
+        BFA_STATUS_IM_VLAN_OVER_TEAM_DELETE_FAILED = 172,
+        BFA_STATUS_ETHBOOT_ENABLED  = 173,
+        BFA_STATUS_ETHBOOT_DISABLED  = 174,
+        BFA_STATUS_IOPROFILE_OFF = 175,
+        BFA_STATUS_NO_PORT_INSTANCE = 176,
+        BFA_STATUS_BOOT_CODE_TIMEDOUT = 177,
+        BFA_STATUS_NO_VPORT_LOCK = 178,
+        BFA_STATUS_VPORT_NO_CNFG = 179,
+        BFA_STATUS_MAX_VAL
+};
+
+enum bfa_eproto_status {
+        BFA_EPROTO_BAD_ACCEPT = 0,
+        BFA_EPROTO_UNKNOWN_RSP = 1
+};
+
+#endif /* __BFA_DEFS_STATUS_H__ */
diff --git a/drivers/net/bna/bfa_ioc.c b/drivers/net/bna/bfa_ioc.c
new file mode 100644
index 000000000000..73493de98de5
--- /dev/null
+++ b/drivers/net/bna/bfa_ioc.c
@@ -0,0 +1,1738 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#include "bfa_ioc.h"
+#include "cna.h"
+#include "bfi.h"
+#include "bfi_ctreg.h"
+#include "bfa_defs.h"
+
+/**
+ * IOC local definitions
+ */
+
+#define bfa_ioc_timer_start(__ioc)                                      \
+        mod_timer(&(__ioc)->ioc_timer, jiffies +        \
+                        msecs_to_jiffies(BFA_IOC_TOV))
+#define bfa_ioc_timer_stop(__ioc)   del_timer(&(__ioc)->ioc_timer)
+
+#define bfa_ioc_recovery_timer_start(__ioc)                             \
+        mod_timer(&(__ioc)->ioc_timer, jiffies +        \
+                        msecs_to_jiffies(BFA_IOC_TOV_RECOVER))
+
+#define bfa_sem_timer_start(__ioc)                                      \
+        mod_timer(&(__ioc)->sem_timer, jiffies +        \
+                        msecs_to_jiffies(BFA_IOC_HWSEM_TOV))
+#define bfa_sem_timer_stop(__ioc)       del_timer(&(__ioc)->sem_timer)
+
+#define bfa_hb_timer_start(__ioc)                                       \
+        mod_timer(&(__ioc)->hb_timer, jiffies +         \
+                        msecs_to_jiffies(BFA_IOC_HB_TOV))
+#define bfa_hb_timer_stop(__ioc)        del_timer(&(__ioc)->hb_timer)
+
+/**
+ * Asic specific macros : see bfa_hw_cb.c and bfa_hw_ct.c for details.
+ */
+
+#define bfa_ioc_firmware_lock(__ioc)                    \
+                        ((__ioc)->ioc_hwif->ioc_firmware_lock(__ioc))
+#define bfa_ioc_firmware_unlock(__ioc)                  \
+                        ((__ioc)->ioc_hwif->ioc_firmware_unlock(__ioc))
+#define bfa_ioc_reg_init(__ioc) ((__ioc)->ioc_hwif->ioc_reg_init(__ioc))
+#define bfa_ioc_map_port(__ioc) ((__ioc)->ioc_hwif->ioc_map_port(__ioc))
+#define bfa_ioc_notify_hbfail(__ioc)                    \
+                        ((__ioc)->ioc_hwif->ioc_notify_hbfail(__ioc))
+
+#define bfa_ioc_is_optrom(__ioc)        \
+        (bfa_cb_image_get_size(BFA_IOC_FWIMG_TYPE(__ioc)) < BFA_IOC_FWIMG_MINSZ)
+
+#define bfa_ioc_mbox_cmd_pending(__ioc)         \
+                        (!list_empty(&((__ioc)->mbox_mod.cmd_q)) || \
+                        readl((__ioc)->ioc_regs.hfn_mbox_cmd))
+
+bool bfa_nw_auto_recover = true;
+
+/*
+ * forward declarations
+ */
+static void bfa_ioc_hw_sem_get(struct bfa_ioc *ioc);
+static void bfa_ioc_hw_sem_get_cancel(struct bfa_ioc *ioc);
+static void bfa_ioc_hwinit(struct bfa_ioc *ioc, bool force);
+static void bfa_ioc_send_enable(struct bfa_ioc *ioc);
+static void bfa_ioc_send_disable(struct bfa_ioc *ioc);
+static void bfa_ioc_send_getattr(struct bfa_ioc *ioc);
+static void bfa_ioc_hb_monitor(struct bfa_ioc *ioc);
+static void bfa_ioc_hb_stop(struct bfa_ioc *ioc);
+static void bfa_ioc_reset(struct bfa_ioc *ioc, bool force);
+static void bfa_ioc_mbox_poll(struct bfa_ioc *ioc);
+static void bfa_ioc_mbox_hbfail(struct bfa_ioc *ioc);
+static void bfa_ioc_recover(struct bfa_ioc *ioc);
+static void bfa_ioc_check_attr_wwns(struct bfa_ioc *ioc);
+static void bfa_ioc_disable_comp(struct bfa_ioc *ioc);
+static void bfa_ioc_lpu_stop(struct bfa_ioc *ioc);
+static void bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type,
+                         u32 boot_param);
+static u32 bfa_ioc_smem_pgnum(struct bfa_ioc *ioc, u32 fmaddr);
+static u32 bfa_ioc_smem_pgoff(struct bfa_ioc *ioc, u32 fmaddr);
+static void bfa_ioc_get_adapter_serial_num(struct bfa_ioc *ioc,
+                                                char *serial_num);
+static void bfa_ioc_get_adapter_fw_ver(struct bfa_ioc *ioc,
+                                                char *fw_ver);
+static void bfa_ioc_get_pci_chip_rev(struct bfa_ioc *ioc,
+                                                char *chip_rev);
+static void bfa_ioc_get_adapter_optrom_ver(struct bfa_ioc *ioc,
+                                                char *optrom_ver);
+static void bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc,
+                                                char *manufacturer);
+static void bfa_ioc_get_adapter_model(struct bfa_ioc *ioc, char *model);
+static u64 bfa_ioc_get_pwwn(struct bfa_ioc *ioc);
+static mac_t bfa_ioc_get_mfg_mac(struct bfa_ioc *ioc);
+
+/**
+ * IOC state machine events
+ */
+enum ioc_event {
+        IOC_E_ENABLE            = 1,    /*!< IOC enable request         */
+        IOC_E_DISABLE           = 2,    /*!< IOC disable request        */
+        IOC_E_TIMEOUT           = 3,    /*!< f/w response timeout       */
+        IOC_E_FWREADY           = 4,    /*!< f/w initialization done    */
+        IOC_E_FWRSP_GETATTR     = 5,    /*!< IOC get attribute response */
+        IOC_E_FWRSP_ENABLE      = 6,    /*!< enable f/w response        */
+        IOC_E_FWRSP_DISABLE     = 7,    /*!< disable f/w response       */
+        IOC_E_HBFAIL            = 8,    /*!< heartbeat failure          */
+        IOC_E_HWERROR           = 9,    /*!< hardware error interrupt   */
+        IOC_E_SEMLOCKED         = 10,   /*!< h/w semaphore is locked    */
+        IOC_E_DETACH            = 11,   /*!< driver detach cleanup      */
+};
+
+bfa_fsm_state_decl(bfa_ioc, reset, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, fwcheck, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, mismatch, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, semwait, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, hwinit, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, enabling, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, getattr, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, op, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, initfail, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, hbfail, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, disabling, struct bfa_ioc, enum ioc_event);
+bfa_fsm_state_decl(bfa_ioc, disabled, struct bfa_ioc, enum ioc_event);
+
+static struct bfa_sm_table ioc_sm_table[] = {
+        {BFA_SM(bfa_ioc_sm_reset), BFA_IOC_RESET},
+        {BFA_SM(bfa_ioc_sm_fwcheck), BFA_IOC_FWMISMATCH},
+        {BFA_SM(bfa_ioc_sm_mismatch), BFA_IOC_FWMISMATCH},
+        {BFA_SM(bfa_ioc_sm_semwait), BFA_IOC_SEMWAIT},
+        {BFA_SM(bfa_ioc_sm_hwinit), BFA_IOC_HWINIT},
+        {BFA_SM(bfa_ioc_sm_enabling), BFA_IOC_HWINIT},
+        {BFA_SM(bfa_ioc_sm_getattr), BFA_IOC_GETATTR},
+        {BFA_SM(bfa_ioc_sm_op), BFA_IOC_OPERATIONAL},
+        {BFA_SM(bfa_ioc_sm_initfail), BFA_IOC_INITFAIL},
+        {BFA_SM(bfa_ioc_sm_hbfail), BFA_IOC_HBFAIL},
+        {BFA_SM(bfa_ioc_sm_disabling), BFA_IOC_DISABLING},
+        {BFA_SM(bfa_ioc_sm_disabled), BFA_IOC_DISABLED},
+};
+
+/**
+ * Reset entry actions -- initialize state machine
+ */
+static void
+bfa_ioc_sm_reset_entry(struct bfa_ioc *ioc)
+{
+        ioc->retry_count = 0;
+        ioc->auto_recover = bfa_nw_auto_recover;
+}
+
+/**
+ * Beginning state. IOC is in reset state.
+ */
+static void
+bfa_ioc_sm_reset(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_ENABLE:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_fwcheck);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_disable_comp(ioc);
+                break;
+
+        case IOC_E_DETACH:
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+/**
+ * Semaphore should be acquired for version check.
+ */
+static void
+bfa_ioc_sm_fwcheck_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_hw_sem_get(ioc);
+}
+
+/**
+ * Awaiting h/w semaphore to continue with version check.
+ */
+static void
+bfa_ioc_sm_fwcheck(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_SEMLOCKED:
+                if (bfa_ioc_firmware_lock(ioc)) {
+                        ioc->retry_count = 0;
+                        bfa_fsm_set_state(ioc, bfa_ioc_sm_hwinit);
+                } else {
+                        bfa_nw_ioc_hw_sem_release(ioc);
+                        bfa_fsm_set_state(ioc, bfa_ioc_sm_mismatch);
+                }
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_disable_comp(ioc);
+                /* fall through */
+
+        case IOC_E_DETACH:
+                bfa_ioc_hw_sem_get_cancel(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_reset);
+                break;
+
+        case IOC_E_FWREADY:
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+/**
+ * Notify enable completion callback and generate mismatch AEN.
+ */
+static void
+bfa_ioc_sm_mismatch_entry(struct bfa_ioc *ioc)
+{
+        /**
+         * Provide enable completion callback and AEN notification only once.
+         */
+        if (ioc->retry_count == 0)
+                ioc->cbfn->enable_cbfn(ioc->bfa, BFA_STATUS_IOC_FAILURE);
+        ioc->retry_count++;
+        bfa_ioc_timer_start(ioc);
+}
+
+/**
+ * Awaiting firmware version match.
+ */
+static void
+bfa_ioc_sm_mismatch(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_TIMEOUT:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_fwcheck);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_disable_comp(ioc);
+                /* fall through */
+
+        case IOC_E_DETACH:
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_reset);
+                break;
+
+        case IOC_E_FWREADY:
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+/**
+ * Request for semaphore.
+ */
+static void
+bfa_ioc_sm_semwait_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_hw_sem_get(ioc);
+}
+
+/**
+ * Awaiting semaphore for h/w initialzation.
+ */
+static void
+bfa_ioc_sm_semwait(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_SEMLOCKED:
+                ioc->retry_count = 0;
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_hwinit);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_hw_sem_get_cancel(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_hwinit_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_timer_start(ioc);
+        bfa_ioc_reset(ioc, false);
+}
+
+/**
+ * @brief
+ * Hardware is being initialized. Interrupts are enabled.
+ * Holding hardware semaphore lock.
+ */
+static void
+bfa_ioc_sm_hwinit(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_FWREADY:
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_enabling);
+                break;
+
+        case IOC_E_HWERROR:
+                bfa_ioc_timer_stop(ioc);
+                /* fall through */
+
+        case IOC_E_TIMEOUT:
+                ioc->retry_count++;
+                if (ioc->retry_count < BFA_IOC_HWINIT_MAX) {
+                        bfa_ioc_timer_start(ioc);
+                        bfa_ioc_reset(ioc, true);
+                        break;
+                }
+
+                bfa_nw_ioc_hw_sem_release(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_initfail);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_nw_ioc_hw_sem_release(ioc);
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_enabling_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_timer_start(ioc);
+        bfa_ioc_send_enable(ioc);
+}
+
+/**
+ * Host IOC function is being enabled, awaiting response from firmware.
+ * Semaphore is acquired.
+ */
+static void
+bfa_ioc_sm_enabling(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_FWRSP_ENABLE:
+                bfa_ioc_timer_stop(ioc);
+                bfa_nw_ioc_hw_sem_release(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_getattr);
+                break;
+
+        case IOC_E_HWERROR:
+                bfa_ioc_timer_stop(ioc);
+                /* fall through */
+
+        case IOC_E_TIMEOUT:
+                ioc->retry_count++;
+                if (ioc->retry_count < BFA_IOC_HWINIT_MAX) {
+                        writel(BFI_IOC_UNINIT,
+                                      ioc->ioc_regs.ioc_fwstate);
+                        bfa_fsm_set_state(ioc, bfa_ioc_sm_hwinit);
+                        break;
+                }
+
+                bfa_nw_ioc_hw_sem_release(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_initfail);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_timer_stop(ioc);
+                bfa_nw_ioc_hw_sem_release(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        case IOC_E_FWREADY:
+                bfa_ioc_send_enable(ioc);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_getattr_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_timer_start(ioc);
+        bfa_ioc_send_getattr(ioc);
+}
+
+/**
+ * @brief
+ * IOC configuration in progress. Timer is active.
+ */
+static void
+bfa_ioc_sm_getattr(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_FWRSP_GETATTR:
+                bfa_ioc_timer_stop(ioc);
+                bfa_ioc_check_attr_wwns(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_op);
+                break;
+
+        case IOC_E_HWERROR:
+                bfa_ioc_timer_stop(ioc);
+                /* fall through */
+
+        case IOC_E_TIMEOUT:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_initfail);
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_op_entry(struct bfa_ioc *ioc)
+{
+        ioc->cbfn->enable_cbfn(ioc->bfa, BFA_STATUS_OK);
+        bfa_ioc_hb_monitor(ioc);
+}
+
+static void
+bfa_ioc_sm_op(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_ENABLE:
+                break;
+
+        case IOC_E_DISABLE:
+                bfa_ioc_hb_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabling);
+                break;
+
+        case IOC_E_HWERROR:
+        case IOC_E_FWREADY:
+                /**
+                 * Hard error or IOC recovery by other function.
+                 * Treat it same as heartbeat failure.
+                 */
+                bfa_ioc_hb_stop(ioc);
+                /* !!! fall through !!! */
+
+        case IOC_E_HBFAIL:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_hbfail);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_disabling_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_timer_start(ioc);
+        bfa_ioc_send_disable(ioc);
+}
+
+/**
+ * IOC is being disabled
+ */
+static void
+bfa_ioc_sm_disabling(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_FWRSP_DISABLE:
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        case IOC_E_HWERROR:
+                bfa_ioc_timer_stop(ioc);
+                /*
+                 * !!! fall through !!!
+                 */
+
+        case IOC_E_TIMEOUT:
+                writel(BFI_IOC_FAIL, ioc->ioc_regs.ioc_fwstate);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+/**
+ * IOC disable completion entry.
+ */
+static void
+bfa_ioc_sm_disabled_entry(struct bfa_ioc *ioc)
+{
+        bfa_ioc_disable_comp(ioc);
+}
+
+static void
+bfa_ioc_sm_disabled(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_ENABLE:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_semwait);
+                break;
+
+        case IOC_E_DISABLE:
+                ioc->cbfn->disable_cbfn(ioc->bfa);
+                break;
+
+        case IOC_E_FWREADY:
+                break;
+
+        case IOC_E_DETACH:
+                bfa_ioc_firmware_unlock(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_reset);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_initfail_entry(struct bfa_ioc *ioc)
+{
+        ioc->cbfn->enable_cbfn(ioc->bfa, BFA_STATUS_IOC_FAILURE);
+        bfa_ioc_timer_start(ioc);
+}
+
+/**
+ * @brief
+ * Hardware initialization failed.
+ */
+static void
+bfa_ioc_sm_initfail(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+        case IOC_E_DISABLE:
+                bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        case IOC_E_DETACH:
+                bfa_ioc_timer_stop(ioc);
+                bfa_ioc_firmware_unlock(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_reset);
+                break;
+
+        case IOC_E_TIMEOUT:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_semwait);
+                break;
+
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+static void
+bfa_ioc_sm_hbfail_entry(struct bfa_ioc *ioc)
+{
+        struct list_head                        *qe;
+        struct bfa_ioc_hbfail_notify *notify;
+
+        /**
+         * Mark IOC as failed in hardware and stop firmware.
+         */
+        bfa_ioc_lpu_stop(ioc);
+        writel(BFI_IOC_FAIL, ioc->ioc_regs.ioc_fwstate);
+
+        /**
+         * Notify other functions on HB failure.
+         */
+        bfa_ioc_notify_hbfail(ioc);
+
+        /**
+         * Notify driver and common modules registered for notification.
+         */
+        ioc->cbfn->hbfail_cbfn(ioc->bfa);
+        list_for_each(qe, &ioc->hb_notify_q) {
+                notify = (struct bfa_ioc_hbfail_notify *) qe;
+                notify->cbfn(notify->cbarg);
+        }
+
+        /**
+         * Flush any queued up mailbox requests.
+         */
+        bfa_ioc_mbox_hbfail(ioc);
+
+        /**
+         * Trigger auto-recovery after a delay.
+         */
+        if (ioc->auto_recover)
+                mod_timer(&ioc->ioc_timer, jiffies +
+                        msecs_to_jiffies(BFA_IOC_TOV_RECOVER));
+}
+
+/**
+ * @brief
+ * IOC heartbeat failure.
+ */
+static void
+bfa_ioc_sm_hbfail(struct bfa_ioc *ioc, enum ioc_event event)
+{
+        switch (event) {
+
+        case IOC_E_ENABLE:
+                ioc->cbfn->enable_cbfn(ioc->bfa, BFA_STATUS_IOC_FAILURE);
+                break;
+
+        case IOC_E_DISABLE:
+                if (ioc->auto_recover)
+                        bfa_ioc_timer_stop(ioc);
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_disabled);
+                break;
+
+        case IOC_E_TIMEOUT:
+                bfa_fsm_set_state(ioc, bfa_ioc_sm_semwait);
+                break;
+
+        case IOC_E_FWREADY:
+                /**
+                 * Recovery is already initiated by other function.
+                 */
+                break;
+
+        case IOC_E_HWERROR:
+                /*
+                 * HB failure notification, ignore.
+                 */
+                break;
+        default:
+                bfa_sm_fault(ioc, event);
+        }
+}
+
+/**
+ * BFA IOC private functions
+ */
+
+static void
+bfa_ioc_disable_comp(struct bfa_ioc *ioc)
+{
+        struct list_head                        *qe;
+        struct bfa_ioc_hbfail_notify *notify;
+
+        ioc->cbfn->disable_cbfn(ioc->bfa);
+
+        /**
+         * Notify common modules registered for notification.
+         */
+        list_for_each(qe, &ioc->hb_notify_q) {
+                notify = (struct bfa_ioc_hbfail_notify *) qe;
+                notify->cbfn(notify->cbarg);
+        }
+}
+
+void
+bfa_nw_ioc_sem_timeout(void *ioc_arg)
+{
+        struct bfa_ioc *ioc = (struct bfa_ioc *) ioc_arg;
+
+        bfa_ioc_hw_sem_get(ioc);
+}
+
+bool
+bfa_nw_ioc_sem_get(void __iomem *sem_reg)
+{
+        u32 r32;
+        int cnt = 0;
+#define BFA_SEM_SPINCNT 3000
+
+        r32 = readl(sem_reg);
+
+        while (r32 && (cnt < BFA_SEM_SPINCNT)) {
+                cnt++;
+                udelay(2);
+                r32 = readl(sem_reg);
+        }
+
+        if (r32 == 0)
+                return true;
+
+        BUG_ON(!(cnt < BFA_SEM_SPINCNT));
+        return false;
+}
+
+void
+bfa_nw_ioc_sem_release(void __iomem *sem_reg)
+{
+        writel(1, sem_reg);
+}
+
+static void
+bfa_ioc_hw_sem_get(struct bfa_ioc *ioc)
+{
+        u32     r32;
+
+        /**
+         * First read to the semaphore register will return 0, subsequent reads
+         * will return 1. Semaphore is released by writing 1 to the register
+         */
+        r32 = readl(ioc->ioc_regs.ioc_sem_reg);
+        if (r32 == 0) {
+                bfa_fsm_send_event(ioc, IOC_E_SEMLOCKED);
+                return;
+        }
+
+        mod_timer(&ioc->sem_timer, jiffies +
+                msecs_to_jiffies(BFA_IOC_HWSEM_TOV));
+}
+
+void
+bfa_nw_ioc_hw_sem_release(struct bfa_ioc *ioc)
+{
+        writel(1, ioc->ioc_regs.ioc_sem_reg);
+}
+
+static void
+bfa_ioc_hw_sem_get_cancel(struct bfa_ioc *ioc)
+{
+        del_timer(&ioc->sem_timer);
+}
+
+/**
+ * @brief
+ * Initialize LPU local memory (aka secondary memory / SRAM)
+ */
+static void
+bfa_ioc_lmem_init(struct bfa_ioc *ioc)
+{
+        u32     pss_ctl;
+        int             i;
+#define PSS_LMEM_INIT_TIME  10000
+
+        pss_ctl = readl(ioc->ioc_regs.pss_ctl_reg);
+        pss_ctl &= ~__PSS_LMEM_RESET;
+        pss_ctl |= __PSS_LMEM_INIT_EN;
+
+        /*
+         * i2c workaround 12.5khz clock
+         */
+        pss_ctl |= __PSS_I2C_CLK_DIV(3UL);
+        writel(pss_ctl, ioc->ioc_regs.pss_ctl_reg);
+
+        /**
+         * wait for memory initialization to be complete
+         */
+        i = 0;
+        do {
+                pss_ctl = readl(ioc->ioc_regs.pss_ctl_reg);
+                i++;
+        } while (!(pss_ctl & __PSS_LMEM_INIT_DONE) && (i < PSS_LMEM_INIT_TIME));
+
+        /**
+         * If memory initialization is not successful, IOC timeout will catch
+         * such failures.
+         */
+        BUG_ON(!(pss_ctl & __PSS_LMEM_INIT_DONE));
+
+        pss_ctl &= ~(__PSS_LMEM_INIT_DONE | __PSS_LMEM_INIT_EN);
+        writel(pss_ctl, ioc->ioc_regs.pss_ctl_reg);
+}
+
+static void
+bfa_ioc_lpu_start(struct bfa_ioc *ioc)
+{
+        u32     pss_ctl;
+
+        /**
+         * Take processor out of reset.
+         */
+        pss_ctl = readl(ioc->ioc_regs.pss_ctl_reg);
+        pss_ctl &= ~__PSS_LPU0_RESET;
+
+        writel(pss_ctl, ioc->ioc_regs.pss_ctl_reg);
+}
+
+static void
+bfa_ioc_lpu_stop(struct bfa_ioc *ioc)
+{
+        u32     pss_ctl;
+
+        /**
+         * Put processors in reset.
+         */
+        pss_ctl = readl(ioc->ioc_regs.pss_ctl_reg);
+        pss_ctl |= (__PSS_LPU0_RESET | __PSS_LPU1_RESET);
+
+        writel(pss_ctl, ioc->ioc_regs.pss_ctl_reg);
+}
+
+/**
+ * Get driver and firmware versions.
+ */
+void
+bfa_nw_ioc_fwver_get(struct bfa_ioc *ioc, struct bfi_ioc_image_hdr *fwhdr)
+{
+        u32     pgnum, pgoff;
+        u32     loff = 0;
+        int             i;
+        u32     *fwsig = (u32 *) fwhdr;
+
+        pgnum = bfa_ioc_smem_pgnum(ioc, loff);
+        pgoff = bfa_ioc_smem_pgoff(ioc, loff);
+        writel(pgnum, ioc->ioc_regs.host_page_num_fn);
+
+        for (i = 0; i < (sizeof(struct bfi_ioc_image_hdr) / sizeof(u32));
+             i++) {
+                fwsig[i] =
+                        swab32(readl((loff) + (ioc->ioc_regs.smem_page_start)));
+                loff += sizeof(u32);
+        }
+}
+
+/**
+ * Returns TRUE if same.
+ */
+bool
+bfa_nw_ioc_fwver_cmp(struct bfa_ioc *ioc, struct bfi_ioc_image_hdr *fwhdr)
+{
+        struct bfi_ioc_image_hdr *drv_fwhdr;
+        int i;
+
+        drv_fwhdr = (struct bfi_ioc_image_hdr *)
+                bfa_cb_image_get_chunk(BFA_IOC_FWIMG_TYPE(ioc), 0);
+
+        for (i = 0; i < BFI_IOC_MD5SUM_SZ; i++) {
+                if (fwhdr->md5sum[i] != drv_fwhdr->md5sum[i])
+                        return false;
+        }
+
+        return true;
+}
+
+/**
+ * Return true if current running version is valid. Firmware signature and
+ * execution context (driver/bios) must match.
+ */
+static bool
+bfa_ioc_fwver_valid(struct bfa_ioc *ioc)
+{
+        struct bfi_ioc_image_hdr fwhdr, *drv_fwhdr;
+
+        /**
+         * If bios/efi boot (flash based) -- return true
+         */
+        if (bfa_ioc_is_optrom(ioc))
+                return true;
+
+        bfa_nw_ioc_fwver_get(ioc, &fwhdr);
+        drv_fwhdr = (struct bfi_ioc_image_hdr *)
+                bfa_cb_image_get_chunk(BFA_IOC_FWIMG_TYPE(ioc), 0);
+
+        if (fwhdr.signature != drv_fwhdr->signature)
+                return false;
+
+        if (fwhdr.exec != drv_fwhdr->exec)
+                return false;
+
+        return bfa_nw_ioc_fwver_cmp(ioc, &fwhdr);
+}
+
+/**
+ * Conditionally flush any pending message from firmware at start.
+ */
+static void
+bfa_ioc_msgflush(struct bfa_ioc *ioc)
+{
+        u32     r32;
+
+        r32 = readl(ioc->ioc_regs.lpu_mbox_cmd);
+        if (r32)
+                writel(1, ioc->ioc_regs.lpu_mbox_cmd);
+}
+
+/**
+ * @img ioc_init_logic.jpg
+ */
+static void
+bfa_ioc_hwinit(struct bfa_ioc *ioc, bool force)
+{
+        enum bfi_ioc_state ioc_fwstate;
+        bool fwvalid;
+
+        ioc_fwstate = readl(ioc->ioc_regs.ioc_fwstate);
+
+        if (force)
+                ioc_fwstate = BFI_IOC_UNINIT;
+
+        /**
+         * check if firmware is valid
+         */
+        fwvalid = (ioc_fwstate == BFI_IOC_UNINIT) ?
+                false : bfa_ioc_fwver_valid(ioc);
+
+        if (!fwvalid) {
+                bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, ioc->pcidev.device_id);
+                return;
+        }
+
+        /**
+         * If hardware initialization is in progress (initialized by other IOC),
+         * just wait for an initialization completion interrupt.
+         */
+        if (ioc_fwstate == BFI_IOC_INITING) {
+                ioc->cbfn->reset_cbfn(ioc->bfa);
+                return;
+        }
+
+        /**
+         * If IOC function is disabled and firmware version is same,
+         * just re-enable IOC.
+         *
+         * If option rom, IOC must not be in operational state. With
+         * convergence, IOC will be in operational state when 2nd driver
+         * is loaded.
+         */
+        if (ioc_fwstate == BFI_IOC_DISABLED ||
+            (!bfa_ioc_is_optrom(ioc) && ioc_fwstate == BFI_IOC_OP)) {
+                /**
+                 * When using MSI-X any pending firmware ready event should
+                 * be flushed. Otherwise MSI-X interrupts are not delivered.
+                 */
+                bfa_ioc_msgflush(ioc);
+                ioc->cbfn->reset_cbfn(ioc->bfa);
+                bfa_fsm_send_event(ioc, IOC_E_FWREADY);
+                return;
+        }
+
+        /**
+         * Initialize the h/w for any other states.
+         */
+        bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, ioc->pcidev.device_id);
+}
+
+void
+bfa_nw_ioc_timeout(void *ioc_arg)
+{
+        struct bfa_ioc *ioc = (struct bfa_ioc *) ioc_arg;
+
+        bfa_fsm_send_event(ioc, IOC_E_TIMEOUT);
+}
+
+static void
+bfa_ioc_mbox_send(struct bfa_ioc *ioc, void *ioc_msg, int len)
+{
+        u32 *msgp = (u32 *) ioc_msg;
+        u32 i;
+
+        BUG_ON(!(len <= BFI_IOC_MSGLEN_MAX));
+
+        /*
+         * first write msg to mailbox registers
+         */
+        for (i = 0; i < len / sizeof(u32); i++)
+                writel(cpu_to_le32(msgp[i]),
+                              ioc->ioc_regs.hfn_mbox + i * sizeof(u32));
+
+        for (; i < BFI_IOC_MSGLEN_MAX / sizeof(u32); i++)
+                writel(0, ioc->ioc_regs.hfn_mbox + i * sizeof(u32));
+
+        /*
+         * write 1 to mailbox CMD to trigger LPU event
+         */
+        writel(1, ioc->ioc_regs.hfn_mbox_cmd);
+        (void) readl(ioc->ioc_regs.hfn_mbox_cmd);
+}
+
+static void
+bfa_ioc_send_enable(struct bfa_ioc *ioc)
+{
+        struct bfi_ioc_ctrl_req enable_req;
+        struct timeval tv;
+
+        bfi_h2i_set(enable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_ENABLE_REQ,
+                    bfa_ioc_portid(ioc));
+        enable_req.ioc_class = ioc->ioc_mc;
+        do_gettimeofday(&tv);
+        enable_req.tv_sec = ntohl(tv.tv_sec);
+        bfa_ioc_mbox_send(ioc, &enable_req, sizeof(struct bfi_ioc_ctrl_req));
+}
+
+static void
+bfa_ioc_send_disable(struct bfa_ioc *ioc)
+{
+        struct bfi_ioc_ctrl_req disable_req;
+
+        bfi_h2i_set(disable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_DISABLE_REQ,
+                    bfa_ioc_portid(ioc));
+        bfa_ioc_mbox_send(ioc, &disable_req, sizeof(struct bfi_ioc_ctrl_req));
+}
+
+static void
+bfa_ioc_send_getattr(struct bfa_ioc *ioc)
+{
+        struct bfi_ioc_getattr_req attr_req;
+
+        bfi_h2i_set(attr_req.mh, BFI_MC_IOC, BFI_IOC_H2I_GETATTR_REQ,
+                    bfa_ioc_portid(ioc));
+        bfa_dma_be_addr_set(attr_req.attr_addr, ioc->attr_dma.pa);
+        bfa_ioc_mbox_send(ioc, &attr_req, sizeof(attr_req));
+}
+
+void
+bfa_nw_ioc_hb_check(void *cbarg)
+{
+        struct bfa_ioc *ioc = cbarg;
+        u32     hb_count;
+
+        hb_count = readl(ioc->ioc_regs.heartbeat);
+        if (ioc->hb_count == hb_count) {
+                pr_crit("Firmware heartbeat failure at %d", hb_count);
+                bfa_ioc_recover(ioc);
+                return;
+        } else {
+                ioc->hb_count = hb_count;
+        }
+
+        bfa_ioc_mbox_poll(ioc);
+        mod_timer(&ioc->hb_timer, jiffies +
+                msecs_to_jiffies(BFA_IOC_HB_TOV));
+}
+
+static void
+bfa_ioc_hb_monitor(struct bfa_ioc *ioc)
+{
+        ioc->hb_count = readl(ioc->ioc_regs.heartbeat);
+        mod_timer(&ioc->hb_timer, jiffies +
+                msecs_to_jiffies(BFA_IOC_HB_TOV));
+}
+
+static void
+bfa_ioc_hb_stop(struct bfa_ioc *ioc)
+{
+        del_timer(&ioc->hb_timer);
+}
+
+/**
+ * @brief
+ *      Initiate a full firmware download.
+ */
+static void
+bfa_ioc_download_fw(struct bfa_ioc *ioc, u32 boot_type,
+                    u32 boot_param)
+{
+        u32 *fwimg;
+        u32 pgnum, pgoff;
+        u32 loff = 0;
+        u32 chunkno = 0;
+        u32 i;
+
+        /**
+         * Initialize LMEM first before code download
+         */
+        bfa_ioc_lmem_init(ioc);
+
+        /**
+         * Flash based firmware boot
+         */
+        if (bfa_ioc_is_optrom(ioc))
+                boot_type = BFI_BOOT_TYPE_FLASH;
+        fwimg = bfa_cb_image_get_chunk(BFA_IOC_FWIMG_TYPE(ioc), chunkno);
+
+        pgnum = bfa_ioc_smem_pgnum(ioc, loff);
+        pgoff = bfa_ioc_smem_pgoff(ioc, loff);
+
+        writel(pgnum, ioc->ioc_regs.host_page_num_fn);
+
+        for (i = 0; i < bfa_cb_image_get_size(BFA_IOC_FWIMG_TYPE(ioc)); i++) {
+                if (BFA_IOC_FLASH_CHUNK_NO(i) != chunkno) {
+                        chunkno = BFA_IOC_FLASH_CHUNK_NO(i);
+                        fwimg = bfa_cb_image_get_chunk(BFA_IOC_FWIMG_TYPE(ioc),
+                                        BFA_IOC_FLASH_CHUNK_ADDR(chunkno));
+                }
+
+                /**
+                 * write smem
+                 */
+                writel((swab32(fwimg[BFA_IOC_FLASH_OFFSET_IN_CHUNK(i)])),
+                              ((ioc->ioc_regs.smem_page_start) + (loff)));
+
+                loff += sizeof(u32);
+
+                /**
+                 * handle page offset wrap around
+                 */
+                loff = PSS_SMEM_PGOFF(loff);
+                if (loff == 0) {
+                        pgnum++;
+                        writel(pgnum,
+                                      ioc->ioc_regs.host_page_num_fn);
+                }
+        }
+
+        writel(bfa_ioc_smem_pgnum(ioc, 0),
+                      ioc->ioc_regs.host_page_num_fn);
+
+        /*
+         * Set boot type and boot param at the end.
+        */
+        writel((swab32(swab32(boot_type))), ((ioc->ioc_regs.smem_page_start)
+                        + (BFI_BOOT_TYPE_OFF)));
+        writel((swab32(swab32(boot_param))), ((ioc->ioc_regs.smem_page_start)
+                        + (BFI_BOOT_PARAM_OFF)));
+}
+
+static void
+bfa_ioc_reset(struct bfa_ioc *ioc, bool force)
+{
+        bfa_ioc_hwinit(ioc, force);
+}
+
+/**
+ * @brief
+ * Update BFA configuration from firmware configuration.
+ */
+static void
+bfa_ioc_getattr_reply(struct bfa_ioc *ioc)
+{
+        struct bfi_ioc_attr *attr = ioc->attr;
+
+        attr->adapter_prop  = ntohl(attr->adapter_prop);
+        attr->card_type     = ntohl(attr->card_type);
+        attr->maxfrsize     = ntohs(attr->maxfrsize);
+
+        bfa_fsm_send_event(ioc, IOC_E_FWRSP_GETATTR);
+}
+
+/**
+ * Attach time initialization of mbox logic.
+ */
+static void
+bfa_ioc_mbox_attach(struct bfa_ioc *ioc)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+        int     mc;
+
+        INIT_LIST_HEAD(&mod->cmd_q);
+        for (mc = 0; mc < BFI_MC_MAX; mc++) {
+                mod->mbhdlr[mc].cbfn = NULL;
+                mod->mbhdlr[mc].cbarg = ioc->bfa;
+        }
+}
+
+/**
+ * Mbox poll timer -- restarts any pending mailbox requests.
+ */
+static void
+bfa_ioc_mbox_poll(struct bfa_ioc *ioc)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+        struct bfa_mbox_cmd *cmd;
+        u32                     stat;
+
+        /**
+         * If no command pending, do nothing
+         */
+        if (list_empty(&mod->cmd_q))
+                return;
+
+        /**
+         * If previous command is not yet fetched by firmware, do nothing
+         */
+        stat = readl(ioc->ioc_regs.hfn_mbox_cmd);
+        if (stat)
+                return;
+
+        /**
+         * Enqueue command to firmware.
+         */
+        bfa_q_deq(&mod->cmd_q, &cmd);
+        bfa_ioc_mbox_send(ioc, cmd->msg, sizeof(cmd->msg));
+}
+
+/**
+ * Cleanup any pending requests.
+ */
+static void
+bfa_ioc_mbox_hbfail(struct bfa_ioc *ioc)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+        struct bfa_mbox_cmd *cmd;
+
+        while (!list_empty(&mod->cmd_q))
+                bfa_q_deq(&mod->cmd_q, &cmd);
+}
+
+/**
+ * IOC public
+ */
+static enum bfa_status
+bfa_ioc_pll_init(struct bfa_ioc *ioc)
+{
+        /*
+         *  Hold semaphore so that nobody can access the chip during init.
+         */
+        bfa_nw_ioc_sem_get(ioc->ioc_regs.ioc_init_sem_reg);
+
+        bfa_ioc_pll_init_asic(ioc);
+
+        ioc->pllinit = true;
+        /*
+         *  release semaphore.
+         */
+        bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_init_sem_reg);
+
+        return BFA_STATUS_OK;
+}
+
+/**
+ * Interface used by diag module to do firmware boot with memory test
+ * as the entry vector.
+ */
+static void
+bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type, u32 boot_param)
+{
+        void __iomem *rb;
+
+        bfa_ioc_stats(ioc, ioc_boots);
+
+        if (bfa_ioc_pll_init(ioc) != BFA_STATUS_OK)
+                return;
+
+        /**
+         * Initialize IOC state of all functions on a chip reset.
+         */
+        rb = ioc->pcidev.pci_bar_kva;
+        if (boot_param == BFI_BOOT_TYPE_MEMTEST) {
+                writel(BFI_IOC_MEMTEST, (rb + BFA_IOC0_STATE_REG));
+                writel(BFI_IOC_MEMTEST, (rb + BFA_IOC1_STATE_REG));
+        } else {
+                writel(BFI_IOC_INITING, (rb + BFA_IOC0_STATE_REG));
+                writel(BFI_IOC_INITING, (rb + BFA_IOC1_STATE_REG));
+        }
+
+        bfa_ioc_msgflush(ioc);
+        bfa_ioc_download_fw(ioc, boot_type, boot_param);
+
+        /**
+         * Enable interrupts just before starting LPU
+         */
+        ioc->cbfn->reset_cbfn(ioc->bfa);
+        bfa_ioc_lpu_start(ioc);
+}
+
+/**
+ * Enable/disable IOC failure auto recovery.
+ */
+void
+bfa_nw_ioc_auto_recover(bool auto_recover)
+{
+        bfa_nw_auto_recover = auto_recover;
+}
+
+bool
+bfa_nw_ioc_is_operational(struct bfa_ioc *ioc)
+{
+        return bfa_fsm_cmp_state(ioc, bfa_ioc_sm_op);
+}
+
+static void
+bfa_ioc_msgget(struct bfa_ioc *ioc, void *mbmsg)
+{
+        u32     *msgp = mbmsg;
+        u32     r32;
+        int             i;
+
+        /**
+         * read the MBOX msg
+         */
+        for (i = 0; i < (sizeof(union bfi_ioc_i2h_msg_u) / sizeof(u32));
+             i++) {
+                r32 = readl(ioc->ioc_regs.lpu_mbox +
+                                   i * sizeof(u32));
+                msgp[i] = htonl(r32);
+        }
+
+        /**
+         * turn off mailbox interrupt by clearing mailbox status
+         */
+        writel(1, ioc->ioc_regs.lpu_mbox_cmd);
+        readl(ioc->ioc_regs.lpu_mbox_cmd);
+}
+
+static void
+bfa_ioc_isr(struct bfa_ioc *ioc, struct bfi_mbmsg *m)
+{
+        union bfi_ioc_i2h_msg_u *msg;
+
+        msg = (union bfi_ioc_i2h_msg_u *) m;
+
+        bfa_ioc_stats(ioc, ioc_isrs);
+
+        switch (msg->mh.msg_id) {
+        case BFI_IOC_I2H_HBEAT:
+                break;
+
+        case BFI_IOC_I2H_READY_EVENT:
+                bfa_fsm_send_event(ioc, IOC_E_FWREADY);
+                break;
+
+        case BFI_IOC_I2H_ENABLE_REPLY:
+                bfa_fsm_send_event(ioc, IOC_E_FWRSP_ENABLE);
+                break;
+
+        case BFI_IOC_I2H_DISABLE_REPLY:
+                bfa_fsm_send_event(ioc, IOC_E_FWRSP_DISABLE);
+                break;
+
+        case BFI_IOC_I2H_GETATTR_REPLY:
+                bfa_ioc_getattr_reply(ioc);
+                break;
+
+        default:
+                BUG_ON(1);
+        }
+}
+
+/**
+ * IOC attach time initialization and setup.
+ *
+ * @param[in]   ioc     memory for IOC
+ * @param[in]   bfa     driver instance structure
+ */
+void
+bfa_nw_ioc_attach(struct bfa_ioc *ioc, void *bfa, struct bfa_ioc_cbfn *cbfn)
+{
+        ioc->bfa        = bfa;
+        ioc->cbfn       = cbfn;
+        ioc->fcmode     = false;
+        ioc->pllinit    = false;
+        ioc->dbg_fwsave_once = true;
+
+        bfa_ioc_mbox_attach(ioc);
+        INIT_LIST_HEAD(&ioc->hb_notify_q);
+
+        bfa_fsm_set_state(ioc, bfa_ioc_sm_reset);
+}
+
+/**
+ * Driver detach time IOC cleanup.
+ */
+void
+bfa_nw_ioc_detach(struct bfa_ioc *ioc)
+{
+        bfa_fsm_send_event(ioc, IOC_E_DETACH);
+}
+
+/**
+ * Setup IOC PCI properties.
+ *
+ * @param[in]   pcidev  PCI device information for this IOC
+ */
+void
+bfa_nw_ioc_pci_init(struct bfa_ioc *ioc, struct bfa_pcidev *pcidev,
+                 enum bfi_mclass mc)
+{
+        ioc->ioc_mc     = mc;
+        ioc->pcidev     = *pcidev;
+        ioc->ctdev      = bfa_asic_id_ct(ioc->pcidev.device_id);
+        ioc->cna        = ioc->ctdev && !ioc->fcmode;
+
+        bfa_nw_ioc_set_ct_hwif(ioc);
+
+        bfa_ioc_map_port(ioc);
+        bfa_ioc_reg_init(ioc);
+}
+
+/**
+ * Initialize IOC dma memory
+ *
+ * @param[in]   dm_kva  kernel virtual address of IOC dma memory
+ * @param[in]   dm_pa   physical address of IOC dma memory
+ */
+void
+bfa_nw_ioc_mem_claim(struct bfa_ioc *ioc,  u8 *dm_kva, u64 dm_pa)
+{
+        /**
+         * dma memory for firmware attribute
+         */
+        ioc->attr_dma.kva = dm_kva;
+        ioc->attr_dma.pa = dm_pa;
+        ioc->attr = (struct bfi_ioc_attr *) dm_kva;
+}
+
+/**
+ * Return size of dma memory required.
+ */
+u32
+bfa_nw_ioc_meminfo(void)
+{
+        return roundup(sizeof(struct bfi_ioc_attr), BFA_DMA_ALIGN_SZ);
+}
+
+void
+bfa_nw_ioc_enable(struct bfa_ioc *ioc)
+{
+        bfa_ioc_stats(ioc, ioc_enables);
+        ioc->dbg_fwsave_once = true;
+
+        bfa_fsm_send_event(ioc, IOC_E_ENABLE);
+}
+
+void
+bfa_nw_ioc_disable(struct bfa_ioc *ioc)
+{
+        bfa_ioc_stats(ioc, ioc_disables);
+        bfa_fsm_send_event(ioc, IOC_E_DISABLE);
+}
+
+static u32
+bfa_ioc_smem_pgnum(struct bfa_ioc *ioc, u32 fmaddr)
+{
+        return PSS_SMEM_PGNUM(ioc->ioc_regs.smem_pg0, fmaddr);
+}
+
+static u32
+bfa_ioc_smem_pgoff(struct bfa_ioc *ioc, u32 fmaddr)
+{
+        return PSS_SMEM_PGOFF(fmaddr);
+}
+
+/**
+ * Register mailbox message handler function, to be called by common modules
+ */
+void
+bfa_nw_ioc_mbox_regisr(struct bfa_ioc *ioc, enum bfi_mclass mc,
+                    bfa_ioc_mbox_mcfunc_t cbfn, void *cbarg)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+
+        mod->mbhdlr[mc].cbfn    = cbfn;
+        mod->mbhdlr[mc].cbarg = cbarg;
+}
+
+/**
+ * Queue a mailbox command request to firmware. Waits if mailbox is busy.
+ * Responsibility of caller to serialize
+ *
+ * @param[in]   ioc     IOC instance
+ * @param[i]    cmd     Mailbox command
+ */
+void
+bfa_nw_ioc_mbox_queue(struct bfa_ioc *ioc, struct bfa_mbox_cmd *cmd)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+        u32                     stat;
+
+        /**
+         * If a previous command is pending, queue new command
+         */
+        if (!list_empty(&mod->cmd_q)) {
+                list_add_tail(&cmd->qe, &mod->cmd_q);
+                return;
+        }
+
+        /**
+         * If mailbox is busy, queue command for poll timer
+         */
+        stat = readl(ioc->ioc_regs.hfn_mbox_cmd);
+        if (stat) {
+                list_add_tail(&cmd->qe, &mod->cmd_q);
+                return;
+        }
+
+        /**
+         * mailbox is free -- queue command to firmware
+         */
+        bfa_ioc_mbox_send(ioc, cmd->msg, sizeof(cmd->msg));
+}
+
+/**
+ * Handle mailbox interrupts
+ */
+void
+bfa_nw_ioc_mbox_isr(struct bfa_ioc *ioc)
+{
+        struct bfa_ioc_mbox_mod *mod = &ioc->mbox_mod;
+        struct bfi_mbmsg m;
+        int                             mc;
+
+        bfa_ioc_msgget(ioc, &m);
+
+        /**
+         * Treat IOC message class as special.
+         */
+        mc = m.mh.msg_class;
+        if (mc == BFI_MC_IOC) {
+                bfa_ioc_isr(ioc, &m);
+                return;
+        }
+
+        if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
+                return;
+
+        mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
+}
+
+void
+bfa_nw_ioc_error_isr(struct bfa_ioc *ioc)
+{
+        bfa_fsm_send_event(ioc, IOC_E_HWERROR);
+}
+
+/**
+ * Add to IOC heartbeat failure notification queue. To be used by common
+ * modules such as cee, port, diag.
+ */
+void
+bfa_nw_ioc_hbfail_register(struct bfa_ioc *ioc,
+                        struct bfa_ioc_hbfail_notify *notify)
+{
+        list_add_tail(&notify->qe, &ioc->hb_notify_q);
+}
+
+#define BFA_MFG_NAME "Brocade"
+static void
+bfa_ioc_get_adapter_attr(struct bfa_ioc *ioc,
+                         struct bfa_adapter_attr *ad_attr)
+{
+        struct bfi_ioc_attr *ioc_attr;
+
+        ioc_attr = ioc->attr;
+
+        bfa_ioc_get_adapter_serial_num(ioc, ad_attr->serial_num);
+        bfa_ioc_get_adapter_fw_ver(ioc, ad_attr->fw_ver);
+        bfa_ioc_get_adapter_optrom_ver(ioc, ad_attr->optrom_ver);
+        bfa_ioc_get_adapter_manufacturer(ioc, ad_attr->manufacturer);
+        memcpy(&ad_attr->vpd, &ioc_attr->vpd,
+                      sizeof(struct bfa_mfg_vpd));
+
+        ad_attr->nports = bfa_ioc_get_nports(ioc);
+        ad_attr->max_speed = bfa_ioc_speed_sup(ioc);
+
+        bfa_ioc_get_adapter_model(ioc, ad_attr->model);
+        /* For now, model descr uses same model string */
+        bfa_ioc_get_adapter_model(ioc, ad_attr->model_descr);
+
+        ad_attr->card_type = ioc_attr->card_type;
+        ad_attr->is_mezz = bfa_mfg_is_mezz(ioc_attr->card_type);
+
+        if (BFI_ADAPTER_IS_SPECIAL(ioc_attr->adapter_prop))
+                ad_attr->prototype = 1;
+        else
+                ad_attr->prototype = 0;
+
+        ad_attr->pwwn = bfa_ioc_get_pwwn(ioc);
+        ad_attr->mac  = bfa_nw_ioc_get_mac(ioc);
+
+        ad_attr->pcie_gen = ioc_attr->pcie_gen;
+        ad_attr->pcie_lanes = ioc_attr->pcie_lanes;
+        ad_attr->pcie_lanes_orig = ioc_attr->pcie_lanes_orig;
+        ad_attr->asic_rev = ioc_attr->asic_rev;
+
+        bfa_ioc_get_pci_chip_rev(ioc, ad_attr->hw_ver);
+
+        ad_attr->cna_capable = ioc->cna;
+        ad_attr->trunk_capable = (ad_attr->nports > 1) && !ioc->cna;
+}
+
+static enum bfa_ioc_type
+bfa_ioc_get_type(struct bfa_ioc *ioc)
+{
+        if (!ioc->ctdev || ioc->fcmode)
+                return BFA_IOC_TYPE_FC;
+        else if (ioc->ioc_mc == BFI_MC_IOCFC)
+                return BFA_IOC_TYPE_FCoE;
+        else if (ioc->ioc_mc == BFI_MC_LL)
+                return BFA_IOC_TYPE_LL;
+        else {
+                BUG_ON(!(ioc->ioc_mc == BFI_MC_LL));
+                return BFA_IOC_TYPE_LL;
+        }
+}
+
+static void
+bfa_ioc_get_adapter_serial_num(struct bfa_ioc *ioc, char *serial_num)
+{
+        memset(serial_num, 0, BFA_ADAPTER_SERIAL_NUM_LEN);
+        memcpy(serial_num,
+                        (void *)ioc->attr->brcd_serialnum,
+                        BFA_ADAPTER_SERIAL_NUM_LEN);
+}
+
+static void
+bfa_ioc_get_adapter_fw_ver(struct bfa_ioc *ioc, char *fw_ver)
+{
+        memset(fw_ver, 0, BFA_VERSION_LEN);
+        memcpy(fw_ver, ioc->attr->fw_version, BFA_VERSION_LEN);
+}
+
+static void
+bfa_ioc_get_pci_chip_rev(struct bfa_ioc *ioc, char *chip_rev)
+{
+        BUG_ON(!(chip_rev));
+
+        memset(chip_rev, 0, BFA_IOC_CHIP_REV_LEN);
+
+        chip_rev[0] = 'R';
+        chip_rev[1] = 'e';
+        chip_rev[2] = 'v';
+        chip_rev[3] = '-';
+        chip_rev[4] = ioc->attr->asic_rev;
+        chip_rev[5] = '\0';
+}
+
+static void
+bfa_ioc_get_adapter_optrom_ver(struct bfa_ioc *ioc, char *optrom_ver)
+{
+        memset(optrom_ver, 0, BFA_VERSION_LEN);
+        memcpy(optrom_ver, ioc->attr->optrom_version,
+                      BFA_VERSION_LEN);
+}
+
+static void
+bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer)
+{
+        memset(manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN);
+        memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+}
+
+static void
+bfa_ioc_get_adapter_model(struct bfa_ioc *ioc, char *model)
+{
+        struct bfi_ioc_attr *ioc_attr;
+
+        BUG_ON(!(model));
+        memset(model, 0, BFA_ADAPTER_MODEL_NAME_LEN);
+
+        ioc_attr = ioc->attr;
+
+        /**
+         * model name
+         */
+        snprintf(model, BFA_ADAPTER_MODEL_NAME_LEN, "%s-%u",
+                BFA_MFG_NAME, ioc_attr->card_type);
+}
+
+static enum bfa_ioc_state
+bfa_ioc_get_state(struct bfa_ioc *ioc)
+{
+        return bfa_sm_to_state(ioc_sm_table, ioc->fsm);
+}
+
+void
+bfa_nw_ioc_get_attr(struct bfa_ioc *ioc, struct bfa_ioc_attr *ioc_attr)
+{
+        memset((void *)ioc_attr, 0, sizeof(struct bfa_ioc_attr));
+
+        ioc_attr->state = bfa_ioc_get_state(ioc);
+        ioc_attr->port_id = ioc->port_id;
+
+        ioc_attr->ioc_type = bfa_ioc_get_type(ioc);
+
+        bfa_ioc_get_adapter_attr(ioc, &ioc_attr->adapter_attr);
+
+        ioc_attr->pci_attr.device_id = ioc->pcidev.device_id;
+        ioc_attr->pci_attr.pcifn = ioc->pcidev.pci_func;
+        bfa_ioc_get_pci_chip_rev(ioc, ioc_attr->pci_attr.chip_rev);
+}
+
+/**
+ * WWN public
+ */
+static u64
+bfa_ioc_get_pwwn(struct bfa_ioc *ioc)
+{
+        return ioc->attr->pwwn;
+}
+
+mac_t
+bfa_nw_ioc_get_mac(struct bfa_ioc *ioc)
+{
+        /*
+         * Currently mfg mac is used as FCoE enode mac (not configured by PBC)
+         */
+        if (bfa_ioc_get_type(ioc) == BFA_IOC_TYPE_FCoE)
+                return bfa_ioc_get_mfg_mac(ioc);
+        else
+                return ioc->attr->mac;
+}
+
+static mac_t
+bfa_ioc_get_mfg_mac(struct bfa_ioc *ioc)
+{
+        mac_t   m;
+
+        m = ioc->attr->mfg_mac;
+        if (bfa_mfg_is_old_wwn_mac_model(ioc->attr->card_type))
+                m.mac[MAC_ADDRLEN - 1] += bfa_ioc_pcifn(ioc);
+        else
+                bfa_mfg_increment_wwn_mac(&(m.mac[MAC_ADDRLEN-3]),
+                        bfa_ioc_pcifn(ioc));
+
+        return m;
+}
+
+/**
+ * Firmware failure detected. Start recovery actions.
+ */
+static void
+bfa_ioc_recover(struct bfa_ioc *ioc)
+{
+        bfa_ioc_stats(ioc, ioc_hbfails);
+        bfa_fsm_send_event(ioc, IOC_E_HBFAIL);
+}
+
+static void
+bfa_ioc_check_attr_wwns(struct bfa_ioc *ioc)
+{
+        if (bfa_ioc_get_type(ioc) == BFA_IOC_TYPE_LL)
+                return;
+
+}
diff --git a/drivers/net/bna/bfa_ioc.h b/drivers/net/bna/bfa_ioc.h
new file mode 100644
index 000000000000..7f0719e17efc
--- /dev/null
+++ b/drivers/net/bna/bfa_ioc.h
@@ -0,0 +1,301 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __BFA_IOC_H__
+#define __BFA_IOC_H__
+
+#include "bfa_sm.h"
+#include "bfi.h"
+#include "cna.h"
+
+#define BFA_IOC_TOV             3000    /* msecs */
+#define BFA_IOC_HWSEM_TOV       500     /* msecs */
+#define BFA_IOC_HB_TOV          500     /* msecs */
+#define BFA_IOC_HWINIT_MAX      2
+#define BFA_IOC_TOV_RECOVER     BFA_IOC_HB_TOV
+
+/**
+ * Generic Scatter Gather Element used by driver
+ */
+struct bfa_sge {
+        u32     sg_len;
+        void    *sg_addr;
+};
+
+/**
+ * PCI device information required by IOC
+ */
+struct bfa_pcidev {
+        int     pci_slot;
+        u8      pci_func;
+        u16     device_id;
+        void    __iomem *pci_bar_kva;
+};
+
+/**
+ * Structure used to remember the DMA-able memory block's KVA and Physical
+ * Address
+ */
+struct bfa_dma {
+        void    *kva;   /* ! Kernel virtual address     */
+        u64     pa;     /* ! Physical address           */
+};
+
+#define BFA_DMA_ALIGN_SZ        256
+
+/**
+ * smem size for Crossbow and Catapult
+ */
+#define BFI_SMEM_CB_SIZE        0x200000U       /* ! 2MB for crossbow   */
+#define BFI_SMEM_CT_SIZE        0x280000U       /* ! 2.5MB for catapult */
+
+/**
+ * @brief BFA dma address assignment macro
+ */
+#define bfa_dma_addr_set(dma_addr, pa)  \
+                __bfa_dma_addr_set(&dma_addr, (u64)pa)
+
+static inline void
+__bfa_dma_addr_set(union bfi_addr_u *dma_addr, u64 pa)
+{
+        dma_addr->a32.addr_lo = (u32) pa;
+        dma_addr->a32.addr_hi = (u32) (upper_32_bits(pa));
+}
+
+/**
+ * @brief BFA dma address assignment macro. (big endian format)
+ */
+#define bfa_dma_be_addr_set(dma_addr, pa)       \
+                __bfa_dma_be_addr_set(&dma_addr, (u64)pa)
+static inline void
+__bfa_dma_be_addr_set(union bfi_addr_u *dma_addr, u64 pa)
+{
+        dma_addr->a32.addr_lo = (u32) htonl(pa);
+        dma_addr->a32.addr_hi = (u32) htonl(upper_32_bits(pa));
+}
+
+struct bfa_ioc_regs {
+        void __iomem *hfn_mbox_cmd;
+        void __iomem *hfn_mbox;
+        void __iomem *lpu_mbox_cmd;
+        void __iomem *lpu_mbox;
+        void __iomem *pss_ctl_reg;
+        void __iomem *pss_err_status_reg;
+        void __iomem *app_pll_fast_ctl_reg;
+        void __iomem *app_pll_slow_ctl_reg;
+        void __iomem *ioc_sem_reg;
+        void __iomem *ioc_usage_sem_reg;
+        void __iomem *ioc_init_sem_reg;
+        void __iomem *ioc_usage_reg;
+        void __iomem *host_page_num_fn;
+        void __iomem *heartbeat;
+        void __iomem *ioc_fwstate;
+        void __iomem *ll_halt;
+        void __iomem *err_set;
+        void __iomem *shirq_isr_next;
+        void __iomem *shirq_msk_next;
+        void __iomem *smem_page_start;
+        u32     smem_pg0;
+};
+
+/**
+ * IOC Mailbox structures
+ */
+struct bfa_mbox_cmd {
+        struct list_head        qe;
+        u32                     msg[BFI_IOC_MSGSZ];
+};
+
+/**
+ * IOC mailbox module
+ */
+typedef void (*bfa_ioc_mbox_mcfunc_t)(void *cbarg, struct bfi_mbmsg *m);
+struct bfa_ioc_mbox_mod {
+        struct list_head        cmd_q;          /*!< pending mbox queue */
+        int                     nmclass;        /*!< number of handlers */
+        struct {
+                bfa_ioc_mbox_mcfunc_t   cbfn;   /*!< message handlers   */
+                void                    *cbarg;
+        } mbhdlr[BFI_MC_MAX];
+};
+
+/**
+ * IOC callback function interfaces
+ */
+typedef void (*bfa_ioc_enable_cbfn_t)(void *bfa, enum bfa_status status);
+typedef void (*bfa_ioc_disable_cbfn_t)(void *bfa);
+typedef void (*bfa_ioc_hbfail_cbfn_t)(void *bfa);
+typedef void (*bfa_ioc_reset_cbfn_t)(void *bfa);
+struct bfa_ioc_cbfn {
+        bfa_ioc_enable_cbfn_t   enable_cbfn;
+        bfa_ioc_disable_cbfn_t  disable_cbfn;
+        bfa_ioc_hbfail_cbfn_t   hbfail_cbfn;
+        bfa_ioc_reset_cbfn_t    reset_cbfn;
+};
+
+/**
+ * Heartbeat failure notification queue element.
+ */
+struct bfa_ioc_hbfail_notify {
+        struct list_head        qe;
+        bfa_ioc_hbfail_cbfn_t   cbfn;
+        void                    *cbarg;
+};
+
+/**
+ * Initialize a heartbeat failure notification structure
+ */
+#define bfa_ioc_hbfail_init(__notify, __cbfn, __cbarg) do {     \
+        (__notify)->cbfn = (__cbfn);                            \
+        (__notify)->cbarg = (__cbarg);                          \
+} while (0)
+
+struct bfa_ioc {
+        bfa_fsm_t               fsm;
+        struct bfa              *bfa;
+        struct bfa_pcidev       pcidev;
+        struct bfa_timer_mod    *timer_mod;
+        struct timer_list       ioc_timer;
+        struct timer_list       sem_timer;
+        struct timer_list       hb_timer;
+        u32                     hb_count;
+        u32                     retry_count;
+        struct list_head        hb_notify_q;
+        void                    *dbg_fwsave;
+        int                     dbg_fwsave_len;
+        bool                    dbg_fwsave_once;
+        enum bfi_mclass         ioc_mc;
+        struct bfa_ioc_regs     ioc_regs;
+        struct bfa_ioc_drv_stats stats;
+        bool                    auto_recover;
+        bool                    fcmode;
+        bool                    ctdev;
+        bool                    cna;
+        bool                    pllinit;
+        bool                    stats_busy;     /*!< outstanding stats */
+        u8                      port_id;
+
+        struct bfa_dma          attr_dma;
+        struct bfi_ioc_attr     *attr;
+        struct bfa_ioc_cbfn     *cbfn;
+        struct bfa_ioc_mbox_mod mbox_mod;
+        struct bfa_ioc_hwif     *ioc_hwif;
+};
+
+struct bfa_ioc_hwif {
+        enum bfa_status (*ioc_pll_init) (void __iomem *rb, bool fcmode);
+        bool            (*ioc_firmware_lock)    (struct bfa_ioc *ioc);
+        void            (*ioc_firmware_unlock)  (struct bfa_ioc *ioc);
+        void            (*ioc_reg_init) (struct bfa_ioc *ioc);
+        void            (*ioc_map_port) (struct bfa_ioc *ioc);
+        void            (*ioc_isr_mode_set)     (struct bfa_ioc *ioc,
+                                        bool msix);
+        void            (*ioc_notify_hbfail)    (struct bfa_ioc *ioc);
+        void            (*ioc_ownership_reset)  (struct bfa_ioc *ioc);
+};
+
+#define bfa_ioc_pcifn(__ioc)            ((__ioc)->pcidev.pci_func)
+#define bfa_ioc_devid(__ioc)            ((__ioc)->pcidev.device_id)
+#define bfa_ioc_bar0(__ioc)             ((__ioc)->pcidev.pci_bar_kva)
+#define bfa_ioc_portid(__ioc)           ((__ioc)->port_id)
+#define bfa_ioc_fetch_stats(__ioc, __stats) \
+                (((__stats)->drv_stats) = (__ioc)->stats)
+#define bfa_ioc_clr_stats(__ioc)        \
+                memset(&(__ioc)->stats, 0, sizeof((__ioc)->stats))
+#define bfa_ioc_maxfrsize(__ioc)        ((__ioc)->attr->maxfrsize)
+#define bfa_ioc_rx_bbcredit(__ioc)      ((__ioc)->attr->rx_bbcredit)
+#define bfa_ioc_speed_sup(__ioc)        \
+        BFI_ADAPTER_GETP(SPEED, (__ioc)->attr->adapter_prop)
+#define bfa_ioc_get_nports(__ioc)       \
+        BFI_ADAPTER_GETP(NPORTS, (__ioc)->attr->adapter_prop)
+
+#define bfa_ioc_stats(_ioc, _stats)     ((_ioc)->stats._stats++)
+#define BFA_IOC_FWIMG_MINSZ     (16 * 1024)
+#define BFA_IOC_FWIMG_TYPE(__ioc)                                       \
+        (((__ioc)->ctdev) ?                                             \
+         (((__ioc)->fcmode) ? BFI_IMAGE_CT_FC : BFI_IMAGE_CT_CNA) :     \
+         BFI_IMAGE_CB_FC)
+#define BFA_IOC_FW_SMEM_SIZE(__ioc)                                     \
+        (((__ioc)->ctdev) ? BFI_SMEM_CT_SIZE : BFI_SMEM_CB_SIZE)
+#define BFA_IOC_FLASH_CHUNK_NO(off)             (off / BFI_FLASH_CHUNK_SZ_WORDS)
+#define BFA_IOC_FLASH_OFFSET_IN_CHUNK(off)      (off % BFI_FLASH_CHUNK_SZ_WORDS)
+#define BFA_IOC_FLASH_CHUNK_ADDR(chunkno)  (chunkno * BFI_FLASH_CHUNK_SZ_WORDS)
+
+/**
+ * IOC mailbox interface
+ */
+void bfa_nw_ioc_mbox_queue(struct bfa_ioc *ioc, struct bfa_mbox_cmd *cmd);
+void bfa_nw_ioc_mbox_isr(struct bfa_ioc *ioc);
+void bfa_nw_ioc_mbox_regisr(struct bfa_ioc *ioc, enum bfi_mclass mc,
+                bfa_ioc_mbox_mcfunc_t cbfn, void *cbarg);
+
+/**
+ * IOC interfaces
+ */
+
+#define bfa_ioc_pll_init_asic(__ioc) \
+        ((__ioc)->ioc_hwif->ioc_pll_init((__ioc)->pcidev.pci_bar_kva, \
+                           (__ioc)->fcmode))
+
+#define bfa_ioc_isr_mode_set(__ioc, __msix)                     \
+                        ((__ioc)->ioc_hwif->ioc_isr_mode_set(__ioc, __msix))
+#define bfa_ioc_ownership_reset(__ioc)                          \
+                        ((__ioc)->ioc_hwif->ioc_ownership_reset(__ioc))
+
+void bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc);
+
+void bfa_nw_ioc_attach(struct bfa_ioc *ioc, void *bfa,
+                struct bfa_ioc_cbfn *cbfn);
+void bfa_nw_ioc_auto_recover(bool auto_recover);
+void bfa_nw_ioc_detach(struct bfa_ioc *ioc);
+void bfa_nw_ioc_pci_init(struct bfa_ioc *ioc, struct bfa_pcidev *pcidev,
+                enum bfi_mclass mc);
+u32 bfa_nw_ioc_meminfo(void);
+void bfa_nw_ioc_mem_claim(struct bfa_ioc *ioc,  u8 *dm_kva, u64 dm_pa);
+void bfa_nw_ioc_enable(struct bfa_ioc *ioc);
+void bfa_nw_ioc_disable(struct bfa_ioc *ioc);
+
+void bfa_nw_ioc_error_isr(struct bfa_ioc *ioc);
+bool bfa_nw_ioc_is_operational(struct bfa_ioc *ioc);
+
+void bfa_nw_ioc_get_attr(struct bfa_ioc *ioc, struct bfa_ioc_attr *ioc_attr);
+void bfa_nw_ioc_hbfail_register(struct bfa_ioc *ioc,
+        struct bfa_ioc_hbfail_notify *notify);
+bool bfa_nw_ioc_sem_get(void __iomem *sem_reg);
+void bfa_nw_ioc_sem_release(void __iomem *sem_reg);
+void bfa_nw_ioc_hw_sem_release(struct bfa_ioc *ioc);
+void bfa_nw_ioc_fwver_get(struct bfa_ioc *ioc,
+                        struct bfi_ioc_image_hdr *fwhdr);
+bool bfa_nw_ioc_fwver_cmp(struct bfa_ioc *ioc,
+                        struct bfi_ioc_image_hdr *fwhdr);
+mac_t bfa_nw_ioc_get_mac(struct bfa_ioc *ioc);
+
+/*
+ * Timeout APIs
+ */
+void bfa_nw_ioc_timeout(void *ioc);
+void bfa_nw_ioc_hb_check(void *ioc);
+void bfa_nw_ioc_sem_timeout(void *ioc);
+
+/*
+ * F/W Image Size & Chunk
+ */
+u32 *bfa_cb_image_get_chunk(int type, u32 off);
+u32 bfa_cb_image_get_size(int type);
+
+#endif /* __BFA_IOC_H__ */
diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
new file mode 100644
index 000000000000..462857cbab9b
--- /dev/null
+++ b/drivers/net/bna/bfa_ioc_ct.c
@@ -0,0 +1,392 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#include "bfa_ioc.h"
+#include "cna.h"
+#include "bfi.h"
+#include "bfi_ctreg.h"
+#include "bfa_defs.h"
+
+/*
+ * forward declarations
+ */
+static bool bfa_ioc_ct_firmware_lock(struct bfa_ioc *ioc);
+static void bfa_ioc_ct_firmware_unlock(struct bfa_ioc *ioc);
+static void bfa_ioc_ct_reg_init(struct bfa_ioc *ioc);
+static void bfa_ioc_ct_map_port(struct bfa_ioc *ioc);
+static void bfa_ioc_ct_isr_mode_set(struct bfa_ioc *ioc, bool msix);
+static void bfa_ioc_ct_notify_hbfail(struct bfa_ioc *ioc);
+static void bfa_ioc_ct_ownership_reset(struct bfa_ioc *ioc);
+static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
+
+struct bfa_ioc_hwif nw_hwif_ct;
+
+/**
+ * Called from bfa_ioc_attach() to map asic specific calls.
+ */
+void
+bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
+{
+        nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
+        nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
+        nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
+        nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
+        nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
+        nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
+        nw_hwif_ct.ioc_notify_hbfail = bfa_ioc_ct_notify_hbfail;
+        nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
+
+        ioc->ioc_hwif = &nw_hwif_ct;
+}
+
+/**
+ * Return true if firmware of current driver matches the running firmware.
+ */
+static bool
+bfa_ioc_ct_firmware_lock(struct bfa_ioc *ioc)
+{
+        enum bfi_ioc_state ioc_fwstate;
+        u32 usecnt;
+        struct bfi_ioc_image_hdr fwhdr;
+
+        /**
+         * Firmware match check is relevant only for CNA.
+         */
+        if (!ioc->cna)
+                return true;
+
+        /**
+         * If bios boot (flash based) -- do not increment usage count
+         */
+        if (bfa_cb_image_get_size(BFA_IOC_FWIMG_TYPE(ioc)) <
+                                                BFA_IOC_FWIMG_MINSZ)
+                return true;
+
+        bfa_nw_ioc_sem_get(ioc->ioc_regs.ioc_usage_sem_reg);
+        usecnt = readl(ioc->ioc_regs.ioc_usage_reg);
+
+        /**
+         * If usage count is 0, always return TRUE.
+         */
+        if (usecnt == 0) {
+                writel(1, ioc->ioc_regs.ioc_usage_reg);
+                bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_usage_sem_reg);
+                return true;
+        }
+
+        ioc_fwstate = readl(ioc->ioc_regs.ioc_fwstate);
+
+        /**
+         * Use count cannot be non-zero and chip in uninitialized state.
+         */
+        BUG_ON(!(ioc_fwstate != BFI_IOC_UNINIT));
+
+        /**
+         * Check if another driver with a different firmware is active
+         */
+        bfa_nw_ioc_fwver_get(ioc, &fwhdr);
+        if (!bfa_nw_ioc_fwver_cmp(ioc, &fwhdr)) {
+                bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_usage_sem_reg);
+                return false;
+        }
+
+        /**
+         * Same firmware version. Increment the reference count.
+         */
+        usecnt++;
+        writel(usecnt, ioc->ioc_regs.ioc_usage_reg);
+        bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_usage_sem_reg);
+        return true;
+}
+
+static void
+bfa_ioc_ct_firmware_unlock(struct bfa_ioc *ioc)
+{
+        u32 usecnt;
+
+        /**
+         * Firmware lock is relevant only for CNA.
+         */
+        if (!ioc->cna)
+                return;
+
+        /**
+         * If bios boot (flash based) -- do not decrement usage count
+         */
+        if (bfa_cb_image_get_size(BFA_IOC_FWIMG_TYPE(ioc)) <
+                                                BFA_IOC_FWIMG_MINSZ)
+                return;
+
+        /**
+         * decrement usage count
+         */
+        bfa_nw_ioc_sem_get(ioc->ioc_regs.ioc_usage_sem_reg);
+        usecnt = readl(ioc->ioc_regs.ioc_usage_reg);
+        BUG_ON(!(usecnt > 0));
+
+        usecnt--;
+        writel(usecnt, ioc->ioc_regs.ioc_usage_reg);
+
+        bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_usage_sem_reg);
+}
+
+/**
+ * Notify other functions on HB failure.
+ */
+static void
+bfa_ioc_ct_notify_hbfail(struct bfa_ioc *ioc)
+{
+        if (ioc->cna) {
+                writel(__FW_INIT_HALT_P, ioc->ioc_regs.ll_halt);
+                /* Wait for halt to take effect */
+                readl(ioc->ioc_regs.ll_halt);
+        } else {
+                writel(__PSS_ERR_STATUS_SET, ioc->ioc_regs.err_set);
+                readl(ioc->ioc_regs.err_set);
+        }
+}
+
+/**
+ * Host to LPU mailbox message addresses
+ */
+static struct { u32 hfn_mbox, lpu_mbox, hfn_pgn; } iocreg_fnreg[] = {
+        { HOSTFN0_LPU_MBOX0_0, LPU_HOSTFN0_MBOX0_0, HOST_PAGE_NUM_FN0 },
+        { HOSTFN1_LPU_MBOX0_8, LPU_HOSTFN1_MBOX0_8, HOST_PAGE_NUM_FN1 },
+        { HOSTFN2_LPU_MBOX0_0, LPU_HOSTFN2_MBOX0_0, HOST_PAGE_NUM_FN2 },
+        { HOSTFN3_LPU_MBOX0_8, LPU_HOSTFN3_MBOX0_8, HOST_PAGE_NUM_FN3 }
+};
+
+/**
+ * Host <-> LPU mailbox command/status registers - port 0
+ */
+static struct { u32 hfn, lpu; } iocreg_mbcmd_p0[] = {
+        { HOSTFN0_LPU0_MBOX0_CMD_STAT, LPU0_HOSTFN0_MBOX0_CMD_STAT },
+        { HOSTFN1_LPU0_MBOX0_CMD_STAT, LPU0_HOSTFN1_MBOX0_CMD_STAT },
+        { HOSTFN2_LPU0_MBOX0_CMD_STAT, LPU0_HOSTFN2_MBOX0_CMD_STAT },
+        { HOSTFN3_LPU0_MBOX0_CMD_STAT, LPU0_HOSTFN3_MBOX0_CMD_STAT }
+};
+
+/**
+ * Host <-> LPU mailbox command/status registers - port 1
+ */
+static struct { u32 hfn, lpu; } iocreg_mbcmd_p1[] = {
+        { HOSTFN0_LPU1_MBOX0_CMD_STAT, LPU1_HOSTFN0_MBOX0_CMD_STAT },
+        { HOSTFN1_LPU1_MBOX0_CMD_STAT, LPU1_HOSTFN1_MBOX0_CMD_STAT },
+        { HOSTFN2_LPU1_MBOX0_CMD_STAT, LPU1_HOSTFN2_MBOX0_CMD_STAT },
+        { HOSTFN3_LPU1_MBOX0_CMD_STAT, LPU1_HOSTFN3_MBOX0_CMD_STAT }
+};
+
+static void
+bfa_ioc_ct_reg_init(struct bfa_ioc *ioc)
+{
+        void __iomem *rb;
+        int             pcifn = bfa_ioc_pcifn(ioc);
+
+        rb = bfa_ioc_bar0(ioc);
+
+        ioc->ioc_regs.hfn_mbox = rb + iocreg_fnreg[pcifn].hfn_mbox;
+        ioc->ioc_regs.lpu_mbox = rb + iocreg_fnreg[pcifn].lpu_mbox;
+        ioc->ioc_regs.host_page_num_fn = rb + iocreg_fnreg[pcifn].hfn_pgn;
+
+        if (ioc->port_id == 0) {
+                ioc->ioc_regs.heartbeat = rb + BFA_IOC0_HBEAT_REG;
+                ioc->ioc_regs.ioc_fwstate = rb + BFA_IOC0_STATE_REG;
+                ioc->ioc_regs.hfn_mbox_cmd = rb + iocreg_mbcmd_p0[pcifn].hfn;
+                ioc->ioc_regs.lpu_mbox_cmd = rb + iocreg_mbcmd_p0[pcifn].lpu;
+                ioc->ioc_regs.ll_halt = rb + FW_INIT_HALT_P0;
+        } else {
+                ioc->ioc_regs.heartbeat = (rb + BFA_IOC1_HBEAT_REG);
+                ioc->ioc_regs.ioc_fwstate = (rb + BFA_IOC1_STATE_REG);
+                ioc->ioc_regs.hfn_mbox_cmd = rb + iocreg_mbcmd_p1[pcifn].hfn;
+                ioc->ioc_regs.lpu_mbox_cmd = rb + iocreg_mbcmd_p1[pcifn].lpu;
+                ioc->ioc_regs.ll_halt = rb + FW_INIT_HALT_P1;
+        }
+
+        /*
+         * PSS control registers
+         */
+        ioc->ioc_regs.pss_ctl_reg = (rb + PSS_CTL_REG);
+        ioc->ioc_regs.pss_err_status_reg = (rb + PSS_ERR_STATUS_REG);
+        ioc->ioc_regs.app_pll_fast_ctl_reg = (rb + APP_PLL_425_CTL_REG);
+        ioc->ioc_regs.app_pll_slow_ctl_reg = (rb + APP_PLL_312_CTL_REG);
+
+        /*
+         * IOC semaphore registers and serialization
+         */
+        ioc->ioc_regs.ioc_sem_reg = (rb + HOST_SEM0_REG);
+        ioc->ioc_regs.ioc_usage_sem_reg = (rb + HOST_SEM1_REG);
+        ioc->ioc_regs.ioc_init_sem_reg = (rb + HOST_SEM2_REG);
+        ioc->ioc_regs.ioc_usage_reg = (rb + BFA_FW_USE_COUNT);
+
+        /**
+         * sram memory access
+         */
+        ioc->ioc_regs.smem_page_start = (rb + PSS_SMEM_PAGE_START);
+        ioc->ioc_regs.smem_pg0 = BFI_IOC_SMEM_PG0_CT;
+
+        /*
+         * err set reg : for notification of hb failure in fcmode
+         */
+        ioc->ioc_regs.err_set = (rb + ERR_SET_REG);
+}
+
+/**
+ * Initialize IOC to port mapping.
+ */
+
+#define FNC_PERS_FN_SHIFT(__fn) ((__fn) * 8)
+static void
+bfa_ioc_ct_map_port(struct bfa_ioc *ioc)
+{
+        void __iomem *rb = ioc->pcidev.pci_bar_kva;
+        u32     r32;
+
+        /**
+         * For catapult, base port id on personality register and IOC type
+         */
+        r32 = readl(rb + FNC_PERS_REG);
+        r32 >>= FNC_PERS_FN_SHIFT(bfa_ioc_pcifn(ioc));
+        ioc->port_id = (r32 & __F0_PORT_MAP_MK) >> __F0_PORT_MAP_SH;
+
+}
+
+/**
+ * Set interrupt mode for a function: INTX or MSIX
+ */
+static void
+bfa_ioc_ct_isr_mode_set(struct bfa_ioc *ioc, bool msix)
+{
+        void __iomem *rb = ioc->pcidev.pci_bar_kva;
+        u32     r32, mode;
+
+        r32 = readl(rb + FNC_PERS_REG);
+
+        mode = (r32 >> FNC_PERS_FN_SHIFT(bfa_ioc_pcifn(ioc))) &
+                __F0_INTX_STATUS;
+
+        /**
+         * If already in desired mode, do not change anything
+         */
+        if (!msix && mode)
+                return;
+
+        if (msix)
+                mode = __F0_INTX_STATUS_MSIX;
+        else
+                mode = __F0_INTX_STATUS_INTA;
+
+        r32 &= ~(__F0_INTX_STATUS << FNC_PERS_FN_SHIFT(bfa_ioc_pcifn(ioc)));
+        r32 |= (mode << FNC_PERS_FN_SHIFT(bfa_ioc_pcifn(ioc)));
+
+        writel(r32, rb + FNC_PERS_REG);
+}
+
+/**
+ * Cleanup hw semaphore and usecnt registers
+ */
+static void
+bfa_ioc_ct_ownership_reset(struct bfa_ioc *ioc)
+{
+        if (ioc->cna) {
+                bfa_nw_ioc_sem_get(ioc->ioc_regs.ioc_usage_sem_reg);
+                writel(0, ioc->ioc_regs.ioc_usage_reg);
+                bfa_nw_ioc_sem_release(ioc->ioc_regs.ioc_usage_sem_reg);
+        }
+
+        /*
+         * Read the hw sem reg to make sure that it is locked
+         * before we clear it. If it is not locked, writing 1
+         * will lock it instead of clearing it.
+         */
+        readl(ioc->ioc_regs.ioc_sem_reg);
+        bfa_nw_ioc_hw_sem_release(ioc);
+}
+
+static enum bfa_status
+bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode)
+{
+        u32     pll_sclk, pll_fclk, r32;
+
+        pll_sclk = __APP_PLL_312_LRESETN | __APP_PLL_312_ENARST |
+                __APP_PLL_312_RSEL200500 | __APP_PLL_312_P0_1(3U) |
+                __APP_PLL_312_JITLMT0_1(3U) |
+                __APP_PLL_312_CNTLMT0_1(1U);
+        pll_fclk = __APP_PLL_425_LRESETN | __APP_PLL_425_ENARST |
+                __APP_PLL_425_RSEL200500 | __APP_PLL_425_P0_1(3U) |
+                __APP_PLL_425_JITLMT0_1(3U) |
+                __APP_PLL_425_CNTLMT0_1(1U);
+        if (fcmode) {
+                writel(0, (rb + OP_MODE));
+                writel(__APP_EMS_CMLCKSEL |
+                                __APP_EMS_REFCKBUFEN2 |
+                                __APP_EMS_CHANNEL_SEL,
+                                (rb + ETH_MAC_SER_REG));
+        } else {
+                writel(__GLOBAL_FCOE_MODE, (rb + OP_MODE));
+                writel(__APP_EMS_REFCKBUFEN1,
+                                (rb + ETH_MAC_SER_REG));
+        }
+        writel(BFI_IOC_UNINIT, (rb + BFA_IOC0_STATE_REG));
+        writel(BFI_IOC_UNINIT, (rb + BFA_IOC1_STATE_REG));
+        writel(0xffffffffU, (rb + HOSTFN0_INT_MSK));
+        writel(0xffffffffU, (rb + HOSTFN1_INT_MSK));
+        writel(0xffffffffU, (rb + HOSTFN0_INT_STATUS));
+        writel(0xffffffffU, (rb + HOSTFN1_INT_STATUS));
+        writel(0xffffffffU, (rb + HOSTFN0_INT_MSK));
+        writel(0xffffffffU, (rb + HOSTFN1_INT_MSK));
+        writel(pll_sclk |
+                __APP_PLL_312_LOGIC_SOFT_RESET,
+                rb + APP_PLL_312_CTL_REG);
+        writel(pll_fclk |
+                __APP_PLL_425_LOGIC_SOFT_RESET,
+                rb + APP_PLL_425_CTL_REG);
+        writel(pll_sclk |
+                __APP_PLL_312_LOGIC_SOFT_RESET | __APP_PLL_312_ENABLE,
+                rb + APP_PLL_312_CTL_REG);
+        writel(pll_fclk |
+                __APP_PLL_425_LOGIC_SOFT_RESET | __APP_PLL_425_ENABLE,
+                rb + APP_PLL_425_CTL_REG);
+        readl(rb + HOSTFN0_INT_MSK);
+        udelay(2000);
+        writel(0xffffffffU, (rb + HOSTFN0_INT_STATUS));
+        writel(0xffffffffU, (rb + HOSTFN1_INT_STATUS));
+        writel(pll_sclk |
+                __APP_PLL_312_ENABLE,
+                rb + APP_PLL_312_CTL_REG);
+        writel(pll_fclk |
+                __APP_PLL_425_ENABLE,
+                rb + APP_PLL_425_CTL_REG);
+        if (!fcmode) {
+                writel(__PMM_1T_RESET_P, (rb + PMM_1T_RESET_REG_P0));
+                writel(__PMM_1T_RESET_P, (rb + PMM_1T_RESET_REG_P1));
+        }
+        r32 = readl((rb + PSS_CTL_REG));
+        r32 &= ~__PSS_LMEM_RESET;
+        writel(r32, (rb + PSS_CTL_REG));
+        udelay(1000);
+        if (!fcmode) {
+                writel(0, (rb + PMM_1T_RESET_REG_P0));
+                writel(0, (rb + PMM_1T_RESET_REG_P1));
+        }
+
+        writel(__EDRAM_BISTR_START, (rb + MBIST_CTL_REG));
+        udelay(1000);
+        r32 = readl((rb + MBIST_STAT_REG));
+        writel(0, (rb + MBIST_CTL_REG));
+        return BFA_STATUS_OK;
+}
diff --git a/drivers/net/bna/bfa_sm.h b/drivers/net/bna/bfa_sm.h
new file mode 100644
index 000000000000..1d3d975d6f68
--- /dev/null
+++ b/drivers/net/bna/bfa_sm.h
@@ -0,0 +1,88 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+/**
+ * @file bfasm.h State machine defines
+ */
+
+#ifndef __BFA_SM_H__
+#define __BFA_SM_H__
+
+#include "cna.h"
+
+typedef void (*bfa_sm_t)(void *sm, int event);
+
+/**
+ * oc - object class eg. bfa_ioc
+ * st - state, eg. reset
+ * otype - object type, eg. struct bfa_ioc
+ * etype - object type, eg. enum ioc_event
+ */
+#define bfa_sm_state_decl(oc, st, otype, etype)         \
+        static void oc ## _sm_ ## st(otype * fsm, etype event)
+
+#define bfa_sm_set_state(_sm, _state)   ((_sm)->sm = (bfa_sm_t)(_state))
+#define bfa_sm_send_event(_sm, _event)  ((_sm)->sm((_sm), (_event)))
+#define bfa_sm_get_state(_sm)           ((_sm)->sm)
+#define bfa_sm_cmp_state(_sm, _state)   ((_sm)->sm == (bfa_sm_t)(_state))
+
+/**
+ * For converting from state machine function to state encoding.
+ */
+struct bfa_sm_table {
+        bfa_sm_t        sm;     /*!< state machine function     */
+        int             state;  /*!< state machine encoding     */
+        char            *name;  /*!< state name for display     */
+};
+#define BFA_SM(_sm)     ((bfa_sm_t)(_sm))
+
+/**
+ * State machine with entry actions.
+ */
+typedef void (*bfa_fsm_t)(void *fsm, int event);
+
+/**
+ * oc - object class eg. bfa_ioc
+ * st - state, eg. reset
+ * otype - object type, eg. struct bfa_ioc
+ * etype - object type, eg. enum ioc_event
+ */
+#define bfa_fsm_state_decl(oc, st, otype, etype)                \
+        static void oc ## _sm_ ## st(otype * fsm, etype event); \
+        static void oc ## _sm_ ## st ## _entry(otype * fsm)
+
+#define bfa_fsm_set_state(_fsm, _state) do {    \
+        (_fsm)->fsm = (bfa_fsm_t)(_state);      \
+        _state ## _entry(_fsm);                 \
+} while (0)
+
+#define bfa_fsm_send_event(_fsm, _event)        ((_fsm)->fsm((_fsm), (_event)))
+#define bfa_fsm_get_state(_fsm)                 ((_fsm)->fsm)
+#define bfa_fsm_cmp_state(_fsm, _state)         \
+        ((_fsm)->fsm == (bfa_fsm_t)(_state))
+
+static inline int
+bfa_sm_to_state(struct bfa_sm_table *smt, bfa_sm_t sm)
+{
+        int     i = 0;
+
+        while (smt[i].sm && smt[i].sm != sm)
+                i++;
+        return smt[i].state;
+}
+#endif
diff --git a/drivers/net/bna/bfa_wc.h b/drivers/net/bna/bfa_wc.h
new file mode 100644
index 000000000000..d0e4caee67b0
--- /dev/null
+++ b/drivers/net/bna/bfa_wc.h
@@ -0,0 +1,69 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+/**
+ * @file bfa_wc.h Generic wait counter.
+ */
+
+#ifndef __BFA_WC_H__
+#define __BFA_WC_H__
+
+typedef void (*bfa_wc_resume_t) (void *cbarg);
+
+struct bfa_wc {
+        bfa_wc_resume_t wc_resume;
+        void            *wc_cbarg;
+        int             wc_count;
+};
+
+static inline void
+bfa_wc_up(struct bfa_wc *wc)
+{
+        wc->wc_count++;
+}
+
+static inline void
+bfa_wc_down(struct bfa_wc *wc)
+{
+        wc->wc_count--;
+        if (wc->wc_count == 0)
+                wc->wc_resume(wc->wc_cbarg);
+}
+
+/**
+ * Initialize a waiting counter.
+ */
+static inline void
+bfa_wc_init(struct bfa_wc *wc, bfa_wc_resume_t wc_resume, void *wc_cbarg)
+{
+        wc->wc_resume = wc_resume;
+        wc->wc_cbarg = wc_cbarg;
+        wc->wc_count = 0;
+        bfa_wc_up(wc);
+}
+
+/**
+ * Wait for counter to reach zero
+ */
+static inline void
+bfa_wc_wait(struct bfa_wc *wc)
+{
+        bfa_wc_down(wc);
+}
+
+#endif
diff --git a/drivers/net/bna/bfi.h b/drivers/net/bna/bfi.h
new file mode 100644
index 000000000000..a97396811050
--- /dev/null
+++ b/drivers/net/bna/bfi.h
@@ -0,0 +1,392 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __BFI_H__
+#define __BFI_H__
+
+#include "bfa_defs.h"
+
+#pragma pack(1)
+
+/**
+ * BFI FW image type
+ */
+#define BFI_FLASH_CHUNK_SZ                      256     /*!< Flash chunk size */
+#define BFI_FLASH_CHUNK_SZ_WORDS        (BFI_FLASH_CHUNK_SZ/sizeof(u32))
+enum {
+        BFI_IMAGE_CB_FC,
+        BFI_IMAGE_CT_FC,
+        BFI_IMAGE_CT_CNA,
+        BFI_IMAGE_MAX,
+};
+
+/**
+ * Msg header common to all msgs
+ */
+struct bfi_mhdr {
+        u8              msg_class;      /*!< @ref enum bfi_mclass           */
+        u8              msg_id;         /*!< msg opcode with in the class   */
+        union {
+                struct {
+                        u8      rsvd;
+                        u8      lpu_id; /*!< msg destination                */
+                } h2i;
+                u16     i2htok; /*!< token in msgs to host          */
+        } mtag;
+};
+
+#define bfi_h2i_set(_mh, _mc, _op, _lpuid) do {         \
+        (_mh).msg_class                 = (_mc);                \
+        (_mh).msg_id                    = (_op);                \
+        (_mh).mtag.h2i.lpu_id   = (_lpuid);                     \
+} while (0)
+
+#define bfi_i2h_set(_mh, _mc, _op, _i2htok) do {                \
+        (_mh).msg_class                 = (_mc);                \
+        (_mh).msg_id                    = (_op);                \
+        (_mh).mtag.i2htok               = (_i2htok);            \
+} while (0)
+
+/*
+ * Message opcodes: 0-127 to firmware, 128-255 to host
+ */
+#define BFI_I2H_OPCODE_BASE     128
+#define BFA_I2HM(_x)                    ((_x) + BFI_I2H_OPCODE_BASE)
+
+/**
+ ****************************************************************************
+ *
+ * Scatter Gather Element and Page definition
+ *
+ ****************************************************************************
+ */
+
+#define BFI_SGE_INLINE  1
+#define BFI_SGE_INLINE_MAX      (BFI_SGE_INLINE + 1)
+
+/**
+ * SG Flags
+ */
+enum {
+        BFI_SGE_DATA            = 0,    /*!< data address, not last          */
+        BFI_SGE_DATA_CPL        = 1,    /*!< data addr, last in current page */
+        BFI_SGE_DATA_LAST       = 3,    /*!< data address, last              */
+        BFI_SGE_LINK            = 2,    /*!< link address                    */
+        BFI_SGE_PGDLEN          = 2,    /*!< cumulative data length for page */
+};
+
+/**
+ * DMA addresses
+ */
+union bfi_addr_u {
+        struct {
+                u32     addr_lo;
+                u32     addr_hi;
+        } a32;
+};
+
+/**
+ * Scatter Gather Element
+ */
+struct bfi_sge {
+#ifdef __BIGENDIAN
+        u32     flags:2,
+                        rsvd:2,
+                        sg_len:28;
+#else
+        u32     sg_len:28,
+                        rsvd:2,
+                        flags:2;
+#endif
+        union bfi_addr_u sga;
+};
+
+/**
+ * Scatter Gather Page
+ */
+#define BFI_SGPG_DATA_SGES              7
+#define BFI_SGPG_SGES_MAX               (BFI_SGPG_DATA_SGES + 1)
+#define BFI_SGPG_RSVD_WD_LEN    8
+struct bfi_sgpg {
+        struct bfi_sge sges[BFI_SGPG_SGES_MAX];
+        u32     rsvd[BFI_SGPG_RSVD_WD_LEN];
+};
+
+/*
+ * Large Message structure - 128 Bytes size Msgs
+ */
+#define BFI_LMSG_SZ             128
+#define BFI_LMSG_PL_WSZ \
+                        ((BFI_LMSG_SZ - sizeof(struct bfi_mhdr)) / 4)
+
+struct bfi_msg {
+        struct bfi_mhdr mhdr;
+        u32     pl[BFI_LMSG_PL_WSZ];
+};
+
+/**
+ * Mailbox message structure
+ */
+#define BFI_MBMSG_SZ            7
+struct bfi_mbmsg {
+        struct bfi_mhdr mh;
+        u32             pl[BFI_MBMSG_SZ];
+};
+
+/**
+ * Message Classes
+ */
+enum bfi_mclass {
+        BFI_MC_IOC              = 1,    /*!< IO Controller (IOC)            */
+        BFI_MC_DIAG             = 2,    /*!< Diagnostic Msgs                */
+        BFI_MC_FLASH            = 3,    /*!< Flash message class            */
+        BFI_MC_CEE              = 4,    /*!< CEE                            */
+        BFI_MC_FCPORT           = 5,    /*!< FC port                        */
+        BFI_MC_IOCFC            = 6,    /*!< FC - IO Controller (IOC)       */
+        BFI_MC_LL               = 7,    /*!< Link Layer                     */
+        BFI_MC_UF               = 8,    /*!< Unsolicited frame receive      */
+        BFI_MC_FCXP             = 9,    /*!< FC Transport                   */
+        BFI_MC_LPS              = 10,   /*!< lport fc login services        */
+        BFI_MC_RPORT            = 11,   /*!< Remote port                    */
+        BFI_MC_ITNIM            = 12,   /*!< I-T nexus (Initiator mode)     */
+        BFI_MC_IOIM_READ        = 13,   /*!< read IO (Initiator mode)       */
+        BFI_MC_IOIM_WRITE       = 14,   /*!< write IO (Initiator mode)      */
+        BFI_MC_IOIM_IO          = 15,   /*!< IO (Initiator mode)            */
+        BFI_MC_IOIM             = 16,   /*!< IO (Initiator mode)            */
+        BFI_MC_IOIM_IOCOM       = 17,   /*!< good IO completion             */
+        BFI_MC_TSKIM            = 18,   /*!< Initiator Task management      */
+        BFI_MC_SBOOT            = 19,   /*!< SAN boot services              */
+        BFI_MC_IPFC             = 20,   /*!< IP over FC Msgs                */
+        BFI_MC_PORT             = 21,   /*!< Physical port                  */
+        BFI_MC_SFP              = 22,   /*!< SFP module                     */
+        BFI_MC_MSGQ             = 23,   /*!< MSGQ                           */
+        BFI_MC_ENET             = 24,   /*!< ENET commands/responses        */
+        BFI_MC_MAX              = 32
+};
+
+#define BFI_IOC_MAX_CQS         4
+#define BFI_IOC_MAX_CQS_ASIC    8
+#define BFI_IOC_MSGLEN_MAX      32      /* 32 bytes */
+
+#define BFI_BOOT_TYPE_OFF               8
+#define BFI_BOOT_PARAM_OFF              12
+
+#define BFI_BOOT_TYPE_NORMAL            0       /* param is device id */
+#define BFI_BOOT_TYPE_FLASH             1
+#define BFI_BOOT_TYPE_MEMTEST           2
+
+#define BFI_BOOT_MEMTEST_RES_ADDR   0x900
+#define BFI_BOOT_MEMTEST_RES_SIG    0xA0A1A2A3
+
+/**
+ *----------------------------------------------------------------------
+ *                              IOC
+ *----------------------------------------------------------------------
+ */
+
+enum bfi_ioc_h2i_msgs {
+        BFI_IOC_H2I_ENABLE_REQ          = 1,
+        BFI_IOC_H2I_DISABLE_REQ         = 2,
+        BFI_IOC_H2I_GETATTR_REQ         = 3,
+        BFI_IOC_H2I_DBG_SYNC            = 4,
+        BFI_IOC_H2I_DBG_DUMP            = 5,
+};
+
+enum bfi_ioc_i2h_msgs {
+        BFI_IOC_I2H_ENABLE_REPLY        = BFA_I2HM(1),
+        BFI_IOC_I2H_DISABLE_REPLY       = BFA_I2HM(2),
+        BFI_IOC_I2H_GETATTR_REPLY       = BFA_I2HM(3),
+        BFI_IOC_I2H_READY_EVENT         = BFA_I2HM(4),
+        BFI_IOC_I2H_HBEAT               = BFA_I2HM(5),
+};
+
+/**
+ * BFI_IOC_H2I_GETATTR_REQ message
+ */
+struct bfi_ioc_getattr_req {
+        struct bfi_mhdr mh;
+        union bfi_addr_u        attr_addr;
+};
+
+struct bfi_ioc_attr {
+        u64             mfg_pwwn;       /*!< Mfg port wwn          */
+        u64             mfg_nwwn;       /*!< Mfg node wwn          */
+        mac_t           mfg_mac;        /*!< Mfg mac               */
+        u16     rsvd_a;
+        u64             pwwn;
+        u64             nwwn;
+        mac_t           mac;            /*!< PBC or Mfg mac        */
+        u16     rsvd_b;
+        mac_t           fcoe_mac;
+        u16     rsvd_c;
+        char            brcd_serialnum[STRSZ(BFA_MFG_SERIALNUM_SIZE)];
+        u8              pcie_gen;
+        u8              pcie_lanes_orig;
+        u8              pcie_lanes;
+        u8              rx_bbcredit;    /*!< receive buffer credits */
+        u32     adapter_prop;   /*!< adapter properties     */
+        u16     maxfrsize;      /*!< max receive frame size */
+        char            asic_rev;
+        u8              rsvd_d;
+        char            fw_version[BFA_VERSION_LEN];
+        char            optrom_version[BFA_VERSION_LEN];
+        struct bfa_mfg_vpd vpd;
+        u32     card_type;      /*!< card type                  */
+};
+
+/**
+ * BFI_IOC_I2H_GETATTR_REPLY message
+ */
+struct bfi_ioc_getattr_reply {
+        struct bfi_mhdr mh;     /*!< Common msg header          */
+        u8                      status; /*!< cfg reply status           */
+        u8                      rsvd[3];
+};
+
+/**
+ * Firmware memory page offsets
+ */
+#define BFI_IOC_SMEM_PG0_CB     (0x40)
+#define BFI_IOC_SMEM_PG0_CT     (0x180)
+
+/**
+ * Firmware statistic offset
+ */
+#define BFI_IOC_FWSTATS_OFF     (0x6B40)
+#define BFI_IOC_FWSTATS_SZ      (4096)
+
+/**
+ * Firmware trace offset
+ */
+#define BFI_IOC_TRC_OFF         (0x4b00)
+#define BFI_IOC_TRC_ENTS        256
+
+#define BFI_IOC_FW_SIGNATURE    (0xbfadbfad)
+#define BFI_IOC_MD5SUM_SZ       4
+struct bfi_ioc_image_hdr {
+        u32     signature;      /*!< constant signature */
+        u32     rsvd_a;
+        u32     exec;           /*!< exec vector        */
+        u32     param;          /*!< parameters         */
+        u32     rsvd_b[4];
+        u32     md5sum[BFI_IOC_MD5SUM_SZ];
+};
+
+/**
+ *  BFI_IOC_I2H_READY_EVENT message
+ */
+struct bfi_ioc_rdy_event {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8                      init_status;    /*!< init event status */
+        u8                      rsvd[3];
+};
+
+struct bfi_ioc_hbeat {
+        struct bfi_mhdr mh;             /*!< common msg header          */
+        u32        hb_count;    /*!< current heart beat count   */
+};
+
+/**
+ * IOC hardware/firmware state
+ */
+enum bfi_ioc_state {
+        BFI_IOC_UNINIT          = 0,    /*!< not initialized                 */
+        BFI_IOC_INITING         = 1,    /*!< h/w is being initialized        */
+        BFI_IOC_HWINIT          = 2,    /*!< h/w is initialized              */
+        BFI_IOC_CFG             = 3,    /*!< IOC configuration in progress   */
+        BFI_IOC_OP              = 4,    /*!< IOC is operational              */
+        BFI_IOC_DISABLING       = 5,    /*!< IOC is being disabled           */
+        BFI_IOC_DISABLED        = 6,    /*!< IOC is disabled                 */
+        BFI_IOC_CFG_DISABLED    = 7,    /*!< IOC is being disabled;transient */
+        BFI_IOC_FAIL            = 8,    /*!< IOC heart-beat failure          */
+        BFI_IOC_MEMTEST         = 9,    /*!< IOC is doing memtest            */
+};
+
+#define BFI_IOC_ENDIAN_SIG  0x12345678
+
+enum {
+        BFI_ADAPTER_TYPE_FC     = 0x01,         /*!< FC adapters           */
+        BFI_ADAPTER_TYPE_MK     = 0x0f0000,     /*!< adapter type mask     */
+        BFI_ADAPTER_TYPE_SH     = 16,           /*!< adapter type shift    */
+        BFI_ADAPTER_NPORTS_MK   = 0xff00,       /*!< number of ports mask  */
+        BFI_ADAPTER_NPORTS_SH   = 8,            /*!< number of ports shift */
+        BFI_ADAPTER_SPEED_MK    = 0xff,         /*!< adapter speed mask    */
+        BFI_ADAPTER_SPEED_SH    = 0,            /*!< adapter speed shift   */
+        BFI_ADAPTER_PROTO       = 0x100000,     /*!< prototype adapaters   */
+        BFI_ADAPTER_TTV         = 0x200000,     /*!< TTV debug capable     */
+        BFI_ADAPTER_UNSUPP      = 0x400000,     /*!< unknown adapter type  */
+};
+
+#define BFI_ADAPTER_GETP(__prop, __adap_prop)                   \
+        (((__adap_prop) & BFI_ADAPTER_ ## __prop ## _MK) >>     \
+                BFI_ADAPTER_ ## __prop ## _SH)
+#define BFI_ADAPTER_SETP(__prop, __val)                         \
+        ((__val) << BFI_ADAPTER_ ## __prop ## _SH)
+#define BFI_ADAPTER_IS_PROTO(__adap_type)                       \
+        ((__adap_type) & BFI_ADAPTER_PROTO)
+#define BFI_ADAPTER_IS_TTV(__adap_type)                         \
+        ((__adap_type) & BFI_ADAPTER_TTV)
+#define BFI_ADAPTER_IS_UNSUPP(__adap_type)                      \
+        ((__adap_type) & BFI_ADAPTER_UNSUPP)
+#define BFI_ADAPTER_IS_SPECIAL(__adap_type)                     \
+        ((__adap_type) & (BFI_ADAPTER_TTV | BFI_ADAPTER_PROTO | \
+                        BFI_ADAPTER_UNSUPP))
+
+/**
+ * BFI_IOC_H2I_ENABLE_REQ & BFI_IOC_H2I_DISABLE_REQ messages
+ */
+struct bfi_ioc_ctrl_req {
+        struct bfi_mhdr mh;
+        u8                      ioc_class;
+        u8                      rsvd[3];
+        u32             tv_sec;
+};
+
+/**
+ * BFI_IOC_I2H_ENABLE_REPLY & BFI_IOC_I2H_DISABLE_REPLY messages
+ */
+struct bfi_ioc_ctrl_reply {
+        struct bfi_mhdr mh;             /*!< Common msg header     */
+        u8                      status;         /*!< enable/disable status */
+        u8                      rsvd[3];
+};
+
+#define BFI_IOC_MSGSZ   8
+/**
+ * H2I Messages
+ */
+union bfi_ioc_h2i_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_ioc_ctrl_req enable_req;
+        struct bfi_ioc_ctrl_req disable_req;
+        struct bfi_ioc_getattr_req getattr_req;
+        u32                     mboxmsg[BFI_IOC_MSGSZ];
+};
+
+/**
+ * I2H Messages
+ */
+union bfi_ioc_i2h_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_ioc_rdy_event rdy_event;
+        u32                     mboxmsg[BFI_IOC_MSGSZ];
+};
+
+#pragma pack()
+
+#endif /* __BFI_H__ */
diff --git a/drivers/net/bna/bfi_cna.h b/drivers/net/bna/bfi_cna.h
new file mode 100644
index 000000000000..4eecabea397b
--- /dev/null
+++ b/drivers/net/bna/bfi_cna.h
@@ -0,0 +1,199 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BFI_CNA_H__
+#define __BFI_CNA_H__
+
+#include "bfi.h"
+#include "bfa_defs_cna.h"
+
+#pragma pack(1)
+
+enum bfi_port_h2i {
+        BFI_PORT_H2I_ENABLE_REQ         = (1),
+        BFI_PORT_H2I_DISABLE_REQ        = (2),
+        BFI_PORT_H2I_GET_STATS_REQ      = (3),
+        BFI_PORT_H2I_CLEAR_STATS_REQ    = (4),
+};
+
+enum bfi_port_i2h {
+        BFI_PORT_I2H_ENABLE_RSP         = BFA_I2HM(1),
+        BFI_PORT_I2H_DISABLE_RSP        = BFA_I2HM(2),
+        BFI_PORT_I2H_GET_STATS_RSP      = BFA_I2HM(3),
+        BFI_PORT_I2H_CLEAR_STATS_RSP    = BFA_I2HM(4),
+};
+
+/**
+ * Generic REQ type
+ */
+struct bfi_port_generic_req {
+        struct bfi_mhdr mh;             /*!< msg header                     */
+        u32     msgtag;         /*!< msgtag for reply               */
+        u32     rsvd;
+};
+
+/**
+ * Generic RSP type
+ */
+struct bfi_port_generic_rsp {
+        struct bfi_mhdr mh;             /*!< common msg header              */
+        u8              status;         /*!< port enable status             */
+        u8              rsvd[3];
+        u32     msgtag;         /*!< msgtag for reply               */
+};
+
+/**
+ * @todo
+ * BFI_PORT_H2I_ENABLE_REQ
+ */
+
+/**
+ * @todo
+ * BFI_PORT_I2H_ENABLE_RSP
+ */
+
+/**
+ * BFI_PORT_H2I_DISABLE_REQ
+ */
+
+/**
+ * BFI_PORT_I2H_DISABLE_RSP
+ */
+
+/**
+ * BFI_PORT_H2I_GET_STATS_REQ
+ */
+struct bfi_port_get_stats_req {
+        struct bfi_mhdr mh;             /*!< common msg header              */
+        union bfi_addr_u   dma_addr;
+};
+
+/**
+ * BFI_PORT_I2H_GET_STATS_RSP
+ */
+
+/**
+ * BFI_PORT_H2I_CLEAR_STATS_REQ
+ */
+
+/**
+ * BFI_PORT_I2H_CLEAR_STATS_RSP
+ */
+
+union bfi_port_h2i_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_port_generic_req enable_req;
+        struct bfi_port_generic_req disable_req;
+        struct bfi_port_get_stats_req getstats_req;
+        struct bfi_port_generic_req clearstats_req;
+};
+
+union bfi_port_i2h_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_port_generic_rsp enable_rsp;
+        struct bfi_port_generic_rsp disable_rsp;
+        struct bfi_port_generic_rsp getstats_rsp;
+        struct bfi_port_generic_rsp clearstats_rsp;
+};
+
+/* @brief Mailbox commands from host to (DCBX/LLDP) firmware */
+enum bfi_cee_h2i_msgs {
+        BFI_CEE_H2I_GET_CFG_REQ = 1,
+        BFI_CEE_H2I_RESET_STATS = 2,
+        BFI_CEE_H2I_GET_STATS_REQ = 3,
+};
+
+/* @brief Mailbox reply and AEN messages from DCBX/LLDP firmware to host */
+enum bfi_cee_i2h_msgs {
+        BFI_CEE_I2H_GET_CFG_RSP = BFA_I2HM(1),
+        BFI_CEE_I2H_RESET_STATS_RSP = BFA_I2HM(2),
+        BFI_CEE_I2H_GET_STATS_RSP = BFA_I2HM(3),
+};
+
+/* Data structures */
+
+/*
+ * @brief H2I command structure for resetting the stats.
+ * BFI_CEE_H2I_RESET_STATS
+ */
+struct bfi_lldp_reset_stats {
+        struct bfi_mhdr mh;
+};
+
+/*
+ * @brief H2I command structure for resetting the stats.
+ * BFI_CEE_H2I_RESET_STATS
+ */
+struct bfi_cee_reset_stats {
+        struct bfi_mhdr mh;
+};
+
+/*
+ * @brief  get configuration  command from host
+ * BFI_CEE_H2I_GET_CFG_REQ
+ */
+struct bfi_cee_get_req {
+        struct bfi_mhdr mh;
+        union bfi_addr_u   dma_addr;
+};
+
+/*
+ * @brief reply message from firmware
+ * BFI_CEE_I2H_GET_CFG_RSP
+ */
+struct bfi_cee_get_rsp {
+        struct bfi_mhdr mh;
+        u8                      cmd_status;
+        u8                      rsvd[3];
+};
+
+/*
+ * @brief  get configuration  command from host
+ * BFI_CEE_H2I_GET_STATS_REQ
+ */
+struct bfi_cee_stats_req {
+        struct bfi_mhdr mh;
+        union bfi_addr_u   dma_addr;
+};
+
+/*
+ * @brief reply message from firmware
+ * BFI_CEE_I2H_GET_STATS_RSP
+ */
+struct bfi_cee_stats_rsp {
+        struct bfi_mhdr mh;
+        u8                      cmd_status;
+        u8                      rsvd[3];
+};
+
+/* @brief mailbox command structures from host to firmware */
+union bfi_cee_h2i_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_cee_get_req get_req;
+        struct bfi_cee_stats_req stats_req;
+};
+
+/* @brief mailbox message structures from firmware to host      */
+union bfi_cee_i2h_msg_u {
+        struct bfi_mhdr mh;
+        struct bfi_cee_get_rsp get_rsp;
+        struct bfi_cee_stats_rsp stats_rsp;
+};
+
+#pragma pack()
+
+#endif /* __BFI_CNA_H__ */
diff --git a/drivers/net/bna/bfi_ctreg.h b/drivers/net/bna/bfi_ctreg.h
new file mode 100644
index 000000000000..404ea351d4a1
--- /dev/null
+++ b/drivers/net/bna/bfi_ctreg.h
@@ -0,0 +1,637 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+/*
+ * bfi_ctreg.h catapult host block register definitions
+ *
+ * !!! Do not edit. Auto generated. !!!
+ */
+
+#ifndef __BFI_CTREG_H__
+#define __BFI_CTREG_H__
+
+#define HOSTFN0_LPU_MBOX0_0             0x00019200
+#define HOSTFN1_LPU_MBOX0_8             0x00019260
+#define LPU_HOSTFN0_MBOX0_0             0x00019280
+#define LPU_HOSTFN1_MBOX0_8             0x000192e0
+#define HOSTFN2_LPU_MBOX0_0             0x00019400
+#define HOSTFN3_LPU_MBOX0_8             0x00019460
+#define LPU_HOSTFN2_MBOX0_0             0x00019480
+#define LPU_HOSTFN3_MBOX0_8             0x000194e0
+#define HOSTFN0_INT_STATUS              0x00014000
+#define __HOSTFN0_HALT_OCCURRED         0x01000000
+#define __HOSTFN0_INT_STATUS_LVL_MK     0x00f00000
+#define __HOSTFN0_INT_STATUS_LVL_SH     20
+#define __HOSTFN0_INT_STATUS_LVL(_v)    ((_v) << __HOSTFN0_INT_STATUS_LVL_SH)
+#define __HOSTFN0_INT_STATUS_P_MK       0x000f0000
+#define __HOSTFN0_INT_STATUS_P_SH       16
+#define __HOSTFN0_INT_STATUS_P(_v)      ((_v) << __HOSTFN0_INT_STATUS_P_SH)
+#define __HOSTFN0_INT_STATUS_F          0x0000ffff
+#define HOSTFN0_INT_MSK                 0x00014004
+#define HOST_PAGE_NUM_FN0               0x00014008
+#define __HOST_PAGE_NUM_FN              0x000001ff
+#define HOST_MSIX_ERR_INDEX_FN0         0x0001400c
+#define __MSIX_ERR_INDEX_FN             0x000001ff
+#define HOSTFN1_INT_STATUS              0x00014100
+#define __HOSTFN1_HALT_OCCURRED         0x01000000
+#define __HOSTFN1_INT_STATUS_LVL_MK     0x00f00000
+#define __HOSTFN1_INT_STATUS_LVL_SH     20
+#define __HOSTFN1_INT_STATUS_LVL(_v)    ((_v) << __HOSTFN1_INT_STATUS_LVL_SH)
+#define __HOSTFN1_INT_STATUS_P_MK       0x000f0000
+#define __HOSTFN1_INT_STATUS_P_SH       16
+#define __HOSTFN1_INT_STATUS_P(_v)      ((_v) << __HOSTFN1_INT_STATUS_P_SH)
+#define __HOSTFN1_INT_STATUS_F          0x0000ffff
+#define HOSTFN1_INT_MSK                 0x00014104
+#define HOST_PAGE_NUM_FN1               0x00014108
+#define HOST_MSIX_ERR_INDEX_FN1         0x0001410c
+#define APP_PLL_425_CTL_REG             0x00014204
+#define __P_425_PLL_LOCK                0x80000000
+#define __APP_PLL_425_SRAM_USE_100MHZ   0x00100000
+#define __APP_PLL_425_RESET_TIMER_MK    0x000e0000
+#define __APP_PLL_425_RESET_TIMER_SH    17
+#define __APP_PLL_425_RESET_TIMER(_v)   ((_v) << __APP_PLL_425_RESET_TIMER_SH)
+#define __APP_PLL_425_LOGIC_SOFT_RESET  0x00010000
+#define __APP_PLL_425_CNTLMT0_1_MK      0x0000c000
+#define __APP_PLL_425_CNTLMT0_1_SH      14
+#define __APP_PLL_425_CNTLMT0_1(_v)     ((_v) << __APP_PLL_425_CNTLMT0_1_SH)
+#define __APP_PLL_425_JITLMT0_1_MK      0x00003000
+#define __APP_PLL_425_JITLMT0_1_SH      12
+#define __APP_PLL_425_JITLMT0_1(_v)     ((_v) << __APP_PLL_425_JITLMT0_1_SH)
+#define __APP_PLL_425_HREF              0x00000800
+#define __APP_PLL_425_HDIV              0x00000400
+#define __APP_PLL_425_P0_1_MK           0x00000300
+#define __APP_PLL_425_P0_1_SH           8
+#define __APP_PLL_425_P0_1(_v)          ((_v) << __APP_PLL_425_P0_1_SH)
+#define __APP_PLL_425_Z0_2_MK           0x000000e0
+#define __APP_PLL_425_Z0_2_SH           5
+#define __APP_PLL_425_Z0_2(_v)          ((_v) << __APP_PLL_425_Z0_2_SH)
+#define __APP_PLL_425_RSEL200500        0x00000010
+#define __APP_PLL_425_ENARST            0x00000008
+#define __APP_PLL_425_BYPASS            0x00000004
+#define __APP_PLL_425_LRESETN           0x00000002
+#define __APP_PLL_425_ENABLE            0x00000001
+#define APP_PLL_312_CTL_REG             0x00014208
+#define __P_312_PLL_LOCK                0x80000000
+#define __ENABLE_MAC_AHB_1              0x00800000
+#define __ENABLE_MAC_AHB_0              0x00400000
+#define __ENABLE_MAC_1                  0x00200000
+#define __ENABLE_MAC_0                  0x00100000
+#define __APP_PLL_312_RESET_TIMER_MK    0x000e0000
+#define __APP_PLL_312_RESET_TIMER_SH    17
+#define __APP_PLL_312_RESET_TIMER(_v)   ((_v) << __APP_PLL_312_RESET_TIMER_SH)
+#define __APP_PLL_312_LOGIC_SOFT_RESET  0x00010000
+#define __APP_PLL_312_CNTLMT0_1_MK      0x0000c000
+#define __APP_PLL_312_CNTLMT0_1_SH      14
+#define __APP_PLL_312_CNTLMT0_1(_v)     ((_v) << __APP_PLL_312_CNTLMT0_1_SH)
+#define __APP_PLL_312_JITLMT0_1_MK      0x00003000
+#define __APP_PLL_312_JITLMT0_1_SH      12
+#define __APP_PLL_312_JITLMT0_1(_v)     ((_v) << __APP_PLL_312_JITLMT0_1_SH)
+#define __APP_PLL_312_HREF              0x00000800
+#define __APP_PLL_312_HDIV              0x00000400
+#define __APP_PLL_312_P0_1_MK           0x00000300
+#define __APP_PLL_312_P0_1_SH           8
+#define __APP_PLL_312_P0_1(_v)          ((_v) << __APP_PLL_312_P0_1_SH)
+#define __APP_PLL_312_Z0_2_MK           0x000000e0
+#define __APP_PLL_312_Z0_2_SH           5
+#define __APP_PLL_312_Z0_2(_v)          ((_v) << __APP_PLL_312_Z0_2_SH)
+#define __APP_PLL_312_RSEL200500        0x00000010
+#define __APP_PLL_312_ENARST            0x00000008
+#define __APP_PLL_312_BYPASS            0x00000004
+#define __APP_PLL_312_LRESETN           0x00000002
+#define __APP_PLL_312_ENABLE            0x00000001
+#define MBIST_CTL_REG                   0x00014220
+#define __EDRAM_BISTR_START             0x00000004
+#define __MBIST_RESET                   0x00000002
+#define __MBIST_START                   0x00000001
+#define MBIST_STAT_REG                  0x00014224
+#define __EDRAM_BISTR_STATUS            0x00000008
+#define __EDRAM_BISTR_DONE              0x00000004
+#define __MEM_BIT_STATUS                0x00000002
+#define __MBIST_DONE                    0x00000001
+#define HOST_SEM0_REG                   0x00014230
+#define __HOST_SEMAPHORE                0x00000001
+#define HOST_SEM1_REG                   0x00014234
+#define HOST_SEM2_REG                   0x00014238
+#define HOST_SEM3_REG                   0x0001423c
+#define HOST_SEM0_INFO_REG              0x00014240
+#define HOST_SEM1_INFO_REG              0x00014244
+#define HOST_SEM2_INFO_REG              0x00014248
+#define HOST_SEM3_INFO_REG              0x0001424c
+#define ETH_MAC_SER_REG                 0x00014288
+#define __APP_EMS_CKBUFAMPIN            0x00000020
+#define __APP_EMS_REFCLKSEL             0x00000010
+#define __APP_EMS_CMLCKSEL              0x00000008
+#define __APP_EMS_REFCKBUFEN2           0x00000004
+#define __APP_EMS_REFCKBUFEN1           0x00000002
+#define __APP_EMS_CHANNEL_SEL           0x00000001
+#define HOSTFN2_INT_STATUS              0x00014300
+#define __HOSTFN2_HALT_OCCURRED         0x01000000
+#define __HOSTFN2_INT_STATUS_LVL_MK     0x00f00000
+#define __HOSTFN2_INT_STATUS_LVL_SH     20
+#define __HOSTFN2_INT_STATUS_LVL(_v)    ((_v) << __HOSTFN2_INT_STATUS_LVL_SH)
+#define __HOSTFN2_INT_STATUS_P_MK       0x000f0000
+#define __HOSTFN2_INT_STATUS_P_SH       16
+#define __HOSTFN2_INT_STATUS_P(_v)      ((_v) << __HOSTFN2_INT_STATUS_P_SH)
+#define __HOSTFN2_INT_STATUS_F          0x0000ffff
+#define HOSTFN2_INT_MSK                 0x00014304
+#define HOST_PAGE_NUM_FN2               0x00014308
+#define HOST_MSIX_ERR_INDEX_FN2         0x0001430c
+#define HOSTFN3_INT_STATUS              0x00014400
+#define __HALT_OCCURRED                 0x01000000
+#define __HOSTFN3_INT_STATUS_LVL_MK     0x00f00000
+#define __HOSTFN3_INT_STATUS_LVL_SH     20
+#define __HOSTFN3_INT_STATUS_LVL(_v)    ((_v) << __HOSTFN3_INT_STATUS_LVL_SH)
+#define __HOSTFN3_INT_STATUS_P_MK       0x000f0000
+#define __HOSTFN3_INT_STATUS_P_SH       16
+#define __HOSTFN3_INT_STATUS_P(_v)      ((_v) << __HOSTFN3_INT_STATUS_P_SH)
+#define __HOSTFN3_INT_STATUS_F          0x0000ffff
+#define HOSTFN3_INT_MSK                 0x00014404
+#define HOST_PAGE_NUM_FN3               0x00014408
+#define HOST_MSIX_ERR_INDEX_FN3         0x0001440c
+#define FNC_ID_REG                      0x00014600
+#define __FUNCTION_NUMBER               0x00000007
+#define FNC_PERS_REG                    0x00014604
+#define __F3_FUNCTION_ACTIVE            0x80000000
+#define __F3_FUNCTION_MODE              0x40000000
+#define __F3_PORT_MAP_MK                0x30000000
+#define __F3_PORT_MAP_SH                28
+#define __F3_PORT_MAP(_v)               ((_v) << __F3_PORT_MAP_SH)
+#define __F3_VM_MODE                    0x08000000
+#define __F3_INTX_STATUS_MK             0x07000000
+#define __F3_INTX_STATUS_SH             24
+#define __F3_INTX_STATUS(_v)            ((_v) << __F3_INTX_STATUS_SH)
+#define __F2_FUNCTION_ACTIVE            0x00800000
+#define __F2_FUNCTION_MODE              0x00400000
+#define __F2_PORT_MAP_MK                0x00300000
+#define __F2_PORT_MAP_SH                20
+#define __F2_PORT_MAP(_v)               ((_v) << __F2_PORT_MAP_SH)
+#define __F2_VM_MODE                    0x00080000
+#define __F2_INTX_STATUS_MK             0x00070000
+#define __F2_INTX_STATUS_SH             16
+#define __F2_INTX_STATUS(_v)            ((_v) << __F2_INTX_STATUS_SH)
+#define __F1_FUNCTION_ACTIVE            0x00008000
+#define __F1_FUNCTION_MODE              0x00004000
+#define __F1_PORT_MAP_MK                0x00003000
+#define __F1_PORT_MAP_SH                12
+#define __F1_PORT_MAP(_v)               ((_v) << __F1_PORT_MAP_SH)
+#define __F1_VM_MODE                    0x00000800
+#define __F1_INTX_STATUS_MK             0x00000700
+#define __F1_INTX_STATUS_SH             8
+#define __F1_INTX_STATUS(_v)            ((_v) << __F1_INTX_STATUS_SH)
+#define __F0_FUNCTION_ACTIVE            0x00000080
+#define __F0_FUNCTION_MODE              0x00000040
+#define __F0_PORT_MAP_MK                0x00000030
+#define __F0_PORT_MAP_SH                4
+#define __F0_PORT_MAP(_v)               ((_v) << __F0_PORT_MAP_SH)
+#define __F0_VM_MODE            0x00000008
+#define __F0_INTX_STATUS                0x00000007
+enum {
+        __F0_INTX_STATUS_MSIX           = 0x0,
+        __F0_INTX_STATUS_INTA           = 0x1,
+        __F0_INTX_STATUS_INTB           = 0x2,
+        __F0_INTX_STATUS_INTC           = 0x3,
+        __F0_INTX_STATUS_INTD           = 0x4,
+};
+#define OP_MODE                         0x0001460c
+#define __APP_ETH_CLK_LOWSPEED          0x00000004
+#define __GLOBAL_CORECLK_HALFSPEED      0x00000002
+#define __GLOBAL_FCOE_MODE              0x00000001
+#define HOST_SEM4_REG                   0x00014610
+#define HOST_SEM5_REG                   0x00014614
+#define HOST_SEM6_REG                   0x00014618
+#define HOST_SEM7_REG                   0x0001461c
+#define HOST_SEM4_INFO_REG              0x00014620
+#define HOST_SEM5_INFO_REG              0x00014624
+#define HOST_SEM6_INFO_REG              0x00014628
+#define HOST_SEM7_INFO_REG              0x0001462c
+#define HOSTFN0_LPU0_MBOX0_CMD_STAT     0x00019000
+#define __HOSTFN0_LPU0_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN0_LPU0_MBOX0_INFO_SH    1
+#define __HOSTFN0_LPU0_MBOX0_INFO(_v)   ((_v) << __HOSTFN0_LPU0_MBOX0_INFO_SH)
+#define __HOSTFN0_LPU0_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN0_LPU1_MBOX0_CMD_STAT     0x00019004
+#define __HOSTFN0_LPU1_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN0_LPU1_MBOX0_INFO_SH    1
+#define __HOSTFN0_LPU1_MBOX0_INFO(_v)   ((_v) << __HOSTFN0_LPU1_MBOX0_INFO_SH)
+#define __HOSTFN0_LPU1_MBOX0_CMD_STATUS 0x00000001
+#define LPU0_HOSTFN0_MBOX0_CMD_STAT     0x00019008
+#define __LPU0_HOSTFN0_MBOX0_INFO_MK    0xfffffffe
+#define __LPU0_HOSTFN0_MBOX0_INFO_SH    1
+#define __LPU0_HOSTFN0_MBOX0_INFO(_v)   ((_v) << __LPU0_HOSTFN0_MBOX0_INFO_SH)
+#define __LPU0_HOSTFN0_MBOX0_CMD_STATUS 0x00000001
+#define LPU1_HOSTFN0_MBOX0_CMD_STAT     0x0001900c
+#define __LPU1_HOSTFN0_MBOX0_INFO_MK    0xfffffffe
+#define __LPU1_HOSTFN0_MBOX0_INFO_SH    1
+#define __LPU1_HOSTFN0_MBOX0_INFO(_v)   ((_v) << __LPU1_HOSTFN0_MBOX0_INFO_SH)
+#define __LPU1_HOSTFN0_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN1_LPU0_MBOX0_CMD_STAT     0x00019010
+#define __HOSTFN1_LPU0_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN1_LPU0_MBOX0_INFO_SH    1
+#define __HOSTFN1_LPU0_MBOX0_INFO(_v)   ((_v) << __HOSTFN1_LPU0_MBOX0_INFO_SH)
+#define __HOSTFN1_LPU0_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN1_LPU1_MBOX0_CMD_STAT     0x00019014
+#define __HOSTFN1_LPU1_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN1_LPU1_MBOX0_INFO_SH    1
+#define __HOSTFN1_LPU1_MBOX0_INFO(_v)   ((_v) << __HOSTFN1_LPU1_MBOX0_INFO_SH)
+#define __HOSTFN1_LPU1_MBOX0_CMD_STATUS 0x00000001
+#define LPU0_HOSTFN1_MBOX0_CMD_STAT     0x00019018
+#define __LPU0_HOSTFN1_MBOX0_INFO_MK    0xfffffffe
+#define __LPU0_HOSTFN1_MBOX0_INFO_SH    1
+#define __LPU0_HOSTFN1_MBOX0_INFO(_v)   ((_v) << __LPU0_HOSTFN1_MBOX0_INFO_SH)
+#define __LPU0_HOSTFN1_MBOX0_CMD_STATUS 0x00000001
+#define LPU1_HOSTFN1_MBOX0_CMD_STAT     0x0001901c
+#define __LPU1_HOSTFN1_MBOX0_INFO_MK    0xfffffffe
+#define __LPU1_HOSTFN1_MBOX0_INFO_SH    1
+#define __LPU1_HOSTFN1_MBOX0_INFO(_v)   ((_v) << __LPU1_HOSTFN1_MBOX0_INFO_SH)
+#define __LPU1_HOSTFN1_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN2_LPU0_MBOX0_CMD_STAT     0x00019150
+#define __HOSTFN2_LPU0_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN2_LPU0_MBOX0_INFO_SH    1
+#define __HOSTFN2_LPU0_MBOX0_INFO(_v)   ((_v) << __HOSTFN2_LPU0_MBOX0_INFO_SH)
+#define __HOSTFN2_LPU0_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN2_LPU1_MBOX0_CMD_STAT     0x00019154
+#define __HOSTFN2_LPU1_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN2_LPU1_MBOX0_INFO_SH    1
+#define __HOSTFN2_LPU1_MBOX0_INFO(_v)   ((_v) << __HOSTFN2_LPU1_MBOX0_INFO_SH)
+#define __HOSTFN2_LPU1_MBOX0BOX0_CMD_STATUS 0x00000001
+#define LPU0_HOSTFN2_MBOX0_CMD_STAT     0x00019158
+#define __LPU0_HOSTFN2_MBOX0_INFO_MK    0xfffffffe
+#define __LPU0_HOSTFN2_MBOX0_INFO_SH    1
+#define __LPU0_HOSTFN2_MBOX0_INFO(_v)   ((_v) << __LPU0_HOSTFN2_MBOX0_INFO_SH)
+#define __LPU0_HOSTFN2_MBOX0_CMD_STATUS 0x00000001
+#define LPU1_HOSTFN2_MBOX0_CMD_STAT     0x0001915c
+#define __LPU1_HOSTFN2_MBOX0_INFO_MK    0xfffffffe
+#define __LPU1_HOSTFN2_MBOX0_INFO_SH    1
+#define __LPU1_HOSTFN2_MBOX0_INFO(_v)   ((_v) << __LPU1_HOSTFN2_MBOX0_INFO_SH)
+#define __LPU1_HOSTFN2_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN3_LPU0_MBOX0_CMD_STAT     0x00019160
+#define __HOSTFN3_LPU0_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN3_LPU0_MBOX0_INFO_SH    1
+#define __HOSTFN3_LPU0_MBOX0_INFO(_v)   ((_v) << __HOSTFN3_LPU0_MBOX0_INFO_SH)
+#define __HOSTFN3_LPU0_MBOX0_CMD_STATUS 0x00000001
+#define HOSTFN3_LPU1_MBOX0_CMD_STAT     0x00019164
+#define __HOSTFN3_LPU1_MBOX0_INFO_MK    0xfffffffe
+#define __HOSTFN3_LPU1_MBOX0_INFO_SH    1
+#define __HOSTFN3_LPU1_MBOX0_INFO(_v)   ((_v) << __HOSTFN3_LPU1_MBOX0_INFO_SH)
+#define __HOSTFN3_LPU1_MBOX0_CMD_STATUS 0x00000001
+#define LPU0_HOSTFN3_MBOX0_CMD_STAT     0x00019168
+#define __LPU0_HOSTFN3_MBOX0_INFO_MK    0xfffffffe
+#define __LPU0_HOSTFN3_MBOX0_INFO_SH    1
+#define __LPU0_HOSTFN3_MBOX0_INFO(_v)   ((_v) << __LPU0_HOSTFN3_MBOX0_INFO_SH)
+#define __LPU0_HOSTFN3_MBOX0_CMD_STATUS 0x00000001
+#define LPU1_HOSTFN3_MBOX0_CMD_STAT     0x0001916c
+#define __LPU1_HOSTFN3_MBOX0_INFO_MK    0xfffffffe
+#define __LPU1_HOSTFN3_MBOX0_INFO_SH    1
+#define __LPU1_HOSTFN3_MBOX0_INFO(_v)   ((_v) << __LPU1_HOSTFN3_MBOX0_INFO_SH)
+#define __LPU1_HOSTFN3_MBOX0_CMD_STATUS 0x00000001
+#define FW_INIT_HALT_P0                 0x000191ac
+#define __FW_INIT_HALT_P                0x00000001
+#define FW_INIT_HALT_P1                 0x000191bc
+#define CPE_PI_PTR_Q0                   0x00038000
+#define __CPE_PI_UNUSED_MK              0xffff0000
+#define __CPE_PI_UNUSED_SH              16
+#define __CPE_PI_UNUSED(_v)             ((_v) << __CPE_PI_UNUSED_SH)
+#define __CPE_PI_PTR                    0x0000ffff
+#define CPE_PI_PTR_Q1                   0x00038040
+#define CPE_CI_PTR_Q0                   0x00038004
+#define __CPE_CI_UNUSED_MK              0xffff0000
+#define __CPE_CI_UNUSED_SH              16
+#define __CPE_CI_UNUSED(_v)             ((_v) << __CPE_CI_UNUSED_SH)
+#define __CPE_CI_PTR                    0x0000ffff
+#define CPE_CI_PTR_Q1                   0x00038044
+#define CPE_DEPTH_Q0                    0x00038008
+#define __CPE_DEPTH_UNUSED_MK           0xf8000000
+#define __CPE_DEPTH_UNUSED_SH           27
+#define __CPE_DEPTH_UNUSED(_v)          ((_v) << __CPE_DEPTH_UNUSED_SH)
+#define __CPE_MSIX_VEC_INDEX_MK         0x07ff0000
+#define __CPE_MSIX_VEC_INDEX_SH         16
+#define __CPE_MSIX_VEC_INDEX(_v)        ((_v) << __CPE_MSIX_VEC_INDEX_SH)
+#define __CPE_DEPTH                     0x0000ffff
+#define CPE_DEPTH_Q1                    0x00038048
+#define CPE_QCTRL_Q0                    0x0003800c
+#define __CPE_CTRL_UNUSED30_MK          0xfc000000
+#define __CPE_CTRL_UNUSED30_SH          26
+#define __CPE_CTRL_UNUSED30(_v)         ((_v) << __CPE_CTRL_UNUSED30_SH)
+#define __CPE_FUNC_INT_CTRL_MK          0x03000000
+#define __CPE_FUNC_INT_CTRL_SH          24
+#define __CPE_FUNC_INT_CTRL(_v)         ((_v) << __CPE_FUNC_INT_CTRL_SH)
+enum {
+        __CPE_FUNC_INT_CTRL_DISABLE             = 0x0,
+        __CPE_FUNC_INT_CTRL_F2NF                = 0x1,
+        __CPE_FUNC_INT_CTRL_3QUART              = 0x2,
+        __CPE_FUNC_INT_CTRL_HALF                = 0x3,
+};
+#define __CPE_CTRL_UNUSED20_MK          0x00f00000
+#define __CPE_CTRL_UNUSED20_SH          20
+#define __CPE_CTRL_UNUSED20(_v)         ((_v) << __CPE_CTRL_UNUSED20_SH)
+#define __CPE_SCI_TH_MK                 0x000f0000
+#define __CPE_SCI_TH_SH                 16
+#define __CPE_SCI_TH(_v)                ((_v) << __CPE_SCI_TH_SH)
+#define __CPE_CTRL_UNUSED10_MK          0x0000c000
+#define __CPE_CTRL_UNUSED10_SH          14
+#define __CPE_CTRL_UNUSED10(_v)         ((_v) << __CPE_CTRL_UNUSED10_SH)
+#define __CPE_ACK_PENDING               0x00002000
+#define __CPE_CTRL_UNUSED40_MK          0x00001c00
+#define __CPE_CTRL_UNUSED40_SH          10
+#define __CPE_CTRL_UNUSED40(_v)         ((_v) << __CPE_CTRL_UNUSED40_SH)
+#define __CPE_PCIEID_MK                 0x00000300
+#define __CPE_PCIEID_SH                 8
+#define __CPE_PCIEID(_v)                ((_v) << __CPE_PCIEID_SH)
+#define __CPE_CTRL_UNUSED00_MK          0x000000fe
+#define __CPE_CTRL_UNUSED00_SH          1
+#define __CPE_CTRL_UNUSED00(_v)         ((_v) << __CPE_CTRL_UNUSED00_SH)
+#define __CPE_ESIZE                     0x00000001
+#define CPE_QCTRL_Q1                    0x0003804c
+#define __CPE_CTRL_UNUSED31_MK          0xfc000000
+#define __CPE_CTRL_UNUSED31_SH          26
+#define __CPE_CTRL_UNUSED31(_v)         ((_v) << __CPE_CTRL_UNUSED31_SH)
+#define __CPE_CTRL_UNUSED21_MK          0x00f00000
+#define __CPE_CTRL_UNUSED21_SH          20
+#define __CPE_CTRL_UNUSED21(_v)         ((_v) << __CPE_CTRL_UNUSED21_SH)
+#define __CPE_CTRL_UNUSED11_MK          0x0000c000
+#define __CPE_CTRL_UNUSED11_SH          14
+#define __CPE_CTRL_UNUSED11(_v)         ((_v) << __CPE_CTRL_UNUSED11_SH)
+#define __CPE_CTRL_UNUSED41_MK          0x00001c00
+#define __CPE_CTRL_UNUSED41_SH          10
+#define __CPE_CTRL_UNUSED41(_v)         ((_v) << __CPE_CTRL_UNUSED41_SH)
+#define __CPE_CTRL_UNUSED01_MK          0x000000fe
+#define __CPE_CTRL_UNUSED01_SH          1
+#define __CPE_CTRL_UNUSED01(_v)         ((_v) << __CPE_CTRL_UNUSED01_SH)
+#define RME_PI_PTR_Q0                   0x00038020
+#define __LATENCY_TIME_STAMP_MK         0xffff0000
+#define __LATENCY_TIME_STAMP_SH         16
+#define __LATENCY_TIME_STAMP(_v)        ((_v) << __LATENCY_TIME_STAMP_SH)
+#define __RME_PI_PTR                    0x0000ffff
+#define RME_PI_PTR_Q1                   0x00038060
+#define RME_CI_PTR_Q0                   0x00038024
+#define __DELAY_TIME_STAMP_MK           0xffff0000
+#define __DELAY_TIME_STAMP_SH           16
+#define __DELAY_TIME_STAMP(_v)          ((_v) << __DELAY_TIME_STAMP_SH)
+#define __RME_CI_PTR                    0x0000ffff
+#define RME_CI_PTR_Q1                   0x00038064
+#define RME_DEPTH_Q0                    0x00038028
+#define __RME_DEPTH_UNUSED_MK           0xf8000000
+#define __RME_DEPTH_UNUSED_SH           27
+#define __RME_DEPTH_UNUSED(_v)          ((_v) << __RME_DEPTH_UNUSED_SH)
+#define __RME_MSIX_VEC_INDEX_MK         0x07ff0000
+#define __RME_MSIX_VEC_INDEX_SH         16
+#define __RME_MSIX_VEC_INDEX(_v)        ((_v) << __RME_MSIX_VEC_INDEX_SH)
+#define __RME_DEPTH                     0x0000ffff
+#define RME_DEPTH_Q1                    0x00038068
+#define RME_QCTRL_Q0                    0x0003802c
+#define __RME_INT_LATENCY_TIMER_MK      0xff000000
+#define __RME_INT_LATENCY_TIMER_SH      24
+#define __RME_INT_LATENCY_TIMER(_v)     ((_v) << __RME_INT_LATENCY_TIMER_SH)
+#define __RME_INT_DELAY_TIMER_MK        0x00ff0000
+#define __RME_INT_DELAY_TIMER_SH        16
+#define __RME_INT_DELAY_TIMER(_v)       ((_v) << __RME_INT_DELAY_TIMER_SH)
+#define __RME_INT_DELAY_DISABLE         0x00008000
+#define __RME_DLY_DELAY_DISABLE         0x00004000
+#define __RME_ACK_PENDING               0x00002000
+#define __RME_FULL_INTERRUPT_DISABLE    0x00001000
+#define __RME_CTRL_UNUSED10_MK          0x00000c00
+#define __RME_CTRL_UNUSED10_SH          10
+#define __RME_CTRL_UNUSED10(_v)         ((_v) << __RME_CTRL_UNUSED10_SH)
+#define __RME_PCIEID_MK                 0x00000300
+#define __RME_PCIEID_SH                 8
+#define __RME_PCIEID(_v)                ((_v) << __RME_PCIEID_SH)
+#define __RME_CTRL_UNUSED00_MK          0x000000fe
+#define __RME_CTRL_UNUSED00_SH          1
+#define __RME_CTRL_UNUSED00(_v)         ((_v) << __RME_CTRL_UNUSED00_SH)
+#define __RME_ESIZE                     0x00000001
+#define RME_QCTRL_Q1                    0x0003806c
+#define __RME_CTRL_UNUSED11_MK          0x00000c00
+#define __RME_CTRL_UNUSED11_SH          10
+#define __RME_CTRL_UNUSED11(_v)         ((_v) << __RME_CTRL_UNUSED11_SH)
+#define __RME_CTRL_UNUSED01_MK          0x000000fe
+#define __RME_CTRL_UNUSED01_SH          1
+#define __RME_CTRL_UNUSED01(_v)         ((_v) << __RME_CTRL_UNUSED01_SH)
+#define PSS_CTL_REG                     0x00018800
+#define __PSS_I2C_CLK_DIV_MK            0x007f0000
+#define __PSS_I2C_CLK_DIV_SH            16
+#define __PSS_I2C_CLK_DIV(_v)           ((_v) << __PSS_I2C_CLK_DIV_SH)
+#define __PSS_LMEM_INIT_DONE            0x00001000
+#define __PSS_LMEM_RESET                0x00000200
+#define __PSS_LMEM_INIT_EN              0x00000100
+#define __PSS_LPU1_RESET                0x00000002
+#define __PSS_LPU0_RESET                0x00000001
+#define PSS_ERR_STATUS_REG              0x00018810
+#define __PSS_LPU1_TCM_READ_ERR         0x00200000
+#define __PSS_LPU0_TCM_READ_ERR         0x00100000
+#define __PSS_LMEM5_CORR_ERR            0x00080000
+#define __PSS_LMEM4_CORR_ERR            0x00040000
+#define __PSS_LMEM3_CORR_ERR            0x00020000
+#define __PSS_LMEM2_CORR_ERR            0x00010000
+#define __PSS_LMEM1_CORR_ERR            0x00008000
+#define __PSS_LMEM0_CORR_ERR            0x00004000
+#define __PSS_LMEM5_UNCORR_ERR          0x00002000
+#define __PSS_LMEM4_UNCORR_ERR          0x00001000
+#define __PSS_LMEM3_UNCORR_ERR          0x00000800
+#define __PSS_LMEM2_UNCORR_ERR          0x00000400
+#define __PSS_LMEM1_UNCORR_ERR          0x00000200
+#define __PSS_LMEM0_UNCORR_ERR          0x00000100
+#define __PSS_BAL_PERR                  0x00000080
+#define __PSS_DIP_IF_ERR                0x00000040
+#define __PSS_IOH_IF_ERR                0x00000020
+#define __PSS_TDS_IF_ERR                0x00000010
+#define __PSS_RDS_IF_ERR                0x00000008
+#define __PSS_SGM_IF_ERR                0x00000004
+#define __PSS_LPU1_RAM_ERR              0x00000002
+#define __PSS_LPU0_RAM_ERR              0x00000001
+#define ERR_SET_REG                     0x00018818
+#define __PSS_ERR_STATUS_SET            0x003fffff
+#define PMM_1T_RESET_REG_P0             0x0002381c
+#define __PMM_1T_RESET_P                0x00000001
+#define PMM_1T_RESET_REG_P1             0x00023c1c
+#define HQM_QSET0_RXQ_DRBL_P0           0x00038000
+#define __RXQ0_ADD_VECTORS_P            0x80000000
+#define __RXQ0_STOP_P                   0x40000000
+#define __RXQ0_PRD_PTR_P                0x0000ffff
+#define HQM_QSET1_RXQ_DRBL_P0           0x00038080
+#define __RXQ1_ADD_VECTORS_P            0x80000000
+#define __RXQ1_STOP_P                   0x40000000
+#define __RXQ1_PRD_PTR_P                0x0000ffff
+#define HQM_QSET0_RXQ_DRBL_P1           0x0003c000
+#define HQM_QSET1_RXQ_DRBL_P1           0x0003c080
+#define HQM_QSET0_TXQ_DRBL_P0           0x00038020
+#define __TXQ0_ADD_VECTORS_P            0x80000000
+#define __TXQ0_STOP_P                   0x40000000
+#define __TXQ0_PRD_PTR_P                0x0000ffff
+#define HQM_QSET1_TXQ_DRBL_P0           0x000380a0
+#define __TXQ1_ADD_VECTORS_P            0x80000000
+#define __TXQ1_STOP_P                   0x40000000
+#define __TXQ1_PRD_PTR_P                0x0000ffff
+#define HQM_QSET0_TXQ_DRBL_P1           0x0003c020
+#define HQM_QSET1_TXQ_DRBL_P1           0x0003c0a0
+#define HQM_QSET0_IB_DRBL_1_P0          0x00038040
+#define __IB1_0_ACK_P                   0x80000000
+#define __IB1_0_DISABLE_P               0x40000000
+#define __IB1_0_COALESCING_CFG_P_MK     0x00ff0000
+#define __IB1_0_COALESCING_CFG_P_SH     16
+#define __IB1_0_COALESCING_CFG_P(_v)    ((_v) << __IB1_0_COALESCING_CFG_P_SH)
+#define __IB1_0_NUM_OF_ACKED_EVENTS_P   0x0000ffff
+#define HQM_QSET1_IB_DRBL_1_P0          0x000380c0
+#define __IB1_1_ACK_P                   0x80000000
+#define __IB1_1_DISABLE_P               0x40000000
+#define __IB1_1_COALESCING_CFG_P_MK     0x00ff0000
+#define __IB1_1_COALESCING_CFG_P_SH     16
+#define __IB1_1_COALESCING_CFG_P(_v)    ((_v) << __IB1_1_COALESCING_CFG_P_SH)
+#define __IB1_1_NUM_OF_ACKED_EVENTS_P   0x0000ffff
+#define HQM_QSET0_IB_DRBL_1_P1          0x0003c040
+#define HQM_QSET1_IB_DRBL_1_P1          0x0003c0c0
+#define HQM_QSET0_IB_DRBL_2_P0          0x00038060
+#define __IB2_0_ACK_P                   0x80000000
+#define __IB2_0_DISABLE_P               0x40000000
+#define __IB2_0_COALESCING_CFG_P_MK     0x00ff0000
+#define __IB2_0_COALESCING_CFG_P_SH     16
+#define __IB2_0_COALESCING_CFG_P(_v)    ((_v) << __IB2_0_COALESCING_CFG_P_SH)
+#define __IB2_0_NUM_OF_ACKED_EVENTS_P   0x0000ffff
+#define HQM_QSET1_IB_DRBL_2_P0          0x000380e0
+#define __IB2_1_ACK_P                   0x80000000
+#define __IB2_1_DISABLE_P               0x40000000
+#define __IB2_1_COALESCING_CFG_P_MK     0x00ff0000
+#define __IB2_1_COALESCING_CFG_P_SH     16
+#define __IB2_1_COALESCING_CFG_P(_v)    ((_v) << __IB2_1_COALESCING_CFG_P_SH)
+#define __IB2_1_NUM_OF_ACKED_EVENTS_P   0x0000ffff
+#define HQM_QSET0_IB_DRBL_2_P1          0x0003c060
+#define HQM_QSET1_IB_DRBL_2_P1          0x0003c0e0
+
+/*
+ * These definitions are either in error/missing in spec. Its auto-generated
+ * from hard coded values in regparse.pl.
+ */
+#define __EMPHPOST_AT_4G_MK_FIX         0x0000001c
+#define __EMPHPOST_AT_4G_SH_FIX         0x00000002
+#define __EMPHPRE_AT_4G_FIX             0x00000003
+#define __SFP_TXRATE_EN_FIX             0x00000100
+#define __SFP_RXRATE_EN_FIX             0x00000080
+
+/*
+ * These register definitions are auto-generated from hard coded values
+ * in regparse.pl.
+ */
+
+/*
+ * These register mapping definitions are auto-generated from mapping tables
+ * in regparse.pl.
+ */
+#define BFA_IOC0_HBEAT_REG              HOST_SEM0_INFO_REG
+#define BFA_IOC0_STATE_REG              HOST_SEM1_INFO_REG
+#define BFA_IOC1_HBEAT_REG              HOST_SEM2_INFO_REG
+#define BFA_IOC1_STATE_REG              HOST_SEM3_INFO_REG
+#define BFA_FW_USE_COUNT                 HOST_SEM4_INFO_REG
+
+#define CPE_DEPTH_Q(__n) \
+        (CPE_DEPTH_Q0 + (__n) * (CPE_DEPTH_Q1 - CPE_DEPTH_Q0))
+#define CPE_QCTRL_Q(__n) \
+        (CPE_QCTRL_Q0 + (__n) * (CPE_QCTRL_Q1 - CPE_QCTRL_Q0))
+#define CPE_PI_PTR_Q(__n) \
+        (CPE_PI_PTR_Q0 + (__n) * (CPE_PI_PTR_Q1 - CPE_PI_PTR_Q0))
+#define CPE_CI_PTR_Q(__n) \
+        (CPE_CI_PTR_Q0 + (__n) * (CPE_CI_PTR_Q1 - CPE_CI_PTR_Q0))
+#define RME_DEPTH_Q(__n) \
+        (RME_DEPTH_Q0 + (__n) * (RME_DEPTH_Q1 - RME_DEPTH_Q0))
+#define RME_QCTRL_Q(__n) \
+        (RME_QCTRL_Q0 + (__n) * (RME_QCTRL_Q1 - RME_QCTRL_Q0))
+#define RME_PI_PTR_Q(__n) \
+        (RME_PI_PTR_Q0 + (__n) * (RME_PI_PTR_Q1 - RME_PI_PTR_Q0))
+#define RME_CI_PTR_Q(__n) \
+        (RME_CI_PTR_Q0 + (__n) * (RME_CI_PTR_Q1 - RME_CI_PTR_Q0))
+#define HQM_QSET_RXQ_DRBL_P0(__n) (HQM_QSET0_RXQ_DRBL_P0 + (__n) \
+        * (HQM_QSET1_RXQ_DRBL_P0 - HQM_QSET0_RXQ_DRBL_P0))
+#define HQM_QSET_TXQ_DRBL_P0(__n) (HQM_QSET0_TXQ_DRBL_P0 + (__n) \
+        * (HQM_QSET1_TXQ_DRBL_P0 - HQM_QSET0_TXQ_DRBL_P0))
+#define HQM_QSET_IB_DRBL_1_P0(__n) (HQM_QSET0_IB_DRBL_1_P0 + (__n) \
+        * (HQM_QSET1_IB_DRBL_1_P0 - HQM_QSET0_IB_DRBL_1_P0))
+#define HQM_QSET_IB_DRBL_2_P0(__n) (HQM_QSET0_IB_DRBL_2_P0 + (__n) \
+        * (HQM_QSET1_IB_DRBL_2_P0 - HQM_QSET0_IB_DRBL_2_P0))
+#define HQM_QSET_RXQ_DRBL_P1(__n) (HQM_QSET0_RXQ_DRBL_P1 + (__n) \
+        * (HQM_QSET1_RXQ_DRBL_P1 - HQM_QSET0_RXQ_DRBL_P1))
+#define HQM_QSET_TXQ_DRBL_P1(__n) (HQM_QSET0_TXQ_DRBL_P1 + (__n) \
+        * (HQM_QSET1_TXQ_DRBL_P1 - HQM_QSET0_TXQ_DRBL_P1))
+#define HQM_QSET_IB_DRBL_1_P1(__n) (HQM_QSET0_IB_DRBL_1_P1 + (__n) \
+        * (HQM_QSET1_IB_DRBL_1_P1 - HQM_QSET0_IB_DRBL_1_P1))
+#define HQM_QSET_IB_DRBL_2_P1(__n) (HQM_QSET0_IB_DRBL_2_P1 + (__n) \
+        * (HQM_QSET1_IB_DRBL_2_P1 - HQM_QSET0_IB_DRBL_2_P1))
+
+#define CPE_Q_NUM(__fn, __q) (((__fn) << 2) + (__q))
+#define RME_Q_NUM(__fn, __q) (((__fn) << 2) + (__q))
+#define CPE_Q_MASK(__q) ((__q) & 0x3)
+#define RME_Q_MASK(__q) ((__q) & 0x3)
+
+/*
+ * PCI MSI-X vector defines
+ */
+enum {
+        BFA_MSIX_CPE_Q0 = 0,
+        BFA_MSIX_CPE_Q1 = 1,
+        BFA_MSIX_CPE_Q2 = 2,
+        BFA_MSIX_CPE_Q3 = 3,
+        BFA_MSIX_RME_Q0 = 4,
+        BFA_MSIX_RME_Q1 = 5,
+        BFA_MSIX_RME_Q2 = 6,
+        BFA_MSIX_RME_Q3 = 7,
+        BFA_MSIX_LPU_ERR = 8,
+        BFA_MSIX_CT_MAX = 9,
+};
+
+/*
+ * And corresponding host interrupt status bit field defines
+ */
+#define __HFN_INT_CPE_Q0                0x00000001U
+#define __HFN_INT_CPE_Q1                0x00000002U
+#define __HFN_INT_CPE_Q2                0x00000004U
+#define __HFN_INT_CPE_Q3                0x00000008U
+#define __HFN_INT_CPE_Q4                0x00000010U
+#define __HFN_INT_CPE_Q5                0x00000020U
+#define __HFN_INT_CPE_Q6                0x00000040U
+#define __HFN_INT_CPE_Q7                0x00000080U
+#define __HFN_INT_RME_Q0                0x00000100U
+#define __HFN_INT_RME_Q1                0x00000200U
+#define __HFN_INT_RME_Q2                0x00000400U
+#define __HFN_INT_RME_Q3                0x00000800U
+#define __HFN_INT_RME_Q4                0x00001000U
+#define __HFN_INT_RME_Q5                0x00002000U
+#define __HFN_INT_RME_Q6                0x00004000U
+#define __HFN_INT_RME_Q7                0x00008000U
+#define __HFN_INT_ERR_EMC               0x00010000U
+#define __HFN_INT_ERR_LPU0              0x00020000U
+#define __HFN_INT_ERR_LPU1              0x00040000U
+#define __HFN_INT_ERR_PSS               0x00080000U
+#define __HFN_INT_MBOX_LPU0             0x00100000U
+#define __HFN_INT_MBOX_LPU1             0x00200000U
+#define __HFN_INT_MBOX1_LPU0            0x00400000U
+#define __HFN_INT_MBOX1_LPU1            0x00800000U
+#define __HFN_INT_LL_HALT               0x01000000U
+#define __HFN_INT_CPE_MASK              0x000000ffU
+#define __HFN_INT_RME_MASK              0x0000ff00U
+
+/*
+ * catapult memory map.
+ */
+#define LL_PGN_HQM0             0x0096
+#define LL_PGN_HQM1             0x0097
+#define PSS_SMEM_PAGE_START     0x8000
+#define PSS_SMEM_PGNUM(_pg0, _ma)       ((_pg0) + ((_ma) >> 15))
+#define PSS_SMEM_PGOFF(_ma)     ((_ma) & 0x7fff)
+
+/*
+ * End of catapult memory map
+ */
+
+#endif /* __BFI_CTREG_H__ */
diff --git a/drivers/net/bna/bfi_ll.h b/drivers/net/bna/bfi_ll.h
new file mode 100644
index 000000000000..bee4d054066a
--- /dev/null
+++ b/drivers/net/bna/bfi_ll.h
@@ -0,0 +1,438 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BFI_LL_H__
+#define __BFI_LL_H__
+
+#include "bfi.h"
+
+#pragma pack(1)
+
+/**
+ * @brief
+ *      "enums" for all LL mailbox messages other than IOC
+ */
+enum {
+        BFI_LL_H2I_MAC_UCAST_SET_REQ = 1,
+        BFI_LL_H2I_MAC_UCAST_ADD_REQ = 2,
+        BFI_LL_H2I_MAC_UCAST_DEL_REQ = 3,
+
+        BFI_LL_H2I_MAC_MCAST_ADD_REQ = 4,
+        BFI_LL_H2I_MAC_MCAST_DEL_REQ = 5,
+        BFI_LL_H2I_MAC_MCAST_FILTER_REQ = 6,
+        BFI_LL_H2I_MAC_MCAST_DEL_ALL_REQ = 7,
+
+        BFI_LL_H2I_PORT_ADMIN_REQ = 8,
+        BFI_LL_H2I_STATS_GET_REQ = 9,
+        BFI_LL_H2I_STATS_CLEAR_REQ = 10,
+
+        BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ = 11,
+        BFI_LL_H2I_RXF_DEFAULT_SET_REQ = 12,
+
+        BFI_LL_H2I_TXQ_STOP_REQ = 13,
+        BFI_LL_H2I_RXQ_STOP_REQ = 14,
+
+        BFI_LL_H2I_DIAG_LOOPBACK_REQ = 15,
+
+        BFI_LL_H2I_SET_PAUSE_REQ = 16,
+        BFI_LL_H2I_MTU_INFO_REQ = 17,
+
+        BFI_LL_H2I_RX_REQ = 18,
+} ;
+
+enum {
+        BFI_LL_I2H_MAC_UCAST_SET_RSP = BFA_I2HM(1),
+        BFI_LL_I2H_MAC_UCAST_ADD_RSP = BFA_I2HM(2),
+        BFI_LL_I2H_MAC_UCAST_DEL_RSP = BFA_I2HM(3),
+
+        BFI_LL_I2H_MAC_MCAST_ADD_RSP = BFA_I2HM(4),
+        BFI_LL_I2H_MAC_MCAST_DEL_RSP = BFA_I2HM(5),
+        BFI_LL_I2H_MAC_MCAST_FILTER_RSP = BFA_I2HM(6),
+        BFI_LL_I2H_MAC_MCAST_DEL_ALL_RSP = BFA_I2HM(7),
+
+        BFI_LL_I2H_PORT_ADMIN_RSP = BFA_I2HM(8),
+        BFI_LL_I2H_STATS_GET_RSP = BFA_I2HM(9),
+        BFI_LL_I2H_STATS_CLEAR_RSP = BFA_I2HM(10),
+
+        BFI_LL_I2H_RXF_PROMISCUOUS_SET_RSP = BFA_I2HM(11),
+        BFI_LL_I2H_RXF_DEFAULT_SET_RSP = BFA_I2HM(12),
+
+        BFI_LL_I2H_TXQ_STOP_RSP = BFA_I2HM(13),
+        BFI_LL_I2H_RXQ_STOP_RSP = BFA_I2HM(14),
+
+        BFI_LL_I2H_DIAG_LOOPBACK_RSP = BFA_I2HM(15),
+
+        BFI_LL_I2H_SET_PAUSE_RSP = BFA_I2HM(16),
+
+        BFI_LL_I2H_MTU_INFO_RSP = BFA_I2HM(17),
+        BFI_LL_I2H_RX_RSP = BFA_I2HM(18),
+
+        BFI_LL_I2H_LINK_DOWN_AEN = BFA_I2HM(19),
+        BFI_LL_I2H_LINK_UP_AEN = BFA_I2HM(20),
+
+        BFI_LL_I2H_PORT_ENABLE_AEN = BFA_I2HM(21),
+        BFI_LL_I2H_PORT_DISABLE_AEN = BFA_I2HM(22),
+} ;
+
+/**
+ * @brief bfi_ll_mac_addr_req is used by:
+ *        BFI_LL_H2I_MAC_UCAST_SET_REQ
+ *        BFI_LL_H2I_MAC_UCAST_ADD_REQ
+ *        BFI_LL_H2I_MAC_UCAST_DEL_REQ
+ *        BFI_LL_H2I_MAC_MCAST_ADD_REQ
+ *        BFI_LL_H2I_MAC_MCAST_DEL_REQ
+ */
+struct bfi_ll_mac_addr_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8              rxf_id;
+        u8              rsvd1[3];
+        mac_t           mac_addr;
+        u8              rsvd2[2];
+};
+
+/**
+ * @brief bfi_ll_mcast_filter_req is used by:
+ *        BFI_LL_H2I_MAC_MCAST_FILTER_REQ
+ */
+struct bfi_ll_mcast_filter_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8              rxf_id;
+        u8              enable;
+        u8              rsvd[2];
+};
+
+/**
+ * @brief bfi_ll_mcast_del_all is used by:
+ *        BFI_LL_H2I_MAC_MCAST_DEL_ALL_REQ
+ */
+struct bfi_ll_mcast_del_all_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8                 rxf_id;
+        u8                 rsvd[3];
+};
+
+/**
+ * @brief bfi_ll_q_stop_req is used by:
+ *      BFI_LL_H2I_TXQ_STOP_REQ
+ *      BFI_LL_H2I_RXQ_STOP_REQ
+ */
+struct bfi_ll_q_stop_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u32     q_id_mask[2];   /* !< bit-mask for queue ids */
+};
+
+/**
+ * @brief bfi_ll_stats_req is used by:
+ *    BFI_LL_I2H_STATS_GET_REQ
+ *    BFI_LL_I2H_STATS_CLEAR_REQ
+ */
+struct bfi_ll_stats_req {
+        struct bfi_mhdr mh;     /*!< common msg header */
+        u16 stats_mask; /* !< bit-mask for non-function statistics */
+        u8      rsvd[2];
+        u32 rxf_id_mask[2];     /* !< bit-mask for RxF Statistics */
+        u32 txf_id_mask[2];     /* !< bit-mask for TxF Statistics */
+        union bfi_addr_u  host_buffer;  /* !< where statistics are returned */
+};
+
+/**
+ * @brief defines for "stats_mask" above.
+ */
+#define BFI_LL_STATS_MAC        (1 << 0)        /* !< MAC Statistics */
+#define BFI_LL_STATS_BPC        (1 << 1)        /* !< Pause Stats from BPC */
+#define BFI_LL_STATS_RAD        (1 << 2)        /* !< Rx Admission Statistics */
+#define BFI_LL_STATS_RX_FC      (1 << 3)        /* !< Rx FC Stats from RxA */
+#define BFI_LL_STATS_TX_FC      (1 << 4)        /* !< Tx FC Stats from TxA */
+
+#define BFI_LL_STATS_ALL        0x1f
+
+/**
+ * @brief bfi_ll_port_admin_req
+ */
+struct bfi_ll_port_admin_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8               up;
+        u8               rsvd[3];
+};
+
+/**
+ * @brief bfi_ll_rxf_req is used by:
+ *      BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ
+ *      BFI_LL_H2I_RXF_DEFAULT_SET_REQ
+ */
+struct bfi_ll_rxf_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8              rxf_id;
+        u8              enable;
+        u8              rsvd[2];
+};
+
+/**
+ * @brief bfi_ll_rxf_multi_req is used by:
+ *      BFI_LL_H2I_RX_REQ
+ */
+struct bfi_ll_rxf_multi_req {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u32     rxf_id_mask[2];
+        u8              enable;
+        u8              rsvd[3];
+};
+
+/**
+ * @brief enum for Loopback opmodes
+ */
+enum {
+        BFI_LL_DIAG_LB_OPMODE_EXT = 0,
+        BFI_LL_DIAG_LB_OPMODE_CBL = 1,
+};
+
+/**
+ * @brief bfi_ll_set_pause_req is used by:
+ *      BFI_LL_H2I_SET_PAUSE_REQ
+ */
+struct bfi_ll_set_pause_req {
+        struct bfi_mhdr mh;
+        u8              tx_pause; /* 1 = enable, 0 =  disable */
+        u8              rx_pause; /* 1 = enable, 0 =  disable */
+        u8              rsvd[2];
+};
+
+/**
+ * @brief bfi_ll_mtu_info_req is used by:
+ *      BFI_LL_H2I_MTU_INFO_REQ
+ */
+struct bfi_ll_mtu_info_req {
+        struct bfi_mhdr mh;
+        u16     mtu;
+        u8              rsvd[2];
+};
+
+/**
+ * @brief
+ *        Response header format used by all responses
+ *        For both responses and asynchronous notifications
+ */
+struct bfi_ll_rsp {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u8              error;
+        u8              rsvd[3];
+};
+
+/**
+ * @brief bfi_ll_cee_aen is used by:
+ *      BFI_LL_I2H_LINK_DOWN_AEN
+ *      BFI_LL_I2H_LINK_UP_AEN
+ */
+struct bfi_ll_aen {
+        struct bfi_mhdr mh;             /*!< common msg header */
+        u32     reason;
+        u8              cee_linkup;
+        u8              prio_map;    /*!< LL priority bit-map */
+        u8              rsvd[2];
+};
+
+/**
+ * @brief
+ *      The following error codes can be returned
+ *      by the mbox commands
+ */
+enum {
+        BFI_LL_CMD_OK           = 0,
+        BFI_LL_CMD_FAIL         = 1,
+        BFI_LL_CMD_DUP_ENTRY    = 2,    /* !< Duplicate entry in CAM */
+        BFI_LL_CMD_CAM_FULL     = 3,    /* !< CAM is full */
+        BFI_LL_CMD_NOT_OWNER    = 4,    /* !< Not permitted, b'cos not owner */
+        BFI_LL_CMD_NOT_EXEC     = 5,    /* !< Was not sent to f/w at all */
+        BFI_LL_CMD_WAITING      = 6,    /* !< Waiting for completion (VMware) */
+        BFI_LL_CMD_PORT_DISABLED        = 7,    /* !< port in disabled state */
+} ;
+
+/* Statistics */
+#define BFI_LL_TXF_ID_MAX       64
+#define BFI_LL_RXF_ID_MAX       64
+
+/* TxF Frame Statistics */
+struct bfi_ll_stats_txf {
+        u64 ucast_octets;
+        u64 ucast;
+        u64 ucast_vlan;
+
+        u64 mcast_octets;
+        u64 mcast;
+        u64 mcast_vlan;
+
+        u64 bcast_octets;
+        u64 bcast;
+        u64 bcast_vlan;
+
+        u64 errors;
+        u64 filter_vlan;      /* frames filtered due to VLAN */
+        u64 filter_mac_sa;    /* frames filtered due to SA check */
+};
+
+/* RxF Frame Statistics */
+struct bfi_ll_stats_rxf {
+        u64 ucast_octets;
+        u64 ucast;
+        u64 ucast_vlan;
+
+        u64 mcast_octets;
+        u64 mcast;
+        u64 mcast_vlan;
+
+        u64 bcast_octets;
+        u64 bcast;
+        u64 bcast_vlan;
+        u64 frame_drops;
+};
+
+/* FC Tx Frame Statistics */
+struct bfi_ll_stats_fc_tx {
+        u64 txf_ucast_octets;
+        u64 txf_ucast;
+        u64 txf_ucast_vlan;
+
+        u64 txf_mcast_octets;
+        u64 txf_mcast;
+        u64 txf_mcast_vlan;
+
+        u64 txf_bcast_octets;
+        u64 txf_bcast;
+        u64 txf_bcast_vlan;
+
+        u64 txf_parity_errors;
+        u64 txf_timeout;
+        u64 txf_fid_parity_errors;
+};
+
+/* FC Rx Frame Statistics */
+struct bfi_ll_stats_fc_rx {
+        u64 rxf_ucast_octets;
+        u64 rxf_ucast;
+        u64 rxf_ucast_vlan;
+
+        u64 rxf_mcast_octets;
+        u64 rxf_mcast;
+        u64 rxf_mcast_vlan;
+
+        u64 rxf_bcast_octets;
+        u64 rxf_bcast;
+        u64 rxf_bcast_vlan;
+};
+
+/* RAD Frame Statistics */
+struct bfi_ll_stats_rad {
+        u64 rx_frames;
+        u64 rx_octets;
+        u64 rx_vlan_frames;
+
+        u64 rx_ucast;
+        u64 rx_ucast_octets;
+        u64 rx_ucast_vlan;
+
+        u64 rx_mcast;
+        u64 rx_mcast_octets;
+        u64 rx_mcast_vlan;
+
+        u64 rx_bcast;
+        u64 rx_bcast_octets;
+        u64 rx_bcast_vlan;
+
+        u64 rx_drops;
+};
+
+/* BPC Tx Registers */
+struct bfi_ll_stats_bpc {
+        /* transmit stats */
+        u64 tx_pause[8];
+        u64 tx_zero_pause[8];   /*!< Pause cancellation */
+        /*!<Pause initiation rather than retention */
+        u64 tx_first_pause[8];
+
+        /* receive stats */
+        u64 rx_pause[8];
+        u64 rx_zero_pause[8];   /*!< Pause cancellation */
+        /*!<Pause initiation rather than retention */
+        u64 rx_first_pause[8];
+};
+
+/* MAC Rx Statistics */
+struct bfi_ll_stats_mac {
+        u64 frame_64;           /* both rx and tx counter */
+        u64 frame_65_127;               /* both rx and tx counter */
+        u64 frame_128_255;              /* both rx and tx counter */
+        u64 frame_256_511;              /* both rx and tx counter */
+        u64 frame_512_1023;     /* both rx and tx counter */
+        u64 frame_1024_1518;    /* both rx and tx counter */
+        u64 frame_1519_1522;    /* both rx and tx counter */
+
+        /* receive stats */
+        u64 rx_bytes;
+        u64 rx_packets;
+        u64 rx_fcs_error;
+        u64 rx_multicast;
+        u64 rx_broadcast;
+        u64 rx_control_frames;
+        u64 rx_pause;
+        u64 rx_unknown_opcode;
+        u64 rx_alignment_error;
+        u64 rx_frame_length_error;
+        u64 rx_code_error;
+        u64 rx_carrier_sense_error;
+        u64 rx_undersize;
+        u64 rx_oversize;
+        u64 rx_fragments;
+        u64 rx_jabber;
+        u64 rx_drop;
+
+        /* transmit stats */
+        u64 tx_bytes;
+        u64 tx_packets;
+        u64 tx_multicast;
+        u64 tx_broadcast;
+        u64 tx_pause;
+        u64 tx_deferral;
+        u64 tx_excessive_deferral;
+        u64 tx_single_collision;
+        u64 tx_muliple_collision;
+        u64 tx_late_collision;
+        u64 tx_excessive_collision;
+        u64 tx_total_collision;
+        u64 tx_pause_honored;
+        u64 tx_drop;
+        u64 tx_jabber;
+        u64 tx_fcs_error;
+        u64 tx_control_frame;
+        u64 tx_oversize;
+        u64 tx_undersize;
+        u64 tx_fragments;
+};
+
+/* Complete statistics */
+struct bfi_ll_stats {
+        struct bfi_ll_stats_mac         mac_stats;
+        struct bfi_ll_stats_bpc         bpc_stats;
+        struct bfi_ll_stats_rad         rad_stats;
+        struct bfi_ll_stats_fc_rx       fc_rx_stats;
+        struct bfi_ll_stats_fc_tx       fc_tx_stats;
+        struct bfi_ll_stats_rxf rxf_stats[BFI_LL_RXF_ID_MAX];
+        struct bfi_ll_stats_txf txf_stats[BFI_LL_TXF_ID_MAX];
+};
+
+#pragma pack()
+
+#endif  /* __BFI_LL_H__ */
diff --git a/drivers/net/bna/bna.h b/drivers/net/bna/bna.h
new file mode 100644
index 000000000000..6a2b3291c190
--- /dev/null
+++ b/drivers/net/bna/bna.h
@@ -0,0 +1,654 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+#ifndef __BNA_H__
+#define __BNA_H__
+
+#include "bfa_wc.h"
+#include "bfa_ioc.h"
+#include "cna.h"
+#include "bfi_ll.h"
+#include "bna_types.h"
+
+extern u32 bna_dim_vector[][BNA_BIAS_T_MAX];
+extern u32 bna_napi_dim_vector[][BNA_BIAS_T_MAX];
+
+/**
+ *
+ *  Macros and constants
+ *
+ */
+
+#define BNA_IOC_TIMER_FREQ              200
+
+/* Log string size */
+#define BNA_MESSAGE_SIZE                256
+
+#define bna_device_timer(_dev)          bfa_timer_beat(&((_dev)->timer_mod))
+
+/* MBOX API for PORT, TX, RX */
+#define bna_mbox_qe_fill(_qe, _cmd, _cmd_len, _cbfn, _cbarg)            \
+do {                                                                    \
+        memcpy(&((_qe)->cmd.msg[0]), (_cmd), (_cmd_len));       \
+        (_qe)->cbfn = (_cbfn);                                          \
+        (_qe)->cbarg = (_cbarg);                                        \
+} while (0)
+
+#define bna_is_small_rxq(rcb) ((rcb)->id == 1)
+
+#define BNA_MAC_IS_EQUAL(_mac1, _mac2)                                  \
+        (!memcmp((_mac1), (_mac2), sizeof(mac_t)))
+
+#define BNA_POWER_OF_2(x) (((x) & ((x) - 1)) == 0)
+
+#define BNA_TO_POWER_OF_2(x)                                            \
+do {                                                                    \
+        int _shift = 0;                                                 \
+        while ((x) && (x) != 1) {                                       \
+                (x) >>= 1;                                              \
+                _shift++;                                               \
+        }                                                               \
+        (x) <<= _shift;                                                 \
+} while (0)
+
+#define BNA_TO_POWER_OF_2_HIGH(x)                                       \
+do {                                                                    \
+        int n = 1;                                                      \
+        while (n < (x))                                                 \
+                n <<= 1;                                                \
+        (x) = n;                                                        \
+} while (0)
+
+/*
+ * input : _addr-> os dma addr in host endian format,
+ * output : _bna_dma_addr-> pointer to hw dma addr
+ */
+#define BNA_SET_DMA_ADDR(_addr, _bna_dma_addr)                          \
+do {                                                                    \
+        u64 tmp_addr =                                          \
+        cpu_to_be64((u64)(_addr));                              \
+        (_bna_dma_addr)->msb = ((struct bna_dma_addr *)&tmp_addr)->msb; \
+        (_bna_dma_addr)->lsb = ((struct bna_dma_addr *)&tmp_addr)->lsb; \
+} while (0)
+
+/*
+ * input : _bna_dma_addr-> pointer to hw dma addr
+ * output : _addr-> os dma addr in host endian format
+ */
+#define BNA_GET_DMA_ADDR(_bna_dma_addr, _addr)                  \
+do {                                                            \
+        (_addr) = ((((u64)ntohl((_bna_dma_addr)->msb))) << 32)          \
+        | ((ntohl((_bna_dma_addr)->lsb) & 0xffffffff)); \
+} while (0)
+
+#define containing_rec(addr, type, field)                               \
+        ((type *)((unsigned char *)(addr) -                             \
+        (unsigned char *)(&((type *)0)->field)))
+
+#define BNA_TXQ_WI_NEEDED(_vectors)     (((_vectors) + 3) >> 2)
+
+/* TxQ element is 64 bytes */
+#define BNA_TXQ_PAGE_INDEX_MAX          (PAGE_SIZE >> 6)
+#define BNA_TXQ_PAGE_INDEX_MAX_SHIFT    (PAGE_SHIFT - 6)
+
+#define BNA_TXQ_QPGE_PTR_GET(_qe_idx, _qpt_ptr, _qe_ptr, _qe_ptr_range) \
+{                                                                       \
+        unsigned int page_index;        /* index within a page */       \
+        void *page_addr;                                                \
+        page_index = (_qe_idx) & (BNA_TXQ_PAGE_INDEX_MAX - 1);          \
+        (_qe_ptr_range) = (BNA_TXQ_PAGE_INDEX_MAX - page_index);        \
+        page_addr = (_qpt_ptr)[((_qe_idx) >>  BNA_TXQ_PAGE_INDEX_MAX_SHIFT)];\
+        (_qe_ptr) = &((struct bna_txq_entry *)(page_addr))[page_index]; \
+}
+
+/* RxQ element is 8 bytes */
+#define BNA_RXQ_PAGE_INDEX_MAX          (PAGE_SIZE >> 3)
+#define BNA_RXQ_PAGE_INDEX_MAX_SHIFT    (PAGE_SHIFT - 3)
+
+#define BNA_RXQ_QPGE_PTR_GET(_qe_idx, _qpt_ptr, _qe_ptr, _qe_ptr_range) \
+{                                                                       \
+        unsigned int page_index;        /* index within a page */       \
+        void *page_addr;                                                \
+        page_index = (_qe_idx) & (BNA_RXQ_PAGE_INDEX_MAX - 1);          \
+        (_qe_ptr_range) = (BNA_RXQ_PAGE_INDEX_MAX - page_index);        \
+        page_addr = (_qpt_ptr)[((_qe_idx) >>                            \
+                                BNA_RXQ_PAGE_INDEX_MAX_SHIFT)];         \
+        (_qe_ptr) = &((struct bna_rxq_entry *)(page_addr))[page_index]; \
+}
+
+/* CQ element is 16 bytes */
+#define BNA_CQ_PAGE_INDEX_MAX           (PAGE_SIZE >> 4)
+#define BNA_CQ_PAGE_INDEX_MAX_SHIFT     (PAGE_SHIFT - 4)
+
+#define BNA_CQ_QPGE_PTR_GET(_qe_idx, _qpt_ptr, _qe_ptr, _qe_ptr_range)  \
+{                                                                       \
+        unsigned int page_index;          /* index within a page */     \
+        void *page_addr;                                                \
+                                                                        \
+        page_index = (_qe_idx) & (BNA_CQ_PAGE_INDEX_MAX - 1);           \
+        (_qe_ptr_range) = (BNA_CQ_PAGE_INDEX_MAX - page_index);         \
+        page_addr = (_qpt_ptr)[((_qe_idx) >>                            \
+                                    BNA_CQ_PAGE_INDEX_MAX_SHIFT)];      \
+        (_qe_ptr) = &((struct bna_cq_entry *)(page_addr))[page_index];\
+}
+
+#define BNA_QE_INDX_2_PTR(_cast, _qe_idx, _q_base)                      \
+        (&((_cast *)(_q_base))[(_qe_idx)])
+
+#define BNA_QE_INDX_RANGE(_qe_idx, _q_depth) ((_q_depth) - (_qe_idx))
+
+#define BNA_QE_INDX_ADD(_qe_idx, _qe_num, _q_depth)                     \
+        ((_qe_idx) = ((_qe_idx) + (_qe_num)) & ((_q_depth) - 1))
+
+#define BNA_Q_INDEX_CHANGE(_old_idx, _updated_idx, _q_depth)            \
+        (((_updated_idx) - (_old_idx)) & ((_q_depth) - 1))
+
+#define BNA_QE_FREE_CNT(_q_ptr, _q_depth)                               \
+        (((_q_ptr)->consumer_index - (_q_ptr)->producer_index - 1) &    \
+         ((_q_depth) - 1))
+
+#define BNA_QE_IN_USE_CNT(_q_ptr, _q_depth)                             \
+        ((((_q_ptr)->producer_index - (_q_ptr)->consumer_index)) &      \
+         (_q_depth - 1))
+
+#define BNA_Q_GET_CI(_q_ptr)            ((_q_ptr)->q.consumer_index)
+
+#define BNA_Q_GET_PI(_q_ptr)            ((_q_ptr)->q.producer_index)
+
+#define BNA_Q_PI_ADD(_q_ptr, _num)                                      \
+        (_q_ptr)->q.producer_index =                                    \
+                (((_q_ptr)->q.producer_index + (_num)) &                \
+                ((_q_ptr)->q.q_depth - 1))
+
+#define BNA_Q_CI_ADD(_q_ptr, _num)                                      \
+        (_q_ptr)->q.consumer_index =                                    \
+                (((_q_ptr)->q.consumer_index + (_num))                  \
+                & ((_q_ptr)->q.q_depth - 1))
+
+#define BNA_Q_FREE_COUNT(_q_ptr)                                        \
+        (BNA_QE_FREE_CNT(&((_q_ptr)->q), (_q_ptr)->q.q_depth))
+
+#define BNA_Q_IN_USE_COUNT(_q_ptr)                                      \
+        (BNA_QE_IN_USE_CNT(&(_q_ptr)->q, (_q_ptr)->q.q_depth))
+
+/* These macros build the data portion of the TxQ/RxQ doorbell */
+#define BNA_DOORBELL_Q_PRD_IDX(_pi)     (0x80000000 | (_pi))
+#define BNA_DOORBELL_Q_STOP             (0x40000000)
+
+/* These macros build the data portion of the IB doorbell */
+#define BNA_DOORBELL_IB_INT_ACK(_timeout, _events) \
+        (0x80000000 | ((_timeout) << 16) | (_events))
+#define BNA_DOORBELL_IB_INT_DISABLE     (0x40000000)
+
+/* Set the coalescing timer for the given ib */
+#define bna_ib_coalescing_timer_set(_i_dbell, _cls_timer)               \
+        ((_i_dbell)->doorbell_ack = BNA_DOORBELL_IB_INT_ACK((_cls_timer), 0));
+
+/* Acks 'events' # of events for a given ib */
+#define bna_ib_ack(_i_dbell, _events)                                   \
+        (writel(((_i_dbell)->doorbell_ack | (_events)), \
+                (_i_dbell)->doorbell_addr));
+
+#define bna_txq_prod_indx_doorbell(_tcb)                                \
+        (writel(BNA_DOORBELL_Q_PRD_IDX((_tcb)->producer_index), \
+                (_tcb)->q_dbell));
+
+#define bna_rxq_prod_indx_doorbell(_rcb)                                \
+        (writel(BNA_DOORBELL_Q_PRD_IDX((_rcb)->producer_index), \
+                (_rcb)->q_dbell));
+
+#define BNA_LARGE_PKT_SIZE              1000
+
+#define BNA_UPDATE_PKT_CNT(_pkt, _len)                                  \
+do {                                                                    \
+        if ((_len) > BNA_LARGE_PKT_SIZE) {                              \
+                (_pkt)->large_pkt_cnt++;                                \
+        } else {                                                        \
+                (_pkt)->small_pkt_cnt++;                                \
+        }                                                               \
+} while (0)
+
+#define call_rxf_stop_cbfn(rxf, status)                                 \
+        if ((rxf)->stop_cbfn) {                                         \
+                (*(rxf)->stop_cbfn)((rxf)->stop_cbarg, (status));       \
+                (rxf)->stop_cbfn = NULL;                                \
+                (rxf)->stop_cbarg = NULL;                               \
+        }
+
+#define call_rxf_start_cbfn(rxf, status)                                \
+        if ((rxf)->start_cbfn) {                                        \
+                (*(rxf)->start_cbfn)((rxf)->start_cbarg, (status));     \
+                (rxf)->start_cbfn = NULL;                               \
+                (rxf)->start_cbarg = NULL;                              \
+        }
+
+#define call_rxf_cam_fltr_cbfn(rxf, status)                             \
+        if ((rxf)->cam_fltr_cbfn) {                                     \
+                (*(rxf)->cam_fltr_cbfn)((rxf)->cam_fltr_cbarg, rxf->rx, \
+                                        (status));                      \
+                (rxf)->cam_fltr_cbfn = NULL;                            \
+                (rxf)->cam_fltr_cbarg = NULL;                           \
+        }
+
+#define call_rxf_pause_cbfn(rxf, status)                                \
+        if ((rxf)->oper_state_cbfn) {                                   \
+                (*(rxf)->oper_state_cbfn)((rxf)->oper_state_cbarg, rxf->rx,\
+                                        (status));                      \
+                (rxf)->rxf_flags &= ~BNA_RXF_FL_OPERSTATE_CHANGED;      \
+                (rxf)->oper_state_cbfn = NULL;                          \
+                (rxf)->oper_state_cbarg = NULL;                         \
+        }
+
+#define call_rxf_resume_cbfn(rxf, status) call_rxf_pause_cbfn(rxf, status)
+
+#define is_xxx_enable(mode, bitmask, xxx) ((bitmask & xxx) && (mode & xxx))
+
+#define is_xxx_disable(mode, bitmask, xxx) ((bitmask & xxx) && !(mode & xxx))
+
+#define xxx_enable(mode, bitmask, xxx)                                  \
+do {                                                                    \
+        bitmask |= xxx;                                                 \
+        mode |= xxx;                                                    \
+} while (0)
+
+#define xxx_disable(mode, bitmask, xxx)                                 \
+do {                                                                    \
+        bitmask |= xxx;                                                 \
+        mode &= ~xxx;                                                   \
+} while (0)
+
+#define xxx_inactive(mode, bitmask, xxx)                                \
+do {                                                                    \
+        bitmask &= ~xxx;                                                \
+        mode &= ~xxx;                                                   \
+} while (0)
+
+#define is_promisc_enable(mode, bitmask)                                \
+        is_xxx_enable(mode, bitmask, BNA_RXMODE_PROMISC)
+
+#define is_promisc_disable(mode, bitmask)                               \
+        is_xxx_disable(mode, bitmask, BNA_RXMODE_PROMISC)
+
+#define promisc_enable(mode, bitmask)                                   \
+        xxx_enable(mode, bitmask, BNA_RXMODE_PROMISC)
+
+#define promisc_disable(mode, bitmask)                                  \
+        xxx_disable(mode, bitmask, BNA_RXMODE_PROMISC)
+
+#define promisc_inactive(mode, bitmask)                                 \
+        xxx_inactive(mode, bitmask, BNA_RXMODE_PROMISC)
+
+#define is_default_enable(mode, bitmask)                                \
+        is_xxx_enable(mode, bitmask, BNA_RXMODE_DEFAULT)
+
+#define is_default_disable(mode, bitmask)                               \
+        is_xxx_disable(mode, bitmask, BNA_RXMODE_DEFAULT)
+
+#define default_enable(mode, bitmask)                                   \
+        xxx_enable(mode, bitmask, BNA_RXMODE_DEFAULT)
+
+#define default_disable(mode, bitmask)                                  \
+        xxx_disable(mode, bitmask, BNA_RXMODE_DEFAULT)
+
+#define default_inactive(mode, bitmask)                                 \
+        xxx_inactive(mode, bitmask, BNA_RXMODE_DEFAULT)
+
+#define is_allmulti_enable(mode, bitmask)                               \
+        is_xxx_enable(mode, bitmask, BNA_RXMODE_ALLMULTI)
+
+#define is_allmulti_disable(mode, bitmask)                              \
+        is_xxx_disable(mode, bitmask, BNA_RXMODE_ALLMULTI)
+
+#define allmulti_enable(mode, bitmask)                                  \
+        xxx_enable(mode, bitmask, BNA_RXMODE_ALLMULTI)
+
+#define allmulti_disable(mode, bitmask)                                 \
+        xxx_disable(mode, bitmask, BNA_RXMODE_ALLMULTI)
+
+#define allmulti_inactive(mode, bitmask)                                \
+        xxx_inactive(mode, bitmask, BNA_RXMODE_ALLMULTI)
+
+#define GET_RXQS(rxp, q0, q1)   do {                                    \
+        switch ((rxp)->type) {                                          \
+        case BNA_RXP_SINGLE:                                            \
+                (q0) = rxp->rxq.single.only;                            \
+                (q1) = NULL;                                            \
+                break;                                                  \
+        case BNA_RXP_SLR:                                               \
+                (q0) = rxp->rxq.slr.large;                              \
+                (q1) = rxp->rxq.slr.small;                              \
+                break;                                                  \
+        case BNA_RXP_HDS:                                               \
+                (q0) = rxp->rxq.hds.data;                               \
+                (q1) = rxp->rxq.hds.hdr;                                \
+                break;                                                  \
+        }                                                               \
+} while (0)
+
+/**
+ *
+ * Function prototypes
+ *
+ */
+
+/**
+ * BNA
+ */
+
+/* Internal APIs */
+void bna_adv_res_req(struct bna_res_info *res_info);
+
+/* APIs for BNAD */
+void bna_res_req(struct bna_res_info *res_info);
+void bna_init(struct bna *bna, struct bnad *bnad,
+                        struct bfa_pcidev *pcidev,
+                        struct bna_res_info *res_info);
+void bna_uninit(struct bna *bna);
+void bna_stats_get(struct bna *bna);
+void bna_stats_clr(struct bna *bna);
+void bna_get_perm_mac(struct bna *bna, u8 *mac);
+
+/* APIs for Rx */
+int bna_rit_mod_can_satisfy(struct bna_rit_mod *rit_mod, int seg_size);
+
+/* APIs for RxF */
+struct bna_mac *bna_ucam_mod_mac_get(struct bna_ucam_mod *ucam_mod);
+void bna_ucam_mod_mac_put(struct bna_ucam_mod *ucam_mod,
+                          struct bna_mac *mac);
+struct bna_mac *bna_mcam_mod_mac_get(struct bna_mcam_mod *mcam_mod);
+void bna_mcam_mod_mac_put(struct bna_mcam_mod *mcam_mod,
+                          struct bna_mac *mac);
+struct bna_rit_segment *
+bna_rit_mod_seg_get(struct bna_rit_mod *rit_mod, int seg_size);
+void bna_rit_mod_seg_put(struct bna_rit_mod *rit_mod,
+                        struct bna_rit_segment *seg);
+
+/**
+ * DEVICE
+ */
+
+/* Interanl APIs */
+void bna_adv_device_init(struct bna_device *device, struct bna *bna,
+                        struct bna_res_info *res_info);
+
+/* APIs for BNA */
+void bna_device_init(struct bna_device *device, struct bna *bna,
+                     struct bna_res_info *res_info);
+void bna_device_uninit(struct bna_device *device);
+void bna_device_cb_port_stopped(void *arg, enum bna_cb_status status);
+int bna_device_status_get(struct bna_device *device);
+int bna_device_state_get(struct bna_device *device);
+
+/* APIs for BNAD */
+void bna_device_enable(struct bna_device *device);
+void bna_device_disable(struct bna_device *device,
+                        enum bna_cleanup_type type);
+
+/**
+ * MBOX
+ */
+
+/* APIs for DEVICE */
+void bna_mbox_mod_init(struct bna_mbox_mod *mbox_mod, struct bna *bna);
+void bna_mbox_mod_uninit(struct bna_mbox_mod *mbox_mod);
+void bna_mbox_mod_start(struct bna_mbox_mod *mbox_mod);
+void bna_mbox_mod_stop(struct bna_mbox_mod *mbox_mod);
+
+/* APIs for PORT, TX, RX */
+void bna_mbox_handler(struct bna *bna, u32 intr_status);
+void bna_mbox_send(struct bna *bna, struct bna_mbox_qe *mbox_qe);
+
+/**
+ * PORT
+ */
+
+/* APIs for BNA */
+void bna_port_init(struct bna_port *port, struct bna *bna);
+void bna_port_uninit(struct bna_port *port);
+int bna_port_state_get(struct bna_port *port);
+int bna_llport_state_get(struct bna_llport *llport);
+
+/* APIs for DEVICE */
+void bna_port_start(struct bna_port *port);
+void bna_port_stop(struct bna_port *port);
+void bna_port_fail(struct bna_port *port);
+
+/* API for RX */
+int bna_port_mtu_get(struct bna_port *port);
+void bna_llport_admin_up(struct bna_llport *llport);
+void bna_llport_admin_down(struct bna_llport *llport);
+
+/* API for BNAD */
+void bna_port_enable(struct bna_port *port);
+void bna_port_disable(struct bna_port *port, enum bna_cleanup_type type,
+                      void (*cbfn)(void *, enum bna_cb_status));
+void bna_port_pause_config(struct bna_port *port,
+                           struct bna_pause_config *pause_config,
+                           void (*cbfn)(struct bnad *, enum bna_cb_status));
+void bna_port_mtu_set(struct bna_port *port, int mtu,
+                      void (*cbfn)(struct bnad *, enum bna_cb_status));
+void bna_port_mac_get(struct bna_port *port, mac_t *mac);
+void bna_port_type_set(struct bna_port *port, enum bna_port_type type);
+void bna_port_linkcbfn_set(struct bna_port *port,
+                           void (*linkcbfn)(struct bnad *,
+                                            enum bna_link_status));
+void bna_port_admin_up(struct bna_port *port);
+void bna_port_admin_down(struct bna_port *port);
+
+/* Callbacks for TX, RX */
+void bna_port_cb_tx_stopped(struct bna_port *port,
+                            enum bna_cb_status status);
+void bna_port_cb_rx_stopped(struct bna_port *port,
+                            enum bna_cb_status status);
+
+/* Callbacks for MBOX */
+void bna_port_cb_link_up(struct bna_port *port, struct bfi_ll_aen *aen,
+                         int status);
+void bna_port_cb_link_down(struct bna_port *port, int status);
+
+/**
+ * IB
+ */
+
+/* APIs for BNA */
+void bna_ib_mod_init(struct bna_ib_mod *ib_mod, struct bna *bna,
+                     struct bna_res_info *res_info);
+void bna_ib_mod_uninit(struct bna_ib_mod *ib_mod);
+
+/* APIs for TX, RX */
+struct bna_ib *bna_ib_get(struct bna_ib_mod *ib_mod,
+                            enum bna_intr_type intr_type, int vector);
+void bna_ib_put(struct bna_ib_mod *ib_mod, struct bna_ib *ib);
+int bna_ib_reserve_idx(struct bna_ib *ib);
+void bna_ib_release_idx(struct bna_ib *ib, int idx);
+int bna_ib_config(struct bna_ib *ib, struct bna_ib_config *ib_config);
+void bna_ib_start(struct bna_ib *ib);
+void bna_ib_stop(struct bna_ib *ib);
+void bna_ib_fail(struct bna_ib *ib);
+void bna_ib_coalescing_timeo_set(struct bna_ib *ib, u8 coalescing_timeo);
+
+/**
+ * TX MODULE AND TX
+ */
+
+/* Internal APIs */
+void bna_tx_prio_changed(struct bna_tx *tx, int prio);
+
+/* APIs for BNA */
+void bna_tx_mod_init(struct bna_tx_mod *tx_mod, struct bna *bna,
+                     struct bna_res_info *res_info);
+void bna_tx_mod_uninit(struct bna_tx_mod *tx_mod);
+int bna_tx_state_get(struct bna_tx *tx);
+
+/* APIs for PORT */
+void bna_tx_mod_start(struct bna_tx_mod *tx_mod, enum bna_tx_type type);
+void bna_tx_mod_stop(struct bna_tx_mod *tx_mod, enum bna_tx_type type);
+void bna_tx_mod_fail(struct bna_tx_mod *tx_mod);
+void bna_tx_mod_prio_changed(struct bna_tx_mod *tx_mod, int prio);
+void bna_tx_mod_cee_link_status(struct bna_tx_mod *tx_mod, int cee_link);
+
+/* APIs for BNAD */
+void bna_tx_res_req(int num_txq, int txq_depth,
+                    struct bna_res_info *res_info);
+struct bna_tx *bna_tx_create(struct bna *bna, struct bnad *bnad,
+                               struct bna_tx_config *tx_cfg,
+                               struct bna_tx_event_cbfn *tx_cbfn,
+                               struct bna_res_info *res_info, void *priv);
+void bna_tx_destroy(struct bna_tx *tx);
+void bna_tx_enable(struct bna_tx *tx);
+void bna_tx_disable(struct bna_tx *tx, enum bna_cleanup_type type,
+                    void (*cbfn)(void *, struct bna_tx *,
+                                 enum bna_cb_status));
+enum bna_cb_status
+bna_tx_prio_set(struct bna_tx *tx, int prio,
+                void (*cbfn)(struct bnad *, struct bna_tx *,
+                             enum bna_cb_status));
+void bna_tx_coalescing_timeo_set(struct bna_tx *tx, int coalescing_timeo);
+
+/**
+ * RX MODULE, RX, RXF
+ */
+
+/* Internal APIs */
+void rxf_cb_cam_fltr_mbox_cmd(void *arg, int status);
+void rxf_cam_mbox_cmd(struct bna_rxf *rxf, u8 cmd,
+                const struct bna_mac *mac_addr);
+void __rxf_vlan_filter_set(struct bna_rxf *rxf, enum bna_status status);
+void bna_rxf_adv_init(struct bna_rxf *rxf,
+                struct bna_rx *rx,
+                struct bna_rx_config *q_config);
+int rxf_process_packet_filter_ucast(struct bna_rxf *rxf);
+int rxf_process_packet_filter_promisc(struct bna_rxf *rxf);
+int rxf_process_packet_filter_default(struct bna_rxf *rxf);
+int rxf_process_packet_filter_allmulti(struct bna_rxf *rxf);
+int rxf_clear_packet_filter_ucast(struct bna_rxf *rxf);
+int rxf_clear_packet_filter_promisc(struct bna_rxf *rxf);
+int rxf_clear_packet_filter_default(struct bna_rxf *rxf);
+int rxf_clear_packet_filter_allmulti(struct bna_rxf *rxf);
+void rxf_reset_packet_filter_ucast(struct bna_rxf *rxf);
+void rxf_reset_packet_filter_promisc(struct bna_rxf *rxf);
+void rxf_reset_packet_filter_default(struct bna_rxf *rxf);
+void rxf_reset_packet_filter_allmulti(struct bna_rxf *rxf);
+
+/* APIs for BNA */
+void bna_rx_mod_init(struct bna_rx_mod *rx_mod, struct bna *bna,
+                     struct bna_res_info *res_info);
+void bna_rx_mod_uninit(struct bna_rx_mod *rx_mod);
+int bna_rx_state_get(struct bna_rx *rx);
+int bna_rxf_state_get(struct bna_rxf *rxf);
+
+/* APIs for PORT */
+void bna_rx_mod_start(struct bna_rx_mod *rx_mod, enum bna_rx_type type);
+void bna_rx_mod_stop(struct bna_rx_mod *rx_mod, enum bna_rx_type type);
+void bna_rx_mod_fail(struct bna_rx_mod *rx_mod);
+
+/* APIs for BNAD */
+void bna_rx_res_req(struct bna_rx_config *rx_config,
+                    struct bna_res_info *res_info);
+struct bna_rx *bna_rx_create(struct bna *bna, struct bnad *bnad,
+                               struct bna_rx_config *rx_cfg,
+                               struct bna_rx_event_cbfn *rx_cbfn,
+                               struct bna_res_info *res_info, void *priv);
+void bna_rx_destroy(struct bna_rx *rx);
+void bna_rx_enable(struct bna_rx *rx);
+void bna_rx_disable(struct bna_rx *rx, enum bna_cleanup_type type,
+                    void (*cbfn)(void *, struct bna_rx *,
+                                 enum bna_cb_status));
+void bna_rx_coalescing_timeo_set(struct bna_rx *rx, int coalescing_timeo);
+void bna_rx_dim_reconfig(struct bna *bna, u32 vector[][BNA_BIAS_T_MAX]);
+void bna_rx_dim_update(struct bna_ccb *ccb);
+enum bna_cb_status
+bna_rx_ucast_set(struct bna_rx *rx, u8 *ucmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status));
+enum bna_cb_status
+bna_rx_ucast_add(struct bna_rx *rx, u8* ucmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status));
+enum bna_cb_status
+bna_rx_ucast_del(struct bna_rx *rx, u8 *ucmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status));
+enum bna_cb_status
+bna_rx_mcast_add(struct bna_rx *rx, u8 *mcmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status));
+enum bna_cb_status
+bna_rx_mcast_del(struct bna_rx *rx, u8 *mcmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status));
+enum bna_cb_status
+bna_rx_mcast_listset(struct bna_rx *rx, int count, u8 *mcmac,
+                     void (*cbfn)(struct bnad *, struct bna_rx *,
+                                  enum bna_cb_status));
+void bna_rx_mcast_delall(struct bna_rx *rx,
+                         void (*cbfn)(struct bnad *, struct bna_rx *,
+                                      enum bna_cb_status));
+enum bna_cb_status
+bna_rx_mode_set(struct bna_rx *rx, enum bna_rxmode rxmode,
+                enum bna_rxmode bitmask,
+                void (*cbfn)(struct bnad *, struct bna_rx *,
+                             enum bna_cb_status));
+void bna_rx_vlan_add(struct bna_rx *rx, int vlan_id);
+void bna_rx_vlan_del(struct bna_rx *rx, int vlan_id);
+void bna_rx_vlanfilter_enable(struct bna_rx *rx);
+void bna_rx_vlanfilter_disable(struct bna_rx *rx);
+void bna_rx_rss_enable(struct bna_rx *rx);
+void bna_rx_rss_disable(struct bna_rx *rx);
+void bna_rx_rss_reconfig(struct bna_rx *rx, struct bna_rxf_rss *rss_config);
+void bna_rx_rss_rit_set(struct bna_rx *rx, unsigned int *vectors,
+                        int nvectors);
+void bna_rx_hds_enable(struct bna_rx *rx, struct bna_rxf_hds *hds_config,
+                       void (*cbfn)(struct bnad *, struct bna_rx *,
+                                    enum bna_cb_status));
+void bna_rx_hds_disable(struct bna_rx *rx,
+                        void (*cbfn)(struct bnad *, struct bna_rx *,
+                                     enum bna_cb_status));
+void bna_rx_receive_pause(struct bna_rx *rx,
+                          void (*cbfn)(struct bnad *, struct bna_rx *,
+                                       enum bna_cb_status));
+void bna_rx_receive_resume(struct bna_rx *rx,
+                           void (*cbfn)(struct bnad *, struct bna_rx *,
+                                        enum bna_cb_status));
+
+/* RxF APIs for RX */
+void bna_rxf_start(struct bna_rxf *rxf);
+void bna_rxf_stop(struct bna_rxf *rxf);
+void bna_rxf_fail(struct bna_rxf *rxf);
+void bna_rxf_init(struct bna_rxf *rxf, struct bna_rx *rx,
+                  struct bna_rx_config *q_config);
+void bna_rxf_uninit(struct bna_rxf *rxf);
+
+/* Callback from RXF to RX */
+void bna_rx_cb_rxf_stopped(struct bna_rx *rx, enum bna_cb_status);
+void bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status);
+
+/**
+ * BNAD
+ */
+
+/* Callbacks for BNA */
+void bnad_cb_stats_get(struct bnad *bnad, enum bna_cb_status status,
+                       struct bna_stats *stats);
+void bnad_cb_stats_clr(struct bnad *bnad);
+
+/* Callbacks for DEVICE */
+void bnad_cb_device_enabled(struct bnad *bnad, enum bna_cb_status status);
+void bnad_cb_device_disabled(struct bnad *bnad, enum bna_cb_status status);
+void bnad_cb_device_enable_mbox_intr(struct bnad *bnad);
+void bnad_cb_device_disable_mbox_intr(struct bnad *bnad);
+
+/* Callbacks for port */
+void bnad_cb_port_link_status(struct bnad *bnad,
+                              enum bna_link_status status);
+
+#endif  /* __BNA_H__ */
diff --git a/drivers/net/bna/bna_ctrl.c b/drivers/net/bna/bna_ctrl.c
new file mode 100644
index 000000000000..ddd922f210c7
--- /dev/null
+++ b/drivers/net/bna/bna_ctrl.c
@@ -0,0 +1,3624 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#include "bna.h"
+#include "bfa_sm.h"
+#include "bfa_wc.h"
+
+/**
+ * MBOX
+ */
+static int
+bna_is_aen(u8 msg_id)
+{
+        return msg_id == BFI_LL_I2H_LINK_DOWN_AEN ||
+               msg_id == BFI_LL_I2H_LINK_UP_AEN;
+}
+
+static void
+bna_mbox_aen_callback(struct bna *bna, struct bfi_mbmsg *msg)
+{
+        struct bfi_ll_aen *aen = (struct bfi_ll_aen *)(msg);
+
+        switch (aen->mh.msg_id) {
+        case BFI_LL_I2H_LINK_UP_AEN:
+                bna_port_cb_link_up(&bna->port, aen, aen->reason);
+                break;
+        case BFI_LL_I2H_LINK_DOWN_AEN:
+                bna_port_cb_link_down(&bna->port, aen->reason);
+                break;
+        default:
+                break;
+        }
+}
+
+static void
+bna_ll_isr(void *llarg, struct bfi_mbmsg *msg)
+{
+        struct bna *bna = (struct bna *)(llarg);
+        struct bfi_ll_rsp *mb_rsp = (struct bfi_ll_rsp *)(msg);
+        struct bfi_mhdr *cmd_h, *rsp_h;
+        struct bna_mbox_qe *mb_qe = NULL;
+        int to_post = 0;
+        u8 aen = 0;
+        char message[BNA_MESSAGE_SIZE];
+
+        aen = bna_is_aen(mb_rsp->mh.msg_id);
+
+        if (!aen) {
+                mb_qe = bfa_q_first(&bna->mbox_mod.posted_q);
+                cmd_h = (struct bfi_mhdr *)(&mb_qe->cmd.msg[0]);
+                rsp_h = (struct bfi_mhdr *)(&mb_rsp->mh);
+
+                if ((BFA_I2HM(cmd_h->msg_id) == rsp_h->msg_id) &&
+                    (cmd_h->mtag.i2htok == rsp_h->mtag.i2htok)) {
+                        /* Remove the request from posted_q, update state  */
+                        list_del(&mb_qe->qe);
+                        bna->mbox_mod.msg_pending--;
+                        if (list_empty(&bna->mbox_mod.posted_q))
+                                bna->mbox_mod.state = BNA_MBOX_FREE;
+                        else
+                                to_post = 1;
+
+                        /* Dispatch the cbfn */
+                        if (mb_qe->cbfn)
+                                mb_qe->cbfn(mb_qe->cbarg, mb_rsp->error);
+
+                        /* Post the next entry, if needed */
+                        if (to_post) {
+                                mb_qe = bfa_q_first(&bna->mbox_mod.posted_q);
+                                bfa_nw_ioc_mbox_queue(&bna->device.ioc,
+                                                        &mb_qe->cmd);
+                        }
+                } else {
+                        snprintf(message, BNA_MESSAGE_SIZE,
+                                       "No matching rsp for [%d:%d:%d]\n",
+                                       mb_rsp->mh.msg_class, mb_rsp->mh.msg_id,
+                                       mb_rsp->mh.mtag.i2htok);
+                pr_info("%s", message);
+                }
+
+        } else
+                bna_mbox_aen_callback(bna, msg);
+}
+
+void
+bna_err_handler(struct bna *bna, u32 intr_status)
+{
+        u32 init_halt;
+
+        if (intr_status & __HALT_STATUS_BITS) {
+                init_halt = readl(bna->device.ioc.ioc_regs.ll_halt);
+                init_halt &= ~__FW_INIT_HALT_P;
+                writel(init_halt, bna->device.ioc.ioc_regs.ll_halt);
+        }
+
+        bfa_nw_ioc_error_isr(&bna->device.ioc);
+}
+
+void
+bna_mbox_handler(struct bna *bna, u32 intr_status)
+{
+        if (BNA_IS_ERR_INTR(intr_status)) {
+                bna_err_handler(bna, intr_status);
+                return;
+        }
+        if (BNA_IS_MBOX_INTR(intr_status))
+                bfa_nw_ioc_mbox_isr(&bna->device.ioc);
+}
+
+void
+bna_mbox_send(struct bna *bna, struct bna_mbox_qe *mbox_qe)
+{
+        struct bfi_mhdr *mh;
+
+        mh = (struct bfi_mhdr *)(&mbox_qe->cmd.msg[0]);
+
+        mh->mtag.i2htok = htons(bna->mbox_mod.msg_ctr);
+        bna->mbox_mod.msg_ctr++;
+        bna->mbox_mod.msg_pending++;
+        if (bna->mbox_mod.state == BNA_MBOX_FREE) {
+                list_add_tail(&mbox_qe->qe, &bna->mbox_mod.posted_q);
+                bfa_nw_ioc_mbox_queue(&bna->device.ioc, &mbox_qe->cmd);
+                bna->mbox_mod.state = BNA_MBOX_POSTED;
+        } else {
+                list_add_tail(&mbox_qe->qe, &bna->mbox_mod.posted_q);
+        }
+}
+
+void
+bna_mbox_flush_q(struct bna *bna, struct list_head *q)
+{
+        struct bna_mbox_qe *mb_qe = NULL;
+        struct bfi_mhdr *cmd_h;
+        struct list_head                        *mb_q;
+        void                    (*cbfn)(void *arg, int status);
+        void                    *cbarg;
+
+        mb_q = &bna->mbox_mod.posted_q;
+
+        while (!list_empty(mb_q)) {
+                bfa_q_deq(mb_q, &mb_qe);
+                cbfn = mb_qe->cbfn;
+                cbarg = mb_qe->cbarg;
+                bfa_q_qe_init(mb_qe);
+                bna->mbox_mod.msg_pending--;
+
+                cmd_h = (struct bfi_mhdr *)(&mb_qe->cmd.msg[0]);
+                if (cbfn)
+                        cbfn(cbarg, BNA_CB_NOT_EXEC);
+        }
+
+        bna->mbox_mod.state = BNA_MBOX_FREE;
+}
+
+void
+bna_mbox_mod_start(struct bna_mbox_mod *mbox_mod)
+{
+}
+
+void
+bna_mbox_mod_stop(struct bna_mbox_mod *mbox_mod)
+{
+        bna_mbox_flush_q(mbox_mod->bna, &mbox_mod->posted_q);
+}
+
+void
+bna_mbox_mod_init(struct bna_mbox_mod *mbox_mod, struct bna *bna)
+{
+        bfa_nw_ioc_mbox_regisr(&bna->device.ioc, BFI_MC_LL, bna_ll_isr, bna);
+        mbox_mod->state = BNA_MBOX_FREE;
+        mbox_mod->msg_ctr = mbox_mod->msg_pending = 0;
+        INIT_LIST_HEAD(&mbox_mod->posted_q);
+        mbox_mod->bna = bna;
+}
+
+void
+bna_mbox_mod_uninit(struct bna_mbox_mod *mbox_mod)
+{
+        mbox_mod->bna = NULL;
+}
+
+/**
+ * LLPORT
+ */
+#define call_llport_stop_cbfn(llport, status)\
+do {\
+        if ((llport)->stop_cbfn)\
+                (llport)->stop_cbfn(&(llport)->bna->port, status);\
+        (llport)->stop_cbfn = NULL;\
+} while (0)
+
+static void bna_fw_llport_up(struct bna_llport *llport);
+static void bna_fw_cb_llport_up(void *arg, int status);
+static void bna_fw_llport_down(struct bna_llport *llport);
+static void bna_fw_cb_llport_down(void *arg, int status);
+static void bna_llport_start(struct bna_llport *llport);
+static void bna_llport_stop(struct bna_llport *llport);
+static void bna_llport_fail(struct bna_llport *llport);
+
+enum bna_llport_event {
+        LLPORT_E_START                  = 1,
+        LLPORT_E_STOP                   = 2,
+        LLPORT_E_FAIL                   = 3,
+        LLPORT_E_UP                     = 4,
+        LLPORT_E_DOWN                   = 5,
+        LLPORT_E_FWRESP_UP              = 6,
+        LLPORT_E_FWRESP_DOWN            = 7
+};
+
+enum bna_llport_state {
+        BNA_LLPORT_STOPPED              = 1,
+        BNA_LLPORT_DOWN                 = 2,
+        BNA_LLPORT_UP_RESP_WAIT         = 3,
+        BNA_LLPORT_DOWN_RESP_WAIT       = 4,
+        BNA_LLPORT_UP                   = 5,
+        BNA_LLPORT_LAST_RESP_WAIT       = 6
+};
+
+bfa_fsm_state_decl(bna_llport, stopped, struct bna_llport,
+                        enum bna_llport_event);
+bfa_fsm_state_decl(bna_llport, down, struct bna_llport,
+                        enum bna_llport_event);
+bfa_fsm_state_decl(bna_llport, up_resp_wait, struct bna_llport,
+                        enum bna_llport_event);
+bfa_fsm_state_decl(bna_llport, down_resp_wait, struct bna_llport,
+                        enum bna_llport_event);
+bfa_fsm_state_decl(bna_llport, up, struct bna_llport,
+                        enum bna_llport_event);
+bfa_fsm_state_decl(bna_llport, last_resp_wait, struct bna_llport,
+                        enum bna_llport_event);
+
+static struct bfa_sm_table llport_sm_table[] = {
+        {BFA_SM(bna_llport_sm_stopped), BNA_LLPORT_STOPPED},
+        {BFA_SM(bna_llport_sm_down), BNA_LLPORT_DOWN},
+        {BFA_SM(bna_llport_sm_up_resp_wait), BNA_LLPORT_UP_RESP_WAIT},
+        {BFA_SM(bna_llport_sm_down_resp_wait), BNA_LLPORT_DOWN_RESP_WAIT},
+        {BFA_SM(bna_llport_sm_up), BNA_LLPORT_UP},
+        {BFA_SM(bna_llport_sm_last_resp_wait), BNA_LLPORT_LAST_RESP_WAIT}
+};
+
+static void
+bna_llport_sm_stopped_entry(struct bna_llport *llport)
+{
+        llport->bna->port.link_cbfn((llport)->bna->bnad, BNA_LINK_DOWN);
+        call_llport_stop_cbfn(llport, BNA_CB_SUCCESS);
+}
+
+static void
+bna_llport_sm_stopped(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_START:
+                bfa_fsm_set_state(llport, bna_llport_sm_down);
+                break;
+
+        case LLPORT_E_STOP:
+                call_llport_stop_cbfn(llport, BNA_CB_SUCCESS);
+                break;
+
+        case LLPORT_E_FAIL:
+                break;
+
+        case LLPORT_E_DOWN:
+                /* This event is received due to Rx objects failing */
+                /* No-op */
+                break;
+
+        case LLPORT_E_FWRESP_UP:
+        case LLPORT_E_FWRESP_DOWN:
+                /**
+                 * These events are received due to flushing of mbox when
+                 * device fails
+                 */
+                /* No-op */
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_llport_sm_down_entry(struct bna_llport *llport)
+{
+        bnad_cb_port_link_status((llport)->bna->bnad, BNA_LINK_DOWN);
+}
+
+static void
+bna_llport_sm_down(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_STOP:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_FAIL:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_UP:
+                bfa_fsm_set_state(llport, bna_llport_sm_up_resp_wait);
+                bna_fw_llport_up(llport);
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_llport_sm_up_resp_wait_entry(struct bna_llport *llport)
+{
+        /**
+         * NOTE: Do not call bna_fw_llport_up() here. That will over step
+         * mbox due to down_resp_wait -> up_resp_wait transition on event
+         * LLPORT_E_UP
+         */
+}
+
+static void
+bna_llport_sm_up_resp_wait(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_STOP:
+                bfa_fsm_set_state(llport, bna_llport_sm_last_resp_wait);
+                break;
+
+        case LLPORT_E_FAIL:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_DOWN:
+                bfa_fsm_set_state(llport, bna_llport_sm_down_resp_wait);
+                break;
+
+        case LLPORT_E_FWRESP_UP:
+                bfa_fsm_set_state(llport, bna_llport_sm_up);
+                break;
+
+        case LLPORT_E_FWRESP_DOWN:
+                /* down_resp_wait -> up_resp_wait transition on LLPORT_E_UP */
+                bna_fw_llport_up(llport);
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_llport_sm_down_resp_wait_entry(struct bna_llport *llport)
+{
+        /**
+         * NOTE: Do not call bna_fw_llport_down() here. That will over step
+         * mbox due to up_resp_wait -> down_resp_wait transition on event
+         * LLPORT_E_DOWN
+         */
+}
+
+static void
+bna_llport_sm_down_resp_wait(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_STOP:
+                bfa_fsm_set_state(llport, bna_llport_sm_last_resp_wait);
+                break;
+
+        case LLPORT_E_FAIL:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_UP:
+                bfa_fsm_set_state(llport, bna_llport_sm_up_resp_wait);
+                break;
+
+        case LLPORT_E_FWRESP_UP:
+                /* up_resp_wait->down_resp_wait transition on LLPORT_E_DOWN */
+                bna_fw_llport_down(llport);
+                break;
+
+        case LLPORT_E_FWRESP_DOWN:
+                bfa_fsm_set_state(llport, bna_llport_sm_down);
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_llport_sm_up_entry(struct bna_llport *llport)
+{
+}
+
+static void
+bna_llport_sm_up(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_STOP:
+                bfa_fsm_set_state(llport, bna_llport_sm_last_resp_wait);
+                bna_fw_llport_down(llport);
+                break;
+
+        case LLPORT_E_FAIL:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_DOWN:
+                bfa_fsm_set_state(llport, bna_llport_sm_down_resp_wait);
+                bna_fw_llport_down(llport);
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_llport_sm_last_resp_wait_entry(struct bna_llport *llport)
+{
+}
+
+static void
+bna_llport_sm_last_resp_wait(struct bna_llport *llport,
+                        enum bna_llport_event event)
+{
+        switch (event) {
+        case LLPORT_E_FAIL:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        case LLPORT_E_DOWN:
+                /**
+                 * This event is received due to Rx objects stopping in
+                 * parallel to llport
+                 */
+                /* No-op */
+                break;
+
+        case LLPORT_E_FWRESP_UP:
+                /* up_resp_wait->last_resp_wait transition on LLPORT_T_STOP */
+                bna_fw_llport_down(llport);
+                break;
+
+        case LLPORT_E_FWRESP_DOWN:
+                bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(llport->bna, event);
+        }
+}
+
+static void
+bna_fw_llport_admin_up(struct bna_llport *llport)
+{
+        struct bfi_ll_port_admin_req ll_req;
+
+        memset(&ll_req, 0, sizeof(ll_req));
+        ll_req.mh.msg_class = BFI_MC_LL;
+        ll_req.mh.msg_id = BFI_LL_H2I_PORT_ADMIN_REQ;
+        ll_req.mh.mtag.h2i.lpu_id = 0;
+
+        ll_req.up = BNA_STATUS_T_ENABLED;
+
+        bna_mbox_qe_fill(&llport->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_fw_cb_llport_up, llport);
+
+        bna_mbox_send(llport->bna, &llport->mbox_qe);
+}
+
+static void
+bna_fw_llport_up(struct bna_llport *llport)
+{
+        if (llport->type == BNA_PORT_T_REGULAR)
+                bna_fw_llport_admin_up(llport);
+}
+
+static void
+bna_fw_cb_llport_up(void *arg, int status)
+{
+        struct bna_llport *llport = (struct bna_llport *)arg;
+
+        bfa_q_qe_init(&llport->mbox_qe.qe);
+        bfa_fsm_send_event(llport, LLPORT_E_FWRESP_UP);
+}
+
+static void
+bna_fw_llport_admin_down(struct bna_llport *llport)
+{
+        struct bfi_ll_port_admin_req ll_req;
+
+        memset(&ll_req, 0, sizeof(ll_req));
+        ll_req.mh.msg_class = BFI_MC_LL;
+        ll_req.mh.msg_id = BFI_LL_H2I_PORT_ADMIN_REQ;
+        ll_req.mh.mtag.h2i.lpu_id = 0;
+
+        ll_req.up = BNA_STATUS_T_DISABLED;
+
+        bna_mbox_qe_fill(&llport->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_fw_cb_llport_down, llport);
+
+        bna_mbox_send(llport->bna, &llport->mbox_qe);
+}
+
+static void
+bna_fw_llport_down(struct bna_llport *llport)
+{
+        if (llport->type == BNA_PORT_T_REGULAR)
+                bna_fw_llport_admin_down(llport);
+}
+
+static void
+bna_fw_cb_llport_down(void *arg, int status)
+{
+        struct bna_llport *llport = (struct bna_llport *)arg;
+
+        bfa_q_qe_init(&llport->mbox_qe.qe);
+        bfa_fsm_send_event(llport, LLPORT_E_FWRESP_DOWN);
+}
+
+void
+bna_port_cb_llport_stopped(struct bna_port *port,
+                                enum bna_cb_status status)
+{
+        bfa_wc_down(&port->chld_stop_wc);
+}
+
+static void
+bna_llport_init(struct bna_llport *llport, struct bna *bna)
+{
+        llport->flags |= BNA_LLPORT_F_ENABLED;
+        llport->type = BNA_PORT_T_REGULAR;
+        llport->bna = bna;
+
+        llport->link_status = BNA_LINK_DOWN;
+
+        llport->admin_up_count = 0;
+
+        llport->stop_cbfn = NULL;
+
+        bfa_q_qe_init(&llport->mbox_qe.qe);
+
+        bfa_fsm_set_state(llport, bna_llport_sm_stopped);
+}
+
+static void
+bna_llport_uninit(struct bna_llport *llport)
+{
+        llport->flags &= ~BNA_LLPORT_F_ENABLED;
+
+        llport->bna = NULL;
+}
+
+static void
+bna_llport_start(struct bna_llport *llport)
+{
+        bfa_fsm_send_event(llport, LLPORT_E_START);
+}
+
+static void
+bna_llport_stop(struct bna_llport *llport)
+{
+        llport->stop_cbfn = bna_port_cb_llport_stopped;
+
+        bfa_fsm_send_event(llport, LLPORT_E_STOP);
+}
+
+static void
+bna_llport_fail(struct bna_llport *llport)
+{
+        bfa_fsm_send_event(llport, LLPORT_E_FAIL);
+}
+
+int
+bna_llport_state_get(struct bna_llport *llport)
+{
+        return bfa_sm_to_state(llport_sm_table, llport->fsm);
+}
+
+void
+bna_llport_admin_up(struct bna_llport *llport)
+{
+        llport->admin_up_count++;
+
+        if (llport->admin_up_count == 1) {
+                llport->flags |= BNA_LLPORT_F_RX_ENABLED;
+                if (llport->flags & BNA_LLPORT_F_ENABLED)
+                        bfa_fsm_send_event(llport, LLPORT_E_UP);
+        }
+}
+
+void
+bna_llport_admin_down(struct bna_llport *llport)
+{
+        llport->admin_up_count--;
+
+        if (llport->admin_up_count == 0) {
+                llport->flags &= ~BNA_LLPORT_F_RX_ENABLED;
+                if (llport->flags & BNA_LLPORT_F_ENABLED)
+                        bfa_fsm_send_event(llport, LLPORT_E_DOWN);
+        }
+}
+
+/**
+ * PORT
+ */
+#define bna_port_chld_start(port)\
+do {\
+        enum bna_tx_type tx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_TX_T_REGULAR : BNA_TX_T_LOOPBACK;\
+        enum bna_rx_type rx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_RX_T_REGULAR : BNA_RX_T_LOOPBACK;\
+        bna_llport_start(&(port)->llport);\
+        bna_tx_mod_start(&(port)->bna->tx_mod, tx_type);\
+        bna_rx_mod_start(&(port)->bna->rx_mod, rx_type);\
+} while (0)
+
+#define bna_port_chld_stop(port)\
+do {\
+        enum bna_tx_type tx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_TX_T_REGULAR : BNA_TX_T_LOOPBACK;\
+        enum bna_rx_type rx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_RX_T_REGULAR : BNA_RX_T_LOOPBACK;\
+        bfa_wc_up(&(port)->chld_stop_wc);\
+        bfa_wc_up(&(port)->chld_stop_wc);\
+        bfa_wc_up(&(port)->chld_stop_wc);\
+        bna_llport_stop(&(port)->llport);\
+        bna_tx_mod_stop(&(port)->bna->tx_mod, tx_type);\
+        bna_rx_mod_stop(&(port)->bna->rx_mod, rx_type);\
+} while (0)
+
+#define bna_port_chld_fail(port)\
+do {\
+        bna_llport_fail(&(port)->llport);\
+        bna_tx_mod_fail(&(port)->bna->tx_mod);\
+        bna_rx_mod_fail(&(port)->bna->rx_mod);\
+} while (0)
+
+#define bna_port_rx_start(port)\
+do {\
+        enum bna_rx_type rx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_RX_T_REGULAR : BNA_RX_T_LOOPBACK;\
+        bna_rx_mod_start(&(port)->bna->rx_mod, rx_type);\
+} while (0)
+
+#define bna_port_rx_stop(port)\
+do {\
+        enum bna_rx_type rx_type = ((port)->type == BNA_PORT_T_REGULAR) ?\
+                                        BNA_RX_T_REGULAR : BNA_RX_T_LOOPBACK;\
+        bfa_wc_up(&(port)->chld_stop_wc);\
+        bna_rx_mod_stop(&(port)->bna->rx_mod, rx_type);\
+} while (0)
+
+#define call_port_stop_cbfn(port, status)\
+do {\
+        if ((port)->stop_cbfn)\
+                (port)->stop_cbfn((port)->stop_cbarg, status);\
+        (port)->stop_cbfn = NULL;\
+        (port)->stop_cbarg = NULL;\
+} while (0)
+
+#define call_port_pause_cbfn(port, status)\
+do {\
+        if ((port)->pause_cbfn)\
+                (port)->pause_cbfn((port)->bna->bnad, status);\
+        (port)->pause_cbfn = NULL;\
+} while (0)
+
+#define call_port_mtu_cbfn(port, status)\
+do {\
+        if ((port)->mtu_cbfn)\
+                (port)->mtu_cbfn((port)->bna->bnad, status);\
+        (port)->mtu_cbfn = NULL;\
+} while (0)
+
+static void bna_fw_pause_set(struct bna_port *port);
+static void bna_fw_cb_pause_set(void *arg, int status);
+static void bna_fw_mtu_set(struct bna_port *port);
+static void bna_fw_cb_mtu_set(void *arg, int status);
+
+enum bna_port_event {
+        PORT_E_START                    = 1,
+        PORT_E_STOP                     = 2,
+        PORT_E_FAIL                     = 3,
+        PORT_E_PAUSE_CFG                = 4,
+        PORT_E_MTU_CFG                  = 5,
+        PORT_E_CHLD_STOPPED             = 6,
+        PORT_E_FWRESP_PAUSE             = 7,
+        PORT_E_FWRESP_MTU               = 8
+};
+
+enum bna_port_state {
+        BNA_PORT_STOPPED                = 1,
+        BNA_PORT_MTU_INIT_WAIT          = 2,
+        BNA_PORT_PAUSE_INIT_WAIT        = 3,
+        BNA_PORT_LAST_RESP_WAIT         = 4,
+        BNA_PORT_STARTED                = 5,
+        BNA_PORT_PAUSE_CFG_WAIT         = 6,
+        BNA_PORT_RX_STOP_WAIT           = 7,
+        BNA_PORT_MTU_CFG_WAIT           = 8,
+        BNA_PORT_CHLD_STOP_WAIT         = 9
+};
+
+bfa_fsm_state_decl(bna_port, stopped, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, mtu_init_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, pause_init_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, last_resp_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, started, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, pause_cfg_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, rx_stop_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, mtu_cfg_wait, struct bna_port,
+                        enum bna_port_event);
+bfa_fsm_state_decl(bna_port, chld_stop_wait, struct bna_port,
+                        enum bna_port_event);
+
+static struct bfa_sm_table port_sm_table[] = {
+        {BFA_SM(bna_port_sm_stopped), BNA_PORT_STOPPED},
+        {BFA_SM(bna_port_sm_mtu_init_wait), BNA_PORT_MTU_INIT_WAIT},
+        {BFA_SM(bna_port_sm_pause_init_wait), BNA_PORT_PAUSE_INIT_WAIT},
+        {BFA_SM(bna_port_sm_last_resp_wait), BNA_PORT_LAST_RESP_WAIT},
+        {BFA_SM(bna_port_sm_started), BNA_PORT_STARTED},
+        {BFA_SM(bna_port_sm_pause_cfg_wait), BNA_PORT_PAUSE_CFG_WAIT},
+        {BFA_SM(bna_port_sm_rx_stop_wait), BNA_PORT_RX_STOP_WAIT},
+        {BFA_SM(bna_port_sm_mtu_cfg_wait), BNA_PORT_MTU_CFG_WAIT},
+        {BFA_SM(bna_port_sm_chld_stop_wait), BNA_PORT_CHLD_STOP_WAIT}
+};
+
+static void
+bna_port_sm_stopped_entry(struct bna_port *port)
+{
+        call_port_pause_cbfn(port, BNA_CB_SUCCESS);
+        call_port_mtu_cbfn(port, BNA_CB_SUCCESS);
+        call_port_stop_cbfn(port, BNA_CB_SUCCESS);
+}
+
+static void
+bna_port_sm_stopped(struct bna_port *port, enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_START:
+                bfa_fsm_set_state(port, bna_port_sm_mtu_init_wait);
+                break;
+
+        case PORT_E_STOP:
+                call_port_stop_cbfn(port, BNA_CB_SUCCESS);
+                break;
+
+        case PORT_E_FAIL:
+                /* No-op */
+                break;
+
+        case PORT_E_PAUSE_CFG:
+                call_port_pause_cbfn(port, BNA_CB_SUCCESS);
+                break;
+
+        case PORT_E_MTU_CFG:
+                call_port_mtu_cbfn(port, BNA_CB_SUCCESS);
+                break;
+
+        case PORT_E_CHLD_STOPPED:
+                /**
+                 * This event is received due to LLPort, Tx and Rx objects
+                 * failing
+                 */
+                /* No-op */
+                break;
+
+        case PORT_E_FWRESP_PAUSE:
+        case PORT_E_FWRESP_MTU:
+                /**
+                 * These events are received due to flushing of mbox when
+                 * device fails
+                 */
+                /* No-op */
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_mtu_init_wait_entry(struct bna_port *port)
+{
+        bna_fw_mtu_set(port);
+}
+
+static void
+bna_port_sm_mtu_init_wait(struct bna_port *port, enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_STOP:
+                bfa_fsm_set_state(port, bna_port_sm_last_resp_wait);
+                break;
+
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                break;
+
+        case PORT_E_PAUSE_CFG:
+                /* No-op */
+                break;
+
+        case PORT_E_MTU_CFG:
+                port->flags |= BNA_PORT_F_MTU_CHANGED;
+                break;
+
+        case PORT_E_FWRESP_MTU:
+                if (port->flags & BNA_PORT_F_MTU_CHANGED) {
+                        port->flags &= ~BNA_PORT_F_MTU_CHANGED;
+                        bna_fw_mtu_set(port);
+                } else {
+                        bfa_fsm_set_state(port, bna_port_sm_pause_init_wait);
+                }
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_pause_init_wait_entry(struct bna_port *port)
+{
+        bna_fw_pause_set(port);
+}
+
+static void
+bna_port_sm_pause_init_wait(struct bna_port *port,
+                                enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_STOP:
+                bfa_fsm_set_state(port, bna_port_sm_last_resp_wait);
+                break;
+
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                break;
+
+        case PORT_E_PAUSE_CFG:
+                port->flags |= BNA_PORT_F_PAUSE_CHANGED;
+                break;
+
+        case PORT_E_MTU_CFG:
+                port->flags |= BNA_PORT_F_MTU_CHANGED;
+                break;
+
+        case PORT_E_FWRESP_PAUSE:
+                if (port->flags & BNA_PORT_F_PAUSE_CHANGED) {
+                        port->flags &= ~BNA_PORT_F_PAUSE_CHANGED;
+                        bna_fw_pause_set(port);
+                } else if (port->flags & BNA_PORT_F_MTU_CHANGED) {
+                        port->flags &= ~BNA_PORT_F_MTU_CHANGED;
+                        bfa_fsm_set_state(port, bna_port_sm_mtu_init_wait);
+                } else {
+                        bfa_fsm_set_state(port, bna_port_sm_started);
+                        bna_port_chld_start(port);
+                }
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_last_resp_wait_entry(struct bna_port *port)
+{
+}
+
+static void
+bna_port_sm_last_resp_wait(struct bna_port *port,
+                                enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_FAIL:
+        case PORT_E_FWRESP_PAUSE:
+        case PORT_E_FWRESP_MTU:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_started_entry(struct bna_port *port)
+{
+        /**
+         * NOTE: Do not call bna_port_chld_start() here, since it will be
+         * inadvertently called during pause_cfg_wait->started transition
+         * as well
+         */
+        call_port_pause_cbfn(port, BNA_CB_SUCCESS);
+        call_port_mtu_cbfn(port, BNA_CB_SUCCESS);
+}
+
+static void
+bna_port_sm_started(struct bna_port *port,
+                        enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_STOP:
+                bfa_fsm_set_state(port, bna_port_sm_chld_stop_wait);
+                break;
+
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                bna_port_chld_fail(port);
+                break;
+
+        case PORT_E_PAUSE_CFG:
+                bfa_fsm_set_state(port, bna_port_sm_pause_cfg_wait);
+                break;
+
+        case PORT_E_MTU_CFG:
+                bfa_fsm_set_state(port, bna_port_sm_rx_stop_wait);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_pause_cfg_wait_entry(struct bna_port *port)
+{
+        bna_fw_pause_set(port);
+}
+
+static void
+bna_port_sm_pause_cfg_wait(struct bna_port *port,
+                                enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                bna_port_chld_fail(port);
+                break;
+
+        case PORT_E_FWRESP_PAUSE:
+                bfa_fsm_set_state(port, bna_port_sm_started);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_rx_stop_wait_entry(struct bna_port *port)
+{
+        bna_port_rx_stop(port);
+}
+
+static void
+bna_port_sm_rx_stop_wait(struct bna_port *port,
+                                enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                bna_port_chld_fail(port);
+                break;
+
+        case PORT_E_CHLD_STOPPED:
+                bfa_fsm_set_state(port, bna_port_sm_mtu_cfg_wait);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_mtu_cfg_wait_entry(struct bna_port *port)
+{
+        bna_fw_mtu_set(port);
+}
+
+static void
+bna_port_sm_mtu_cfg_wait(struct bna_port *port, enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                bna_port_chld_fail(port);
+                break;
+
+        case PORT_E_FWRESP_MTU:
+                bfa_fsm_set_state(port, bna_port_sm_started);
+                bna_port_rx_start(port);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_port_sm_chld_stop_wait_entry(struct bna_port *port)
+{
+        bna_port_chld_stop(port);
+}
+
+static void
+bna_port_sm_chld_stop_wait(struct bna_port *port,
+                                enum bna_port_event event)
+{
+        switch (event) {
+        case PORT_E_FAIL:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                bna_port_chld_fail(port);
+                break;
+
+        case PORT_E_CHLD_STOPPED:
+                bfa_fsm_set_state(port, bna_port_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(port->bna, event);
+        }
+}
+
+static void
+bna_fw_pause_set(struct bna_port *port)
+{
+        struct bfi_ll_set_pause_req ll_req;
+
+        memset(&ll_req, 0, sizeof(ll_req));
+        ll_req.mh.msg_class = BFI_MC_LL;
+        ll_req.mh.msg_id = BFI_LL_H2I_SET_PAUSE_REQ;
+        ll_req.mh.mtag.h2i.lpu_id = 0;
+
+        ll_req.tx_pause = port->pause_config.tx_pause;
+        ll_req.rx_pause = port->pause_config.rx_pause;
+
+        bna_mbox_qe_fill(&port->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_fw_cb_pause_set, port);
+
+        bna_mbox_send(port->bna, &port->mbox_qe);
+}
+
+static void
+bna_fw_cb_pause_set(void *arg, int status)
+{
+        struct bna_port *port = (struct bna_port *)arg;
+
+        bfa_q_qe_init(&port->mbox_qe.qe);
+        bfa_fsm_send_event(port, PORT_E_FWRESP_PAUSE);
+}
+
+void
+bna_fw_mtu_set(struct bna_port *port)
+{
+        struct bfi_ll_mtu_info_req ll_req;
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_MTU_INFO_REQ, 0);
+        ll_req.mtu = htons((u16)port->mtu);
+
+        bna_mbox_qe_fill(&port->mbox_qe, &ll_req, sizeof(ll_req),
+                                bna_fw_cb_mtu_set, port);
+        bna_mbox_send(port->bna, &port->mbox_qe);
+}
+
+void
+bna_fw_cb_mtu_set(void *arg, int status)
+{
+        struct bna_port *port = (struct bna_port *)arg;
+
+        bfa_q_qe_init(&port->mbox_qe.qe);
+        bfa_fsm_send_event(port, PORT_E_FWRESP_MTU);
+}
+
+static void
+bna_port_cb_chld_stopped(void *arg)
+{
+        struct bna_port *port = (struct bna_port *)arg;
+
+        bfa_fsm_send_event(port, PORT_E_CHLD_STOPPED);
+}
+
+void
+bna_port_init(struct bna_port *port, struct bna *bna)
+{
+        port->bna = bna;
+        port->flags = 0;
+        port->mtu = 0;
+        port->type = BNA_PORT_T_REGULAR;
+
+        port->link_cbfn = bnad_cb_port_link_status;
+
+        port->chld_stop_wc.wc_resume = bna_port_cb_chld_stopped;
+        port->chld_stop_wc.wc_cbarg = port;
+        port->chld_stop_wc.wc_count = 0;
+
+        port->stop_cbfn = NULL;
+        port->stop_cbarg = NULL;
+
+        port->pause_cbfn = NULL;
+
+        port->mtu_cbfn = NULL;
+
+        bfa_q_qe_init(&port->mbox_qe.qe);
+
+        bfa_fsm_set_state(port, bna_port_sm_stopped);
+
+        bna_llport_init(&port->llport, bna);
+}
+
+void
+bna_port_uninit(struct bna_port *port)
+{
+        bna_llport_uninit(&port->llport);
+
+        port->flags = 0;
+
+        port->bna = NULL;
+}
+
+int
+bna_port_state_get(struct bna_port *port)
+{
+        return bfa_sm_to_state(port_sm_table, port->fsm);
+}
+
+void
+bna_port_start(struct bna_port *port)
+{
+        port->flags |= BNA_PORT_F_DEVICE_READY;
+        if (port->flags & BNA_PORT_F_ENABLED)
+                bfa_fsm_send_event(port, PORT_E_START);
+}
+
+void
+bna_port_stop(struct bna_port *port)
+{
+        port->stop_cbfn = bna_device_cb_port_stopped;
+        port->stop_cbarg = &port->bna->device;
+
+        port->flags &= ~BNA_PORT_F_DEVICE_READY;
+        bfa_fsm_send_event(port, PORT_E_STOP);
+}
+
+void
+bna_port_fail(struct bna_port *port)
+{
+        port->flags &= ~BNA_PORT_F_DEVICE_READY;
+        bfa_fsm_send_event(port, PORT_E_FAIL);
+}
+
+void
+bna_port_cb_tx_stopped(struct bna_port *port, enum bna_cb_status status)
+{
+        bfa_wc_down(&port->chld_stop_wc);
+}
+
+void
+bna_port_cb_rx_stopped(struct bna_port *port, enum bna_cb_status status)
+{
+        bfa_wc_down(&port->chld_stop_wc);
+}
+
+void
+bna_port_cb_link_up(struct bna_port *port, struct bfi_ll_aen *aen,
+                        int status)
+{
+        int i;
+        u8 prio_map;
+
+        port->llport.link_status = BNA_LINK_UP;
+        if (aen->cee_linkup)
+                port->llport.link_status = BNA_CEE_UP;
+
+        /* Compute the priority */
+        prio_map = aen->prio_map;
+        if (prio_map) {
+                for (i = 0; i < 8; i++) {
+                        if ((prio_map >> i) & 0x1)
+                                break;
+                }
+                port->priority = i;
+        } else
+                port->priority = 0;
+
+        /* Dispatch events */
+        bna_tx_mod_cee_link_status(&port->bna->tx_mod, aen->cee_linkup);
+        bna_tx_mod_prio_changed(&port->bna->tx_mod, port->priority);
+        port->link_cbfn(port->bna->bnad, port->llport.link_status);
+}
+
+void
+bna_port_cb_link_down(struct bna_port *port, int status)
+{
+        port->llport.link_status = BNA_LINK_DOWN;
+
+        /* Dispatch events */
+        bna_tx_mod_cee_link_status(&port->bna->tx_mod, BNA_LINK_DOWN);
+        port->link_cbfn(port->bna->bnad, BNA_LINK_DOWN);
+}
+
+int
+bna_port_mtu_get(struct bna_port *port)
+{
+        return port->mtu;
+}
+
+void
+bna_port_enable(struct bna_port *port)
+{
+        if (port->fsm != (bfa_sm_t)bna_port_sm_stopped)
+                return;
+
+        port->flags |= BNA_PORT_F_ENABLED;
+
+        if (port->flags & BNA_PORT_F_DEVICE_READY)
+                bfa_fsm_send_event(port, PORT_E_START);
+}
+
+void
+bna_port_disable(struct bna_port *port, enum bna_cleanup_type type,
+                 void (*cbfn)(void *, enum bna_cb_status))
+{
+        if (type == BNA_SOFT_CLEANUP) {
+                (*cbfn)(port->bna->bnad, BNA_CB_SUCCESS);
+                return;
+        }
+
+        port->stop_cbfn = cbfn;
+        port->stop_cbarg = port->bna->bnad;
+
+        port->flags &= ~BNA_PORT_F_ENABLED;
+
+        bfa_fsm_send_event(port, PORT_E_STOP);
+}
+
+void
+bna_port_pause_config(struct bna_port *port,
+                      struct bna_pause_config *pause_config,
+                      void (*cbfn)(struct bnad *, enum bna_cb_status))
+{
+        port->pause_config = *pause_config;
+
+        port->pause_cbfn = cbfn;
+
+        bfa_fsm_send_event(port, PORT_E_PAUSE_CFG);
+}
+
+void
+bna_port_mtu_set(struct bna_port *port, int mtu,
+                 void (*cbfn)(struct bnad *, enum bna_cb_status))
+{
+        port->mtu = mtu;
+
+        port->mtu_cbfn = cbfn;
+
+        bfa_fsm_send_event(port, PORT_E_MTU_CFG);
+}
+
+void
+bna_port_mac_get(struct bna_port *port, mac_t *mac)
+{
+        *mac = bfa_nw_ioc_get_mac(&port->bna->device.ioc);
+}
+
+/**
+ * Should be called only when port is disabled
+ */
+void
+bna_port_type_set(struct bna_port *port, enum bna_port_type type)
+{
+        port->type = type;
+        port->llport.type = type;
+}
+
+/**
+ * Should be called only when port is disabled
+ */
+void
+bna_port_linkcbfn_set(struct bna_port *port,
+                      void (*linkcbfn)(struct bnad *, enum bna_link_status))
+{
+        port->link_cbfn = linkcbfn;
+}
+
+void
+bna_port_admin_up(struct bna_port *port)
+{
+        struct bna_llport *llport = &port->llport;
+
+        if (llport->flags & BNA_LLPORT_F_ENABLED)
+                return;
+
+        llport->flags |= BNA_LLPORT_F_ENABLED;
+
+        if (llport->flags & BNA_LLPORT_F_RX_ENABLED)
+                bfa_fsm_send_event(llport, LLPORT_E_UP);
+}
+
+void
+bna_port_admin_down(struct bna_port *port)
+{
+        struct bna_llport *llport = &port->llport;
+
+        if (!(llport->flags & BNA_LLPORT_F_ENABLED))
+                return;
+
+        llport->flags &= ~BNA_LLPORT_F_ENABLED;
+
+        if (llport->flags & BNA_LLPORT_F_RX_ENABLED)
+                bfa_fsm_send_event(llport, LLPORT_E_DOWN);
+}
+
+/**
+ * DEVICE
+ */
+#define enable_mbox_intr(_device)\
+do {\
+        u32 intr_status;\
+        bna_intr_status_get((_device)->bna, intr_status);\
+        bnad_cb_device_enable_mbox_intr((_device)->bna->bnad);\
+        bna_mbox_intr_enable((_device)->bna);\
+} while (0)
+
+#define disable_mbox_intr(_device)\
+do {\
+        bna_mbox_intr_disable((_device)->bna);\
+        bnad_cb_device_disable_mbox_intr((_device)->bna->bnad);\
+} while (0)
+
+const struct bna_chip_regs_offset reg_offset[] =
+{{HOST_PAGE_NUM_FN0, HOSTFN0_INT_STATUS,
+        HOSTFN0_INT_MASK, HOST_MSIX_ERR_INDEX_FN0},
+{HOST_PAGE_NUM_FN1, HOSTFN1_INT_STATUS,
+        HOSTFN1_INT_MASK, HOST_MSIX_ERR_INDEX_FN1},
+{HOST_PAGE_NUM_FN2, HOSTFN2_INT_STATUS,
+        HOSTFN2_INT_MASK, HOST_MSIX_ERR_INDEX_FN2},
+{HOST_PAGE_NUM_FN3, HOSTFN3_INT_STATUS,
+        HOSTFN3_INT_MASK, HOST_MSIX_ERR_INDEX_FN3},
+};
+
+enum bna_device_event {
+        DEVICE_E_ENABLE                 = 1,
+        DEVICE_E_DISABLE                = 2,
+        DEVICE_E_IOC_READY              = 3,
+        DEVICE_E_IOC_FAILED             = 4,
+        DEVICE_E_IOC_DISABLED           = 5,
+        DEVICE_E_IOC_RESET              = 6,
+        DEVICE_E_PORT_STOPPED           = 7,
+};
+
+enum bna_device_state {
+        BNA_DEVICE_STOPPED              = 1,
+        BNA_DEVICE_IOC_READY_WAIT       = 2,
+        BNA_DEVICE_READY                = 3,
+        BNA_DEVICE_PORT_STOP_WAIT       = 4,
+        BNA_DEVICE_IOC_DISABLE_WAIT     = 5,
+        BNA_DEVICE_FAILED               = 6
+};
+
+bfa_fsm_state_decl(bna_device, stopped, struct bna_device,
+                        enum bna_device_event);
+bfa_fsm_state_decl(bna_device, ioc_ready_wait, struct bna_device,
+                        enum bna_device_event);
+bfa_fsm_state_decl(bna_device, ready, struct bna_device,
+                        enum bna_device_event);
+bfa_fsm_state_decl(bna_device, port_stop_wait, struct bna_device,
+                        enum bna_device_event);
+bfa_fsm_state_decl(bna_device, ioc_disable_wait, struct bna_device,
+                        enum bna_device_event);
+bfa_fsm_state_decl(bna_device, failed, struct bna_device,
+                        enum bna_device_event);
+
+static struct bfa_sm_table device_sm_table[] = {
+        {BFA_SM(bna_device_sm_stopped), BNA_DEVICE_STOPPED},
+        {BFA_SM(bna_device_sm_ioc_ready_wait), BNA_DEVICE_IOC_READY_WAIT},
+        {BFA_SM(bna_device_sm_ready), BNA_DEVICE_READY},
+        {BFA_SM(bna_device_sm_port_stop_wait), BNA_DEVICE_PORT_STOP_WAIT},
+        {BFA_SM(bna_device_sm_ioc_disable_wait), BNA_DEVICE_IOC_DISABLE_WAIT},
+        {BFA_SM(bna_device_sm_failed), BNA_DEVICE_FAILED},
+};
+
+static void
+bna_device_sm_stopped_entry(struct bna_device *device)
+{
+        if (device->stop_cbfn)
+                device->stop_cbfn(device->stop_cbarg, BNA_CB_SUCCESS);
+
+        device->stop_cbfn = NULL;
+        device->stop_cbarg = NULL;
+}
+
+static void
+bna_device_sm_stopped(struct bna_device *device,
+                        enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_ENABLE:
+                if (device->intr_type == BNA_INTR_T_MSIX)
+                        bna_mbox_msix_idx_set(device);
+                bfa_nw_ioc_enable(&device->ioc);
+                bfa_fsm_set_state(device, bna_device_sm_ioc_ready_wait);
+                break;
+
+        case DEVICE_E_DISABLE:
+                bfa_fsm_set_state(device, bna_device_sm_stopped);
+                break;
+
+        case DEVICE_E_IOC_RESET:
+                enable_mbox_intr(device);
+                break;
+
+        case DEVICE_E_IOC_FAILED:
+                bfa_fsm_set_state(device, bna_device_sm_failed);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+static void
+bna_device_sm_ioc_ready_wait_entry(struct bna_device *device)
+{
+        /**
+         * Do not call bfa_ioc_enable() here. It must be called in the
+         * previous state due to failed -> ioc_ready_wait transition.
+         */
+}
+
+static void
+bna_device_sm_ioc_ready_wait(struct bna_device *device,
+                                enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_DISABLE:
+                if (device->ready_cbfn)
+                        device->ready_cbfn(device->ready_cbarg,
+                                                BNA_CB_INTERRUPT);
+                device->ready_cbfn = NULL;
+                device->ready_cbarg = NULL;
+                bfa_fsm_set_state(device, bna_device_sm_ioc_disable_wait);
+                break;
+
+        case DEVICE_E_IOC_READY:
+                bfa_fsm_set_state(device, bna_device_sm_ready);
+                break;
+
+        case DEVICE_E_IOC_FAILED:
+                bfa_fsm_set_state(device, bna_device_sm_failed);
+                break;
+
+        case DEVICE_E_IOC_RESET:
+                enable_mbox_intr(device);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+static void
+bna_device_sm_ready_entry(struct bna_device *device)
+{
+        bna_mbox_mod_start(&device->bna->mbox_mod);
+        bna_port_start(&device->bna->port);
+
+        if (device->ready_cbfn)
+                device->ready_cbfn(device->ready_cbarg,
+                                        BNA_CB_SUCCESS);
+        device->ready_cbfn = NULL;
+        device->ready_cbarg = NULL;
+}
+
+static void
+bna_device_sm_ready(struct bna_device *device, enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_DISABLE:
+                bfa_fsm_set_state(device, bna_device_sm_port_stop_wait);
+                break;
+
+        case DEVICE_E_IOC_FAILED:
+                bfa_fsm_set_state(device, bna_device_sm_failed);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+static void
+bna_device_sm_port_stop_wait_entry(struct bna_device *device)
+{
+        bna_port_stop(&device->bna->port);
+}
+
+static void
+bna_device_sm_port_stop_wait(struct bna_device *device,
+                                enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_PORT_STOPPED:
+                bna_mbox_mod_stop(&device->bna->mbox_mod);
+                bfa_fsm_set_state(device, bna_device_sm_ioc_disable_wait);
+                break;
+
+        case DEVICE_E_IOC_FAILED:
+                disable_mbox_intr(device);
+                bna_port_fail(&device->bna->port);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+static void
+bna_device_sm_ioc_disable_wait_entry(struct bna_device *device)
+{
+        bfa_nw_ioc_disable(&device->ioc);
+}
+
+static void
+bna_device_sm_ioc_disable_wait(struct bna_device *device,
+                                enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_IOC_DISABLED:
+                disable_mbox_intr(device);
+                bfa_fsm_set_state(device, bna_device_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+static void
+bna_device_sm_failed_entry(struct bna_device *device)
+{
+        disable_mbox_intr(device);
+        bna_port_fail(&device->bna->port);
+        bna_mbox_mod_stop(&device->bna->mbox_mod);
+
+        if (device->ready_cbfn)
+                device->ready_cbfn(device->ready_cbarg,
+                                        BNA_CB_FAIL);
+        device->ready_cbfn = NULL;
+        device->ready_cbarg = NULL;
+}
+
+static void
+bna_device_sm_failed(struct bna_device *device,
+                        enum bna_device_event event)
+{
+        switch (event) {
+        case DEVICE_E_DISABLE:
+                bfa_fsm_set_state(device, bna_device_sm_ioc_disable_wait);
+                break;
+
+        case DEVICE_E_IOC_RESET:
+                enable_mbox_intr(device);
+                bfa_fsm_set_state(device, bna_device_sm_ioc_ready_wait);
+                break;
+
+        default:
+                bfa_sm_fault(device->bna, event);
+        }
+}
+
+/* IOC callback functions */
+
+static void
+bna_device_cb_iocll_ready(void *dev, enum bfa_status error)
+{
+        struct bna_device *device = (struct bna_device *)dev;
+
+        if (error)
+                bfa_fsm_send_event(device, DEVICE_E_IOC_FAILED);
+        else
+                bfa_fsm_send_event(device, DEVICE_E_IOC_READY);
+}
+
+static void
+bna_device_cb_iocll_disabled(void *dev)
+{
+        struct bna_device *device = (struct bna_device *)dev;
+
+        bfa_fsm_send_event(device, DEVICE_E_IOC_DISABLED);
+}
+
+static void
+bna_device_cb_iocll_failed(void *dev)
+{
+        struct bna_device *device = (struct bna_device *)dev;
+
+        bfa_fsm_send_event(device, DEVICE_E_IOC_FAILED);
+}
+
+static void
+bna_device_cb_iocll_reset(void *dev)
+{
+        struct bna_device *device = (struct bna_device *)dev;
+
+        bfa_fsm_send_event(device, DEVICE_E_IOC_RESET);
+}
+
+static struct bfa_ioc_cbfn bfa_iocll_cbfn = {
+        bna_device_cb_iocll_ready,
+        bna_device_cb_iocll_disabled,
+        bna_device_cb_iocll_failed,
+        bna_device_cb_iocll_reset
+};
+
+void
+bna_device_init(struct bna_device *device, struct bna *bna,
+                struct bna_res_info *res_info)
+{
+        u64 dma;
+
+        device->bna = bna;
+
+        /**
+         * Attach IOC and claim:
+         *      1. DMA memory for IOC attributes
+         *      2. Kernel memory for FW trace
+         */
+        bfa_nw_ioc_attach(&device->ioc, device, &bfa_iocll_cbfn);
+        bfa_nw_ioc_pci_init(&device->ioc, &bna->pcidev, BFI_MC_LL);
+
+        BNA_GET_DMA_ADDR(
+                &res_info[BNA_RES_MEM_T_ATTR].res_u.mem_info.mdl[0].dma, dma);
+        bfa_nw_ioc_mem_claim(&device->ioc,
+                res_info[BNA_RES_MEM_T_ATTR].res_u.mem_info.mdl[0].kva,
+                          dma);
+
+        bna_adv_device_init(device, bna, res_info);
+        /*
+         * Initialize mbox_mod only after IOC, so that mbox handler
+         * registration goes through
+         */
+        device->intr_type =
+                res_info[BNA_RES_INTR_T_MBOX].res_u.intr_info.intr_type;
+        device->vector =
+                res_info[BNA_RES_INTR_T_MBOX].res_u.intr_info.idl[0].vector;
+        bna_mbox_mod_init(&bna->mbox_mod, bna);
+
+        device->ready_cbfn = device->stop_cbfn = NULL;
+        device->ready_cbarg = device->stop_cbarg = NULL;
+
+        bfa_fsm_set_state(device, bna_device_sm_stopped);
+}
+
+void
+bna_device_uninit(struct bna_device *device)
+{
+        bna_mbox_mod_uninit(&device->bna->mbox_mod);
+
+        bfa_nw_ioc_detach(&device->ioc);
+
+        device->bna = NULL;
+}
+
+void
+bna_device_cb_port_stopped(void *arg, enum bna_cb_status status)
+{
+        struct bna_device *device = (struct bna_device *)arg;
+
+        bfa_fsm_send_event(device, DEVICE_E_PORT_STOPPED);
+}
+
+int
+bna_device_status_get(struct bna_device *device)
+{
+        return device->fsm == (bfa_fsm_t)bna_device_sm_ready;
+}
+
+void
+bna_device_enable(struct bna_device *device)
+{
+        if (device->fsm != (bfa_fsm_t)bna_device_sm_stopped) {
+                bnad_cb_device_enabled(device->bna->bnad, BNA_CB_BUSY);
+                return;
+        }
+
+        device->ready_cbfn = bnad_cb_device_enabled;
+        device->ready_cbarg = device->bna->bnad;
+
+        bfa_fsm_send_event(device, DEVICE_E_ENABLE);
+}
+
+void
+bna_device_disable(struct bna_device *device, enum bna_cleanup_type type)
+{
+        if (type == BNA_SOFT_CLEANUP) {
+                bnad_cb_device_disabled(device->bna->bnad, BNA_CB_SUCCESS);
+                return;
+        }
+
+        device->stop_cbfn = bnad_cb_device_disabled;
+        device->stop_cbarg = device->bna->bnad;
+
+        bfa_fsm_send_event(device, DEVICE_E_DISABLE);
+}
+
+int
+bna_device_state_get(struct bna_device *device)
+{
+        return bfa_sm_to_state(device_sm_table, device->fsm);
+}
+
+u32 bna_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
+        {12, 20},
+        {10, 18},
+        {8, 16},
+        {6, 12},
+        {4, 8},
+        {3, 6},
+        {2, 4},
+        {1, 2},
+};
+
+u32 bna_napi_dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX] = {
+        {12, 12},
+        {6, 10},
+        {5, 10},
+        {4, 8},
+        {3, 6},
+        {3, 6},
+        {2, 4},
+        {1, 2},
+};
+
+/* device */
+void
+bna_adv_device_init(struct bna_device *device, struct bna *bna,
+                struct bna_res_info *res_info)
+{
+        u8 *kva;
+        u64 dma;
+
+        device->bna = bna;
+
+        kva = res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.mdl[0].kva;
+
+        /**
+         * Attach common modules (Diag, SFP, CEE, Port) and claim respective
+         * DMA memory.
+         */
+        BNA_GET_DMA_ADDR(
+                &res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].dma, dma);
+        kva = res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mdl[0].kva;
+
+        bfa_nw_cee_attach(&bna->cee, &device->ioc, bna);
+        bfa_nw_cee_mem_claim(&bna->cee, kva, dma);
+        kva += bfa_nw_cee_meminfo();
+        dma += bfa_nw_cee_meminfo();
+
+}
+
+/* utils */
+
+void
+bna_adv_res_req(struct bna_res_info *res_info)
+{
+        /* DMA memory for COMMON_MODULE */
+        res_info[BNA_RES_MEM_T_COM].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_COM].res_u.mem_info.mem_type = BNA_MEM_T_DMA;
+        res_info[BNA_RES_MEM_T_COM].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_COM].res_u.mem_info.len = ALIGN(
+                                bfa_nw_cee_meminfo(), PAGE_SIZE);
+
+        /* Virtual memory for retreiving fw_trc */
+        res_info[BNA_RES_MEM_T_FWTRC].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.mem_type = BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.num = 0;
+        res_info[BNA_RES_MEM_T_FWTRC].res_u.mem_info.len = 0;
+
+        /* DMA memory for retreiving stats */
+        res_info[BNA_RES_MEM_T_STATS].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.mem_type = BNA_MEM_T_DMA;
+        res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.len =
+                                ALIGN(BFI_HW_STATS_SIZE, PAGE_SIZE);
+
+        /* Virtual memory for soft stats */
+        res_info[BNA_RES_MEM_T_SWSTATS].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_SWSTATS].res_u.mem_info.mem_type = BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_SWSTATS].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_SWSTATS].res_u.mem_info.len =
+                                sizeof(struct bna_sw_stats);
+}
+
+static void
+bna_sw_stats_get(struct bna *bna, struct bna_sw_stats *sw_stats)
+{
+        struct bna_tx *tx;
+        struct bna_txq *txq;
+        struct bna_rx *rx;
+        struct bna_rxp *rxp;
+        struct list_head *qe;
+        struct list_head *txq_qe;
+        struct list_head *rxp_qe;
+        struct list_head *mac_qe;
+        int i;
+
+        sw_stats->device_state = bna_device_state_get(&bna->device);
+        sw_stats->port_state = bna_port_state_get(&bna->port);
+        sw_stats->port_flags = bna->port.flags;
+        sw_stats->llport_state = bna_llport_state_get(&bna->port.llport);
+        sw_stats->priority = bna->port.priority;
+
+        i = 0;
+        list_for_each(qe, &bna->tx_mod.tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                sw_stats->tx_stats[i].tx_state = bna_tx_state_get(tx);
+                sw_stats->tx_stats[i].tx_flags = tx->flags;
+
+                sw_stats->tx_stats[i].num_txqs = 0;
+                sw_stats->tx_stats[i].txq_bmap[0] = 0;
+                sw_stats->tx_stats[i].txq_bmap[1] = 0;
+                list_for_each(txq_qe, &tx->txq_q) {
+                        txq = (struct bna_txq *)txq_qe;
+                        if (txq->txq_id < 32)
+                                sw_stats->tx_stats[i].txq_bmap[0] |=
+                                                ((u32)1 << txq->txq_id);
+                        else
+                                sw_stats->tx_stats[i].txq_bmap[1] |=
+                                                ((u32)
+                                                 1 << (txq->txq_id - 32));
+                        sw_stats->tx_stats[i].num_txqs++;
+                }
+
+                sw_stats->tx_stats[i].txf_id = tx->txf.txf_id;
+
+                i++;
+        }
+        sw_stats->num_active_tx = i;
+
+        i = 0;
+        list_for_each(qe, &bna->rx_mod.rx_active_q) {
+                rx = (struct bna_rx *)qe;
+                sw_stats->rx_stats[i].rx_state = bna_rx_state_get(rx);
+                sw_stats->rx_stats[i].rx_flags = rx->rx_flags;
+
+                sw_stats->rx_stats[i].num_rxps = 0;
+                sw_stats->rx_stats[i].num_rxqs = 0;
+                sw_stats->rx_stats[i].rxq_bmap[0] = 0;
+                sw_stats->rx_stats[i].rxq_bmap[1] = 0;
+                sw_stats->rx_stats[i].cq_bmap[0] = 0;
+                sw_stats->rx_stats[i].cq_bmap[1] = 0;
+                list_for_each(rxp_qe, &rx->rxp_q) {
+                        rxp = (struct bna_rxp *)rxp_qe;
+
+                        sw_stats->rx_stats[i].num_rxqs += 1;
+
+                        if (rxp->type == BNA_RXP_SINGLE) {
+                                if (rxp->rxq.single.only->rxq_id < 32) {
+                                        sw_stats->rx_stats[i].rxq_bmap[0] |=
+                                        ((u32)1 <<
+                                        rxp->rxq.single.only->rxq_id);
+                                } else {
+                                        sw_stats->rx_stats[i].rxq_bmap[1] |=
+                                        ((u32)1 <<
+                                        (rxp->rxq.single.only->rxq_id - 32));
+                                }
+                        } else {
+                                if (rxp->rxq.slr.large->rxq_id < 32) {
+                                        sw_stats->rx_stats[i].rxq_bmap[0] |=
+                                        ((u32)1 <<
+                                        rxp->rxq.slr.large->rxq_id);
+                                } else {
+                                        sw_stats->rx_stats[i].rxq_bmap[1] |=
+                                        ((u32)1 <<
+                                        (rxp->rxq.slr.large->rxq_id - 32));
+                                }
+
+                                if (rxp->rxq.slr.small->rxq_id < 32) {
+                                        sw_stats->rx_stats[i].rxq_bmap[0] |=
+                                        ((u32)1 <<
+                                        rxp->rxq.slr.small->rxq_id);
+                                } else {
+                                        sw_stats->rx_stats[i].rxq_bmap[1] |=
+                                ((u32)1 <<
+                                 (rxp->rxq.slr.small->rxq_id - 32));
+                                }
+                                sw_stats->rx_stats[i].num_rxqs += 1;
+                        }
+
+                        if (rxp->cq.cq_id < 32)
+                                sw_stats->rx_stats[i].cq_bmap[0] |=
+                                        (1 << rxp->cq.cq_id);
+                        else
+                                sw_stats->rx_stats[i].cq_bmap[1] |=
+                                        (1 << (rxp->cq.cq_id - 32));
+
+                        sw_stats->rx_stats[i].num_rxps++;
+                }
+
+                sw_stats->rx_stats[i].rxf_id = rx->rxf.rxf_id;
+                sw_stats->rx_stats[i].rxf_state = bna_rxf_state_get(&rx->rxf);
+                sw_stats->rx_stats[i].rxf_oper_state = rx->rxf.rxf_oper_state;
+
+                sw_stats->rx_stats[i].num_active_ucast = 0;
+                if (rx->rxf.ucast_active_mac)
+                        sw_stats->rx_stats[i].num_active_ucast++;
+                list_for_each(mac_qe, &rx->rxf.ucast_active_q)
+                        sw_stats->rx_stats[i].num_active_ucast++;
+
+                sw_stats->rx_stats[i].num_active_mcast = 0;
+                list_for_each(mac_qe, &rx->rxf.mcast_active_q)
+                        sw_stats->rx_stats[i].num_active_mcast++;
+
+                sw_stats->rx_stats[i].rxmode_active = rx->rxf.rxmode_active;
+                sw_stats->rx_stats[i].vlan_filter_status =
+                                                rx->rxf.vlan_filter_status;
+                memcpy(sw_stats->rx_stats[i].vlan_filter_table,
+                                rx->rxf.vlan_filter_table,
+                                sizeof(u32) * ((BFI_MAX_VLAN + 1) / 32));
+
+                sw_stats->rx_stats[i].rss_status = rx->rxf.rss_status;
+                sw_stats->rx_stats[i].hds_status = rx->rxf.hds_status;
+
+                i++;
+        }
+        sw_stats->num_active_rx = i;
+}
+
+static void
+bna_fw_cb_stats_get(void *arg, int status)
+{
+        struct bna *bna = (struct bna *)arg;
+        u64 *p_stats;
+        int i, count;
+        int rxf_count, txf_count;
+        u64 rxf_bmap, txf_bmap;
+
+        bfa_q_qe_init(&bna->mbox_qe.qe);
+
+        if (status == 0) {
+                p_stats = (u64 *)bna->stats.hw_stats;
+                count = sizeof(struct bfi_ll_stats) / sizeof(u64);
+                for (i = 0; i < count; i++)
+                        p_stats[i] = cpu_to_be64(p_stats[i]);
+
+                rxf_count = 0;
+                rxf_bmap = (u64)bna->stats.rxf_bmap[0] |
+                        ((u64)bna->stats.rxf_bmap[1] << 32);
+                for (i = 0; i < BFI_LL_RXF_ID_MAX; i++)
+                        if (rxf_bmap & ((u64)1 << i))
+                                rxf_count++;
+
+                txf_count = 0;
+                txf_bmap = (u64)bna->stats.txf_bmap[0] |
+                        ((u64)bna->stats.txf_bmap[1] << 32);
+                for (i = 0; i < BFI_LL_TXF_ID_MAX; i++)
+                        if (txf_bmap & ((u64)1 << i))
+                                txf_count++;
+
+                p_stats = (u64 *)&bna->stats.hw_stats->rxf_stats[0] +
+                                ((rxf_count * sizeof(struct bfi_ll_stats_rxf) +
+                                txf_count * sizeof(struct bfi_ll_stats_txf))/
+                                sizeof(u64));
+
+                /* Populate the TXF stats from the firmware DMAed copy */
+                for (i = (BFI_LL_TXF_ID_MAX - 1); i >= 0; i--)
+                        if (txf_bmap & ((u64)1 << i)) {
+                                p_stats -= sizeof(struct bfi_ll_stats_txf)/
+                                                sizeof(u64);
+                                memcpy(&bna->stats.hw_stats->txf_stats[i],
+                                        p_stats,
+                                        sizeof(struct bfi_ll_stats_txf));
+                        }
+
+                /* Populate the RXF stats from the firmware DMAed copy */
+                for (i = (BFI_LL_RXF_ID_MAX - 1); i >= 0; i--)
+                        if (rxf_bmap & ((u64)1 << i)) {
+                                p_stats -= sizeof(struct bfi_ll_stats_rxf)/
+                                                sizeof(u64);
+                                memcpy(&bna->stats.hw_stats->rxf_stats[i],
+                                        p_stats,
+                                        sizeof(struct bfi_ll_stats_rxf));
+                        }
+
+                bna_sw_stats_get(bna, bna->stats.sw_stats);
+                bnad_cb_stats_get(bna->bnad, BNA_CB_SUCCESS, &bna->stats);
+        } else
+                bnad_cb_stats_get(bna->bnad, BNA_CB_FAIL, &bna->stats);
+}
+
+static void
+bna_fw_stats_get(struct bna *bna)
+{
+        struct bfi_ll_stats_req ll_req;
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_STATS_GET_REQ, 0);
+        ll_req.stats_mask = htons(BFI_LL_STATS_ALL);
+
+        ll_req.rxf_id_mask[0] = htonl(bna->rx_mod.rxf_bmap[0]);
+        ll_req.rxf_id_mask[1] = htonl(bna->rx_mod.rxf_bmap[1]);
+        ll_req.txf_id_mask[0] = htonl(bna->tx_mod.txf_bmap[0]);
+        ll_req.txf_id_mask[1] = htonl(bna->tx_mod.txf_bmap[1]);
+
+        ll_req.host_buffer.a32.addr_hi = bna->hw_stats_dma.msb;
+        ll_req.host_buffer.a32.addr_lo = bna->hw_stats_dma.lsb;
+
+        bna_mbox_qe_fill(&bna->mbox_qe, &ll_req, sizeof(ll_req),
+                                bna_fw_cb_stats_get, bna);
+        bna_mbox_send(bna, &bna->mbox_qe);
+
+        bna->stats.rxf_bmap[0] = bna->rx_mod.rxf_bmap[0];
+        bna->stats.rxf_bmap[1] = bna->rx_mod.rxf_bmap[1];
+        bna->stats.txf_bmap[0] = bna->tx_mod.txf_bmap[0];
+        bna->stats.txf_bmap[1] = bna->tx_mod.txf_bmap[1];
+}
+
+static void
+bna_fw_cb_stats_clr(void *arg, int status)
+{
+        struct bna *bna = (struct bna *)arg;
+
+        bfa_q_qe_init(&bna->mbox_qe.qe);
+
+        memset(bna->stats.sw_stats, 0, sizeof(struct bna_sw_stats));
+        memset(bna->stats.hw_stats, 0, sizeof(struct bfi_ll_stats));
+
+        bnad_cb_stats_clr(bna->bnad);
+}
+
+static void
+bna_fw_stats_clr(struct bna *bna)
+{
+        struct bfi_ll_stats_req ll_req;
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_STATS_CLEAR_REQ, 0);
+        ll_req.stats_mask = htons(BFI_LL_STATS_ALL);
+        ll_req.rxf_id_mask[0] = htonl(0xffffffff);
+        ll_req.rxf_id_mask[1] = htonl(0xffffffff);
+        ll_req.txf_id_mask[0] = htonl(0xffffffff);
+        ll_req.txf_id_mask[1] = htonl(0xffffffff);
+
+        bna_mbox_qe_fill(&bna->mbox_qe, &ll_req, sizeof(ll_req),
+                                bna_fw_cb_stats_clr, bna);
+        bna_mbox_send(bna, &bna->mbox_qe);
+}
+
+void
+bna_stats_get(struct bna *bna)
+{
+        if (bna_device_status_get(&bna->device))
+                bna_fw_stats_get(bna);
+        else
+                bnad_cb_stats_get(bna->bnad, BNA_CB_FAIL, &bna->stats);
+}
+
+void
+bna_stats_clr(struct bna *bna)
+{
+        if (bna_device_status_get(&bna->device))
+                bna_fw_stats_clr(bna);
+        else {
+                memset(&bna->stats.sw_stats, 0,
+                                sizeof(struct bna_sw_stats));
+                memset(bna->stats.hw_stats, 0,
+                                sizeof(struct bfi_ll_stats));
+                bnad_cb_stats_clr(bna->bnad);
+        }
+}
+
+/* IB */
+void
+bna_ib_coalescing_timeo_set(struct bna_ib *ib, u8 coalescing_timeo)
+{
+        ib->ib_config.coalescing_timeo = coalescing_timeo;
+
+        if (ib->start_count)
+                ib->door_bell.doorbell_ack = BNA_DOORBELL_IB_INT_ACK(
+                                (u32)ib->ib_config.coalescing_timeo, 0);
+}
+
+/* RxF */
+void
+bna_rxf_adv_init(struct bna_rxf *rxf,
+                struct bna_rx *rx,
+                struct bna_rx_config *q_config)
+{
+        switch (q_config->rxp_type) {
+        case BNA_RXP_SINGLE:
+                /* No-op */
+                break;
+        case BNA_RXP_SLR:
+                rxf->ctrl_flags |= BNA_RXF_CF_SM_LG_RXQ;
+                break;
+        case BNA_RXP_HDS:
+                rxf->hds_cfg.hdr_type = q_config->hds_config.hdr_type;
+                rxf->hds_cfg.header_size =
+                                q_config->hds_config.header_size;
+                rxf->forced_offset = 0;
+                break;
+        default:
+                break;
+        }
+
+        if (q_config->rss_status == BNA_STATUS_T_ENABLED) {
+                rxf->ctrl_flags |= BNA_RXF_CF_RSS_ENABLE;
+                rxf->rss_cfg.hash_type = q_config->rss_config.hash_type;
+                rxf->rss_cfg.hash_mask = q_config->rss_config.hash_mask;
+                memcpy(&rxf->rss_cfg.toeplitz_hash_key[0],
+                        &q_config->rss_config.toeplitz_hash_key[0],
+                        sizeof(rxf->rss_cfg.toeplitz_hash_key));
+        }
+}
+
+static void
+rxf_fltr_mbox_cmd(struct bna_rxf *rxf, u8 cmd, enum bna_status status)
+{
+        struct bfi_ll_rxf_req req;
+
+        bfi_h2i_set(req.mh, BFI_MC_LL, cmd, 0);
+
+        req.rxf_id = rxf->rxf_id;
+        req.enable = status;
+
+        bna_mbox_qe_fill(&rxf->mbox_qe, &req, sizeof(req),
+                        rxf_cb_cam_fltr_mbox_cmd, rxf);
+
+        bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
+}
+
+void
+__rxf_default_function_config(struct bna_rxf *rxf, enum bna_status status)
+{
+        struct bna_rx_fndb_ram *rx_fndb_ram;
+        u32 ctrl_flags;
+        int i;
+
+        rx_fndb_ram = (struct bna_rx_fndb_ram *)
+                        BNA_GET_MEM_BASE_ADDR(rxf->rx->bna->pcidev.pci_bar_kva,
+                        RX_FNDB_RAM_BASE_OFFSET);
+
+        for (i = 0; i < BFI_MAX_RXF; i++) {
+                if (status == BNA_STATUS_T_ENABLED) {
+                        if (i == rxf->rxf_id)
+                                continue;
+
+                        ctrl_flags =
+                                readl(&rx_fndb_ram[i].control_flags);
+                        ctrl_flags |= BNA_RXF_CF_DEFAULT_FUNCTION_ENABLE;
+                        writel(ctrl_flags,
+                                                &rx_fndb_ram[i].control_flags);
+                } else {
+                        ctrl_flags =
+                                readl(&rx_fndb_ram[i].control_flags);
+                        ctrl_flags &= ~BNA_RXF_CF_DEFAULT_FUNCTION_ENABLE;
+                        writel(ctrl_flags,
+                                                &rx_fndb_ram[i].control_flags);
+                }
+        }
+}
+
+int
+rxf_process_packet_filter_ucast(struct bna_rxf *rxf)
+{
+        struct bna_mac *mac = NULL;
+        struct list_head *qe;
+
+        /* Add additional MAC entries */
+        if (!list_empty(&rxf->ucast_pending_add_q)) {
+                bfa_q_deq(&rxf->ucast_pending_add_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_UCAST_ADD_REQ, mac);
+                list_add_tail(&mac->qe, &rxf->ucast_active_q);
+                return 1;
+        }
+
+        /* Delete MAC addresses previousely added */
+        if (!list_empty(&rxf->ucast_pending_del_q)) {
+                bfa_q_deq(&rxf->ucast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_UCAST_DEL_REQ, mac);
+                bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_process_packet_filter_promisc(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* Enable/disable promiscuous mode */
+        if (is_promisc_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move promisc configuration from pending -> active */
+                promisc_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active |= BNA_RXMODE_PROMISC;
+
+                /* Disable VLAN filter to allow all VLANs */
+                __rxf_vlan_filter_set(rxf, BNA_STATUS_T_DISABLED);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ,
+                                BNA_STATUS_T_ENABLED);
+                return 1;
+        } else if (is_promisc_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move promisc configuration from pending -> active */
+                promisc_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_PROMISC;
+                bna->rxf_promisc_id = BFI_MAX_RXF;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_process_packet_filter_default(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* Enable/disable default mode */
+        if (is_default_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move default configuration from pending -> active */
+                default_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active |= BNA_RXMODE_DEFAULT;
+
+                /* Disable VLAN filter to allow all VLANs */
+                __rxf_vlan_filter_set(rxf, BNA_STATUS_T_DISABLED);
+                /* Redirect all other RxF vlan filtering to this one */
+                __rxf_default_function_config(rxf, BNA_STATUS_T_ENABLED);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_DEFAULT_SET_REQ,
+                                BNA_STATUS_T_ENABLED);
+                return 1;
+        } else if (is_default_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move default configuration from pending -> active */
+                default_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_DEFAULT;
+                bna->rxf_default_id = BFI_MAX_RXF;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                /* Stop RxF vlan filter table redirection */
+                __rxf_default_function_config(rxf, BNA_STATUS_T_DISABLED);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_DEFAULT_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_process_packet_filter_allmulti(struct bna_rxf *rxf)
+{
+        /* Enable/disable allmulti mode */
+        if (is_allmulti_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move allmulti configuration from pending -> active */
+                allmulti_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active |= BNA_RXMODE_ALLMULTI;
+
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_FILTER_REQ,
+                                BNA_STATUS_T_ENABLED);
+                return 1;
+        } else if (is_allmulti_disable(rxf->rxmode_pending,
+                                        rxf->rxmode_pending_bitmask)) {
+                /* move allmulti configuration from pending -> active */
+                allmulti_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_ALLMULTI;
+
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_FILTER_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_clear_packet_filter_ucast(struct bna_rxf *rxf)
+{
+        struct bna_mac *mac = NULL;
+        struct list_head *qe;
+
+        /* 1. delete pending ucast entries */
+        if (!list_empty(&rxf->ucast_pending_del_q)) {
+                bfa_q_deq(&rxf->ucast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_UCAST_DEL_REQ, mac);
+                bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
+                return 1;
+        }
+
+        /* 2. clear active ucast entries; move them to pending_add_q */
+        if (!list_empty(&rxf->ucast_active_q)) {
+                bfa_q_deq(&rxf->ucast_active_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_UCAST_DEL_REQ, mac);
+                list_add_tail(&mac->qe, &rxf->ucast_pending_add_q);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_clear_packet_filter_promisc(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* 6. Execute pending promisc mode disable command */
+        if (is_promisc_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move promisc configuration from pending -> active */
+                promisc_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_PROMISC;
+                bna->rxf_promisc_id = BFI_MAX_RXF;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        /* 7. Clear active promisc mode; move it to pending enable */
+        if (rxf->rxmode_active & BNA_RXMODE_PROMISC) {
+                /* move promisc configuration from active -> pending */
+                promisc_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_PROMISC;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_PROMISCUOUS_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_clear_packet_filter_default(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* 8. Execute pending default mode disable command */
+        if (is_default_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move default configuration from pending -> active */
+                default_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_DEFAULT;
+                bna->rxf_default_id = BFI_MAX_RXF;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                /* Stop RxF vlan filter table redirection */
+                __rxf_default_function_config(rxf, BNA_STATUS_T_DISABLED);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_DEFAULT_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        /* 9. Clear active default mode; move it to pending enable */
+        if (rxf->rxmode_active & BNA_RXMODE_DEFAULT) {
+                /* move default configuration from active -> pending */
+                default_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_DEFAULT;
+
+                /* Revert VLAN filter */
+                __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+                /* Stop RxF vlan filter table redirection */
+                __rxf_default_function_config(rxf, BNA_STATUS_T_DISABLED);
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_RXF_DEFAULT_SET_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+rxf_clear_packet_filter_allmulti(struct bna_rxf *rxf)
+{
+        /* 10. Execute pending allmulti mode disable command */
+        if (is_allmulti_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* move allmulti configuration from pending -> active */
+                allmulti_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_ALLMULTI;
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_FILTER_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        /* 11. Clear active allmulti mode; move it to pending enable */
+        if (rxf->rxmode_active & BNA_RXMODE_ALLMULTI) {
+                /* move allmulti configuration from active -> pending */
+                allmulti_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_ALLMULTI;
+                rxf_fltr_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_FILTER_REQ,
+                                BNA_STATUS_T_DISABLED);
+                return 1;
+        }
+
+        return 0;
+}
+
+void
+rxf_reset_packet_filter_ucast(struct bna_rxf *rxf)
+{
+        struct list_head *qe;
+        struct bna_mac *mac;
+
+        /* 1. Move active ucast entries to pending_add_q */
+        while (!list_empty(&rxf->ucast_active_q)) {
+                bfa_q_deq(&rxf->ucast_active_q, &qe);
+                bfa_q_qe_init(qe);
+                list_add_tail(qe, &rxf->ucast_pending_add_q);
+        }
+
+        /* 2. Throw away delete pending ucast entries */
+        while (!list_empty(&rxf->ucast_pending_del_q)) {
+                bfa_q_deq(&rxf->ucast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
+        }
+}
+
+void
+rxf_reset_packet_filter_promisc(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* 6. Clear pending promisc mode disable */
+        if (is_promisc_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                promisc_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_PROMISC;
+                bna->rxf_promisc_id = BFI_MAX_RXF;
+        }
+
+        /* 7. Move promisc mode config from active -> pending */
+        if (rxf->rxmode_active & BNA_RXMODE_PROMISC) {
+                promisc_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_PROMISC;
+        }
+
+}
+
+void
+rxf_reset_packet_filter_default(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+
+        /* 8. Clear pending default mode disable */
+        if (is_default_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                default_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_DEFAULT;
+                bna->rxf_default_id = BFI_MAX_RXF;
+        }
+
+        /* 9. Move default mode config from active -> pending */
+        if (rxf->rxmode_active & BNA_RXMODE_DEFAULT) {
+                default_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_DEFAULT;
+        }
+}
+
+void
+rxf_reset_packet_filter_allmulti(struct bna_rxf *rxf)
+{
+        /* 10. Clear pending allmulti mode disable */
+        if (is_allmulti_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                allmulti_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_ALLMULTI;
+        }
+
+        /* 11. Move allmulti mode config from active -> pending */
+        if (rxf->rxmode_active & BNA_RXMODE_ALLMULTI) {
+                allmulti_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                rxf->rxmode_active &= ~BNA_RXMODE_ALLMULTI;
+        }
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_promisc_enable(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+        int ret = 0;
+
+        /* There can not be any pending disable command */
+
+        /* Do nothing if pending enable or already enabled */
+        if (is_promisc_enable(rxf->rxmode_pending,
+                        rxf->rxmode_pending_bitmask) ||
+                        (rxf->rxmode_active & BNA_RXMODE_PROMISC)) {
+                /* Schedule enable */
+        } else {
+                /* Promisc mode should not be active in the system */
+                promisc_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                bna->rxf_promisc_id = rxf->rxf_id;
+                ret = 1;
+        }
+
+        return ret;
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_promisc_disable(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+        int ret = 0;
+
+        /* There can not be any pending disable */
+
+        /* Turn off pending enable command , if any */
+        if (is_promisc_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* Promisc mode should not be active */
+                /* system promisc state should be pending */
+                promisc_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                /* Remove the promisc state from the system */
+                bna->rxf_promisc_id = BFI_MAX_RXF;
+
+                /* Schedule disable */
+        } else if (rxf->rxmode_active & BNA_RXMODE_PROMISC) {
+                /* Promisc mode should be active in the system */
+                promisc_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                ret = 1;
+
+        /* Do nothing if already disabled */
+        } else {
+        }
+
+        return ret;
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_default_enable(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+        int ret = 0;
+
+        /* There can not be any pending disable command */
+
+        /* Do nothing if pending enable or already enabled */
+        if (is_default_enable(rxf->rxmode_pending,
+                rxf->rxmode_pending_bitmask) ||
+                (rxf->rxmode_active & BNA_RXMODE_DEFAULT)) {
+                /* Schedule enable */
+        } else {
+                /* Default mode should not be active in the system */
+                default_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                bna->rxf_default_id = rxf->rxf_id;
+                ret = 1;
+        }
+
+        return ret;
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_default_disable(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+        int ret = 0;
+
+        /* There can not be any pending disable */
+
+        /* Turn off pending enable command , if any */
+        if (is_default_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* Promisc mode should not be active */
+                /* system default state should be pending */
+                default_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                /* Remove the default state from the system */
+                bna->rxf_default_id = BFI_MAX_RXF;
+
+        /* Schedule disable */
+        } else if (rxf->rxmode_active & BNA_RXMODE_DEFAULT) {
+                /* Default mode should be active in the system */
+                default_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                ret = 1;
+
+        /* Do nothing if already disabled */
+        } else {
+        }
+
+        return ret;
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_allmulti_enable(struct bna_rxf *rxf)
+{
+        int ret = 0;
+
+        /* There can not be any pending disable command */
+
+        /* Do nothing if pending enable or already enabled */
+        if (is_allmulti_enable(rxf->rxmode_pending,
+                        rxf->rxmode_pending_bitmask) ||
+                        (rxf->rxmode_active & BNA_RXMODE_ALLMULTI)) {
+                /* Schedule enable */
+        } else {
+                allmulti_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                ret = 1;
+        }
+
+        return ret;
+}
+
+/**
+ * Should only be called by bna_rxf_mode_set.
+ * Helps deciding if h/w configuration is needed or not.
+ *  Returns:
+ *      0 = no h/w change
+ *      1 = need h/w change
+ */
+int
+rxf_allmulti_disable(struct bna_rxf *rxf)
+{
+        int ret = 0;
+
+        /* There can not be any pending disable */
+
+        /* Turn off pending enable command , if any */
+        if (is_allmulti_enable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask)) {
+                /* Allmulti mode should not be active */
+                allmulti_inactive(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+
+        /* Schedule disable */
+        } else if (rxf->rxmode_active & BNA_RXMODE_ALLMULTI) {
+                allmulti_disable(rxf->rxmode_pending,
+                                rxf->rxmode_pending_bitmask);
+                ret = 1;
+        }
+
+        return ret;
+}
+
+/* RxF <- bnad */
+void
+bna_rx_mcast_delall(struct bna_rx *rx,
+                    void (*cbfn)(struct bnad *, struct bna_rx *,
+                                 enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head *qe;
+        struct bna_mac *mac;
+        int need_hw_config = 0;
+
+        /* Purge all entries from pending_add_q */
+        while (!list_empty(&rxf->mcast_pending_add_q)) {
+                bfa_q_deq(&rxf->mcast_pending_add_q, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+        }
+
+        /* Schedule all entries in active_q for deletion */
+        while (!list_empty(&rxf->mcast_active_q)) {
+                bfa_q_deq(&rxf->mcast_active_q, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                list_add_tail(&mac->qe, &rxf->mcast_pending_del_q);
+                need_hw_config = 1;
+        }
+
+        if (need_hw_config) {
+                rxf->cam_fltr_cbfn = cbfn;
+                rxf->cam_fltr_cbarg = rx->bna->bnad;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+                return;
+        }
+
+        if (cbfn)
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+}
+
+/* RxF <- Rx */
+void
+bna_rx_receive_resume(struct bna_rx *rx,
+                      void (*cbfn)(struct bnad *, struct bna_rx *,
+                                   enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_PAUSED) {
+                rxf->oper_state_cbfn = cbfn;
+                rxf->oper_state_cbarg = rx->bna->bnad;
+                bfa_fsm_send_event(rxf, RXF_E_RESUME);
+        } else if (cbfn)
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+}
+
+void
+bna_rx_receive_pause(struct bna_rx *rx,
+                     void (*cbfn)(struct bnad *, struct bna_rx *,
+                                  enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_RUNNING) {
+                rxf->oper_state_cbfn = cbfn;
+                rxf->oper_state_cbarg = rx->bna->bnad;
+                bfa_fsm_send_event(rxf, RXF_E_PAUSE);
+        } else if (cbfn)
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+}
+
+/* RxF <- bnad */
+enum bna_cb_status
+bna_rx_ucast_add(struct bna_rx *rx, u8 *addr,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head *qe;
+        struct bna_mac *mac;
+
+        /* Check if already added */
+        list_for_each(qe, &rxf->ucast_active_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        /* Check if pending addition */
+        list_for_each(qe, &rxf->ucast_pending_add_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        mac = bna_ucam_mod_mac_get(&rxf->rx->bna->ucam_mod);
+        if (mac == NULL)
+                return BNA_CB_UCAST_CAM_FULL;
+        bfa_q_qe_init(&mac->qe);
+        memcpy(mac->addr, addr, ETH_ALEN);
+        list_add_tail(&mac->qe, &rxf->ucast_pending_add_q);
+
+        rxf->cam_fltr_cbfn = cbfn;
+        rxf->cam_fltr_cbarg = rx->bna->bnad;
+
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+
+        return BNA_CB_SUCCESS;
+}
+
+/* RxF <- bnad */
+enum bna_cb_status
+bna_rx_ucast_del(struct bna_rx *rx, u8 *addr,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head *qe;
+        struct bna_mac *mac;
+
+        list_for_each(qe, &rxf->ucast_pending_add_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        list_del(qe);
+                        bfa_q_qe_init(qe);
+                        bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        list_for_each(qe, &rxf->ucast_active_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        list_del(qe);
+                        bfa_q_qe_init(qe);
+                        list_add_tail(qe, &rxf->ucast_pending_del_q);
+                        rxf->cam_fltr_cbfn = cbfn;
+                        rxf->cam_fltr_cbarg = rx->bna->bnad;
+                        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        return BNA_CB_INVALID_MAC;
+}
+
+/* RxF <- bnad */
+enum bna_cb_status
+bna_rx_mode_set(struct bna_rx *rx, enum bna_rxmode new_mode,
+                enum bna_rxmode bitmask,
+                void (*cbfn)(struct bnad *, struct bna_rx *,
+                             enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        int need_hw_config = 0;
+
+        /* Error checks */
+
+        if (is_promisc_enable(new_mode, bitmask)) {
+                /* If promisc mode is already enabled elsewhere in the system */
+                if ((rx->bna->rxf_promisc_id != BFI_MAX_RXF) &&
+                        (rx->bna->rxf_promisc_id != rxf->rxf_id))
+                        goto err_return;
+
+                /* If default mode is already enabled in the system */
+                if (rx->bna->rxf_default_id != BFI_MAX_RXF)
+                        goto err_return;
+
+                /* Trying to enable promiscuous and default mode together */
+                if (is_default_enable(new_mode, bitmask))
+                        goto err_return;
+        }
+
+        if (is_default_enable(new_mode, bitmask)) {
+                /* If default mode is already enabled elsewhere in the system */
+                if ((rx->bna->rxf_default_id != BFI_MAX_RXF) &&
+                        (rx->bna->rxf_default_id != rxf->rxf_id)) {
+                                goto err_return;
+                }
+
+                /* If promiscuous mode is already enabled in the system */
+                if (rx->bna->rxf_promisc_id != BFI_MAX_RXF)
+                        goto err_return;
+        }
+
+        /* Process the commands */
+
+        if (is_promisc_enable(new_mode, bitmask)) {
+                if (rxf_promisc_enable(rxf))
+                        need_hw_config = 1;
+        } else if (is_promisc_disable(new_mode, bitmask)) {
+                if (rxf_promisc_disable(rxf))
+                        need_hw_config = 1;
+        }
+
+        if (is_default_enable(new_mode, bitmask)) {
+                if (rxf_default_enable(rxf))
+                        need_hw_config = 1;
+        } else if (is_default_disable(new_mode, bitmask)) {
+                if (rxf_default_disable(rxf))
+                        need_hw_config = 1;
+        }
+
+        if (is_allmulti_enable(new_mode, bitmask)) {
+                if (rxf_allmulti_enable(rxf))
+                        need_hw_config = 1;
+        } else if (is_allmulti_disable(new_mode, bitmask)) {
+                if (rxf_allmulti_disable(rxf))
+                        need_hw_config = 1;
+        }
+
+        /* Trigger h/w if needed */
+
+        if (need_hw_config) {
+                rxf->cam_fltr_cbfn = cbfn;
+                rxf->cam_fltr_cbarg = rx->bna->bnad;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        } else if (cbfn)
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+
+        return BNA_CB_SUCCESS;
+
+err_return:
+        return BNA_CB_FAIL;
+}
+
+/* RxF <- bnad */
+void
+bna_rx_rss_enable(struct bna_rx *rx)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
+        rxf->rss_status = BNA_STATUS_T_ENABLED;
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+}
+
+/* RxF <- bnad */
+void
+bna_rx_rss_disable(struct bna_rx *rx)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
+        rxf->rss_status = BNA_STATUS_T_DISABLED;
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+}
+
+/* RxF <- bnad */
+void
+bna_rx_rss_reconfig(struct bna_rx *rx, struct bna_rxf_rss *rss_config)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
+        rxf->rss_status = BNA_STATUS_T_ENABLED;
+        rxf->rss_cfg = *rss_config;
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+}
+
+void
+/* RxF <- bnad */
+bna_rx_vlanfilter_enable(struct bna_rx *rx)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        if (rxf->vlan_filter_status == BNA_STATUS_T_DISABLED) {
+                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
+                rxf->vlan_filter_status = BNA_STATUS_T_ENABLED;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        }
+}
+
+/* RxF <- bnad */
+void
+bna_rx_vlanfilter_disable(struct bna_rx *rx)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        if (rxf->vlan_filter_status == BNA_STATUS_T_ENABLED) {
+                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
+                rxf->vlan_filter_status = BNA_STATUS_T_DISABLED;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        }
+}
+
+/* Rx */
+
+struct bna_rxp *
+bna_rx_get_rxp(struct bna_rx *rx, int vector)
+{
+        struct bna_rxp *rxp;
+        struct list_head *qe;
+
+        list_for_each(qe, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe;
+                if (rxp->vector == vector)
+                        return rxp;
+        }
+        return NULL;
+}
+
+/*
+ * bna_rx_rss_rit_set()
+ * Sets the Q ids for the specified msi-x vectors in the RIT.
+ * Maximum rit size supported is 64, which should be the max size of the
+ * vectors array.
+ */
+
+void
+bna_rx_rss_rit_set(struct bna_rx *rx, unsigned int *vectors, int nvectors)
+{
+        int i;
+        struct bna_rxp *rxp;
+        struct bna_rxq *q0 = NULL, *q1 = NULL;
+        struct bna *bna;
+        struct bna_rxf *rxf;
+
+        /* Build the RIT contents for this RX */
+        bna = rx->bna;
+
+        rxf = &rx->rxf;
+        for (i = 0; i < nvectors; i++) {
+                rxp = bna_rx_get_rxp(rx, vectors[i]);
+
+                GET_RXQS(rxp, q0, q1);
+                rxf->rit_segment->rit[i].large_rxq_id = q0->rxq_id;
+                rxf->rit_segment->rit[i].small_rxq_id = (q1 ? q1->rxq_id : 0);
+        }
+
+        rxf->rit_segment->rit_size = nvectors;
+
+        /* Subsequent call to enable/reconfig RSS will update the RIT in h/w */
+}
+
+/* Rx <- bnad */
+void
+bna_rx_coalescing_timeo_set(struct bna_rx *rx, int coalescing_timeo)
+{
+        struct bna_rxp *rxp;
+        struct list_head *qe;
+
+        list_for_each(qe, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe;
+                rxp->cq.ccb->rx_coalescing_timeo = coalescing_timeo;
+                bna_ib_coalescing_timeo_set(rxp->cq.ib, coalescing_timeo);
+        }
+}
+
+/* Rx <- bnad */
+void
+bna_rx_dim_reconfig(struct bna *bna, u32 vector[][BNA_BIAS_T_MAX])
+{
+        int i, j;
+
+        for (i = 0; i < BNA_LOAD_T_MAX; i++)
+                for (j = 0; j < BNA_BIAS_T_MAX; j++)
+                        bna->rx_mod.dim_vector[i][j] = vector[i][j];
+}
+
+/* Rx <- bnad */
+void
+bna_rx_dim_update(struct bna_ccb *ccb)
+{
+        struct bna *bna = ccb->cq->rx->bna;
+        u32 load, bias;
+        u32 pkt_rt, small_rt, large_rt;
+        u8 coalescing_timeo;
+
+        if ((ccb->pkt_rate.small_pkt_cnt == 0) &&
+                (ccb->pkt_rate.large_pkt_cnt == 0))
+                return;
+
+        /* Arrive at preconfigured coalescing timeo value based on pkt rate */
+
+        small_rt = ccb->pkt_rate.small_pkt_cnt;
+        large_rt = ccb->pkt_rate.large_pkt_cnt;
+
+        pkt_rt = small_rt + large_rt;
+
+        if (pkt_rt < BNA_PKT_RATE_10K)
+                load = BNA_LOAD_T_LOW_4;
+        else if (pkt_rt < BNA_PKT_RATE_20K)
+                load = BNA_LOAD_T_LOW_3;
+        else if (pkt_rt < BNA_PKT_RATE_30K)
+                load = BNA_LOAD_T_LOW_2;
+        else if (pkt_rt < BNA_PKT_RATE_40K)
+                load = BNA_LOAD_T_LOW_1;
+        else if (pkt_rt < BNA_PKT_RATE_50K)
+                load = BNA_LOAD_T_HIGH_1;
+        else if (pkt_rt < BNA_PKT_RATE_60K)
+                load = BNA_LOAD_T_HIGH_2;
+        else if (pkt_rt < BNA_PKT_RATE_80K)
+                load = BNA_LOAD_T_HIGH_3;
+        else
+                load = BNA_LOAD_T_HIGH_4;
+
+        if (small_rt > (large_rt << 1))
+                bias = 0;
+        else
+                bias = 1;
+
+        ccb->pkt_rate.small_pkt_cnt = 0;
+        ccb->pkt_rate.large_pkt_cnt = 0;
+
+        coalescing_timeo = bna->rx_mod.dim_vector[load][bias];
+        ccb->rx_coalescing_timeo = coalescing_timeo;
+
+        /* Set it to IB */
+        bna_ib_coalescing_timeo_set(ccb->cq->ib, coalescing_timeo);
+}
+
+/* Tx */
+/* TX <- bnad */
+enum bna_cb_status
+bna_tx_prio_set(struct bna_tx *tx, int prio,
+                void (*cbfn)(struct bnad *, struct bna_tx *,
+                             enum bna_cb_status))
+{
+        if (tx->flags & BNA_TX_F_PRIO_LOCK)
+                return BNA_CB_FAIL;
+        else {
+                tx->prio_change_cbfn = cbfn;
+                bna_tx_prio_changed(tx, prio);
+        }
+
+        return BNA_CB_SUCCESS;
+}
+
+/* TX <- bnad */
+void
+bna_tx_coalescing_timeo_set(struct bna_tx *tx, int coalescing_timeo)
+{
+        struct bna_txq *txq;
+        struct list_head *qe;
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                bna_ib_coalescing_timeo_set(txq->ib, coalescing_timeo);
+        }
+}
+
+/*
+ * Private data
+ */
+
+struct bna_ritseg_pool_cfg {
+        u32     pool_size;
+        u32     pool_entry_size;
+};
+init_ritseg_pool(ritseg_pool_cfg);
+
+/*
+ * Private functions
+ */
+static void
+bna_ucam_mod_init(struct bna_ucam_mod *ucam_mod, struct bna *bna,
+                  struct bna_res_info *res_info)
+{
+        int i;
+
+        ucam_mod->ucmac = (struct bna_mac *)
+                res_info[BNA_RES_MEM_T_UCMAC_ARRAY].res_u.mem_info.mdl[0].kva;
+
+        INIT_LIST_HEAD(&ucam_mod->free_q);
+        for (i = 0; i < BFI_MAX_UCMAC; i++) {
+                bfa_q_qe_init(&ucam_mod->ucmac[i].qe);
+                list_add_tail(&ucam_mod->ucmac[i].qe, &ucam_mod->free_q);
+        }
+
+        ucam_mod->bna = bna;
+}
+
+static void
+bna_ucam_mod_uninit(struct bna_ucam_mod *ucam_mod)
+{
+        struct list_head *qe;
+        int i = 0;
+
+        list_for_each(qe, &ucam_mod->free_q)
+                i++;
+
+        ucam_mod->bna = NULL;
+}
+
+static void
+bna_mcam_mod_init(struct bna_mcam_mod *mcam_mod, struct bna *bna,
+                  struct bna_res_info *res_info)
+{
+        int i;
+
+        mcam_mod->mcmac = (struct bna_mac *)
+                res_info[BNA_RES_MEM_T_MCMAC_ARRAY].res_u.mem_info.mdl[0].kva;
+
+        INIT_LIST_HEAD(&mcam_mod->free_q);
+        for (i = 0; i < BFI_MAX_MCMAC; i++) {
+                bfa_q_qe_init(&mcam_mod->mcmac[i].qe);
+                list_add_tail(&mcam_mod->mcmac[i].qe, &mcam_mod->free_q);
+        }
+
+        mcam_mod->bna = bna;
+}
+
+static void
+bna_mcam_mod_uninit(struct bna_mcam_mod *mcam_mod)
+{
+        struct list_head *qe;
+        int i = 0;
+
+        list_for_each(qe, &mcam_mod->free_q)
+                i++;
+
+        mcam_mod->bna = NULL;
+}
+
+static void
+bna_rit_mod_init(struct bna_rit_mod *rit_mod,
+                struct bna_res_info *res_info)
+{
+        int i;
+        int j;
+        int count;
+        int offset;
+
+        rit_mod->rit = (struct bna_rit_entry *)
+                res_info[BNA_RES_MEM_T_RIT_ENTRY].res_u.mem_info.mdl[0].kva;
+        rit_mod->rit_segment = (struct bna_rit_segment *)
+                res_info[BNA_RES_MEM_T_RIT_SEGMENT].res_u.mem_info.mdl[0].kva;
+
+        count = 0;
+        offset = 0;
+        for (i = 0; i < BFI_RIT_SEG_TOTAL_POOLS; i++) {
+                INIT_LIST_HEAD(&rit_mod->rit_seg_pool[i]);
+                for (j = 0; j < ritseg_pool_cfg[i].pool_size; j++) {
+                        bfa_q_qe_init(&rit_mod->rit_segment[count].qe);
+                        rit_mod->rit_segment[count].max_rit_size =
+                                        ritseg_pool_cfg[i].pool_entry_size;
+                        rit_mod->rit_segment[count].rit_offset = offset;
+                        rit_mod->rit_segment[count].rit =
+                                        &rit_mod->rit[offset];
+                        list_add_tail(&rit_mod->rit_segment[count].qe,
+                                &rit_mod->rit_seg_pool[i]);
+                        count++;
+                        offset += ritseg_pool_cfg[i].pool_entry_size;
+                }
+        }
+}
+
+static void
+bna_rit_mod_uninit(struct bna_rit_mod *rit_mod)
+{
+        struct bna_rit_segment *rit_segment;
+        struct list_head *qe;
+        int i;
+        int j;
+
+        for (i = 0; i < BFI_RIT_SEG_TOTAL_POOLS; i++) {
+                j = 0;
+                list_for_each(qe, &rit_mod->rit_seg_pool[i]) {
+                        rit_segment = (struct bna_rit_segment *)qe;
+                        j++;
+                }
+        }
+}
+
+/*
+ * Public functions
+ */
+
+/* Called during probe(), before calling bna_init() */
+void
+bna_res_req(struct bna_res_info *res_info)
+{
+        bna_adv_res_req(res_info);
+
+        /* DMA memory for retrieving IOC attributes */
+        res_info[BNA_RES_MEM_T_ATTR].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_ATTR].res_u.mem_info.mem_type = BNA_MEM_T_DMA;
+        res_info[BNA_RES_MEM_T_ATTR].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_ATTR].res_u.mem_info.len =
+                                ALIGN(bfa_nw_ioc_meminfo(), PAGE_SIZE);
+
+        /* DMA memory for index segment of an IB */
+        res_info[BNA_RES_MEM_T_IBIDX].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.mem_type = BNA_MEM_T_DMA;
+        res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.len =
+                                BFI_IBIDX_SIZE * BFI_IBIDX_MAX_SEGSIZE;
+        res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.num = BFI_MAX_IB;
+
+        /* Virtual memory for IB objects - stored by IB module */
+        res_info[BNA_RES_MEM_T_IB_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_IB_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_IB_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_IB_ARRAY].res_u.mem_info.len =
+                                BFI_MAX_IB * sizeof(struct bna_ib);
+
+        /* Virtual memory for intr objects - stored by IB module */
+        res_info[BNA_RES_MEM_T_INTR_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_INTR_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_INTR_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_INTR_ARRAY].res_u.mem_info.len =
+                                BFI_MAX_IB * sizeof(struct bna_intr);
+
+        /* Virtual memory for idx_seg objects - stored by IB module */
+        res_info[BNA_RES_MEM_T_IDXSEG_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_IDXSEG_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_IDXSEG_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_IDXSEG_ARRAY].res_u.mem_info.len =
+                        BFI_IBIDX_TOTAL_SEGS * sizeof(struct bna_ibidx_seg);
+
+        /* Virtual memory for Tx objects - stored by Tx module */
+        res_info[BNA_RES_MEM_T_TX_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_TX_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_TX_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_TX_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_TXQ * sizeof(struct bna_tx);
+
+        /* Virtual memory for TxQ - stored by Tx module */
+        res_info[BNA_RES_MEM_T_TXQ_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_TXQ_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_TXQ_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_TXQ_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_TXQ * sizeof(struct bna_txq);
+
+        /* Virtual memory for Rx objects - stored by Rx module */
+        res_info[BNA_RES_MEM_T_RX_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_RX_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_RX_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_RX_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_RXQ * sizeof(struct bna_rx);
+
+        /* Virtual memory for RxPath - stored by Rx module */
+        res_info[BNA_RES_MEM_T_RXP_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_RXP_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_RXP_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_RXP_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_RXQ * sizeof(struct bna_rxp);
+
+        /* Virtual memory for RxQ - stored by Rx module */
+        res_info[BNA_RES_MEM_T_RXQ_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_RXQ_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_RXQ_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_RXQ_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_RXQ * sizeof(struct bna_rxq);
+
+        /* Virtual memory for Unicast MAC address - stored by ucam module */
+        res_info[BNA_RES_MEM_T_UCMAC_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_UCMAC_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_UCMAC_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_UCMAC_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_UCMAC * sizeof(struct bna_mac);
+
+        /* Virtual memory for Multicast MAC address - stored by mcam module */
+        res_info[BNA_RES_MEM_T_MCMAC_ARRAY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_MCMAC_ARRAY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_MCMAC_ARRAY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_MCMAC_ARRAY].res_u.mem_info.len =
+                        BFI_MAX_MCMAC * sizeof(struct bna_mac);
+
+        /* Virtual memory for RIT entries */
+        res_info[BNA_RES_MEM_T_RIT_ENTRY].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_RIT_ENTRY].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_RIT_ENTRY].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_RIT_ENTRY].res_u.mem_info.len =
+                        BFI_MAX_RIT_SIZE * sizeof(struct bna_rit_entry);
+
+        /* Virtual memory for RIT segment table */
+        res_info[BNA_RES_MEM_T_RIT_SEGMENT].res_type = BNA_RES_T_MEM;
+        res_info[BNA_RES_MEM_T_RIT_SEGMENT].res_u.mem_info.mem_type =
+                                                                BNA_MEM_T_KVA;
+        res_info[BNA_RES_MEM_T_RIT_SEGMENT].res_u.mem_info.num = 1;
+        res_info[BNA_RES_MEM_T_RIT_SEGMENT].res_u.mem_info.len =
+                        BFI_RIT_TOTAL_SEGS * sizeof(struct bna_rit_segment);
+
+        /* Interrupt resource for mailbox interrupt */
+        res_info[BNA_RES_INTR_T_MBOX].res_type = BNA_RES_T_INTR;
+        res_info[BNA_RES_INTR_T_MBOX].res_u.intr_info.intr_type =
+                                                        BNA_INTR_T_MSIX;
+        res_info[BNA_RES_INTR_T_MBOX].res_u.intr_info.num = 1;
+}
+
+/* Called during probe() */
+void
+bna_init(struct bna *bna, struct bnad *bnad, struct bfa_pcidev *pcidev,
+                struct bna_res_info *res_info)
+{
+        bna->bnad = bnad;
+        bna->pcidev = *pcidev;
+
+        bna->stats.hw_stats = (struct bfi_ll_stats *)
+                res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.mdl[0].kva;
+        bna->hw_stats_dma.msb =
+                res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.mdl[0].dma.msb;
+        bna->hw_stats_dma.lsb =
+                res_info[BNA_RES_MEM_T_STATS].res_u.mem_info.mdl[0].dma.lsb;
+        bna->stats.sw_stats = (struct bna_sw_stats *)
+                res_info[BNA_RES_MEM_T_SWSTATS].res_u.mem_info.mdl[0].kva;
+
+        bna->regs.page_addr = bna->pcidev.pci_bar_kva +
+                                reg_offset[bna->pcidev.pci_func].page_addr;
+        bna->regs.fn_int_status = bna->pcidev.pci_bar_kva +
+                                reg_offset[bna->pcidev.pci_func].fn_int_status;
+        bna->regs.fn_int_mask = bna->pcidev.pci_bar_kva +
+                                reg_offset[bna->pcidev.pci_func].fn_int_mask;
+
+        if (bna->pcidev.pci_func < 3)
+                bna->port_num = 0;
+        else
+                bna->port_num = 1;
+
+        /* Also initializes diag, cee, sfp, phy_port and mbox_mod */
+        bna_device_init(&bna->device, bna, res_info);
+
+        bna_port_init(&bna->port, bna);
+
+        bna_tx_mod_init(&bna->tx_mod, bna, res_info);
+
+        bna_rx_mod_init(&bna->rx_mod, bna, res_info);
+
+        bna_ib_mod_init(&bna->ib_mod, bna, res_info);
+
+        bna_rit_mod_init(&bna->rit_mod, res_info);
+
+        bna_ucam_mod_init(&bna->ucam_mod, bna, res_info);
+
+        bna_mcam_mod_init(&bna->mcam_mod, bna, res_info);
+
+        bna->rxf_default_id = BFI_MAX_RXF;
+        bna->rxf_promisc_id = BFI_MAX_RXF;
+
+        /* Mbox q element for posting stat request to f/w */
+        bfa_q_qe_init(&bna->mbox_qe.qe);
+}
+
+void
+bna_uninit(struct bna *bna)
+{
+        bna_mcam_mod_uninit(&bna->mcam_mod);
+
+        bna_ucam_mod_uninit(&bna->ucam_mod);
+
+        bna_rit_mod_uninit(&bna->rit_mod);
+
+        bna_ib_mod_uninit(&bna->ib_mod);
+
+        bna_rx_mod_uninit(&bna->rx_mod);
+
+        bna_tx_mod_uninit(&bna->tx_mod);
+
+        bna_port_uninit(&bna->port);
+
+        bna_device_uninit(&bna->device);
+
+        bna->bnad = NULL;
+}
+
+struct bna_mac *
+bna_ucam_mod_mac_get(struct bna_ucam_mod *ucam_mod)
+{
+        struct list_head *qe;
+
+        if (list_empty(&ucam_mod->free_q))
+                return NULL;
+
+        bfa_q_deq(&ucam_mod->free_q, &qe);
+
+        return (struct bna_mac *)qe;
+}
+
+void
+bna_ucam_mod_mac_put(struct bna_ucam_mod *ucam_mod, struct bna_mac *mac)
+{
+        list_add_tail(&mac->qe, &ucam_mod->free_q);
+}
+
+struct bna_mac *
+bna_mcam_mod_mac_get(struct bna_mcam_mod *mcam_mod)
+{
+        struct list_head *qe;
+
+        if (list_empty(&mcam_mod->free_q))
+                return NULL;
+
+        bfa_q_deq(&mcam_mod->free_q, &qe);
+
+        return (struct bna_mac *)qe;
+}
+
+void
+bna_mcam_mod_mac_put(struct bna_mcam_mod *mcam_mod, struct bna_mac *mac)
+{
+        list_add_tail(&mac->qe, &mcam_mod->free_q);
+}
+
+/**
+ * Note: This should be called in the same locking context as the call to
+ * bna_rit_mod_seg_get()
+ */
+int
+bna_rit_mod_can_satisfy(struct bna_rit_mod *rit_mod, int seg_size)
+{
+        int i;
+
+        /* Select the pool for seg_size */
+        for (i = 0; i < BFI_RIT_SEG_TOTAL_POOLS; i++) {
+                if (seg_size <= ritseg_pool_cfg[i].pool_entry_size)
+                        break;
+        }
+
+        if (i == BFI_RIT_SEG_TOTAL_POOLS)
+                return 0;
+
+        if (list_empty(&rit_mod->rit_seg_pool[i]))
+                return 0;
+
+        return 1;
+}
+
+struct bna_rit_segment *
+bna_rit_mod_seg_get(struct bna_rit_mod *rit_mod, int seg_size)
+{
+        struct bna_rit_segment *seg;
+        struct list_head *qe;
+        int i;
+
+        /* Select the pool for seg_size */
+        for (i = 0; i < BFI_RIT_SEG_TOTAL_POOLS; i++) {
+                if (seg_size <= ritseg_pool_cfg[i].pool_entry_size)
+                        break;
+        }
+
+        if (i == BFI_RIT_SEG_TOTAL_POOLS)
+                return NULL;
+
+        if (list_empty(&rit_mod->rit_seg_pool[i]))
+                return NULL;
+
+        bfa_q_deq(&rit_mod->rit_seg_pool[i], &qe);
+        seg = (struct bna_rit_segment *)qe;
+        bfa_q_qe_init(&seg->qe);
+        seg->rit_size = seg_size;
+
+        return seg;
+}
+
+void
+bna_rit_mod_seg_put(struct bna_rit_mod *rit_mod,
+                        struct bna_rit_segment *seg)
+{
+        int i;
+
+        /* Select the pool for seg->max_rit_size */
+        for (i = 0; i < BFI_RIT_SEG_TOTAL_POOLS; i++) {
+                if (seg->max_rit_size == ritseg_pool_cfg[i].pool_entry_size)
+                        break;
+        }
+
+        seg->rit_size = 0;
+        list_add_tail(&seg->qe, &rit_mod->rit_seg_pool[i]);
+}
diff --git a/drivers/net/bna/bna_hw.h b/drivers/net/bna/bna_hw.h
new file mode 100644
index 000000000000..67eb376c5c7e
--- /dev/null
+++ b/drivers/net/bna/bna_hw.h
@@ -0,0 +1,1491 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ *
+ * File for interrupt macros and functions
+ */
+
+#ifndef __BNA_HW_H__
+#define __BNA_HW_H__
+
+#include "bfi_ctreg.h"
+
+/**
+ *
+ * SW imposed limits
+ *
+ */
+
+#ifndef BNA_BIOS_BUILD
+
+#define BFI_MAX_TXQ                     64
+#define BFI_MAX_RXQ                     64
+#define BFI_MAX_RXF                     64
+#define BFI_MAX_IB                      128
+#define BFI_MAX_RIT_SIZE                256
+#define BFI_RSS_RIT_SIZE                64
+#define BFI_NONRSS_RIT_SIZE             1
+#define BFI_MAX_UCMAC                   256
+#define BFI_MAX_MCMAC                   512
+#define BFI_IBIDX_SIZE                  4
+#define BFI_MAX_VLAN                    4095
+
+/**
+ * There are 2 free IB index pools:
+ *      pool1: 120 segments of 1 index each
+ *      pool8: 1 segment of 8 indexes
+ */
+#define BFI_IBIDX_POOL1_SIZE            116
+#define BFI_IBIDX_POOL1_ENTRY_SIZE      1
+#define BFI_IBIDX_POOL2_SIZE            2
+#define BFI_IBIDX_POOL2_ENTRY_SIZE      2
+#define BFI_IBIDX_POOL8_SIZE            1
+#define BFI_IBIDX_POOL8_ENTRY_SIZE      8
+#define BFI_IBIDX_TOTAL_POOLS           3
+#define BFI_IBIDX_TOTAL_SEGS            119 /* (POOL1 + POOL2 + POOL8)_SIZE */
+#define BFI_IBIDX_MAX_SEGSIZE           8
+#define init_ibidx_pool(name)                                           \
+static struct bna_ibidx_pool name[BFI_IBIDX_TOTAL_POOLS] =              \
+{                                                                       \
+        { BFI_IBIDX_POOL1_SIZE, BFI_IBIDX_POOL1_ENTRY_SIZE },           \
+        { BFI_IBIDX_POOL2_SIZE, BFI_IBIDX_POOL2_ENTRY_SIZE },           \
+        { BFI_IBIDX_POOL8_SIZE, BFI_IBIDX_POOL8_ENTRY_SIZE }            \
+}
+
+/**
+ * There are 2 free RIT segment pools:
+ *      Pool1: 192 segments of 1 RIT entry each
+ *      Pool2: 1 segment of 64 RIT entry
+ */
+#define BFI_RIT_SEG_POOL1_SIZE          192
+#define BFI_RIT_SEG_POOL1_ENTRY_SIZE    1
+#define BFI_RIT_SEG_POOLRSS_SIZE        1
+#define BFI_RIT_SEG_POOLRSS_ENTRY_SIZE  64
+#define BFI_RIT_SEG_TOTAL_POOLS         2
+#define BFI_RIT_TOTAL_SEGS              193 /* POOL1_SIZE + POOLRSS_SIZE */
+#define init_ritseg_pool(name)                                          \
+static struct bna_ritseg_pool_cfg name[BFI_RIT_SEG_TOTAL_POOLS] =       \
+{                                                                       \
+        { BFI_RIT_SEG_POOL1_SIZE, BFI_RIT_SEG_POOL1_ENTRY_SIZE },       \
+        { BFI_RIT_SEG_POOLRSS_SIZE, BFI_RIT_SEG_POOLRSS_ENTRY_SIZE }    \
+}
+
+#else /* BNA_BIOS_BUILD */
+
+#define BFI_MAX_TXQ                     1
+#define BFI_MAX_RXQ                     1
+#define BFI_MAX_RXF                     1
+#define BFI_MAX_IB                      2
+#define BFI_MAX_RIT_SIZE                2
+#define BFI_RSS_RIT_SIZE                64
+#define BFI_NONRSS_RIT_SIZE             1
+#define BFI_MAX_UCMAC                   1
+#define BFI_MAX_MCMAC                   8
+#define BFI_IBIDX_SIZE                  4
+#define BFI_MAX_VLAN                    4095
+/* There is one free pool: 2 segments of 1 index each */
+#define BFI_IBIDX_POOL1_SIZE            2
+#define BFI_IBIDX_POOL1_ENTRY_SIZE      1
+#define BFI_IBIDX_TOTAL_POOLS           1
+#define BFI_IBIDX_TOTAL_SEGS            2 /* POOL1_SIZE */
+#define BFI_IBIDX_MAX_SEGSIZE           1
+#define init_ibidx_pool(name)                                           \
+static struct bna_ibidx_pool name[BFI_IBIDX_TOTAL_POOLS] =              \
+{                                                                       \
+        { BFI_IBIDX_POOL1_SIZE, BFI_IBIDX_POOL1_ENTRY_SIZE }            \
+}
+
+#define BFI_RIT_SEG_POOL1_SIZE          1
+#define BFI_RIT_SEG_POOL1_ENTRY_SIZE    1
+#define BFI_RIT_SEG_TOTAL_POOLS         1
+#define BFI_RIT_TOTAL_SEGS              1 /* POOL1_SIZE */
+#define init_ritseg_pool(name)                                          \
+static struct bna_ritseg_pool_cfg name[BFI_RIT_SEG_TOTAL_POOLS] =       \
+{                                                                       \
+        { BFI_RIT_SEG_POOL1_SIZE, BFI_RIT_SEG_POOL1_ENTRY_SIZE }        \
+}
+
+#endif /* BNA_BIOS_BUILD */
+
+#define BFI_RSS_HASH_KEY_LEN            10
+
+#define BFI_COALESCING_TIMER_UNIT       5       /* 5us */
+#define BFI_MAX_COALESCING_TIMEO        0xFF    /* in 5us units */
+#define BFI_MAX_INTERPKT_COUNT          0xFF
+#define BFI_MAX_INTERPKT_TIMEO          0xF     /* in 0.5us units */
+#define BFI_TX_COALESCING_TIMEO         20      /* 20 * 5 = 100us */
+#define BFI_TX_INTERPKT_COUNT           32
+#define BFI_RX_COALESCING_TIMEO         12      /* 12 * 5 = 60us */
+#define BFI_RX_INTERPKT_COUNT           6       /* Pkt Cnt = 6 */
+#define BFI_RX_INTERPKT_TIMEO           3       /* 3 * 0.5 = 1.5us */
+
+#define BFI_TXQ_WI_SIZE                 64      /* bytes */
+#define BFI_RXQ_WI_SIZE                 8       /* bytes */
+#define BFI_CQ_WI_SIZE                  16      /* bytes */
+#define BFI_TX_MAX_WRR_QUOTA            0xFFF
+
+#define BFI_TX_MAX_VECTORS_PER_WI       4
+#define BFI_TX_MAX_VECTORS_PER_PKT      0xFF
+#define BFI_TX_MAX_DATA_PER_VECTOR      0xFFFF
+#define BFI_TX_MAX_DATA_PER_PKT         0xFFFFFF
+
+/* Small Q buffer size */
+#define BFI_SMALL_RXBUF_SIZE            128
+
+/* Defined separately since BFA_FLASH_DMA_BUF_SZ is in bfa_flash.c */
+#define BFI_FLASH_DMA_BUF_SZ            0x010000 /* 64K DMA */
+#define BFI_HW_STATS_SIZE               0x4000 /* 16K DMA */
+
+/**
+ *
+ * HW register offsets, macros
+ *
+ */
+
+/* DMA Block Register Host Window Start Address */
+#define DMA_BLK_REG_ADDR                0x00013000
+
+/* DMA Block Internal Registers */
+#define DMA_CTRL_REG0                   (DMA_BLK_REG_ADDR + 0x000)
+#define DMA_CTRL_REG1                   (DMA_BLK_REG_ADDR + 0x004)
+#define DMA_ERR_INT_STATUS              (DMA_BLK_REG_ADDR + 0x008)
+#define DMA_ERR_INT_ENABLE              (DMA_BLK_REG_ADDR + 0x00c)
+#define DMA_ERR_INT_STATUS_SET          (DMA_BLK_REG_ADDR + 0x010)
+
+/* APP Block Register Address Offset from BAR0 */
+#define APP_BLK_REG_ADDR                0x00014000
+
+/* Host Function Interrupt Mask Registers */
+#define HOSTFN0_INT_MASK                (APP_BLK_REG_ADDR + 0x004)
+#define HOSTFN1_INT_MASK                (APP_BLK_REG_ADDR + 0x104)
+#define HOSTFN2_INT_MASK                (APP_BLK_REG_ADDR + 0x304)
+#define HOSTFN3_INT_MASK                (APP_BLK_REG_ADDR + 0x404)
+
+/**
+ * Host Function PCIe Error Registers
+ * Duplicates "Correctable" & "Uncorrectable"
+ * registers in PCIe Config space.
+ */
+#define FN0_PCIE_ERR_REG                (APP_BLK_REG_ADDR + 0x014)
+#define FN1_PCIE_ERR_REG                (APP_BLK_REG_ADDR + 0x114)
+#define FN2_PCIE_ERR_REG                (APP_BLK_REG_ADDR + 0x314)
+#define FN3_PCIE_ERR_REG                (APP_BLK_REG_ADDR + 0x414)
+
+/* Host Function Error Type Status Registers */
+#define FN0_ERR_TYPE_STATUS_REG         (APP_BLK_REG_ADDR + 0x018)
+#define FN1_ERR_TYPE_STATUS_REG         (APP_BLK_REG_ADDR + 0x118)
+#define FN2_ERR_TYPE_STATUS_REG         (APP_BLK_REG_ADDR + 0x318)
+#define FN3_ERR_TYPE_STATUS_REG         (APP_BLK_REG_ADDR + 0x418)
+
+/* Host Function Error Type Mask Registers */
+#define FN0_ERR_TYPE_MSK_STATUS_REG     (APP_BLK_REG_ADDR + 0x01c)
+#define FN1_ERR_TYPE_MSK_STATUS_REG     (APP_BLK_REG_ADDR + 0x11c)
+#define FN2_ERR_TYPE_MSK_STATUS_REG     (APP_BLK_REG_ADDR + 0x31c)
+#define FN3_ERR_TYPE_MSK_STATUS_REG     (APP_BLK_REG_ADDR + 0x41c)
+
+/* Catapult Host Semaphore Status Registers (App block) */
+#define HOST_SEM_STS0_REG               (APP_BLK_REG_ADDR + 0x630)
+#define HOST_SEM_STS1_REG               (APP_BLK_REG_ADDR + 0x634)
+#define HOST_SEM_STS2_REG               (APP_BLK_REG_ADDR + 0x638)
+#define HOST_SEM_STS3_REG               (APP_BLK_REG_ADDR + 0x63c)
+#define HOST_SEM_STS4_REG               (APP_BLK_REG_ADDR + 0x640)
+#define HOST_SEM_STS5_REG               (APP_BLK_REG_ADDR + 0x644)
+#define HOST_SEM_STS6_REG               (APP_BLK_REG_ADDR + 0x648)
+#define HOST_SEM_STS7_REG               (APP_BLK_REG_ADDR + 0x64c)
+
+/* PCIe Misc Register */
+#define PCIE_MISC_REG                   (APP_BLK_REG_ADDR + 0x200)
+
+/* Temp Sensor Control Registers */
+#define TEMPSENSE_CNTL_REG              (APP_BLK_REG_ADDR + 0x250)
+#define TEMPSENSE_STAT_REG              (APP_BLK_REG_ADDR + 0x254)
+
+/* APP Block local error registers */
+#define APP_LOCAL_ERR_STAT              (APP_BLK_REG_ADDR + 0x258)
+#define APP_LOCAL_ERR_MSK               (APP_BLK_REG_ADDR + 0x25c)
+
+/* PCIe Link Error registers */
+#define PCIE_LNK_ERR_STAT               (APP_BLK_REG_ADDR + 0x260)
+#define PCIE_LNK_ERR_MSK                (APP_BLK_REG_ADDR + 0x264)
+
+/**
+ * FCoE/FIP Ethertype Register
+ * 31:16 -- Chip wide value for FIP type
+ * 15:0  -- Chip wide value for FCoE type
+ */
+#define FCOE_FIP_ETH_TYPE               (APP_BLK_REG_ADDR + 0x280)
+
+/**
+ * Reserved Ethertype Register
+ * 31:16 -- Reserved
+ * 15:0  -- Other ethertype
+ */
+#define RESV_ETH_TYPE                   (APP_BLK_REG_ADDR + 0x284)
+
+/**
+ * Host Command Status Registers
+ * Each set consists of 3 registers :
+ * clear, set, cmd
+ * 16 such register sets in all
+ * See catapult_spec.pdf for detailed functionality
+ * Put each type in a single macro accessed by _num ?
+ */
+#define HOST_CMDSTS0_CLR_REG            (APP_BLK_REG_ADDR + 0x500)
+#define HOST_CMDSTS0_SET_REG            (APP_BLK_REG_ADDR + 0x504)
+#define HOST_CMDSTS0_REG                (APP_BLK_REG_ADDR + 0x508)
+#define HOST_CMDSTS1_CLR_REG            (APP_BLK_REG_ADDR + 0x510)
+#define HOST_CMDSTS1_SET_REG            (APP_BLK_REG_ADDR + 0x514)
+#define HOST_CMDSTS1_REG                (APP_BLK_REG_ADDR + 0x518)
+#define HOST_CMDSTS2_CLR_REG            (APP_BLK_REG_ADDR + 0x520)
+#define HOST_CMDSTS2_SET_REG            (APP_BLK_REG_ADDR + 0x524)
+#define HOST_CMDSTS2_REG                (APP_BLK_REG_ADDR + 0x528)
+#define HOST_CMDSTS3_CLR_REG            (APP_BLK_REG_ADDR + 0x530)
+#define HOST_CMDSTS3_SET_REG            (APP_BLK_REG_ADDR + 0x534)
+#define HOST_CMDSTS3_REG                (APP_BLK_REG_ADDR + 0x538)
+#define HOST_CMDSTS4_CLR_REG            (APP_BLK_REG_ADDR + 0x540)
+#define HOST_CMDSTS4_SET_REG            (APP_BLK_REG_ADDR + 0x544)
+#define HOST_CMDSTS4_REG                (APP_BLK_REG_ADDR + 0x548)
+#define HOST_CMDSTS5_CLR_REG            (APP_BLK_REG_ADDR + 0x550)
+#define HOST_CMDSTS5_SET_REG            (APP_BLK_REG_ADDR + 0x554)
+#define HOST_CMDSTS5_REG                (APP_BLK_REG_ADDR + 0x558)
+#define HOST_CMDSTS6_CLR_REG            (APP_BLK_REG_ADDR + 0x560)
+#define HOST_CMDSTS6_SET_REG            (APP_BLK_REG_ADDR + 0x564)
+#define HOST_CMDSTS6_REG                (APP_BLK_REG_ADDR + 0x568)
+#define HOST_CMDSTS7_CLR_REG            (APP_BLK_REG_ADDR + 0x570)
+#define HOST_CMDSTS7_SET_REG            (APP_BLK_REG_ADDR + 0x574)
+#define HOST_CMDSTS7_REG                (APP_BLK_REG_ADDR + 0x578)
+#define HOST_CMDSTS8_CLR_REG            (APP_BLK_REG_ADDR + 0x580)
+#define HOST_CMDSTS8_SET_REG            (APP_BLK_REG_ADDR + 0x584)
+#define HOST_CMDSTS8_REG                (APP_BLK_REG_ADDR + 0x588)
+#define HOST_CMDSTS9_CLR_REG            (APP_BLK_REG_ADDR + 0x590)
+#define HOST_CMDSTS9_SET_REG            (APP_BLK_REG_ADDR + 0x594)
+#define HOST_CMDSTS9_REG                (APP_BLK_REG_ADDR + 0x598)
+#define HOST_CMDSTS10_CLR_REG           (APP_BLK_REG_ADDR + 0x5A0)
+#define HOST_CMDSTS10_SET_REG           (APP_BLK_REG_ADDR + 0x5A4)
+#define HOST_CMDSTS10_REG               (APP_BLK_REG_ADDR + 0x5A8)
+#define HOST_CMDSTS11_CLR_REG           (APP_BLK_REG_ADDR + 0x5B0)
+#define HOST_CMDSTS11_SET_REG           (APP_BLK_REG_ADDR + 0x5B4)
+#define HOST_CMDSTS11_REG               (APP_BLK_REG_ADDR + 0x5B8)
+#define HOST_CMDSTS12_CLR_REG           (APP_BLK_REG_ADDR + 0x5C0)
+#define HOST_CMDSTS12_SET_REG           (APP_BLK_REG_ADDR + 0x5C4)
+#define HOST_CMDSTS12_REG               (APP_BLK_REG_ADDR + 0x5C8)
+#define HOST_CMDSTS13_CLR_REG           (APP_BLK_REG_ADDR + 0x5D0)
+#define HOST_CMDSTS13_SET_REG           (APP_BLK_REG_ADDR + 0x5D4)
+#define HOST_CMDSTS13_REG               (APP_BLK_REG_ADDR + 0x5D8)
+#define HOST_CMDSTS14_CLR_REG           (APP_BLK_REG_ADDR + 0x5E0)
+#define HOST_CMDSTS14_SET_REG           (APP_BLK_REG_ADDR + 0x5E4)
+#define HOST_CMDSTS14_REG               (APP_BLK_REG_ADDR + 0x5E8)
+#define HOST_CMDSTS15_CLR_REG           (APP_BLK_REG_ADDR + 0x5F0)
+#define HOST_CMDSTS15_SET_REG           (APP_BLK_REG_ADDR + 0x5F4)
+#define HOST_CMDSTS15_REG               (APP_BLK_REG_ADDR + 0x5F8)
+
+/**
+ * LPU0 Block Register Address Offset from BAR0
+ * Range 0x18000 - 0x18033
+ */
+#define LPU0_BLK_REG_ADDR               0x00018000
+
+/**
+ * LPU0 Registers
+ * Should they be directly used from host,
+ * except for diagnostics ?
+ * CTL_REG : Control register
+ * CMD_REG : Triggers exec. of cmd. in
+ *           Mailbox memory
+ */
+#define LPU0_MBOX_CTL_REG               (LPU0_BLK_REG_ADDR + 0x000)
+#define LPU0_MBOX_CMD_REG               (LPU0_BLK_REG_ADDR + 0x004)
+#define LPU0_MBOX_LINK_0REG             (LPU0_BLK_REG_ADDR + 0x008)
+#define LPU1_MBOX_LINK_0REG             (LPU0_BLK_REG_ADDR + 0x00c)
+#define LPU0_MBOX_STATUS_0REG           (LPU0_BLK_REG_ADDR + 0x010)
+#define LPU1_MBOX_STATUS_0REG           (LPU0_BLK_REG_ADDR + 0x014)
+#define LPU0_ERR_STATUS_REG             (LPU0_BLK_REG_ADDR + 0x018)
+#define LPU0_ERR_SET_REG                (LPU0_BLK_REG_ADDR + 0x020)
+
+/**
+ * LPU1 Block Register Address Offset from BAR0
+ * Range 0x18400 - 0x18433
+ */
+#define LPU1_BLK_REG_ADDR               0x00018400
+
+/**
+ * LPU1 Registers
+ * Same as LPU0 registers above
+ */
+#define LPU1_MBOX_CTL_REG               (LPU1_BLK_REG_ADDR + 0x000)
+#define LPU1_MBOX_CMD_REG               (LPU1_BLK_REG_ADDR + 0x004)
+#define LPU0_MBOX_LINK_1REG             (LPU1_BLK_REG_ADDR + 0x008)
+#define LPU1_MBOX_LINK_1REG             (LPU1_BLK_REG_ADDR + 0x00c)
+#define LPU0_MBOX_STATUS_1REG           (LPU1_BLK_REG_ADDR + 0x010)
+#define LPU1_MBOX_STATUS_1REG           (LPU1_BLK_REG_ADDR + 0x014)
+#define LPU1_ERR_STATUS_REG             (LPU1_BLK_REG_ADDR + 0x018)
+#define LPU1_ERR_SET_REG                (LPU1_BLK_REG_ADDR + 0x020)
+
+/**
+ * PSS Block Register Address Offset from BAR0
+ * Range 0x18800 - 0x188DB
+ */
+#define PSS_BLK_REG_ADDR                0x00018800
+
+/**
+ * PSS Registers
+ * For details, see catapult_spec.pdf
+ * ERR_STATUS_REG : Indicates error in PSS module
+ * RAM_ERR_STATUS_REG : Indicates RAM module that detected error
+ */
+#define ERR_STATUS_SET                  (PSS_BLK_REG_ADDR + 0x018)
+#define PSS_RAM_ERR_STATUS_REG          (PSS_BLK_REG_ADDR + 0x01C)
+
+/**
+ * PSS Semaphore Lock Registers, total 16
+ * First read when unlocked returns 0,
+ * and is set to 1, atomically.
+ * Subsequent reads returns 1.
+ * To clear set the value to 0.
+ * Range : 0x20 to 0x5c
+ */
+#define PSS_SEM_LOCK_REG(_num)          \
+        (PSS_BLK_REG_ADDR + 0x020 + ((_num) << 2))
+
+/**
+ * PSS Semaphore Status Registers,
+ * corresponding to the lock registers above
+ */
+#define PSS_SEM_STATUS_REG(_num)                \
+        (PSS_BLK_REG_ADDR + 0x060 + ((_num) << 2))
+
+/**
+ * Catapult CPQ Registers
+ * Defines for Mailbox Registers
+ * Used to send mailbox commands to firmware from
+ * host. The data part is written to the MBox
+ * memory, registers are used to indicate that
+ * a commnad is resident in memory.
+ *
+ * Note : LPU0<->LPU1 mailboxes are not listed here
+ */
+#define CPQ_BLK_REG_ADDR                0x00019000
+
+#define HOSTFN0_LPU0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x130)
+#define HOSTFN0_LPU1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x134)
+#define LPU0_HOSTFN0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x138)
+#define LPU1_HOSTFN0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x13C)
+
+#define HOSTFN1_LPU0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x140)
+#define HOSTFN1_LPU1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x144)
+#define LPU0_HOSTFN1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x148)
+#define LPU1_HOSTFN1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x14C)
+
+#define HOSTFN2_LPU0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x170)
+#define HOSTFN2_LPU1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x174)
+#define LPU0_HOSTFN2_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x178)
+#define LPU1_HOSTFN2_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x17C)
+
+#define HOSTFN3_LPU0_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x180)
+#define HOSTFN3_LPU1_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x184)
+#define LPU0_HOSTFN3_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x188)
+#define LPU1_HOSTFN3_MBOX1_CMD_STAT     (CPQ_BLK_REG_ADDR + 0x18C)
+
+/* Host Function Force Parity Error Registers */
+#define HOSTFN0_LPU_FORCE_PERR          (CPQ_BLK_REG_ADDR + 0x120)
+#define HOSTFN1_LPU_FORCE_PERR          (CPQ_BLK_REG_ADDR + 0x124)
+#define HOSTFN2_LPU_FORCE_PERR          (CPQ_BLK_REG_ADDR + 0x128)
+#define HOSTFN3_LPU_FORCE_PERR          (CPQ_BLK_REG_ADDR + 0x12C)
+
+/* LL Port[0|1] Halt Mask Registers */
+#define LL_HALT_MSK_P0                  (CPQ_BLK_REG_ADDR + 0x1A0)
+#define LL_HALT_MSK_P1                  (CPQ_BLK_REG_ADDR + 0x1B0)
+
+/* LL Port[0|1] Error Mask Registers */
+#define LL_ERR_MSK_P0                   (CPQ_BLK_REG_ADDR + 0x1D0)
+#define LL_ERR_MSK_P1                   (CPQ_BLK_REG_ADDR + 0x1D4)
+
+/* EMC FLI (Flash Controller) Block Register Address Offset from BAR0 */
+#define FLI_BLK_REG_ADDR                0x0001D000
+
+/* EMC FLI Registers */
+#define FLI_CMD_REG                     (FLI_BLK_REG_ADDR + 0x000)
+#define FLI_ADDR_REG                    (FLI_BLK_REG_ADDR + 0x004)
+#define FLI_CTL_REG                     (FLI_BLK_REG_ADDR + 0x008)
+#define FLI_WRDATA_REG                  (FLI_BLK_REG_ADDR + 0x00C)
+#define FLI_RDDATA_REG                  (FLI_BLK_REG_ADDR + 0x010)
+#define FLI_DEV_STATUS_REG              (FLI_BLK_REG_ADDR + 0x014)
+#define FLI_SIG_WD_REG                  (FLI_BLK_REG_ADDR + 0x018)
+
+/**
+ * RO register
+ * 31:16 -- Vendor Id
+ * 15:0  -- Device Id
+ */
+#define FLI_DEV_VENDOR_REG              (FLI_BLK_REG_ADDR + 0x01C)
+#define FLI_ERR_STATUS_REG              (FLI_BLK_REG_ADDR + 0x020)
+
+/**
+ * RAD (RxAdm) Block Register Address Offset from BAR0
+ * RAD0 Range : 0x20000 - 0x203FF
+ * RAD1 Range : 0x20400 - 0x207FF
+ */
+#define RAD0_BLK_REG_ADDR               0x00020000
+#define RAD1_BLK_REG_ADDR               0x00020400
+
+/* RAD0 Registers */
+#define RAD0_CTL_REG                    (RAD0_BLK_REG_ADDR + 0x000)
+#define RAD0_PE_PARM_REG                (RAD0_BLK_REG_ADDR + 0x004)
+#define RAD0_BCN_REG                    (RAD0_BLK_REG_ADDR + 0x008)
+
+/* Default function ID register */
+#define RAD0_DEFAULT_REG                (RAD0_BLK_REG_ADDR + 0x00C)
+
+/* Default promiscuous ID register */
+#define RAD0_PROMISC_REG                (RAD0_BLK_REG_ADDR + 0x010)
+
+#define RAD0_BCNQ_REG                   (RAD0_BLK_REG_ADDR + 0x014)
+
+/*
+ * This register selects 1 of 8 PM Q's using
+ * VLAN pri, for non-BCN packets without a VLAN tag
+ */
+#define RAD0_DEFAULTQ_REG               (RAD0_BLK_REG_ADDR + 0x018)
+
+#define RAD0_ERR_STS                    (RAD0_BLK_REG_ADDR + 0x01C)
+#define RAD0_SET_ERR_STS                (RAD0_BLK_REG_ADDR + 0x020)
+#define RAD0_ERR_INT_EN                 (RAD0_BLK_REG_ADDR + 0x024)
+#define RAD0_FIRST_ERR                  (RAD0_BLK_REG_ADDR + 0x028)
+#define RAD0_FORCE_ERR                  (RAD0_BLK_REG_ADDR + 0x02C)
+
+#define RAD0_IF_RCVD                    (RAD0_BLK_REG_ADDR + 0x030)
+#define RAD0_IF_RCVD_OCTETS_HIGH        (RAD0_BLK_REG_ADDR + 0x034)
+#define RAD0_IF_RCVD_OCTETS_LOW         (RAD0_BLK_REG_ADDR + 0x038)
+#define RAD0_IF_RCVD_VLAN               (RAD0_BLK_REG_ADDR + 0x03C)
+#define RAD0_IF_RCVD_UCAST              (RAD0_BLK_REG_ADDR + 0x040)
+#define RAD0_IF_RCVD_UCAST_OCTETS_HIGH  (RAD0_BLK_REG_ADDR + 0x044)
+#define RAD0_IF_RCVD_UCAST_OCTETS_LOW   (RAD0_BLK_REG_ADDR + 0x048)
+#define RAD0_IF_RCVD_UCAST_VLAN         (RAD0_BLK_REG_ADDR + 0x04C)
+#define RAD0_IF_RCVD_MCAST              (RAD0_BLK_REG_ADDR + 0x050)
+#define RAD0_IF_RCVD_MCAST_OCTETS_HIGH  (RAD0_BLK_REG_ADDR + 0x054)
+#define RAD0_IF_RCVD_MCAST_OCTETS_LOW   (RAD0_BLK_REG_ADDR + 0x058)
+#define RAD0_IF_RCVD_MCAST_VLAN         (RAD0_BLK_REG_ADDR + 0x05C)
+#define RAD0_IF_RCVD_BCAST              (RAD0_BLK_REG_ADDR + 0x060)
+#define RAD0_IF_RCVD_BCAST_OCTETS_HIGH  (RAD0_BLK_REG_ADDR + 0x064)
+#define RAD0_IF_RCVD_BCAST_OCTETS_LOW   (RAD0_BLK_REG_ADDR + 0x068)
+#define RAD0_IF_RCVD_BCAST_VLAN         (RAD0_BLK_REG_ADDR + 0x06C)
+#define RAD0_DROPPED_FRAMES             (RAD0_BLK_REG_ADDR + 0x070)
+
+#define RAD0_MAC_MAN_1H                 (RAD0_BLK_REG_ADDR + 0x080)
+#define RAD0_MAC_MAN_1L                 (RAD0_BLK_REG_ADDR + 0x084)
+#define RAD0_MAC_MAN_2H                 (RAD0_BLK_REG_ADDR + 0x088)
+#define RAD0_MAC_MAN_2L                 (RAD0_BLK_REG_ADDR + 0x08C)
+#define RAD0_MAC_MAN_3H                 (RAD0_BLK_REG_ADDR + 0x090)
+#define RAD0_MAC_MAN_3L                 (RAD0_BLK_REG_ADDR + 0x094)
+#define RAD0_MAC_MAN_4H                 (RAD0_BLK_REG_ADDR + 0x098)
+#define RAD0_MAC_MAN_4L                 (RAD0_BLK_REG_ADDR + 0x09C)
+
+#define RAD0_LAST4_IP                   (RAD0_BLK_REG_ADDR + 0x100)
+
+/* RAD1 Registers */
+#define RAD1_CTL_REG                    (RAD1_BLK_REG_ADDR + 0x000)
+#define RAD1_PE_PARM_REG                (RAD1_BLK_REG_ADDR + 0x004)
+#define RAD1_BCN_REG                    (RAD1_BLK_REG_ADDR + 0x008)
+
+/* Default function ID register */
+#define RAD1_DEFAULT_REG                (RAD1_BLK_REG_ADDR + 0x00C)
+
+/* Promiscuous function ID register */
+#define RAD1_PROMISC_REG                (RAD1_BLK_REG_ADDR + 0x010)
+
+#define RAD1_BCNQ_REG                   (RAD1_BLK_REG_ADDR + 0x014)
+
+/*
+ * This register selects 1 of 8 PM Q's using
+ * VLAN pri, for non-BCN packets without a VLAN tag
+ */
+#define RAD1_DEFAULTQ_REG               (RAD1_BLK_REG_ADDR + 0x018)
+
+#define RAD1_ERR_STS                    (RAD1_BLK_REG_ADDR + 0x01C)
+#define RAD1_SET_ERR_STS                (RAD1_BLK_REG_ADDR + 0x020)
+#define RAD1_ERR_INT_EN                 (RAD1_BLK_REG_ADDR + 0x024)
+
+/**
+ * TXA Block Register Address Offset from BAR0
+ * TXA0 Range : 0x21000 - 0x213FF
+ * TXA1 Range : 0x21400 - 0x217FF
+ */
+#define TXA0_BLK_REG_ADDR               0x00021000
+#define TXA1_BLK_REG_ADDR               0x00021400
+
+/* TXA Registers */
+#define TXA0_CTRL_REG                   (TXA0_BLK_REG_ADDR + 0x000)
+#define TXA1_CTRL_REG                   (TXA1_BLK_REG_ADDR + 0x000)
+
+/**
+ * TSO Sequence # Registers (RO)
+ * Total 8 (for 8 queues)
+ * Holds the last seq.# for TSO frames
+ * See catapult_spec.pdf for more details
+ */
+#define TXA0_TSO_TCP_SEQ_REG(_num)              \
+        (TXA0_BLK_REG_ADDR + 0x020 + ((_num) << 2))
+
+#define TXA1_TSO_TCP_SEQ_REG(_num)              \
+        (TXA1_BLK_REG_ADDR + 0x020 + ((_num) << 2))
+
+/**
+ * TSO IP ID # Registers (RO)
+ * Total 8 (for 8 queues)
+ * Holds the last IP ID for TSO frames
+ * See catapult_spec.pdf for more details
+ */
+#define TXA0_TSO_IP_INFO_REG(_num)              \
+        (TXA0_BLK_REG_ADDR + 0x040 + ((_num) << 2))
+
+#define TXA1_TSO_IP_INFO_REG(_num)              \
+        (TXA1_BLK_REG_ADDR + 0x040 + ((_num) << 2))
+
+/**
+ * RXA Block Register Address Offset from BAR0
+ * RXA0 Range : 0x21800 - 0x21BFF
+ * RXA1 Range : 0x21C00 - 0x21FFF
+ */
+#define RXA0_BLK_REG_ADDR               0x00021800
+#define RXA1_BLK_REG_ADDR               0x00021C00
+
+/* RXA Registers */
+#define RXA0_CTL_REG                    (RXA0_BLK_REG_ADDR + 0x040)
+#define RXA1_CTL_REG                    (RXA1_BLK_REG_ADDR + 0x040)
+
+/**
+ * PPLB Block Register Address Offset from BAR0
+ * PPLB0 Range : 0x22000 - 0x223FF
+ * PPLB1 Range : 0x22400 - 0x227FF
+ */
+#define PLB0_BLK_REG_ADDR               0x00022000
+#define PLB1_BLK_REG_ADDR               0x00022400
+
+/**
+ * PLB Registers
+ * Holds RL timer used time stamps in RLT tagged frames
+ */
+#define PLB0_ECM_TIMER_REG              (PLB0_BLK_REG_ADDR + 0x05C)
+#define PLB1_ECM_TIMER_REG              (PLB1_BLK_REG_ADDR + 0x05C)
+
+/* Controls the rate-limiter on each of the priority class */
+#define PLB0_RL_CTL                     (PLB0_BLK_REG_ADDR + 0x060)
+#define PLB1_RL_CTL                     (PLB1_BLK_REG_ADDR + 0x060)
+
+/**
+ * Max byte register, total 8, 0-7
+ * see catapult_spec.pdf for details
+ */
+#define PLB0_RL_MAX_BC(_num)                    \
+        (PLB0_BLK_REG_ADDR + 0x064 + ((_num) << 2))
+#define PLB1_RL_MAX_BC(_num)                    \
+        (PLB1_BLK_REG_ADDR + 0x064 + ((_num) << 2))
+
+/**
+ * RL Time Unit Register for priority 0-7
+ * 4 bits per priority
+ * (2^rl_unit)*1us is the actual time period
+ */
+#define PLB0_RL_TU_PRIO                 (PLB0_BLK_REG_ADDR + 0x084)
+#define PLB1_RL_TU_PRIO                 (PLB1_BLK_REG_ADDR + 0x084)
+
+/**
+ * RL byte count register,
+ * bytes transmitted in (rl_unit*1)us time period
+ * 1 per priority, 8 in all, 0-7.
+ */
+#define PLB0_RL_BYTE_CNT(_num)                  \
+        (PLB0_BLK_REG_ADDR + 0x088 + ((_num) << 2))
+#define PLB1_RL_BYTE_CNT(_num)                  \
+        (PLB1_BLK_REG_ADDR + 0x088 + ((_num) << 2))
+
+/**
+ * RL Min factor register
+ * 2 bits per priority,
+ * 4 factors possible: 1, 0.5, 0.25, 0
+ * 2'b00 - 0; 2'b01 - 0.25; 2'b10 - 0.5; 2'b11 - 1
+ */
+#define PLB0_RL_MIN_REG                 (PLB0_BLK_REG_ADDR + 0x0A8)
+#define PLB1_RL_MIN_REG                 (PLB1_BLK_REG_ADDR + 0x0A8)
+
+/**
+ * RL Max factor register
+ * 2 bits per priority,
+ * 4 factors possible: 1, 0.5, 0.25, 0
+ * 2'b00 - 0; 2'b01 - 0.25; 2'b10 - 0.5; 2'b11 - 1
+ */
+#define PLB0_RL_MAX_REG                 (PLB0_BLK_REG_ADDR + 0x0AC)
+#define PLB1_RL_MAX_REG                 (PLB1_BLK_REG_ADDR + 0x0AC)
+
+/* MAC SERDES Address Paging register */
+#define PLB0_EMS_ADD_REG                (PLB0_BLK_REG_ADDR + 0xD0)
+#define PLB1_EMS_ADD_REG                (PLB1_BLK_REG_ADDR + 0xD0)
+
+/* LL EMS Registers */
+#define LL_EMS0_BLK_REG_ADDR            0x00026800
+#define LL_EMS1_BLK_REG_ADDR            0x00026C00
+
+/**
+ * BPC Block Register Address Offset from BAR0
+ * BPC0 Range : 0x23000 - 0x233FF
+ * BPC1 Range : 0x23400 - 0x237FF
+ */
+#define BPC0_BLK_REG_ADDR               0x00023000
+#define BPC1_BLK_REG_ADDR               0x00023400
+
+/**
+ * PMM Block Register Address Offset from BAR0
+ * PMM0 Range : 0x23800 - 0x23BFF
+ * PMM1 Range : 0x23C00 - 0x23FFF
+ */
+#define PMM0_BLK_REG_ADDR               0x00023800
+#define PMM1_BLK_REG_ADDR               0x00023C00
+
+/**
+ * HQM Block Register Address Offset from BAR0
+ * HQM0 Range : 0x24000 - 0x243FF
+ * HQM1 Range : 0x24400 - 0x247FF
+ */
+#define HQM0_BLK_REG_ADDR               0x00024000
+#define HQM1_BLK_REG_ADDR               0x00024400
+
+/**
+ * HQM Control Register
+ * Controls some aspects of IB
+ * See catapult_spec.pdf for details
+ */
+#define HQM0_CTL_REG                    (HQM0_BLK_REG_ADDR + 0x000)
+#define HQM1_CTL_REG                    (HQM1_BLK_REG_ADDR + 0x000)
+
+/**
+ * HQM Stop Q Semaphore Registers.
+ * Only one Queue resource can be stopped at
+ * any given time. This register controls access
+ * to the single stop Q resource.
+ * See catapult_spec.pdf for details
+ */
+#define HQM0_RXQ_STOP_SEM               (HQM0_BLK_REG_ADDR + 0x028)
+#define HQM0_TXQ_STOP_SEM               (HQM0_BLK_REG_ADDR + 0x02C)
+#define HQM1_RXQ_STOP_SEM               (HQM1_BLK_REG_ADDR + 0x028)
+#define HQM1_TXQ_STOP_SEM               (HQM1_BLK_REG_ADDR + 0x02C)
+
+/**
+ * LUT Block Register Address Offset from BAR0
+ * LUT0 Range : 0x25800 - 0x25BFF
+ * LUT1 Range : 0x25C00 - 0x25FFF
+ */
+#define LUT0_BLK_REG_ADDR               0x00025800
+#define LUT1_BLK_REG_ADDR               0x00025C00
+
+/**
+ * LUT Registers
+ * See catapult_spec.pdf for details
+ */
+#define LUT0_ERR_STS                    (LUT0_BLK_REG_ADDR + 0x000)
+#define LUT1_ERR_STS                    (LUT1_BLK_REG_ADDR + 0x000)
+#define LUT0_SET_ERR_STS                (LUT0_BLK_REG_ADDR + 0x004)
+#define LUT1_SET_ERR_STS                (LUT1_BLK_REG_ADDR + 0x004)
+
+/**
+ * TRC (Debug/Trace) Register Offset from BAR0
+ * Range : 0x26000 -- 0x263FFF
+ */
+#define TRC_BLK_REG_ADDR                0x00026000
+
+/**
+ * TRC Registers
+ * See catapult_spec.pdf for details of each
+ */
+#define TRC_CTL_REG                     (TRC_BLK_REG_ADDR + 0x000)
+#define TRC_MODS_REG                    (TRC_BLK_REG_ADDR + 0x004)
+#define TRC_TRGC_REG                    (TRC_BLK_REG_ADDR + 0x008)
+#define TRC_CNT1_REG                    (TRC_BLK_REG_ADDR + 0x010)
+#define TRC_CNT2_REG                    (TRC_BLK_REG_ADDR + 0x014)
+#define TRC_NXTS_REG                    (TRC_BLK_REG_ADDR + 0x018)
+#define TRC_DIRR_REG                    (TRC_BLK_REG_ADDR + 0x01C)
+
+/**
+ * TRC Trigger match filters, total 10
+ * Determines the trigger condition
+ */
+#define TRC_TRGM_REG(_num)              \
+        (TRC_BLK_REG_ADDR + 0x040 + ((_num) << 2))
+
+/**
+ * TRC Next State filters, total 10
+ * Determines the next state conditions
+ */
+#define TRC_NXTM_REG(_num)              \
+        (TRC_BLK_REG_ADDR + 0x080 + ((_num) << 2))
+
+/**
+ * TRC Store Match filters, total 10
+ * Determines the store conditions
+ */
+#define TRC_STRM_REG(_num)              \
+        (TRC_BLK_REG_ADDR + 0x0C0 + ((_num) << 2))
+
+/* DOORBELLS ACCESS */
+
+/**
+ * Catapult doorbells
+ * Each doorbell-queue set has
+ * 1 RxQ, 1 TxQ, 2 IBs in that order
+ * Size of each entry in 32 bytes, even though only 1 word
+ * is used. For Non-VM case each doorbell-q set is
+ * separated by 128 bytes, for VM case it is separated
+ * by 4K bytes
+ * Non VM case Range : 0x38000 - 0x39FFF
+ * VM case Range     : 0x100000 - 0x11FFFF
+ * The range applies to both HQMs
+ */
+#define HQM_DOORBELL_BLK_BASE_ADDR      0x00038000
+#define HQM_DOORBELL_VM_BLK_BASE_ADDR   0x00100000
+
+/* MEMORY ACCESS */
+
+/**
+ * Catapult H/W Block Memory Access Address
+ * To the host a memory space of 32K (page) is visible
+ * at a time. The address range is from 0x08000 to 0x0FFFF
+ */
+#define HW_BLK_HOST_MEM_ADDR            0x08000
+
+/**
+ * Catapult LUT Memory Access Page Numbers
+ * Range : LUT0 0xa0-0xa1
+ *         LUT1 0xa2-0xa3
+ */
+#define LUT0_MEM_BLK_BASE_PG_NUM        0x000000A0
+#define LUT1_MEM_BLK_BASE_PG_NUM        0x000000A2
+
+/**
+ * Catapult RxFn Database Memory Block Base Offset
+ *
+ * The Rx function database exists in LUT block.
+ * In PCIe space this is accessible as a 256x32
+ * bit block. Each entry in this database is 4
+ * (4 byte) words. Max. entries is 64.
+ * Address of an entry corresponding to a function
+ * = base_addr + (function_no. * 16)
+ */
+#define RX_FNDB_RAM_BASE_OFFSET         0x0000B400
+
+/**
+ * Catapult TxFn Database Memory Block Base Offset Address
+ *
+ * The Tx function database exists in LUT block.
+ * In PCIe space this is accessible as a 64x32
+ * bit block. Each entry in this database is 1
+ * (4 byte) word. Max. entries is 64.
+ * Address of an entry corresponding to a function
+ * = base_addr + (function_no. * 4)
+ */
+#define TX_FNDB_RAM_BASE_OFFSET         0x0000B800
+
+/**
+ * Catapult Unicast CAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Shared by both the LL & FCoE driver.
+ * Size is 256x48 bits; mapped to PCIe space
+ * 512x32 bit blocks. For each address, bits
+ * are written in the order : [47:32] and then
+ * [31:0].
+ */
+#define UCAST_CAM_BASE_OFFSET           0x0000A800
+
+/**
+ * Catapult Unicast RAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Shared by both the LL & FCoE driver.
+ * Size is 256x9 bits.
+ */
+#define UCAST_RAM_BASE_OFFSET           0x0000B000
+
+/**
+ * Catapult Mulicast CAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Shared by both the LL & FCoE driver.
+ * Size is 256x48 bits; mapped to PCIe space
+ * 512x32 bit blocks. For each address, bits
+ * are written in the order : [47:32] and then
+ * [31:0].
+ */
+#define MCAST_CAM_BASE_OFFSET           0x0000A000
+
+/**
+ * Catapult VLAN RAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Size is 4096x66 bits; mapped to PCIe space as
+ * 8192x32 bit blocks.
+ * All the 4K entries are within the address range
+ * 0x0000 to 0x8000, so in the first LUT page.
+ */
+#define VLAN_RAM_BASE_OFFSET            0x00000000
+
+/**
+ * Catapult Tx Stats RAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Size is 1024x33 bits;
+ * Each Tx function has 64 bytes of space
+ */
+#define TX_STATS_RAM_BASE_OFFSET        0x00009000
+
+/**
+ * Catapult Rx Stats RAM Base Offset Address
+ *
+ * Exists in LUT memory space.
+ * Size is 1024x33 bits;
+ * Each Rx function has 64 bytes of space
+ */
+#define RX_STATS_RAM_BASE_OFFSET        0x00008000
+
+/* Catapult RXA Memory Access Page Numbers */
+#define RXA0_MEM_BLK_BASE_PG_NUM        0x0000008C
+#define RXA1_MEM_BLK_BASE_PG_NUM        0x0000008D
+
+/**
+ * Catapult Multicast Vector Table Base Offset Address
+ *
+ * Exists in RxA memory space.
+ * Organized as 512x65 bit block.
+ * However for each entry 16 bytes allocated (power of 2)
+ * Total size 512*16 bytes.
+ * There are two logical divisions, 256 entries each :
+ * a) Entries 0x00 to 0xff (256) -- Approx. MVT
+ *    Offset 0x000 to 0xFFF
+ * b) Entries 0x100 to 0x1ff (256) -- Exact MVT
+ *    Offsets 0x1000 to 0x1FFF
+ */
+#define MCAST_APPROX_MVT_BASE_OFFSET    0x00000000
+#define MCAST_EXACT_MVT_BASE_OFFSET     0x00001000
+
+/**
+ * Catapult RxQ Translate Table (RIT) Base Offset Address
+ *
+ * Exists in RxA memory space
+ * Total no. of entries 64
+ * Each entry is 1 (4 byte) word.
+ * 31:12 -- Reserved
+ * 11:0  -- Two 6 bit RxQ Ids
+ */
+#define FUNCTION_TO_RXQ_TRANSLATE       0x00002000
+
+/* Catapult RxAdm (RAD) Memory Access Page Numbers */
+#define RAD0_MEM_BLK_BASE_PG_NUM        0x00000086
+#define RAD1_MEM_BLK_BASE_PG_NUM        0x00000087
+
+/**
+ * Catapult RSS Table Base Offset Address
+ *
+ * Exists in RAD memory space.
+ * Each entry is 352 bits, but alligned on
+ * 64 byte (512 bit) boundary. Accessed
+ * 4 byte words, the whole entry can be
+ * broken into 11 word accesses.
+ */
+#define RSS_TABLE_BASE_OFFSET           0x00000800
+
+/**
+ * Catapult CPQ Block Page Number
+ * This value is written to the page number registers
+ * to access the memory associated with the mailboxes.
+ */
+#define CPQ_BLK_PG_NUM                  0x00000005
+
+/**
+ * Clarification :
+ * LL functions are 2 & 3; can HostFn0/HostFn1
+ * <-> LPU0/LPU1 memories be used ?
+ */
+/**
+ * Catapult HostFn0/HostFn1 to LPU0/LPU1 Mbox memory
+ * Per catapult_spec.pdf, the offset of the mbox
+ * memory is in the register space at an offset of 0x200
+ */
+#define CPQ_BLK_REG_MBOX_ADDR           (CPQ_BLK_REG_ADDR + 0x200)
+
+#define HOSTFN_LPU_MBOX                 (CPQ_BLK_REG_MBOX_ADDR + 0x000)
+
+/* Catapult LPU0/LPU1 to HostFn0/HostFn1 Mbox memory */
+#define LPU_HOSTFN_MBOX                 (CPQ_BLK_REG_MBOX_ADDR + 0x080)
+
+/**
+ * Catapult HQM Block Page Number
+ * This is written to the page number register for
+ * the appropriate function to access the memory
+ * associated with HQM
+ */
+#define HQM0_BLK_PG_NUM                 0x00000096
+#define HQM1_BLK_PG_NUM                 0x00000097
+
+/**
+ * Note that TxQ and RxQ entries are interlaced
+ * the HQM memory, i.e RXQ0, TXQ0, RXQ1, TXQ1.. etc.
+ */
+
+#define HQM_RXTX_Q_RAM_BASE_OFFSET      0x00004000
+
+/**
+ * CQ Memory
+ * Exists in HQM Memory space
+ * Each entry is 16 (4 byte) words of which
+ * only 12 words are used for configuration
+ * Total 64 entries per HQM memory space
+ */
+#define HQM_CQ_RAM_BASE_OFFSET          0x00006000
+
+/**
+ * Interrupt Block (IB) Memory
+ * Exists in HQM Memory space
+ * Each entry is 8 (4 byte) words of which
+ * only 5 words are used for configuration
+ * Total 128 entries per HQM memory space
+ */
+#define HQM_IB_RAM_BASE_OFFSET          0x00001000
+
+/**
+ * Index Table (IT) Memory
+ * Exists in HQM Memory space
+ * Each entry is 1 (4 byte) word which
+ * is used for configuration
+ * Total 128 entries per HQM memory space
+ */
+#define HQM_INDX_TBL_RAM_BASE_OFFSET    0x00002000
+
+/**
+ * PSS Block Memory Page Number
+ * This is written to the appropriate page number
+ * register to access the CPU memory.
+ * Also known as the PSS secondary memory (SMEM).
+ * Range : 0x180 to 0x1CF
+ * See catapult_spec.pdf for details
+ */
+#define PSS_BLK_PG_NUM                  0x00000180
+
+/**
+ * Offsets of different instances of PSS SMEM
+ * 2.5M of continuous 1T memory space : 2 blocks
+ * of 1M each (32 pages each, page=32KB) and 4 smaller
+ * blocks of 128K each (4 pages each, page=32KB)
+ * PSS_LMEM_INST0 is used for firmware download
+ */
+#define PSS_LMEM_INST0                  0x00000000
+#define PSS_LMEM_INST1                  0x00100000
+#define PSS_LMEM_INST2                  0x00200000
+#define PSS_LMEM_INST3                  0x00220000
+#define PSS_LMEM_INST4                  0x00240000
+#define PSS_LMEM_INST5                  0x00260000
+
+#define BNA_PCI_REG_CT_ADDRSZ           (0x40000)
+
+#define BNA_GET_PAGE_NUM(_base_page, _offset)   \
+        ((_base_page) + ((_offset) >> 15))
+
+#define BNA_GET_PAGE_OFFSET(_offset)    \
+        ((_offset) & 0x7fff)
+
+#define BNA_GET_MEM_BASE_ADDR(_bar0, _base_offset)      \
+        ((_bar0) + HW_BLK_HOST_MEM_ADDR         \
+          + BNA_GET_PAGE_OFFSET((_base_offset)))
+
+#define BNA_GET_VLAN_MEM_ENTRY_ADDR(_bar0, _fn_id, _vlan_id)\
+        (_bar0 + (HW_BLK_HOST_MEM_ADDR)  \
+        + (BNA_GET_PAGE_OFFSET(VLAN_RAM_BASE_OFFSET))   \
+        + (((_fn_id) & 0x3f) << 9)        \
+        + (((_vlan_id) & 0xfe0) >> 3))
+
+/**
+ *
+ *  Interrupt related bits, flags and macros
+ *
+ */
+
+#define __LPU02HOST_MBOX0_STATUS_BITS 0x00100000
+#define __LPU12HOST_MBOX0_STATUS_BITS 0x00200000
+#define __LPU02HOST_MBOX1_STATUS_BITS 0x00400000
+#define __LPU12HOST_MBOX1_STATUS_BITS 0x00800000
+
+#define __LPU02HOST_MBOX0_MASK_BITS     0x00100000
+#define __LPU12HOST_MBOX0_MASK_BITS     0x00200000
+#define __LPU02HOST_MBOX1_MASK_BITS     0x00400000
+#define __LPU12HOST_MBOX1_MASK_BITS     0x00800000
+
+#define __LPU2HOST_MBOX_MASK_BITS                        \
+        (__LPU02HOST_MBOX0_MASK_BITS | __LPU02HOST_MBOX1_MASK_BITS |    \
+          __LPU12HOST_MBOX0_MASK_BITS | __LPU12HOST_MBOX1_MASK_BITS)
+
+#define __LPU2HOST_IB_STATUS_BITS       0x0000ffff
+
+#define BNA_IS_LPU0_MBOX_INTR(_intr_status) \
+        ((_intr_status) & (__LPU02HOST_MBOX0_STATUS_BITS | \
+                        __LPU02HOST_MBOX1_STATUS_BITS))
+
+#define BNA_IS_LPU1_MBOX_INTR(_intr_status) \
+        ((_intr_status) & (__LPU12HOST_MBOX0_STATUS_BITS | \
+                __LPU12HOST_MBOX1_STATUS_BITS))
+
+#define BNA_IS_MBOX_INTR(_intr_status)          \
+        ((_intr_status) &                       \
+        (__LPU02HOST_MBOX0_STATUS_BITS |        \
+         __LPU02HOST_MBOX1_STATUS_BITS |        \
+         __LPU12HOST_MBOX0_STATUS_BITS |        \
+         __LPU12HOST_MBOX1_STATUS_BITS))
+
+#define __EMC_ERROR_STATUS_BITS         0x00010000
+#define __LPU0_ERROR_STATUS_BITS        0x00020000
+#define __LPU1_ERROR_STATUS_BITS        0x00040000
+#define __PSS_ERROR_STATUS_BITS         0x00080000
+
+#define __HALT_STATUS_BITS              0x01000000
+
+#define __EMC_ERROR_MASK_BITS           0x00010000
+#define __LPU0_ERROR_MASK_BITS          0x00020000
+#define __LPU1_ERROR_MASK_BITS          0x00040000
+#define __PSS_ERROR_MASK_BITS           0x00080000
+
+#define __HALT_MASK_BITS                0x01000000
+
+#define __ERROR_MASK_BITS               \
+        (__EMC_ERROR_MASK_BITS | __LPU0_ERROR_MASK_BITS | \
+          __LPU1_ERROR_MASK_BITS | __PSS_ERROR_MASK_BITS | \
+          __HALT_MASK_BITS)
+
+#define BNA_IS_ERR_INTR(_intr_status)   \
+        ((_intr_status) &               \
+        (__EMC_ERROR_STATUS_BITS |      \
+         __LPU0_ERROR_STATUS_BITS |     \
+         __LPU1_ERROR_STATUS_BITS |     \
+         __PSS_ERROR_STATUS_BITS  |     \
+         __HALT_STATUS_BITS))
+
+#define BNA_IS_MBOX_ERR_INTR(_intr_status)      \
+        (BNA_IS_MBOX_INTR((_intr_status)) |     \
+         BNA_IS_ERR_INTR((_intr_status)))
+
+#define BNA_IS_INTX_DATA_INTR(_intr_status)     \
+        ((_intr_status) & __LPU2HOST_IB_STATUS_BITS)
+
+#define BNA_INTR_STATUS_MBOX_CLR(_intr_status)                  \
+do {                                                            \
+        (_intr_status) &= ~(__LPU02HOST_MBOX0_STATUS_BITS |     \
+                        __LPU02HOST_MBOX1_STATUS_BITS |         \
+                        __LPU12HOST_MBOX0_STATUS_BITS |         \
+                        __LPU12HOST_MBOX1_STATUS_BITS);         \
+} while (0)
+
+#define BNA_INTR_STATUS_ERR_CLR(_intr_status)           \
+do {                                                    \
+        (_intr_status) &= ~(__EMC_ERROR_STATUS_BITS |   \
+                __LPU0_ERROR_STATUS_BITS |              \
+                __LPU1_ERROR_STATUS_BITS |              \
+                __PSS_ERROR_STATUS_BITS  |              \
+                __HALT_STATUS_BITS);                    \
+} while (0)
+
+#define bna_intx_disable(_bna, _cur_mask)               \
+{                                                       \
+        (_cur_mask) = readl((_bna)->regs.fn_int_mask);\
+        writel(0xffffffff, (_bna)->regs.fn_int_mask);\
+}
+
+#define bna_intx_enable(bna, new_mask)                  \
+        writel((new_mask), (bna)->regs.fn_int_mask)
+
+#define bna_mbox_intr_disable(bna)              \
+        writel((readl((bna)->regs.fn_int_mask) | \
+             (__LPU2HOST_MBOX_MASK_BITS | __ERROR_MASK_BITS)), \
+             (bna)->regs.fn_int_mask)
+
+#define bna_mbox_intr_enable(bna)               \
+        writel((readl((bna)->regs.fn_int_mask) & \
+             ~(__LPU2HOST_MBOX_MASK_BITS | __ERROR_MASK_BITS)), \
+             (bna)->regs.fn_int_mask)
+
+#define bna_intr_status_get(_bna, _status)                              \
+{                                                                       \
+        (_status) = readl((_bna)->regs.fn_int_status);          \
+        if ((_status)) {                                                \
+                writel((_status) & ~(__LPU02HOST_MBOX0_STATUS_BITS |\
+                                          __LPU02HOST_MBOX1_STATUS_BITS |\
+                                          __LPU12HOST_MBOX0_STATUS_BITS |\
+                                          __LPU12HOST_MBOX1_STATUS_BITS), \
+                              (_bna)->regs.fn_int_status);\
+        }                                                               \
+}
+
+#define bna_intr_status_get_no_clr(_bna, _status)               \
+        (_status) = readl((_bna)->regs.fn_int_status)
+
+#define bna_intr_mask_get(bna, mask)            \
+        (*mask) = readl((bna)->regs.fn_int_mask)
+
+#define bna_intr_ack(bna, intr_bmap)            \
+        writel((intr_bmap), (bna)->regs.fn_int_status)
+
+#define bna_ib_intx_disable(bna, ib_id)         \
+        writel(readl((bna)->regs.fn_int_mask) | \
+            (1 << (ib_id)), \
+            (bna)->regs.fn_int_mask)
+
+#define bna_ib_intx_enable(bna, ib_id)          \
+        writel(readl((bna)->regs.fn_int_mask) & \
+            ~(1 << (ib_id)), \
+            (bna)->regs.fn_int_mask)
+
+#define bna_mbox_msix_idx_set(_device) \
+do {\
+        writel(((_device)->vector & 0x000001FF), \
+                (_device)->bna->pcidev.pci_bar_kva + \
+                reg_offset[(_device)->bna->pcidev.pci_func].msix_idx);\
+} while (0)
+
+/**
+ *
+ * TxQ, RxQ, CQ related bits, offsets, macros
+ *
+ */
+
+#define BNA_Q_IDLE_STATE        0x00008001
+
+#define BNA_GET_DOORBELL_BASE_ADDR(_bar0)       \
+        ((_bar0) + HQM_DOORBELL_BLK_BASE_ADDR)
+
+#define BNA_GET_DOORBELL_ENTRY_OFFSET(_entry)           \
+        ((HQM_DOORBELL_BLK_BASE_ADDR)           \
+        + (_entry << 7))
+
+#define BNA_DOORBELL_IB_INT_ACK(_timeout, _events) \
+                (0x80000000 | ((_timeout) << 16) | (_events))
+
+#define BNA_DOORBELL_IB_INT_DISABLE             (0x40000000)
+
+/* TxQ Entry Opcodes */
+#define BNA_TXQ_WI_SEND                 (0x402) /* Single Frame Transmission */
+#define BNA_TXQ_WI_SEND_LSO             (0x403) /* Multi-Frame Transmission */
+#define BNA_TXQ_WI_EXTENSION            (0x104) /* Extension WI */
+
+/* TxQ Entry Control Flags */
+#define BNA_TXQ_WI_CF_FCOE_CRC          (1 << 8)
+#define BNA_TXQ_WI_CF_IPID_MODE         (1 << 5)
+#define BNA_TXQ_WI_CF_INS_PRIO          (1 << 4)
+#define BNA_TXQ_WI_CF_INS_VLAN          (1 << 3)
+#define BNA_TXQ_WI_CF_UDP_CKSUM         (1 << 2)
+#define BNA_TXQ_WI_CF_TCP_CKSUM         (1 << 1)
+#define BNA_TXQ_WI_CF_IP_CKSUM          (1 << 0)
+
+#define BNA_TXQ_WI_L4_HDR_N_OFFSET(_hdr_size, _offset) \
+                (((_hdr_size) << 10) | ((_offset) & 0x3FF))
+
+/*
+ * Completion Q defines
+ */
+/* CQ Entry Flags */
+#define BNA_CQ_EF_MAC_ERROR     (1 <<  0)
+#define BNA_CQ_EF_FCS_ERROR     (1 <<  1)
+#define BNA_CQ_EF_TOO_LONG      (1 <<  2)
+#define BNA_CQ_EF_FC_CRC_OK     (1 <<  3)
+
+#define BNA_CQ_EF_RSVD1         (1 <<  4)
+#define BNA_CQ_EF_L4_CKSUM_OK   (1 <<  5)
+#define BNA_CQ_EF_L3_CKSUM_OK   (1 <<  6)
+#define BNA_CQ_EF_HDS_HEADER    (1 <<  7)
+
+#define BNA_CQ_EF_UDP           (1 <<  8)
+#define BNA_CQ_EF_TCP           (1 <<  9)
+#define BNA_CQ_EF_IP_OPTIONS    (1 << 10)
+#define BNA_CQ_EF_IPV6          (1 << 11)
+
+#define BNA_CQ_EF_IPV4          (1 << 12)
+#define BNA_CQ_EF_VLAN          (1 << 13)
+#define BNA_CQ_EF_RSS           (1 << 14)
+#define BNA_CQ_EF_RSVD2         (1 << 15)
+
+#define BNA_CQ_EF_MCAST_MATCH   (1 << 16)
+#define BNA_CQ_EF_MCAST         (1 << 17)
+#define BNA_CQ_EF_BCAST         (1 << 18)
+#define BNA_CQ_EF_REMOTE        (1 << 19)
+
+#define BNA_CQ_EF_LOCAL         (1 << 20)
+
+/**
+ *
+ * Data structures
+ *
+ */
+
+enum txf_flags {
+        BFI_TXF_CF_ENABLE               = 1 << 0,
+        BFI_TXF_CF_VLAN_FILTER          = 1 << 8,
+        BFI_TXF_CF_VLAN_ADMIT           = 1 << 9,
+        BFI_TXF_CF_VLAN_INSERT          = 1 << 10,
+        BFI_TXF_CF_RSVD1                = 1 << 11,
+        BFI_TXF_CF_MAC_SA_CHECK         = 1 << 12,
+        BFI_TXF_CF_VLAN_WI_BASED        = 1 << 13,
+        BFI_TXF_CF_VSWITCH_MCAST        = 1 << 14,
+        BFI_TXF_CF_VSWITCH_UCAST        = 1 << 15,
+        BFI_TXF_CF_RSVD2                = 0x7F << 1
+};
+
+enum ib_flags {
+        BFI_IB_CF_MASTER_ENABLE         = (1 << 0),
+        BFI_IB_CF_MSIX_MODE             = (1 << 1),
+        BFI_IB_CF_COALESCING_MODE       = (1 << 2),
+        BFI_IB_CF_INTER_PKT_ENABLE      = (1 << 3),
+        BFI_IB_CF_INT_ENABLE            = (1 << 4),
+        BFI_IB_CF_INTER_PKT_DMA         = (1 << 5),
+        BFI_IB_CF_ACK_PENDING           = (1 << 6),
+        BFI_IB_CF_RESERVED1             = (1 << 7)
+};
+
+enum rss_hash_type {
+        BFI_RSS_T_V4_TCP                = (1 << 11),
+        BFI_RSS_T_V4_IP                 = (1 << 10),
+        BFI_RSS_T_V6_TCP                = (1 <<  9),
+        BFI_RSS_T_V6_IP                 = (1 <<  8)
+};
+enum hds_header_type {
+        BNA_HDS_T_V4_TCP        = (1 << 11),
+        BNA_HDS_T_V4_UDP        = (1 << 10),
+        BNA_HDS_T_V6_TCP        = (1 << 9),
+        BNA_HDS_T_V6_UDP        = (1 << 8),
+        BNA_HDS_FORCED          = (1 << 7),
+};
+enum rxf_flags {
+        BNA_RXF_CF_SM_LG_RXQ                    = (1 << 15),
+        BNA_RXF_CF_DEFAULT_VLAN                 = (1 << 14),
+        BNA_RXF_CF_DEFAULT_FUNCTION_ENABLE      = (1 << 13),
+        BNA_RXF_CF_VLAN_STRIP                   = (1 << 12),
+        BNA_RXF_CF_RSS_ENABLE                   = (1 <<  8)
+};
+struct bna_chip_regs_offset {
+        u32 page_addr;
+        u32 fn_int_status;
+        u32 fn_int_mask;
+        u32 msix_idx;
+};
+extern const struct bna_chip_regs_offset reg_offset[];
+
+struct bna_chip_regs {
+        void __iomem *page_addr;
+        void __iomem *fn_int_status;
+        void __iomem *fn_int_mask;
+};
+
+struct bna_txq_mem {
+        u32 pg_tbl_addr_lo;
+        u32 pg_tbl_addr_hi;
+        u32 cur_q_entry_lo;
+        u32 cur_q_entry_hi;
+        u32 reserved1;
+        u32 reserved2;
+        u32 pg_cnt_n_prd_ptr;   /* 31:16->total page count */
+                                        /* 15:0 ->producer pointer (index?) */
+        u32 entry_n_pg_size;    /* 31:16->entry size */
+                                        /* 15:0 ->page size */
+        u32 int_blk_n_cns_ptr;  /* 31:24->Int Blk Id;  */
+                                        /* 23:16->Int Blk Offset */
+                                        /* 15:0 ->consumer pointer(index?) */
+        u32 cns_ptr2_n_q_state; /* 31:16->cons. ptr 2; 15:0-> Q state */
+        u32 nxt_qid_n_fid_n_pri;        /* 17:10->next */
+                                        /* QId;9:3->FID;2:0->Priority */
+        u32 wvc_n_cquota_n_rquota; /* 31:24->WI Vector Count; */
+                                        /* 23:12->Cfg Quota; */
+                                        /* 11:0 ->Run Quota */
+        u32 reserved3[4];
+};
+
+struct bna_rxq_mem {
+        u32 pg_tbl_addr_lo;
+        u32 pg_tbl_addr_hi;
+        u32 cur_q_entry_lo;
+        u32 cur_q_entry_hi;
+        u32 reserved1;
+        u32 reserved2;
+        u32 pg_cnt_n_prd_ptr;   /* 31:16->total page count */
+                                        /* 15:0 ->producer pointer (index?) */
+        u32 entry_n_pg_size;    /* 31:16->entry size */
+                                        /* 15:0 ->page size */
+        u32 sg_n_cq_n_cns_ptr;  /* 31:28->reserved; 27:24->sg count */
+                                        /* 23:16->CQ; */
+                                        /* 15:0->consumer pointer(index?) */
+        u32 buf_sz_n_q_state;   /* 31:16->buffer size; 15:0-> Q state */
+        u32 next_qid;           /* 17:10->next QId */
+        u32 reserved3;
+        u32 reserved4[4];
+};
+
+struct bna_rxtx_q_mem {
+        struct bna_rxq_mem rxq;
+        struct bna_txq_mem txq;
+};
+
+struct bna_cq_mem {
+        u32 pg_tbl_addr_lo;
+        u32 pg_tbl_addr_hi;
+        u32 cur_q_entry_lo;
+        u32 cur_q_entry_hi;
+
+        u32 reserved1;
+        u32 reserved2;
+        u32 pg_cnt_n_prd_ptr;   /* 31:16->total page count */
+                                        /* 15:0 ->producer pointer (index?) */
+        u32 entry_n_pg_size;    /* 31:16->entry size */
+                                        /* 15:0 ->page size */
+        u32 int_blk_n_cns_ptr;  /* 31:24->Int Blk Id; */
+                                        /* 23:16->Int Blk Offset */
+                                        /* 15:0 ->consumer pointer(index?) */
+        u32 q_state;            /* 31:16->reserved; 15:0-> Q state */
+        u32 reserved3[2];
+        u32 reserved4[4];
+};
+
+struct bna_ib_blk_mem {
+        u32 host_addr_lo;
+        u32 host_addr_hi;
+        u32 clsc_n_ctrl_n_msix; /* 31:24->coalescing; */
+                                        /* 23:16->coalescing cfg; */
+                                        /* 15:8 ->control; */
+                                        /* 7:0 ->msix; */
+        u32 ipkt_n_ent_n_idxof;
+        u32 ipkt_cnt_cfg_n_unacked;
+
+        u32 reserved[3];
+};
+
+struct bna_idx_tbl_mem {
+        u32 idx;          /* !< 31:16->res;15:0->idx; */
+};
+
+struct bna_doorbell_qset {
+        u32 rxq[0x20 >> 2];
+        u32 txq[0x20 >> 2];
+        u32 ib0[0x20 >> 2];
+        u32 ib1[0x20 >> 2];
+};
+
+struct bna_rx_fndb_ram {
+        u32 rss_prop;
+        u32 size_routing_props;
+        u32 rit_hds_mcastq;
+        u32 control_flags;
+};
+
+struct bna_tx_fndb_ram {
+        u32 vlan_n_ctrl_flags;
+};
+
+/**
+ * @brief
+ *  Structure which maps to RxFn Indirection Table (RIT)
+ *  Size : 1 word
+ *  See catapult_spec.pdf, RxA for details
+ */
+struct bna_rit_mem {
+        u32 rxq_ids;    /* !< 31:12->res;11:0->two 6 bit RxQ Ids */
+};
+
+/**
+ * @brief
+ *  Structure which maps to RSS Table entry
+ *  Size : 16 words
+ *  See catapult_spec.pdf, RAD for details
+ */
+struct bna_rss_mem {
+        /*
+         * 31:12-> res
+         * 11:8 -> protocol type
+         *  7:0 -> hash index
+         */
+        u32 type_n_hash;
+        u32 hash_key[10];  /* !< 40 byte Toeplitz hash key */
+        u32 reserved[5];
+};
+
+/* TxQ Vector (a.k.a. Tx-Buffer Descriptor) */
+struct bna_dma_addr {
+        u32             msb;
+        u32             lsb;
+};
+
+struct bna_txq_wi_vector {
+        u16             reserved;
+        u16             length;         /* Only 14 LSB are valid */
+        struct bna_dma_addr host_addr; /* Tx-Buf DMA addr */
+};
+
+typedef u16 bna_txq_wi_opcode_t;
+
+typedef u16 bna_txq_wi_ctrl_flag_t;
+
+/**
+ *  TxQ Entry Structure
+ *
+ *  BEWARE:  Load values into this structure with correct endianess.
+ */
+struct bna_txq_entry {
+        union {
+                struct {
+                        u8 reserved;
+                        u8 num_vectors; /* number of vectors present */
+                        bna_txq_wi_opcode_t opcode; /* Either */
+                                                    /* BNA_TXQ_WI_SEND or */
+                                                    /* BNA_TXQ_WI_SEND_LSO */
+                        bna_txq_wi_ctrl_flag_t flags; /* OR of all the flags */
+                        u16 l4_hdr_size_n_offset;
+                        u16 vlan_tag;
+                        u16 lso_mss;    /* Only 14 LSB are valid */
+                        u32 frame_length;       /* Only 24 LSB are valid */
+                } wi;
+
+                struct {
+                        u16 reserved;
+                        bna_txq_wi_opcode_t opcode; /* Must be */
+                                                    /* BNA_TXQ_WI_EXTENSION */
+                        u32 reserved2[3];       /* Place holder for */
+                                                /* removed vector (12 bytes) */
+                } wi_ext;
+        } hdr;
+        struct bna_txq_wi_vector vector[4];
+};
+#define wi_hdr          hdr.wi
+#define wi_ext_hdr  hdr.wi_ext
+
+/* RxQ Entry Structure */
+struct bna_rxq_entry {          /* Rx-Buffer */
+        struct bna_dma_addr host_addr; /* Rx-Buffer DMA address */
+};
+
+typedef u32 bna_cq_e_flag_t;
+
+/* CQ Entry Structure */
+struct bna_cq_entry {
+        bna_cq_e_flag_t flags;
+        u16 vlan_tag;
+        u16 length;
+        u32 rss_hash;
+        u8 valid;
+        u8 reserved1;
+        u8 reserved2;
+        u8 rxq_id;
+};
+
+#endif /* __BNA_HW_H__ */
diff --git a/drivers/net/bna/bna_txrx.c b/drivers/net/bna/bna_txrx.c
new file mode 100644
index 000000000000..890846d55502
--- /dev/null
+++ b/drivers/net/bna/bna_txrx.c
@@ -0,0 +1,4209 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+  */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#include "bna.h"
+#include "bfa_sm.h"
+#include "bfi.h"
+
+/**
+ * IB
+ */
+#define bna_ib_find_free_ibidx(_mask, _pos)\
+do {\
+        (_pos) = 0;\
+        while (((_pos) < (BFI_IBIDX_MAX_SEGSIZE)) &&\
+                ((1 << (_pos)) & (_mask)))\
+                (_pos)++;\
+} while (0)
+
+#define bna_ib_count_ibidx(_mask, _count)\
+do {\
+        int pos = 0;\
+        (_count) = 0;\
+        while (pos < (BFI_IBIDX_MAX_SEGSIZE)) {\
+                if ((1 << pos) & (_mask))\
+                        (_count) = pos + 1;\
+                pos++;\
+        } \
+} while (0)
+
+#define bna_ib_select_segpool(_count, _q_idx)\
+do {\
+        int i;\
+        (_q_idx) = -1;\
+        for (i = 0; i < BFI_IBIDX_TOTAL_POOLS; i++) {\
+                if ((_count <= ibidx_pool[i].pool_entry_size)) {\
+                        (_q_idx) = i;\
+                        break;\
+                } \
+        } \
+} while (0)
+
+struct bna_ibidx_pool {
+        int     pool_size;
+        int     pool_entry_size;
+};
+init_ibidx_pool(ibidx_pool);
+
+static struct bna_intr *
+bna_intr_get(struct bna_ib_mod *ib_mod, enum bna_intr_type intr_type,
+                int vector)
+{
+        struct bna_intr *intr;
+        struct list_head *qe;
+
+        list_for_each(qe, &ib_mod->intr_active_q) {
+                intr = (struct bna_intr *)qe;
+
+                if ((intr->intr_type == intr_type) &&
+                        (intr->vector == vector)) {
+                        intr->ref_count++;
+                        return intr;
+                }
+        }
+
+        if (list_empty(&ib_mod->intr_free_q))
+                return NULL;
+
+        bfa_q_deq(&ib_mod->intr_free_q, &intr);
+        bfa_q_qe_init(&intr->qe);
+
+        intr->ref_count = 1;
+        intr->intr_type = intr_type;
+        intr->vector = vector;
+
+        list_add_tail(&intr->qe, &ib_mod->intr_active_q);
+
+        return intr;
+}
+
+static void
+bna_intr_put(struct bna_ib_mod *ib_mod,
+                struct bna_intr *intr)
+{
+        intr->ref_count--;
+
+        if (intr->ref_count == 0) {
+                intr->ib = NULL;
+                list_del(&intr->qe);
+                bfa_q_qe_init(&intr->qe);
+                list_add_tail(&intr->qe, &ib_mod->intr_free_q);
+        }
+}
+
+void
+bna_ib_mod_init(struct bna_ib_mod *ib_mod, struct bna *bna,
+                struct bna_res_info *res_info)
+{
+        int i;
+        int j;
+        int count;
+        u8 offset;
+        struct bna_doorbell_qset *qset;
+        unsigned long off;
+
+        ib_mod->bna = bna;
+
+        ib_mod->ib = (struct bna_ib *)
+                res_info[BNA_RES_MEM_T_IB_ARRAY].res_u.mem_info.mdl[0].kva;
+        ib_mod->intr = (struct bna_intr *)
+                res_info[BNA_RES_MEM_T_INTR_ARRAY].res_u.mem_info.mdl[0].kva;
+        ib_mod->idx_seg = (struct bna_ibidx_seg *)
+                res_info[BNA_RES_MEM_T_IDXSEG_ARRAY].res_u.mem_info.mdl[0].kva;
+
+        INIT_LIST_HEAD(&ib_mod->ib_free_q);
+        INIT_LIST_HEAD(&ib_mod->intr_free_q);
+        INIT_LIST_HEAD(&ib_mod->intr_active_q);
+
+        for (i = 0; i < BFI_IBIDX_TOTAL_POOLS; i++)
+                INIT_LIST_HEAD(&ib_mod->ibidx_seg_pool[i]);
+
+        for (i = 0; i < BFI_MAX_IB; i++) {
+                ib_mod->ib[i].ib_id = i;
+
+                ib_mod->ib[i].ib_seg_host_addr_kva =
+                res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.mdl[i].kva;
+                ib_mod->ib[i].ib_seg_host_addr.lsb =
+                res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.mdl[i].dma.lsb;
+                ib_mod->ib[i].ib_seg_host_addr.msb =
+                res_info[BNA_RES_MEM_T_IBIDX].res_u.mem_info.mdl[i].dma.msb;
+
+                qset = (struct bna_doorbell_qset *)0;
+                off = (unsigned long)(&qset[i >> 1].ib0[(i & 0x1)
+                                        * (0x20 >> 2)]);
+                ib_mod->ib[i].door_bell.doorbell_addr = off +
+                        BNA_GET_DOORBELL_BASE_ADDR(bna->pcidev.pci_bar_kva);
+
+                bfa_q_qe_init(&ib_mod->ib[i].qe);
+                list_add_tail(&ib_mod->ib[i].qe, &ib_mod->ib_free_q);
+
+                bfa_q_qe_init(&ib_mod->intr[i].qe);
+                list_add_tail(&ib_mod->intr[i].qe, &ib_mod->intr_free_q);
+        }
+
+        count = 0;
+        offset = 0;
+        for (i = 0; i < BFI_IBIDX_TOTAL_POOLS; i++) {
+                for (j = 0; j < ibidx_pool[i].pool_size; j++) {
+                        bfa_q_qe_init(&ib_mod->idx_seg[count]);
+                        ib_mod->idx_seg[count].ib_seg_size =
+                                        ibidx_pool[i].pool_entry_size;
+                        ib_mod->idx_seg[count].ib_idx_tbl_offset = offset;
+                        list_add_tail(&ib_mod->idx_seg[count].qe,
+                                &ib_mod->ibidx_seg_pool[i]);
+                        count++;
+                        offset += ibidx_pool[i].pool_entry_size;
+                }
+        }
+}
+
+void
+bna_ib_mod_uninit(struct bna_ib_mod *ib_mod)
+{
+        int i;
+        int j;
+        struct list_head *qe;
+
+        i = 0;
+        list_for_each(qe, &ib_mod->ib_free_q)
+                i++;
+
+        i = 0;
+        list_for_each(qe, &ib_mod->intr_free_q)
+                i++;
+
+        for (i = 0; i < BFI_IBIDX_TOTAL_POOLS; i++) {
+                j = 0;
+                list_for_each(qe, &ib_mod->ibidx_seg_pool[i])
+                        j++;
+        }
+
+        ib_mod->bna = NULL;
+}
+
+struct bna_ib *
+bna_ib_get(struct bna_ib_mod *ib_mod,
+                enum bna_intr_type intr_type,
+                int vector)
+{
+        struct bna_ib *ib;
+        struct bna_intr *intr;
+
+        if (intr_type == BNA_INTR_T_INTX)
+                vector = (1 << vector);
+
+        intr = bna_intr_get(ib_mod, intr_type, vector);
+        if (intr == NULL)
+                return NULL;
+
+        if (intr->ib) {
+                if (intr->ib->ref_count == BFI_IBIDX_MAX_SEGSIZE) {
+                        bna_intr_put(ib_mod, intr);
+                        return NULL;
+                }
+                intr->ib->ref_count++;
+                return intr->ib;
+        }
+
+        if (list_empty(&ib_mod->ib_free_q)) {
+                bna_intr_put(ib_mod, intr);
+                return NULL;
+        }
+
+        bfa_q_deq(&ib_mod->ib_free_q, &ib);
+        bfa_q_qe_init(&ib->qe);
+
+        ib->ref_count = 1;
+        ib->start_count = 0;
+        ib->idx_mask = 0;
+
+        ib->intr = intr;
+        ib->idx_seg = NULL;
+        intr->ib = ib;
+
+        ib->bna = ib_mod->bna;
+
+        return ib;
+}
+
+void
+bna_ib_put(struct bna_ib_mod *ib_mod, struct bna_ib *ib)
+{
+        bna_intr_put(ib_mod, ib->intr);
+
+        ib->ref_count--;
+
+        if (ib->ref_count == 0) {
+                ib->intr = NULL;
+                ib->bna = NULL;
+                list_add_tail(&ib->qe, &ib_mod->ib_free_q);
+        }
+}
+
+/* Returns index offset - starting from 0 */
+int
+bna_ib_reserve_idx(struct bna_ib *ib)
+{
+        struct bna_ib_mod *ib_mod = &ib->bna->ib_mod;
+        struct bna_ibidx_seg *idx_seg;
+        int idx;
+        int num_idx;
+        int q_idx;
+
+        /* Find the first free index position */
+        bna_ib_find_free_ibidx(ib->idx_mask, idx);
+        if (idx == BFI_IBIDX_MAX_SEGSIZE)
+                return -1;
+
+        /*
+         * Calculate the total number of indexes held by this IB,
+         * including the index newly reserved above.
+         */
+        bna_ib_count_ibidx((ib->idx_mask | (1 << idx)), num_idx);
+
+        /* See if there is a free space in the index segment held by this IB */
+        if (ib->idx_seg && (num_idx <= ib->idx_seg->ib_seg_size)) {
+                ib->idx_mask |= (1 << idx);
+                return idx;
+        }
+
+        if (ib->start_count)
+                return -1;
+
+        /* Allocate a new segment */
+        bna_ib_select_segpool(num_idx, q_idx);
+        while (1) {
+                if (q_idx == BFI_IBIDX_TOTAL_POOLS)
+                        return -1;
+                if (!list_empty(&ib_mod->ibidx_seg_pool[q_idx]))
+                        break;
+                q_idx++;
+        }
+        bfa_q_deq(&ib_mod->ibidx_seg_pool[q_idx], &idx_seg);
+        bfa_q_qe_init(&idx_seg->qe);
+
+        /* Free the old segment */
+        if (ib->idx_seg) {
+                bna_ib_select_segpool(ib->idx_seg->ib_seg_size, q_idx);
+                list_add_tail(&ib->idx_seg->qe, &ib_mod->ibidx_seg_pool[q_idx]);
+        }
+
+        ib->idx_seg = idx_seg;
+
+        ib->idx_mask |= (1 << idx);
+
+        return idx;
+}
+
+void
+bna_ib_release_idx(struct bna_ib *ib, int idx)
+{
+        struct bna_ib_mod *ib_mod = &ib->bna->ib_mod;
+        struct bna_ibidx_seg *idx_seg;
+        int num_idx;
+        int cur_q_idx;
+        int new_q_idx;
+
+        ib->idx_mask &= ~(1 << idx);
+
+        if (ib->start_count)
+                return;
+
+        bna_ib_count_ibidx(ib->idx_mask, num_idx);
+
+        /*
+         * Free the segment, if there are no more indexes in the segment
+         * held by this IB
+         */
+        if (!num_idx) {
+                bna_ib_select_segpool(ib->idx_seg->ib_seg_size, cur_q_idx);
+                list_add_tail(&ib->idx_seg->qe,
+                        &ib_mod->ibidx_seg_pool[cur_q_idx]);
+                ib->idx_seg = NULL;
+                return;
+        }
+
+        /* See if we can move to a smaller segment */
+        bna_ib_select_segpool(num_idx, new_q_idx);
+        bna_ib_select_segpool(ib->idx_seg->ib_seg_size, cur_q_idx);
+        while (new_q_idx < cur_q_idx) {
+                if (!list_empty(&ib_mod->ibidx_seg_pool[new_q_idx]))
+                        break;
+                new_q_idx++;
+        }
+        if (new_q_idx < cur_q_idx) {
+                /* Select the new smaller segment */
+                bfa_q_deq(&ib_mod->ibidx_seg_pool[new_q_idx], &idx_seg);
+                bfa_q_qe_init(&idx_seg->qe);
+                /* Free the old segment */
+                list_add_tail(&ib->idx_seg->qe,
+                        &ib_mod->ibidx_seg_pool[cur_q_idx]);
+                ib->idx_seg = idx_seg;
+        }
+}
+
+int
+bna_ib_config(struct bna_ib *ib, struct bna_ib_config *ib_config)
+{
+        if (ib->start_count)
+                return -1;
+
+        ib->ib_config.coalescing_timeo = ib_config->coalescing_timeo;
+        ib->ib_config.interpkt_timeo = ib_config->interpkt_timeo;
+        ib->ib_config.interpkt_count = ib_config->interpkt_count;
+        ib->ib_config.ctrl_flags = ib_config->ctrl_flags;
+
+        ib->ib_config.ctrl_flags |= BFI_IB_CF_MASTER_ENABLE;
+        if (ib->intr->intr_type == BNA_INTR_T_MSIX)
+                ib->ib_config.ctrl_flags |= BFI_IB_CF_MSIX_MODE;
+
+        return 0;
+}
+
+void
+bna_ib_start(struct bna_ib *ib)
+{
+        struct bna_ib_blk_mem ib_cfg;
+        struct bna_ib_blk_mem *ib_mem;
+        u32 pg_num;
+        u32 intx_mask;
+        int i;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        ib->start_count++;
+
+        if (ib->start_count > 1)
+                return;
+
+        ib_cfg.host_addr_lo = (u32)(ib->ib_seg_host_addr.lsb);
+        ib_cfg.host_addr_hi = (u32)(ib->ib_seg_host_addr.msb);
+
+        ib_cfg.clsc_n_ctrl_n_msix = (((u32)
+                                     ib->ib_config.coalescing_timeo << 16) |
+                                ((u32)ib->ib_config.ctrl_flags << 8) |
+                                (ib->intr->vector));
+        ib_cfg.ipkt_n_ent_n_idxof =
+                                ((u32)
+                                 (ib->ib_config.interpkt_timeo & 0xf) << 16) |
+                                ((u32)ib->idx_seg->ib_seg_size << 8) |
+                                (ib->idx_seg->ib_idx_tbl_offset);
+        ib_cfg.ipkt_cnt_cfg_n_unacked = ((u32)
+                                         ib->ib_config.interpkt_count << 24);
+
+        pg_num = BNA_GET_PAGE_NUM(HQM0_BLK_PG_NUM + ib->bna->port_num,
+                                HQM_IB_RAM_BASE_OFFSET);
+        writel(pg_num, ib->bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(ib->bna->pcidev.pci_bar_kva,
+                                        HQM_IB_RAM_BASE_OFFSET);
+
+        ib_mem = (struct bna_ib_blk_mem *)0;
+        off = (unsigned long)&ib_mem[ib->ib_id].host_addr_lo;
+        writel(htonl(ib_cfg.host_addr_lo), base_addr + off);
+
+        off = (unsigned long)&ib_mem[ib->ib_id].host_addr_hi;
+        writel(htonl(ib_cfg.host_addr_hi), base_addr + off);
+
+        off = (unsigned long)&ib_mem[ib->ib_id].clsc_n_ctrl_n_msix;
+        writel(ib_cfg.clsc_n_ctrl_n_msix, base_addr + off);
+
+        off = (unsigned long)&ib_mem[ib->ib_id].ipkt_n_ent_n_idxof;
+        writel(ib_cfg.ipkt_n_ent_n_idxof, base_addr + off);
+
+        off = (unsigned long)&ib_mem[ib->ib_id].ipkt_cnt_cfg_n_unacked;
+        writel(ib_cfg.ipkt_cnt_cfg_n_unacked, base_addr + off);
+
+        ib->door_bell.doorbell_ack = BNA_DOORBELL_IB_INT_ACK(
+                                (u32)ib->ib_config.coalescing_timeo, 0);
+
+        pg_num = BNA_GET_PAGE_NUM(HQM0_BLK_PG_NUM + ib->bna->port_num,
+                                HQM_INDX_TBL_RAM_BASE_OFFSET);
+        writel(pg_num, ib->bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(ib->bna->pcidev.pci_bar_kva,
+                                        HQM_INDX_TBL_RAM_BASE_OFFSET);
+        for (i = 0; i < ib->idx_seg->ib_seg_size; i++) {
+                off = (unsigned long)
+                ((ib->idx_seg->ib_idx_tbl_offset + i) * BFI_IBIDX_SIZE);
+                writel(0, base_addr + off);
+        }
+
+        if (ib->intr->intr_type == BNA_INTR_T_INTX) {
+                bna_intx_disable(ib->bna, intx_mask);
+                intx_mask &= ~(ib->intr->vector);
+                bna_intx_enable(ib->bna, intx_mask);
+        }
+}
+
+void
+bna_ib_stop(struct bna_ib *ib)
+{
+        u32 intx_mask;
+
+        ib->start_count--;
+
+        if (ib->start_count == 0) {
+                writel(BNA_DOORBELL_IB_INT_DISABLE,
+                                ib->door_bell.doorbell_addr);
+                if (ib->intr->intr_type == BNA_INTR_T_INTX) {
+                        bna_intx_disable(ib->bna, intx_mask);
+                        intx_mask |= (ib->intr->vector);
+                        bna_intx_enable(ib->bna, intx_mask);
+                }
+        }
+}
+
+void
+bna_ib_fail(struct bna_ib *ib)
+{
+        ib->start_count = 0;
+}
+
+/**
+ * RXF
+ */
+static void rxf_enable(struct bna_rxf *rxf);
+static void rxf_disable(struct bna_rxf *rxf);
+static void __rxf_config_set(struct bna_rxf *rxf);
+static void __rxf_rit_set(struct bna_rxf *rxf);
+static void __bna_rxf_stat_clr(struct bna_rxf *rxf);
+static int rxf_process_packet_filter(struct bna_rxf *rxf);
+static int rxf_clear_packet_filter(struct bna_rxf *rxf);
+static void rxf_reset_packet_filter(struct bna_rxf *rxf);
+static void rxf_cb_enabled(void *arg, int status);
+static void rxf_cb_disabled(void *arg, int status);
+static void bna_rxf_cb_stats_cleared(void *arg, int status);
+static void __rxf_enable(struct bna_rxf *rxf);
+static void __rxf_disable(struct bna_rxf *rxf);
+
+bfa_fsm_state_decl(bna_rxf, stopped, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, start_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, cam_fltr_mod_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, started, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, cam_fltr_clr_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, stop_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, pause_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, resume_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+bfa_fsm_state_decl(bna_rxf, stat_clr_wait, struct bna_rxf,
+                        enum bna_rxf_event);
+
+static struct bfa_sm_table rxf_sm_table[] = {
+        {BFA_SM(bna_rxf_sm_stopped), BNA_RXF_STOPPED},
+        {BFA_SM(bna_rxf_sm_start_wait), BNA_RXF_START_WAIT},
+        {BFA_SM(bna_rxf_sm_cam_fltr_mod_wait), BNA_RXF_CAM_FLTR_MOD_WAIT},
+        {BFA_SM(bna_rxf_sm_started), BNA_RXF_STARTED},
+        {BFA_SM(bna_rxf_sm_cam_fltr_clr_wait), BNA_RXF_CAM_FLTR_CLR_WAIT},
+        {BFA_SM(bna_rxf_sm_stop_wait), BNA_RXF_STOP_WAIT},
+        {BFA_SM(bna_rxf_sm_pause_wait), BNA_RXF_PAUSE_WAIT},
+        {BFA_SM(bna_rxf_sm_resume_wait), BNA_RXF_RESUME_WAIT},
+        {BFA_SM(bna_rxf_sm_stat_clr_wait), BNA_RXF_STAT_CLR_WAIT}
+};
+
+static void
+bna_rxf_sm_stopped_entry(struct bna_rxf *rxf)
+{
+        call_rxf_stop_cbfn(rxf, BNA_CB_SUCCESS);
+}
+
+static void
+bna_rxf_sm_stopped(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_START:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_start_wait);
+                break;
+
+        case RXF_E_STOP:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_FAIL:
+                /* No-op */
+                break;
+
+        case RXF_E_CAM_FLTR_MOD:
+                call_rxf_cam_fltr_cbfn(rxf, BNA_CB_SUCCESS);
+                break;
+
+        case RXF_E_STARTED:
+        case RXF_E_STOPPED:
+        case RXF_E_CAM_FLTR_RESP:
+                /**
+                 * These events are received due to flushing of mbox
+                 * when device fails
+                 */
+                /* No-op */
+                break;
+
+        case RXF_E_PAUSE:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_PAUSED;
+                call_rxf_pause_cbfn(rxf, BNA_CB_SUCCESS);
+                break;
+
+        case RXF_E_RESUME:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_RUNNING;
+                call_rxf_resume_cbfn(rxf, BNA_CB_SUCCESS);
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_start_wait_entry(struct bna_rxf *rxf)
+{
+        __rxf_config_set(rxf);
+        __rxf_rit_set(rxf);
+        rxf_enable(rxf);
+}
+
+static void
+bna_rxf_sm_start_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_STOP:
+                /**
+                 * STOP is originated from bnad. When this happens,
+                 * it can not be waiting for filter update
+                 */
+                call_rxf_start_cbfn(rxf, BNA_CB_INTERRUPT);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stop_wait);
+                break;
+
+        case RXF_E_FAIL:
+                call_rxf_cam_fltr_cbfn(rxf, BNA_CB_SUCCESS);
+                call_rxf_start_cbfn(rxf, BNA_CB_FAIL);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_CAM_FLTR_MOD:
+                /* No-op */
+                break;
+
+        case RXF_E_STARTED:
+                /**
+                 * Force rxf_process_filter() to go through initial
+                 * config
+                 */
+                if ((rxf->ucast_active_mac != NULL) &&
+                        (rxf->ucast_pending_set == 0))
+                        rxf->ucast_pending_set = 1;
+
+                if (rxf->rss_status == BNA_STATUS_T_ENABLED)
+                        rxf->rxf_flags |= BNA_RXF_FL_RSS_CONFIG_PENDING;
+
+                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
+
+                bfa_fsm_set_state(rxf, bna_rxf_sm_cam_fltr_mod_wait);
+                break;
+
+        case RXF_E_PAUSE:
+        case RXF_E_RESUME:
+                rxf->rxf_flags |= BNA_RXF_FL_OPERSTATE_CHANGED;
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_cam_fltr_mod_wait_entry(struct bna_rxf *rxf)
+{
+        if (!rxf_process_packet_filter(rxf)) {
+                /* No more pending CAM entries to update */
+                bfa_fsm_set_state(rxf, bna_rxf_sm_started);
+        }
+}
+
+static void
+bna_rxf_sm_cam_fltr_mod_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_STOP:
+                /**
+                 * STOP is originated from bnad. When this happens,
+                 * it can not be waiting for filter update
+                 */
+                call_rxf_start_cbfn(rxf, BNA_CB_INTERRUPT);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_cam_fltr_clr_wait);
+                break;
+
+        case RXF_E_FAIL:
+                rxf_reset_packet_filter(rxf);
+                call_rxf_cam_fltr_cbfn(rxf, BNA_CB_SUCCESS);
+                call_rxf_start_cbfn(rxf, BNA_CB_FAIL);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_CAM_FLTR_MOD:
+                /* No-op */
+                break;
+
+        case RXF_E_CAM_FLTR_RESP:
+                if (!rxf_process_packet_filter(rxf)) {
+                        /* No more pending CAM entries to update */
+                        call_rxf_cam_fltr_cbfn(rxf, BNA_CB_SUCCESS);
+                        bfa_fsm_set_state(rxf, bna_rxf_sm_started);
+                }
+                break;
+
+        case RXF_E_PAUSE:
+        case RXF_E_RESUME:
+                rxf->rxf_flags |= BNA_RXF_FL_OPERSTATE_CHANGED;
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_started_entry(struct bna_rxf *rxf)
+{
+        call_rxf_start_cbfn(rxf, BNA_CB_SUCCESS);
+
+        if (rxf->rxf_flags & BNA_RXF_FL_OPERSTATE_CHANGED) {
+                if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_PAUSED)
+                        bfa_fsm_send_event(rxf, RXF_E_PAUSE);
+                else
+                        bfa_fsm_send_event(rxf, RXF_E_RESUME);
+        }
+
+}
+
+static void
+bna_rxf_sm_started(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_STOP:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_cam_fltr_clr_wait);
+                /* Hack to get FSM start clearing CAM entries */
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_RESP);
+                break;
+
+        case RXF_E_FAIL:
+                rxf_reset_packet_filter(rxf);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_CAM_FLTR_MOD:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_cam_fltr_mod_wait);
+                break;
+
+        case RXF_E_PAUSE:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_pause_wait);
+                break;
+
+        case RXF_E_RESUME:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_resume_wait);
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_cam_fltr_clr_wait_entry(struct bna_rxf *rxf)
+{
+        /**
+         *  Note: Do not add rxf_clear_packet_filter here.
+         * It will overstep mbox when this transition happens:
+         *      cam_fltr_mod_wait -> cam_fltr_clr_wait on RXF_E_STOP event
+         */
+}
+
+static void
+bna_rxf_sm_cam_fltr_clr_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_FAIL:
+                /**
+                 * FSM was in the process of stopping, initiated by
+                 * bnad. When this happens, no one can be waiting for
+                 * start or filter update
+                 */
+                rxf_reset_packet_filter(rxf);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_CAM_FLTR_RESP:
+                if (!rxf_clear_packet_filter(rxf)) {
+                        /* No more pending CAM entries to clear */
+                        bfa_fsm_set_state(rxf, bna_rxf_sm_stop_wait);
+                        rxf_disable(rxf);
+                }
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_stop_wait_entry(struct bna_rxf *rxf)
+{
+        /**
+         * NOTE: Do not add  rxf_disable here.
+         * It will overstep mbox when this transition happens:
+         *      start_wait -> stop_wait on RXF_E_STOP event
+         */
+}
+
+static void
+bna_rxf_sm_stop_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_FAIL:
+                /**
+                 * FSM was in the process of stopping, initiated by
+                 * bnad. When this happens, no one can be waiting for
+                 * start or filter update
+                 */
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_STARTED:
+                /**
+                 * This event is received due to abrupt transition from
+                 * bna_rxf_sm_start_wait state on receiving
+                 * RXF_E_STOP event
+                 */
+                rxf_disable(rxf);
+                break;
+
+        case RXF_E_STOPPED:
+                /**
+                 * FSM was in the process of stopping, initiated by
+                 * bnad. When this happens, no one can be waiting for
+                 * start or filter update
+                 */
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stat_clr_wait);
+                break;
+
+        case RXF_E_PAUSE:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_PAUSED;
+                break;
+
+        case RXF_E_RESUME:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_RUNNING;
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_pause_wait_entry(struct bna_rxf *rxf)
+{
+        rxf->rxf_flags &=
+                ~(BNA_RXF_FL_OPERSTATE_CHANGED | BNA_RXF_FL_RXF_ENABLED);
+        __rxf_disable(rxf);
+}
+
+static void
+bna_rxf_sm_pause_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_FAIL:
+                /**
+                 * FSM was in the process of disabling rxf, initiated by
+                 * bnad.
+                 */
+                call_rxf_pause_cbfn(rxf, BNA_CB_FAIL);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_STOPPED:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_PAUSED;
+                call_rxf_pause_cbfn(rxf, BNA_CB_SUCCESS);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_started);
+                break;
+
+        /*
+         * Since PAUSE/RESUME can only be sent by bnad, we don't expect
+         * any other event during these states
+         */
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_resume_wait_entry(struct bna_rxf *rxf)
+{
+        rxf->rxf_flags &= ~(BNA_RXF_FL_OPERSTATE_CHANGED);
+        rxf->rxf_flags |= BNA_RXF_FL_RXF_ENABLED;
+        __rxf_enable(rxf);
+}
+
+static void
+bna_rxf_sm_resume_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_FAIL:
+                /**
+                 * FSM was in the process of disabling rxf, initiated by
+                 * bnad.
+                 */
+                call_rxf_resume_cbfn(rxf, BNA_CB_FAIL);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        case RXF_E_STARTED:
+                rxf->rxf_oper_state = BNA_RXF_OPER_STATE_RUNNING;
+                call_rxf_resume_cbfn(rxf, BNA_CB_SUCCESS);
+                bfa_fsm_set_state(rxf, bna_rxf_sm_started);
+                break;
+
+        /*
+         * Since PAUSE/RESUME can only be sent by bnad, we don't expect
+         * any other event during these states
+         */
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+bna_rxf_sm_stat_clr_wait_entry(struct bna_rxf *rxf)
+{
+        __bna_rxf_stat_clr(rxf);
+}
+
+static void
+bna_rxf_sm_stat_clr_wait(struct bna_rxf *rxf, enum bna_rxf_event event)
+{
+        switch (event) {
+        case RXF_E_FAIL:
+        case RXF_E_STAT_CLEARED:
+                bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(rxf->rx->bna, event);
+        }
+}
+
+static void
+__rxf_enable(struct bna_rxf *rxf)
+{
+        struct bfi_ll_rxf_multi_req ll_req;
+        u32 bm[2] = {0, 0};
+
+        if (rxf->rxf_id < 32)
+                bm[0] = 1 << rxf->rxf_id;
+        else
+                bm[1] = 1 << (rxf->rxf_id - 32);
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_RX_REQ, 0);
+        ll_req.rxf_id_mask[0] = htonl(bm[0]);
+        ll_req.rxf_id_mask[1] = htonl(bm[1]);
+        ll_req.enable = 1;
+
+        bna_mbox_qe_fill(&rxf->mbox_qe, &ll_req, sizeof(ll_req),
+                        rxf_cb_enabled, rxf);
+
+        bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
+}
+
+static void
+__rxf_disable(struct bna_rxf *rxf)
+{
+        struct bfi_ll_rxf_multi_req ll_req;
+        u32 bm[2] = {0, 0};
+
+        if (rxf->rxf_id < 32)
+                bm[0] = 1 << rxf->rxf_id;
+        else
+                bm[1] = 1 << (rxf->rxf_id - 32);
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_RX_REQ, 0);
+        ll_req.rxf_id_mask[0] = htonl(bm[0]);
+        ll_req.rxf_id_mask[1] = htonl(bm[1]);
+        ll_req.enable = 0;
+
+        bna_mbox_qe_fill(&rxf->mbox_qe, &ll_req, sizeof(ll_req),
+                        rxf_cb_disabled, rxf);
+
+        bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
+}
+
+static void
+__rxf_config_set(struct bna_rxf *rxf)
+{
+        u32 i;
+        struct bna_rss_mem *rss_mem;
+        struct bna_rx_fndb_ram *rx_fndb_ram;
+        struct bna *bna = rxf->rx->bna;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(bna->pcidev.pci_bar_kva,
+                        RSS_TABLE_BASE_OFFSET);
+
+        rss_mem = (struct bna_rss_mem *)0;
+
+        /* Configure RSS if required */
+        if (rxf->ctrl_flags & BNA_RXF_CF_RSS_ENABLE) {
+                /* configure RSS Table */
+                writel(BNA_GET_PAGE_NUM(RAD0_MEM_BLK_BASE_PG_NUM +
+                        bna->port_num, RSS_TABLE_BASE_OFFSET),
+                                        bna->regs.page_addr);
+
+                /* temporarily disable RSS, while hash value is written */
+                off = (unsigned long)&rss_mem[0].type_n_hash;
+                writel(0, base_addr + off);
+
+                for (i = 0; i < BFI_RSS_HASH_KEY_LEN; i++) {
+                        off = (unsigned long)
+                        &rss_mem[0].hash_key[(BFI_RSS_HASH_KEY_LEN - 1) - i];
+                        writel(htonl(rxf->rss_cfg.toeplitz_hash_key[i]),
+                        base_addr + off);
+                }
+
+                off = (unsigned long)&rss_mem[0].type_n_hash;
+                writel(rxf->rss_cfg.hash_type | rxf->rss_cfg.hash_mask,
+                        base_addr + off);
+        }
+
+        /* Configure RxF */
+        writel(BNA_GET_PAGE_NUM(
+                LUT0_MEM_BLK_BASE_PG_NUM + (bna->port_num * 2),
+                RX_FNDB_RAM_BASE_OFFSET),
+                bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(bna->pcidev.pci_bar_kva,
+                RX_FNDB_RAM_BASE_OFFSET);
+
+        rx_fndb_ram = (struct bna_rx_fndb_ram *)0;
+
+        /* We always use RSS table 0 */
+        off = (unsigned long)&rx_fndb_ram[rxf->rxf_id].rss_prop;
+        writel(rxf->ctrl_flags & BNA_RXF_CF_RSS_ENABLE,
+                base_addr + off);
+
+        /* small large buffer enable/disable */
+        off = (unsigned long)&rx_fndb_ram[rxf->rxf_id].size_routing_props;
+        writel((rxf->ctrl_flags & BNA_RXF_CF_SM_LG_RXQ) | 0x80,
+                base_addr + off);
+
+        /* RIT offset,  HDS forced offset, multicast RxQ Id */
+        off = (unsigned long)&rx_fndb_ram[rxf->rxf_id].rit_hds_mcastq;
+        writel((rxf->rit_segment->rit_offset << 16) |
+                (rxf->forced_offset << 8) |
+                (rxf->hds_cfg.hdr_type & BNA_HDS_FORCED) | rxf->mcast_rxq_id,
+                base_addr + off);
+
+        /*
+         * default vlan tag, default function enable, strip vlan bytes,
+         * HDS type, header size
+         */
+
+        off = (unsigned long)&rx_fndb_ram[rxf->rxf_id].control_flags;
+         writel(((u32)rxf->default_vlan_tag << 16) |
+                (rxf->ctrl_flags &
+                        (BNA_RXF_CF_DEFAULT_VLAN |
+                        BNA_RXF_CF_DEFAULT_FUNCTION_ENABLE |
+                        BNA_RXF_CF_VLAN_STRIP)) |
+                (rxf->hds_cfg.hdr_type & ~BNA_HDS_FORCED) |
+                rxf->hds_cfg.header_size,
+                base_addr + off);
+}
+
+void
+__rxf_vlan_filter_set(struct bna_rxf *rxf, enum bna_status status)
+{
+        struct bna *bna = rxf->rx->bna;
+        int i;
+
+        writel(BNA_GET_PAGE_NUM(LUT0_MEM_BLK_BASE_PG_NUM +
+                        (bna->port_num * 2), VLAN_RAM_BASE_OFFSET),
+                        bna->regs.page_addr);
+
+        if (status == BNA_STATUS_T_ENABLED) {
+                /* enable VLAN filtering on this function */
+                for (i = 0; i <= BFI_MAX_VLAN / 32; i++) {
+                        writel(rxf->vlan_filter_table[i],
+                                        BNA_GET_VLAN_MEM_ENTRY_ADDR
+                                        (bna->pcidev.pci_bar_kva, rxf->rxf_id,
+                                                i * 32));
+                }
+        } else {
+                /* disable VLAN filtering on this function */
+                for (i = 0; i <= BFI_MAX_VLAN / 32; i++) {
+                        writel(0xffffffff,
+                                        BNA_GET_VLAN_MEM_ENTRY_ADDR
+                                        (bna->pcidev.pci_bar_kva, rxf->rxf_id,
+                                                i * 32));
+                }
+        }
+}
+
+static void
+__rxf_rit_set(struct bna_rxf *rxf)
+{
+        struct bna *bna = rxf->rx->bna;
+        struct bna_rit_mem *rit_mem;
+        int i;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(bna->pcidev.pci_bar_kva,
+                        FUNCTION_TO_RXQ_TRANSLATE);
+
+        rit_mem = (struct bna_rit_mem *)0;
+
+        writel(BNA_GET_PAGE_NUM(RXA0_MEM_BLK_BASE_PG_NUM + bna->port_num,
+                FUNCTION_TO_RXQ_TRANSLATE),
+                bna->regs.page_addr);
+
+        for (i = 0; i < rxf->rit_segment->rit_size; i++) {
+                off = (unsigned long)&rit_mem[i + rxf->rit_segment->rit_offset];
+                writel(rxf->rit_segment->rit[i].large_rxq_id << 6 |
+                        rxf->rit_segment->rit[i].small_rxq_id,
+                        base_addr + off);
+        }
+}
+
+static void
+__bna_rxf_stat_clr(struct bna_rxf *rxf)
+{
+        struct bfi_ll_stats_req ll_req;
+        u32 bm[2] = {0, 0};
+
+        if (rxf->rxf_id < 32)
+                bm[0] = 1 << rxf->rxf_id;
+        else
+                bm[1] = 1 << (rxf->rxf_id - 32);
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_STATS_CLEAR_REQ, 0);
+        ll_req.stats_mask = 0;
+        ll_req.txf_id_mask[0] = 0;
+        ll_req.txf_id_mask[1] = 0;
+
+        ll_req.rxf_id_mask[0] = htonl(bm[0]);
+        ll_req.rxf_id_mask[1] = htonl(bm[1]);
+
+        bna_mbox_qe_fill(&rxf->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_rxf_cb_stats_cleared, rxf);
+        bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
+}
+
+static void
+rxf_enable(struct bna_rxf *rxf)
+{
+        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_PAUSED)
+                bfa_fsm_send_event(rxf, RXF_E_STARTED);
+        else {
+                rxf->rxf_flags |= BNA_RXF_FL_RXF_ENABLED;
+                __rxf_enable(rxf);
+        }
+}
+
+static void
+rxf_cb_enabled(void *arg, int status)
+{
+        struct bna_rxf *rxf = (struct bna_rxf *)arg;
+
+        bfa_q_qe_init(&rxf->mbox_qe.qe);
+        bfa_fsm_send_event(rxf, RXF_E_STARTED);
+}
+
+static void
+rxf_disable(struct bna_rxf *rxf)
+{
+        if (rxf->rxf_oper_state == BNA_RXF_OPER_STATE_PAUSED)
+                bfa_fsm_send_event(rxf, RXF_E_STOPPED);
+        else
+                rxf->rxf_flags &= ~BNA_RXF_FL_RXF_ENABLED;
+                __rxf_disable(rxf);
+}
+
+static void
+rxf_cb_disabled(void *arg, int status)
+{
+        struct bna_rxf *rxf = (struct bna_rxf *)arg;
+
+        bfa_q_qe_init(&rxf->mbox_qe.qe);
+        bfa_fsm_send_event(rxf, RXF_E_STOPPED);
+}
+
+void
+rxf_cb_cam_fltr_mbox_cmd(void *arg, int status)
+{
+        struct bna_rxf *rxf = (struct bna_rxf *)arg;
+
+        bfa_q_qe_init(&rxf->mbox_qe.qe);
+
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_RESP);
+}
+
+static void
+bna_rxf_cb_stats_cleared(void *arg, int status)
+{
+        struct bna_rxf *rxf = (struct bna_rxf *)arg;
+
+        bfa_q_qe_init(&rxf->mbox_qe.qe);
+        bfa_fsm_send_event(rxf, RXF_E_STAT_CLEARED);
+}
+
+void
+rxf_cam_mbox_cmd(struct bna_rxf *rxf, u8 cmd,
+                const struct bna_mac *mac_addr)
+{
+        struct bfi_ll_mac_addr_req req;
+
+        bfi_h2i_set(req.mh, BFI_MC_LL, cmd, 0);
+
+        req.rxf_id = rxf->rxf_id;
+        memcpy(&req.mac_addr, (void *)&mac_addr->addr, ETH_ALEN);
+
+        bna_mbox_qe_fill(&rxf->mbox_qe, &req, sizeof(req),
+                                rxf_cb_cam_fltr_mbox_cmd, rxf);
+
+        bna_mbox_send(rxf->rx->bna, &rxf->mbox_qe);
+}
+
+static int
+rxf_process_packet_filter_mcast(struct bna_rxf *rxf)
+{
+        struct bna_mac *mac = NULL;
+        struct list_head *qe;
+
+        /* Add multicast entries */
+        if (!list_empty(&rxf->mcast_pending_add_q)) {
+                bfa_q_deq(&rxf->mcast_pending_add_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_ADD_REQ, mac);
+                list_add_tail(&mac->qe, &rxf->mcast_active_q);
+                return 1;
+        }
+
+        /* Delete multicast entries previousely added */
+        if (!list_empty(&rxf->mcast_pending_del_q)) {
+                bfa_q_deq(&rxf->mcast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_DEL_REQ, mac);
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+                return 1;
+        }
+
+        return 0;
+}
+
+static int
+rxf_process_packet_filter_vlan(struct bna_rxf *rxf)
+{
+        /* Apply the VLAN filter */
+        if (rxf->rxf_flags & BNA_RXF_FL_VLAN_CONFIG_PENDING) {
+                rxf->rxf_flags &= ~BNA_RXF_FL_VLAN_CONFIG_PENDING;
+                if (!(rxf->rxmode_active & BNA_RXMODE_PROMISC) &&
+                        !(rxf->rxmode_active & BNA_RXMODE_DEFAULT))
+                        __rxf_vlan_filter_set(rxf, rxf->vlan_filter_status);
+        }
+
+        /* Apply RSS configuration */
+        if (rxf->rxf_flags & BNA_RXF_FL_RSS_CONFIG_PENDING) {
+                rxf->rxf_flags &= ~BNA_RXF_FL_RSS_CONFIG_PENDING;
+                if (rxf->rss_status == BNA_STATUS_T_DISABLED) {
+                        /* RSS is being disabled */
+                        rxf->ctrl_flags &= ~BNA_RXF_CF_RSS_ENABLE;
+                        __rxf_rit_set(rxf);
+                        __rxf_config_set(rxf);
+                } else {
+                        /* RSS is being enabled or reconfigured */
+                        rxf->ctrl_flags |= BNA_RXF_CF_RSS_ENABLE;
+                        __rxf_rit_set(rxf);
+                        __rxf_config_set(rxf);
+                }
+        }
+
+        return 0;
+}
+
+/**
+ * Processes pending ucast, mcast entry addition/deletion and issues mailbox
+ * command. Also processes pending filter configuration - promiscuous mode,
+ * default mode, allmutli mode and issues mailbox command or directly applies
+ * to h/w
+ */
+static int
+rxf_process_packet_filter(struct bna_rxf *rxf)
+{
+        /* Set the default MAC first */
+        if (rxf->ucast_pending_set > 0) {
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_UCAST_SET_REQ,
+                                rxf->ucast_active_mac);
+                rxf->ucast_pending_set--;
+                return 1;
+        }
+
+        if (rxf_process_packet_filter_ucast(rxf))
+                return 1;
+
+        if (rxf_process_packet_filter_mcast(rxf))
+                return 1;
+
+        if (rxf_process_packet_filter_promisc(rxf))
+                return 1;
+
+        if (rxf_process_packet_filter_default(rxf))
+                return 1;
+
+        if (rxf_process_packet_filter_allmulti(rxf))
+                return 1;
+
+        if (rxf_process_packet_filter_vlan(rxf))
+                return 1;
+
+        return 0;
+}
+
+static int
+rxf_clear_packet_filter_mcast(struct bna_rxf *rxf)
+{
+        struct bna_mac *mac = NULL;
+        struct list_head *qe;
+
+        /* 3. delete pending mcast entries */
+        if (!list_empty(&rxf->mcast_pending_del_q)) {
+                bfa_q_deq(&rxf->mcast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_DEL_REQ, mac);
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+                return 1;
+        }
+
+        /* 4. clear active mcast entries; move them to pending_add_q */
+        if (!list_empty(&rxf->mcast_active_q)) {
+                bfa_q_deq(&rxf->mcast_active_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                rxf_cam_mbox_cmd(rxf, BFI_LL_H2I_MAC_MCAST_DEL_REQ, mac);
+                list_add_tail(&mac->qe, &rxf->mcast_pending_add_q);
+                return 1;
+        }
+
+        return 0;
+}
+
+/**
+ * In the rxf stop path, processes pending ucast/mcast delete queue and issues
+ * the mailbox command. Moves the active ucast/mcast entries to pending add q,
+ * so that they are added to CAM again in the rxf start path. Moves the current
+ * filter settings - promiscuous, default, allmutli - to pending filter
+ * configuration
+ */
+static int
+rxf_clear_packet_filter(struct bna_rxf *rxf)
+{
+        if (rxf_clear_packet_filter_ucast(rxf))
+                return 1;
+
+        if (rxf_clear_packet_filter_mcast(rxf))
+                return 1;
+
+        /* 5. clear active default MAC in the CAM */
+        if (rxf->ucast_pending_set > 0)
+                rxf->ucast_pending_set = 0;
+
+        if (rxf_clear_packet_filter_promisc(rxf))
+                return 1;
+
+        if (rxf_clear_packet_filter_default(rxf))
+                return 1;
+
+        if (rxf_clear_packet_filter_allmulti(rxf))
+                return 1;
+
+        return 0;
+}
+
+static void
+rxf_reset_packet_filter_mcast(struct bna_rxf *rxf)
+{
+        struct list_head *qe;
+        struct bna_mac *mac;
+
+        /* 3. Move active mcast entries to pending_add_q */
+        while (!list_empty(&rxf->mcast_active_q)) {
+                bfa_q_deq(&rxf->mcast_active_q, &qe);
+                bfa_q_qe_init(qe);
+                list_add_tail(qe, &rxf->mcast_pending_add_q);
+        }
+
+        /* 4. Throw away delete pending mcast entries */
+        while (!list_empty(&rxf->mcast_pending_del_q)) {
+                bfa_q_deq(&rxf->mcast_pending_del_q, &qe);
+                bfa_q_qe_init(qe);
+                mac = (struct bna_mac *)qe;
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+        }
+}
+
+/**
+ * In the rxf fail path, throws away the ucast/mcast entries pending for
+ * deletion, moves all active ucast/mcast entries to pending queue so that
+ * they are added back to CAM in the rxf start path. Also moves the current
+ * filter configuration to pending filter configuration.
+ */
+static void
+rxf_reset_packet_filter(struct bna_rxf *rxf)
+{
+        rxf_reset_packet_filter_ucast(rxf);
+
+        rxf_reset_packet_filter_mcast(rxf);
+
+        /* 5. Turn off ucast set flag */
+        rxf->ucast_pending_set = 0;
+
+        rxf_reset_packet_filter_promisc(rxf);
+
+        rxf_reset_packet_filter_default(rxf);
+
+        rxf_reset_packet_filter_allmulti(rxf);
+}
+
+void
+bna_rxf_init(struct bna_rxf *rxf,
+                struct bna_rx *rx,
+                struct bna_rx_config *q_config)
+{
+        struct list_head *qe;
+        struct bna_rxp *rxp;
+
+        /* rxf_id is initialized during rx_mod init */
+        rxf->rx = rx;
+
+        INIT_LIST_HEAD(&rxf->ucast_pending_add_q);
+        INIT_LIST_HEAD(&rxf->ucast_pending_del_q);
+        rxf->ucast_pending_set = 0;
+        INIT_LIST_HEAD(&rxf->ucast_active_q);
+        rxf->ucast_active_mac = NULL;
+
+        INIT_LIST_HEAD(&rxf->mcast_pending_add_q);
+        INIT_LIST_HEAD(&rxf->mcast_pending_del_q);
+        INIT_LIST_HEAD(&rxf->mcast_active_q);
+
+        bfa_q_qe_init(&rxf->mbox_qe.qe);
+
+        if (q_config->vlan_strip_status == BNA_STATUS_T_ENABLED)
+                rxf->ctrl_flags |= BNA_RXF_CF_VLAN_STRIP;
+
+        rxf->rxf_oper_state = (q_config->paused) ?
+                BNA_RXF_OPER_STATE_PAUSED : BNA_RXF_OPER_STATE_RUNNING;
+
+        bna_rxf_adv_init(rxf, rx, q_config);
+
+        rxf->rit_segment = bna_rit_mod_seg_get(&rxf->rx->bna->rit_mod,
+                                        q_config->num_paths);
+
+        list_for_each(qe, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe;
+                if (q_config->rxp_type == BNA_RXP_SINGLE)
+                        rxf->mcast_rxq_id = rxp->rxq.single.only->rxq_id;
+                else
+                        rxf->mcast_rxq_id = rxp->rxq.slr.large->rxq_id;
+                break;
+        }
+
+        rxf->vlan_filter_status = BNA_STATUS_T_DISABLED;
+        memset(rxf->vlan_filter_table, 0,
+                        (sizeof(u32) * ((BFI_MAX_VLAN + 1) / 32)));
+
+        bfa_fsm_set_state(rxf, bna_rxf_sm_stopped);
+}
+
+void
+bna_rxf_uninit(struct bna_rxf *rxf)
+{
+        struct bna_mac *mac;
+
+        bna_rit_mod_seg_put(&rxf->rx->bna->rit_mod, rxf->rit_segment);
+        rxf->rit_segment = NULL;
+
+        rxf->ucast_pending_set = 0;
+
+        while (!list_empty(&rxf->ucast_pending_add_q)) {
+                bfa_q_deq(&rxf->ucast_pending_add_q, &mac);
+                bfa_q_qe_init(&mac->qe);
+                bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod, mac);
+        }
+
+        if (rxf->ucast_active_mac) {
+                bfa_q_qe_init(&rxf->ucast_active_mac->qe);
+                bna_ucam_mod_mac_put(&rxf->rx->bna->ucam_mod,
+                        rxf->ucast_active_mac);
+                rxf->ucast_active_mac = NULL;
+        }
+
+        while (!list_empty(&rxf->mcast_pending_add_q)) {
+                bfa_q_deq(&rxf->mcast_pending_add_q, &mac);
+                bfa_q_qe_init(&mac->qe);
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+        }
+
+        rxf->rx = NULL;
+}
+
+void
+bna_rxf_start(struct bna_rxf *rxf)
+{
+        rxf->start_cbfn = bna_rx_cb_rxf_started;
+        rxf->start_cbarg = rxf->rx;
+        rxf->rxf_flags &= ~BNA_RXF_FL_FAILED;
+        bfa_fsm_send_event(rxf, RXF_E_START);
+}
+
+void
+bna_rxf_stop(struct bna_rxf *rxf)
+{
+        rxf->stop_cbfn = bna_rx_cb_rxf_stopped;
+        rxf->stop_cbarg = rxf->rx;
+        bfa_fsm_send_event(rxf, RXF_E_STOP);
+}
+
+void
+bna_rxf_fail(struct bna_rxf *rxf)
+{
+        rxf->rxf_flags |= BNA_RXF_FL_FAILED;
+        bfa_fsm_send_event(rxf, RXF_E_FAIL);
+}
+
+int
+bna_rxf_state_get(struct bna_rxf *rxf)
+{
+        return bfa_sm_to_state(rxf_sm_table, rxf->fsm);
+}
+
+enum bna_cb_status
+bna_rx_ucast_set(struct bna_rx *rx, u8 *ucmac,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+
+        if (rxf->ucast_active_mac == NULL) {
+                rxf->ucast_active_mac =
+                                bna_ucam_mod_mac_get(&rxf->rx->bna->ucam_mod);
+                if (rxf->ucast_active_mac == NULL)
+                        return BNA_CB_UCAST_CAM_FULL;
+                bfa_q_qe_init(&rxf->ucast_active_mac->qe);
+        }
+
+        memcpy(rxf->ucast_active_mac->addr, ucmac, ETH_ALEN);
+        rxf->ucast_pending_set++;
+        rxf->cam_fltr_cbfn = cbfn;
+        rxf->cam_fltr_cbarg = rx->bna->bnad;
+
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+
+        return BNA_CB_SUCCESS;
+}
+
+enum bna_cb_status
+bna_rx_mcast_add(struct bna_rx *rx, u8 *addr,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head        *qe;
+        struct bna_mac *mac;
+
+        /* Check if already added */
+        list_for_each(qe, &rxf->mcast_active_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        /* Check if pending addition */
+        list_for_each(qe, &rxf->mcast_pending_add_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        mac = bna_mcam_mod_mac_get(&rxf->rx->bna->mcam_mod);
+        if (mac == NULL)
+                return BNA_CB_MCAST_LIST_FULL;
+        bfa_q_qe_init(&mac->qe);
+        memcpy(mac->addr, addr, ETH_ALEN);
+        list_add_tail(&mac->qe, &rxf->mcast_pending_add_q);
+
+        rxf->cam_fltr_cbfn = cbfn;
+        rxf->cam_fltr_cbarg = rx->bna->bnad;
+
+        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+
+        return BNA_CB_SUCCESS;
+}
+
+enum bna_cb_status
+bna_rx_mcast_del(struct bna_rx *rx, u8 *addr,
+                 void (*cbfn)(struct bnad *, struct bna_rx *,
+                              enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head *qe;
+        struct bna_mac *mac;
+
+        list_for_each(qe, &rxf->mcast_pending_add_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        list_del(qe);
+                        bfa_q_qe_init(qe);
+                        bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+                        if (cbfn)
+                                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        list_for_each(qe, &rxf->mcast_active_q) {
+                mac = (struct bna_mac *)qe;
+                if (BNA_MAC_IS_EQUAL(mac->addr, addr)) {
+                        list_del(qe);
+                        bfa_q_qe_init(qe);
+                        list_add_tail(qe, &rxf->mcast_pending_del_q);
+                        rxf->cam_fltr_cbfn = cbfn;
+                        rxf->cam_fltr_cbarg = rx->bna->bnad;
+                        bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+                        return BNA_CB_SUCCESS;
+                }
+        }
+
+        return BNA_CB_INVALID_MAC;
+}
+
+enum bna_cb_status
+bna_rx_mcast_listset(struct bna_rx *rx, int count, u8 *mclist,
+                     void (*cbfn)(struct bnad *, struct bna_rx *,
+                                  enum bna_cb_status))
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        struct list_head list_head;
+        struct list_head *qe;
+        u8 *mcaddr;
+        struct bna_mac *mac;
+        struct bna_mac *mac1;
+        int skip;
+        int delete;
+        int need_hw_config = 0;
+        int i;
+
+        /* Allocate nodes */
+        INIT_LIST_HEAD(&list_head);
+        for (i = 0, mcaddr = mclist; i < count; i++) {
+                mac = bna_mcam_mod_mac_get(&rxf->rx->bna->mcam_mod);
+                if (mac == NULL)
+                        goto err_return;
+                bfa_q_qe_init(&mac->qe);
+                memcpy(mac->addr, mcaddr, ETH_ALEN);
+                list_add_tail(&mac->qe, &list_head);
+
+                mcaddr += ETH_ALEN;
+        }
+
+        /* Schedule for addition */
+        while (!list_empty(&list_head)) {
+                bfa_q_deq(&list_head, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+
+                skip = 0;
+
+                /* Skip if already added */
+                list_for_each(qe, &rxf->mcast_active_q) {
+                        mac1 = (struct bna_mac *)qe;
+                        if (BNA_MAC_IS_EQUAL(mac1->addr, mac->addr)) {
+                                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod,
+                                                        mac);
+                                skip = 1;
+                                break;
+                        }
+                }
+
+                if (skip)
+                        continue;
+
+                /* Skip if pending addition */
+                list_for_each(qe, &rxf->mcast_pending_add_q) {
+                        mac1 = (struct bna_mac *)qe;
+                        if (BNA_MAC_IS_EQUAL(mac1->addr, mac->addr)) {
+                                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod,
+                                                        mac);
+                                skip = 1;
+                                break;
+                        }
+                }
+
+                if (skip)
+                        continue;
+
+                need_hw_config = 1;
+                list_add_tail(&mac->qe, &rxf->mcast_pending_add_q);
+        }
+
+        /**
+         * Delete the entries that are in the pending_add_q but not
+         * in the new list
+         */
+        while (!list_empty(&rxf->mcast_pending_add_q)) {
+                bfa_q_deq(&rxf->mcast_pending_add_q, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                for (i = 0, mcaddr = mclist, delete = 1; i < count; i++) {
+                        if (BNA_MAC_IS_EQUAL(mcaddr, mac->addr)) {
+                                delete = 0;
+                                break;
+                        }
+                        mcaddr += ETH_ALEN;
+                }
+                if (delete)
+                        bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+                else
+                        list_add_tail(&mac->qe, &list_head);
+        }
+        while (!list_empty(&list_head)) {
+                bfa_q_deq(&list_head, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                list_add_tail(&mac->qe, &rxf->mcast_pending_add_q);
+        }
+
+        /**
+         * Schedule entries for deletion that are in the active_q but not
+         * in the new list
+         */
+        while (!list_empty(&rxf->mcast_active_q)) {
+                bfa_q_deq(&rxf->mcast_active_q, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                for (i = 0, mcaddr = mclist, delete = 1; i < count; i++) {
+                        if (BNA_MAC_IS_EQUAL(mcaddr, mac->addr)) {
+                                delete = 0;
+                                break;
+                        }
+                        mcaddr += ETH_ALEN;
+                }
+                if (delete) {
+                        list_add_tail(&mac->qe, &rxf->mcast_pending_del_q);
+                        need_hw_config = 1;
+                } else {
+                        list_add_tail(&mac->qe, &list_head);
+                }
+        }
+        while (!list_empty(&list_head)) {
+                bfa_q_deq(&list_head, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                list_add_tail(&mac->qe, &rxf->mcast_active_q);
+        }
+
+        if (need_hw_config) {
+                rxf->cam_fltr_cbfn = cbfn;
+                rxf->cam_fltr_cbarg = rx->bna->bnad;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        } else if (cbfn)
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+
+        return BNA_CB_SUCCESS;
+
+err_return:
+        while (!list_empty(&list_head)) {
+                bfa_q_deq(&list_head, &qe);
+                mac = (struct bna_mac *)qe;
+                bfa_q_qe_init(&mac->qe);
+                bna_mcam_mod_mac_put(&rxf->rx->bna->mcam_mod, mac);
+        }
+
+        return BNA_CB_MCAST_LIST_FULL;
+}
+
+void
+bna_rx_vlan_add(struct bna_rx *rx, int vlan_id)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        int index = (vlan_id >> 5);
+        int bit = (1 << (vlan_id & 0x1F));
+
+        rxf->vlan_filter_table[index] |= bit;
+        if (rxf->vlan_filter_status == BNA_STATUS_T_ENABLED) {
+                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        }
+}
+
+void
+bna_rx_vlan_del(struct bna_rx *rx, int vlan_id)
+{
+        struct bna_rxf *rxf = &rx->rxf;
+        int index = (vlan_id >> 5);
+        int bit = (1 << (vlan_id & 0x1F));
+
+        rxf->vlan_filter_table[index] &= ~bit;
+        if (rxf->vlan_filter_status == BNA_STATUS_T_ENABLED) {
+                rxf->rxf_flags |= BNA_RXF_FL_VLAN_CONFIG_PENDING;
+                bfa_fsm_send_event(rxf, RXF_E_CAM_FLTR_MOD);
+        }
+}
+
+/**
+ * RX
+ */
+#define RXQ_RCB_INIT(q, rxp, qdepth, bna, _id, unmapq_mem)      do {    \
+        struct bna_doorbell_qset *_qset;                                \
+        unsigned long off;                                              \
+        (q)->rcb->producer_index = (q)->rcb->consumer_index = 0;        \
+        (q)->rcb->q_depth = (qdepth);                                   \
+        (q)->rcb->unmap_q = unmapq_mem;                                 \
+        (q)->rcb->rxq = (q);                                            \
+        (q)->rcb->cq = &(rxp)->cq;                                      \
+        (q)->rcb->bnad = (bna)->bnad;                                   \
+        _qset = (struct bna_doorbell_qset *)0;                  \
+        off = (unsigned long)&_qset[(q)->rxq_id].rxq[0];                \
+        (q)->rcb->q_dbell = off +                                       \
+                BNA_GET_DOORBELL_BASE_ADDR((bna)->pcidev.pci_bar_kva);  \
+        (q)->rcb->id = _id;                                             \
+} while (0)
+
+#define BNA_GET_RXQS(qcfg)      (((qcfg)->rxp_type == BNA_RXP_SINGLE) ? \
+        (qcfg)->num_paths : ((qcfg)->num_paths * 2))
+
+#define SIZE_TO_PAGES(size)     (((size) >> PAGE_SHIFT) + ((((size) &\
+        (PAGE_SIZE - 1)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT))
+
+#define call_rx_stop_callback(rx, status)                               \
+        if ((rx)->stop_cbfn) {                                          \
+                (*(rx)->stop_cbfn)((rx)->stop_cbarg, rx, (status));     \
+                (rx)->stop_cbfn = NULL;                                 \
+                (rx)->stop_cbarg = NULL;                                \
+        }
+
+/*
+ * Since rx_enable is synchronous callback, there is no start_cbfn required.
+ * Instead, we'll call bnad_rx_post(rxp) so that bnad can post the buffers
+ * for each rxpath.
+ */
+
+#define call_rx_disable_cbfn(rx, status)                                \
+                if ((rx)->disable_cbfn) {                               \
+                        (*(rx)->disable_cbfn)((rx)->disable_cbarg,      \
+                                        status);                        \
+                        (rx)->disable_cbfn = NULL;                      \
+                        (rx)->disable_cbarg = NULL;                     \
+                }                                                       \
+
+#define rxqs_reqd(type, num_rxqs)                                       \
+        (((type) == BNA_RXP_SINGLE) ? (num_rxqs) : ((num_rxqs) * 2))
+
+#define rx_ib_fail(rx)                                          \
+do {                                                            \
+        struct bna_rxp *rxp;                                    \
+        struct list_head *qe;                                           \
+        list_for_each(qe, &(rx)->rxp_q) {                               \
+                rxp = (struct bna_rxp *)qe;                     \
+                bna_ib_fail(rxp->cq.ib);                        \
+        }                                                       \
+} while (0)
+
+static void __bna_multi_rxq_stop(struct bna_rxp *, u32 *);
+static void __bna_rxq_start(struct bna_rxq *rxq);
+static void __bna_cq_start(struct bna_cq *cq);
+static void bna_rit_create(struct bna_rx *rx);
+static void bna_rx_cb_multi_rxq_stopped(void *arg, int status);
+static void bna_rx_cb_rxq_stopped_all(void *arg);
+
+bfa_fsm_state_decl(bna_rx, stopped,
+        struct bna_rx, enum bna_rx_event);
+bfa_fsm_state_decl(bna_rx, rxf_start_wait,
+        struct bna_rx, enum bna_rx_event);
+bfa_fsm_state_decl(bna_rx, started,
+        struct bna_rx, enum bna_rx_event);
+bfa_fsm_state_decl(bna_rx, rxf_stop_wait,
+        struct bna_rx, enum bna_rx_event);
+bfa_fsm_state_decl(bna_rx, rxq_stop_wait,
+        struct bna_rx, enum bna_rx_event);
+
+static struct bfa_sm_table rx_sm_table[] = {
+        {BFA_SM(bna_rx_sm_stopped), BNA_RX_STOPPED},
+        {BFA_SM(bna_rx_sm_rxf_start_wait), BNA_RX_RXF_START_WAIT},
+        {BFA_SM(bna_rx_sm_started), BNA_RX_STARTED},
+        {BFA_SM(bna_rx_sm_rxf_stop_wait), BNA_RX_RXF_STOP_WAIT},
+        {BFA_SM(bna_rx_sm_rxq_stop_wait), BNA_RX_RXQ_STOP_WAIT},
+};
+
+static void bna_rx_sm_stopped_entry(struct bna_rx *rx)
+{
+        struct bna_rxp *rxp;
+        struct list_head *qe_rxp;
+
+        list_for_each(qe_rxp, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe_rxp;
+                rx->rx_cleanup_cbfn(rx->bna->bnad, rxp->cq.ccb);
+        }
+
+        call_rx_stop_callback(rx, BNA_CB_SUCCESS);
+}
+
+static void bna_rx_sm_stopped(struct bna_rx *rx,
+                                enum bna_rx_event event)
+{
+        switch (event) {
+        case RX_E_START:
+                bfa_fsm_set_state(rx, bna_rx_sm_rxf_start_wait);
+                break;
+        case RX_E_STOP:
+                call_rx_stop_callback(rx, BNA_CB_SUCCESS);
+                break;
+        case RX_E_FAIL:
+                /* no-op */
+                break;
+        default:
+                bfa_sm_fault(rx->bna, event);
+                break;
+        }
+
+}
+
+static void bna_rx_sm_rxf_start_wait_entry(struct bna_rx *rx)
+{
+        struct bna_rxp *rxp;
+        struct list_head *qe_rxp;
+        struct bna_rxq *q0 = NULL, *q1 = NULL;
+
+        /* Setup the RIT */
+        bna_rit_create(rx);
+
+        list_for_each(qe_rxp, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe_rxp;
+                bna_ib_start(rxp->cq.ib);
+                GET_RXQS(rxp, q0, q1);
+                q0->buffer_size = bna_port_mtu_get(&rx->bna->port);
+                __bna_rxq_start(q0);
+                rx->rx_post_cbfn(rx->bna->bnad, q0->rcb);
+                if (q1)  {
+                        __bna_rxq_start(q1);
+                        rx->rx_post_cbfn(rx->bna->bnad, q1->rcb);
+                }
+                __bna_cq_start(&rxp->cq);
+        }
+
+        bna_rxf_start(&rx->rxf);
+}
+
+static void bna_rx_sm_rxf_start_wait(struct bna_rx *rx,
+                                enum bna_rx_event event)
+{
+        switch (event) {
+        case RX_E_STOP:
+                bfa_fsm_set_state(rx, bna_rx_sm_rxf_stop_wait);
+                break;
+        case RX_E_FAIL:
+                bfa_fsm_set_state(rx, bna_rx_sm_stopped);
+                rx_ib_fail(rx);
+                bna_rxf_fail(&rx->rxf);
+                break;
+        case RX_E_RXF_STARTED:
+                bfa_fsm_set_state(rx, bna_rx_sm_started);
+                break;
+        default:
+                bfa_sm_fault(rx->bna, event);
+                break;
+        }
+}
+
+void
+bna_rx_sm_started_entry(struct bna_rx *rx)
+{
+        struct bna_rxp *rxp;
+        struct list_head *qe_rxp;
+
+        /* Start IB */
+        list_for_each(qe_rxp, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe_rxp;
+                bna_ib_ack(&rxp->cq.ib->door_bell, 0);
+        }
+
+        bna_llport_admin_up(&rx->bna->port.llport);
+}
+
+void
+bna_rx_sm_started(struct bna_rx *rx, enum bna_rx_event event)
+{
+        switch (event) {
+        case RX_E_FAIL:
+                bna_llport_admin_down(&rx->bna->port.llport);
+                bfa_fsm_set_state(rx, bna_rx_sm_stopped);
+                rx_ib_fail(rx);
+                bna_rxf_fail(&rx->rxf);
+                break;
+        case RX_E_STOP:
+                bna_llport_admin_down(&rx->bna->port.llport);
+                bfa_fsm_set_state(rx, bna_rx_sm_rxf_stop_wait);
+                break;
+        default:
+                bfa_sm_fault(rx->bna, event);
+                break;
+        }
+}
+
+void
+bna_rx_sm_rxf_stop_wait_entry(struct bna_rx *rx)
+{
+        bna_rxf_stop(&rx->rxf);
+}
+
+void
+bna_rx_sm_rxf_stop_wait(struct bna_rx *rx, enum bna_rx_event event)
+{
+        switch (event) {
+        case RX_E_RXF_STOPPED:
+                bfa_fsm_set_state(rx, bna_rx_sm_rxq_stop_wait);
+                break;
+        case RX_E_RXF_STARTED:
+                /**
+                 * RxF was in the process of starting up when
+                 * RXF_E_STOP was issued. Ignore this event
+                 */
+                break;
+        case RX_E_FAIL:
+                bfa_fsm_set_state(rx, bna_rx_sm_stopped);
+                rx_ib_fail(rx);
+                bna_rxf_fail(&rx->rxf);
+                break;
+        default:
+                bfa_sm_fault(rx->bna, event);
+                break;
+        }
+
+}
+
+void
+bna_rx_sm_rxq_stop_wait_entry(struct bna_rx *rx)
+{
+        struct bna_rxp *rxp = NULL;
+        struct bna_rxq *q0 = NULL;
+        struct bna_rxq *q1 = NULL;
+        struct list_head        *qe;
+        u32 rxq_mask[2] = {0, 0};
+
+        /* Only one call to multi-rxq-stop for all RXPs in this RX */
+        bfa_wc_up(&rx->rxq_stop_wc);
+        list_for_each(qe, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe;
+                GET_RXQS(rxp, q0, q1);
+                if (q0->rxq_id < 32)
+                        rxq_mask[0] |= ((u32)1 << q0->rxq_id);
+                else
+                        rxq_mask[1] |= ((u32)1 << (q0->rxq_id - 32));
+                if (q1) {
+                        if (q1->rxq_id < 32)
+                                rxq_mask[0] |= ((u32)1 << q1->rxq_id);
+                        else
+                                rxq_mask[1] |= ((u32)
+                                                1 << (q1->rxq_id - 32));
+                }
+        }
+
+        __bna_multi_rxq_stop(rxp, rxq_mask);
+}
+
+void
+bna_rx_sm_rxq_stop_wait(struct bna_rx *rx, enum bna_rx_event event)
+{
+        struct bna_rxp *rxp = NULL;
+        struct list_head        *qe;
+
+        switch (event) {
+        case RX_E_RXQ_STOPPED:
+                list_for_each(qe, &rx->rxp_q) {
+                        rxp = (struct bna_rxp *)qe;
+                        bna_ib_stop(rxp->cq.ib);
+                }
+                /* Fall through */
+        case RX_E_FAIL:
+                bfa_fsm_set_state(rx, bna_rx_sm_stopped);
+                break;
+        default:
+                bfa_sm_fault(rx->bna, event);
+                break;
+        }
+}
+
+void
+__bna_multi_rxq_stop(struct bna_rxp *rxp, u32 * rxq_id_mask)
+{
+        struct bfi_ll_q_stop_req ll_req;
+
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_RXQ_STOP_REQ, 0);
+        ll_req.q_id_mask[0] = htonl(rxq_id_mask[0]);
+        ll_req.q_id_mask[1] = htonl(rxq_id_mask[1]);
+        bna_mbox_qe_fill(&rxp->mbox_qe, &ll_req, sizeof(ll_req),
+                bna_rx_cb_multi_rxq_stopped, rxp);
+        bna_mbox_send(rxp->rx->bna, &rxp->mbox_qe);
+}
+
+void
+__bna_rxq_start(struct bna_rxq *rxq)
+{
+        struct bna_rxtx_q_mem *q_mem;
+        struct bna_rxq_mem rxq_cfg, *rxq_mem;
+        struct bna_dma_addr cur_q_addr;
+        /* struct bna_doorbell_qset *qset; */
+        struct bna_qpt *qpt;
+        u32 pg_num;
+        struct bna *bna = rxq->rx->bna;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        qpt = &rxq->qpt;
+        cur_q_addr = *((struct bna_dma_addr *)(qpt->kv_qpt_ptr));
+
+        rxq_cfg.pg_tbl_addr_lo = qpt->hw_qpt_ptr.lsb;
+        rxq_cfg.pg_tbl_addr_hi = qpt->hw_qpt_ptr.msb;
+        rxq_cfg.cur_q_entry_lo = cur_q_addr.lsb;
+        rxq_cfg.cur_q_entry_hi = cur_q_addr.msb;
+
+        rxq_cfg.pg_cnt_n_prd_ptr = ((u32)qpt->page_count << 16) | 0x0;
+        rxq_cfg.entry_n_pg_size = ((u32)(BFI_RXQ_WI_SIZE >> 2) << 16) |
+                (qpt->page_size >> 2);
+        rxq_cfg.sg_n_cq_n_cns_ptr =
+                ((u32)(rxq->rxp->cq.cq_id & 0xff) << 16) | 0x0;
+        rxq_cfg.buf_sz_n_q_state = ((u32)rxq->buffer_size << 16) |
+                BNA_Q_IDLE_STATE;
+        rxq_cfg.next_qid = 0x0 | (0x3 << 8);
+
+        /* Write the page number register */
+        pg_num = BNA_GET_PAGE_NUM(HQM0_BLK_PG_NUM + bna->port_num,
+                        HQM_RXTX_Q_RAM_BASE_OFFSET);
+        writel(pg_num, bna->regs.page_addr);
+
+        /* Write to h/w */
+        base_addr = BNA_GET_MEM_BASE_ADDR(bna->pcidev.pci_bar_kva,
+                                        HQM_RXTX_Q_RAM_BASE_OFFSET);
+
+        q_mem = (struct bna_rxtx_q_mem *)0;
+        rxq_mem = &q_mem[rxq->rxq_id].rxq;
+
+        off = (unsigned long)&rxq_mem->pg_tbl_addr_lo;
+        writel(htonl(rxq_cfg.pg_tbl_addr_lo), base_addr + off);
+
+        off = (unsigned long)&rxq_mem->pg_tbl_addr_hi;
+        writel(htonl(rxq_cfg.pg_tbl_addr_hi), base_addr + off);
+
+        off = (unsigned long)&rxq_mem->cur_q_entry_lo;
+        writel(htonl(rxq_cfg.cur_q_entry_lo), base_addr + off);
+
+        off = (unsigned long)&rxq_mem->cur_q_entry_hi;
+        writel(htonl(rxq_cfg.cur_q_entry_hi), base_addr + off);
+
+        off = (unsigned long)&rxq_mem->pg_cnt_n_prd_ptr;
+        writel(rxq_cfg.pg_cnt_n_prd_ptr, base_addr + off);
+
+        off = (unsigned long)&rxq_mem->entry_n_pg_size;
+        writel(rxq_cfg.entry_n_pg_size, base_addr + off);
+
+        off = (unsigned long)&rxq_mem->sg_n_cq_n_cns_ptr;
+        writel(rxq_cfg.sg_n_cq_n_cns_ptr, base_addr + off);
+
+        off = (unsigned long)&rxq_mem->buf_sz_n_q_state;
+        writel(rxq_cfg.buf_sz_n_q_state, base_addr + off);
+
+        off = (unsigned long)&rxq_mem->next_qid;
+        writel(rxq_cfg.next_qid, base_addr + off);
+
+        rxq->rcb->producer_index = 0;
+        rxq->rcb->consumer_index = 0;
+}
+
+void
+__bna_cq_start(struct bna_cq *cq)
+{
+        struct bna_cq_mem cq_cfg, *cq_mem;
+        const struct bna_qpt *qpt;
+        struct bna_dma_addr cur_q_addr;
+        u32 pg_num;
+        struct bna *bna = cq->rx->bna;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        qpt = &cq->qpt;
+        cur_q_addr = *((struct bna_dma_addr *)(qpt->kv_qpt_ptr));
+
+        /*
+         * Fill out structure, to be subsequently written
+         * to hardware
+         */
+        cq_cfg.pg_tbl_addr_lo = qpt->hw_qpt_ptr.lsb;
+        cq_cfg.pg_tbl_addr_hi = qpt->hw_qpt_ptr.msb;
+        cq_cfg.cur_q_entry_lo = cur_q_addr.lsb;
+        cq_cfg.cur_q_entry_hi = cur_q_addr.msb;
+
+        cq_cfg.pg_cnt_n_prd_ptr = (qpt->page_count << 16) | 0x0;
+        cq_cfg.entry_n_pg_size =
+                ((u32)(BFI_CQ_WI_SIZE >> 2) << 16) | (qpt->page_size >> 2);
+        cq_cfg.int_blk_n_cns_ptr = ((((u32)cq->ib_seg_offset) << 24) |
+                        ((u32)(cq->ib->ib_id & 0xff)  << 16) | 0x0);
+        cq_cfg.q_state = BNA_Q_IDLE_STATE;
+
+        /* Write the page number register */
+        pg_num = BNA_GET_PAGE_NUM(HQM0_BLK_PG_NUM + bna->port_num,
+                                  HQM_CQ_RAM_BASE_OFFSET);
+
+        writel(pg_num, bna->regs.page_addr);
+
+        /* H/W write */
+        base_addr = BNA_GET_MEM_BASE_ADDR(bna->pcidev.pci_bar_kva,
+                                        HQM_CQ_RAM_BASE_OFFSET);
+
+        cq_mem = (struct bna_cq_mem *)0;
+
+        off = (unsigned long)&cq_mem[cq->cq_id].pg_tbl_addr_lo;
+        writel(htonl(cq_cfg.pg_tbl_addr_lo), base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].pg_tbl_addr_hi;
+        writel(htonl(cq_cfg.pg_tbl_addr_hi), base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].cur_q_entry_lo;
+        writel(htonl(cq_cfg.cur_q_entry_lo), base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].cur_q_entry_hi;
+        writel(htonl(cq_cfg.cur_q_entry_hi), base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].pg_cnt_n_prd_ptr;
+        writel(cq_cfg.pg_cnt_n_prd_ptr, base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].entry_n_pg_size;
+        writel(cq_cfg.entry_n_pg_size, base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].int_blk_n_cns_ptr;
+        writel(cq_cfg.int_blk_n_cns_ptr, base_addr + off);
+
+        off = (unsigned long)&cq_mem[cq->cq_id].q_state;
+        writel(cq_cfg.q_state, base_addr + off);
+
+        cq->ccb->producer_index = 0;
+        *(cq->ccb->hw_producer_index) = 0;
+}
+
+void
+bna_rit_create(struct bna_rx *rx)
+{
+        struct list_head        *qe_rxp;
+        struct bna *bna;
+        struct bna_rxp *rxp;
+        struct bna_rxq *q0 = NULL;
+        struct bna_rxq *q1 = NULL;
+        int offset;
+
+        bna = rx->bna;
+
+        offset = 0;
+        list_for_each(qe_rxp, &rx->rxp_q) {
+                rxp = (struct bna_rxp *)qe_rxp;
+                GET_RXQS(rxp, q0, q1);
+                rx->rxf.rit_segment->rit[offset].large_rxq_id = q0->rxq_id;
+                rx->rxf.rit_segment->rit[offset].small_rxq_id =
+                                                (q1 ? q1->rxq_id : 0);
+                offset++;
+        }
+}
+
+int
+_rx_can_satisfy(struct bna_rx_mod *rx_mod,
+                struct bna_rx_config *rx_cfg)
+{
+        if ((rx_mod->rx_free_count == 0) ||
+                (rx_mod->rxp_free_count == 0) ||
+                (rx_mod->rxq_free_count == 0))
+                return 0;
+
+        if (rx_cfg->rxp_type == BNA_RXP_SINGLE) {
+                if ((rx_mod->rxp_free_count < rx_cfg->num_paths) ||
+                        (rx_mod->rxq_free_count < rx_cfg->num_paths))
+                                return 0;
+        } else {
+                if ((rx_mod->rxp_free_count < rx_cfg->num_paths) ||
+                        (rx_mod->rxq_free_count < (2 * rx_cfg->num_paths)))
+                        return 0;
+        }
+
+        if (!bna_rit_mod_can_satisfy(&rx_mod->bna->rit_mod, rx_cfg->num_paths))
+                return 0;
+
+        return 1;
+}
+
+struct bna_rxq *
+_get_free_rxq(struct bna_rx_mod *rx_mod)
+{
+        struct bna_rxq *rxq = NULL;
+        struct list_head        *qe = NULL;
+
+        bfa_q_deq(&rx_mod->rxq_free_q, &qe);
+        if (qe) {
+                rx_mod->rxq_free_count--;
+                rxq = (struct bna_rxq *)qe;
+        }
+        return rxq;
+}
+
+void
+_put_free_rxq(struct bna_rx_mod *rx_mod, struct bna_rxq *rxq)
+{
+        bfa_q_qe_init(&rxq->qe);
+        list_add_tail(&rxq->qe, &rx_mod->rxq_free_q);
+        rx_mod->rxq_free_count++;
+}
+
+struct bna_rxp *
+_get_free_rxp(struct bna_rx_mod *rx_mod)
+{
+        struct list_head        *qe = NULL;
+        struct bna_rxp *rxp = NULL;
+
+        bfa_q_deq(&rx_mod->rxp_free_q, &qe);
+        if (qe) {
+                rx_mod->rxp_free_count--;
+
+                rxp = (struct bna_rxp *)qe;
+        }
+
+        return rxp;
+}
+
+void
+_put_free_rxp(struct bna_rx_mod *rx_mod, struct bna_rxp *rxp)
+{
+        bfa_q_qe_init(&rxp->qe);
+        list_add_tail(&rxp->qe, &rx_mod->rxp_free_q);
+        rx_mod->rxp_free_count++;
+}
+
+struct bna_rx *
+_get_free_rx(struct bna_rx_mod *rx_mod)
+{
+        struct list_head        *qe = NULL;
+        struct bna_rx *rx = NULL;
+
+        bfa_q_deq(&rx_mod->rx_free_q, &qe);
+        if (qe) {
+                rx_mod->rx_free_count--;
+
+                rx = (struct bna_rx *)qe;
+                bfa_q_qe_init(qe);
+                list_add_tail(&rx->qe, &rx_mod->rx_active_q);
+        }
+
+        return rx;
+}
+
+void
+_put_free_rx(struct bna_rx_mod *rx_mod, struct bna_rx *rx)
+{
+        bfa_q_qe_init(&rx->qe);
+        list_add_tail(&rx->qe, &rx_mod->rx_free_q);
+        rx_mod->rx_free_count++;
+}
+
+void
+_rx_init(struct bna_rx *rx, struct bna *bna)
+{
+        rx->bna = bna;
+        rx->rx_flags = 0;
+
+        INIT_LIST_HEAD(&rx->rxp_q);
+
+        rx->rxq_stop_wc.wc_resume = bna_rx_cb_rxq_stopped_all;
+        rx->rxq_stop_wc.wc_cbarg = rx;
+        rx->rxq_stop_wc.wc_count = 0;
+
+        rx->stop_cbfn = NULL;
+        rx->stop_cbarg = NULL;
+}
+
+void
+_rxp_add_rxqs(struct bna_rxp *rxp,
+                struct bna_rxq *q0,
+                struct bna_rxq *q1)
+{
+        switch (rxp->type) {
+        case BNA_RXP_SINGLE:
+                rxp->rxq.single.only = q0;
+                rxp->rxq.single.reserved = NULL;
+                break;
+        case BNA_RXP_SLR:
+                rxp->rxq.slr.large = q0;
+                rxp->rxq.slr.small = q1;
+                break;
+        case BNA_RXP_HDS:
+                rxp->rxq.hds.data = q0;
+                rxp->rxq.hds.hdr = q1;
+                break;
+        default:
+                break;
+        }
+}
+
+void
+_rxq_qpt_init(struct bna_rxq *rxq,
+                struct bna_rxp *rxp,
+                u32 page_count,
+                u32 page_size,
+                struct bna_mem_descr *qpt_mem,
+                struct bna_mem_descr *swqpt_mem,
+                struct bna_mem_descr *page_mem)
+{
+        int     i;
+
+        rxq->qpt.hw_qpt_ptr.lsb = qpt_mem->dma.lsb;
+        rxq->qpt.hw_qpt_ptr.msb = qpt_mem->dma.msb;
+        rxq->qpt.kv_qpt_ptr = qpt_mem->kva;
+        rxq->qpt.page_count = page_count;
+        rxq->qpt.page_size = page_size;
+
+        rxq->rcb->sw_qpt = (void **) swqpt_mem->kva;
+
+        for (i = 0; i < rxq->qpt.page_count; i++) {
+                rxq->rcb->sw_qpt[i] = page_mem[i].kva;
+                ((struct bna_dma_addr *)rxq->qpt.kv_qpt_ptr)[i].lsb =
+                        page_mem[i].dma.lsb;
+                ((struct bna_dma_addr *)rxq->qpt.kv_qpt_ptr)[i].msb =
+                        page_mem[i].dma.msb;
+
+        }
+}
+
+void
+_rxp_cqpt_setup(struct bna_rxp *rxp,
+                u32 page_count,
+                u32 page_size,
+                struct bna_mem_descr *qpt_mem,
+                struct bna_mem_descr *swqpt_mem,
+                struct bna_mem_descr *page_mem)
+{
+        int     i;
+
+        rxp->cq.qpt.hw_qpt_ptr.lsb = qpt_mem->dma.lsb;
+        rxp->cq.qpt.hw_qpt_ptr.msb = qpt_mem->dma.msb;
+        rxp->cq.qpt.kv_qpt_ptr = qpt_mem->kva;
+        rxp->cq.qpt.page_count = page_count;
+        rxp->cq.qpt.page_size = page_size;
+
+        rxp->cq.ccb->sw_qpt = (void **) swqpt_mem->kva;
+
+        for (i = 0; i < rxp->cq.qpt.page_count; i++) {
+                rxp->cq.ccb->sw_qpt[i] = page_mem[i].kva;
+
+                ((struct bna_dma_addr *)rxp->cq.qpt.kv_qpt_ptr)[i].lsb =
+                        page_mem[i].dma.lsb;
+                ((struct bna_dma_addr *)rxp->cq.qpt.kv_qpt_ptr)[i].msb =
+                        page_mem[i].dma.msb;
+
+        }
+}
+
+void
+_rx_add_rxp(struct bna_rx *rx, struct bna_rxp *rxp)
+{
+        list_add_tail(&rxp->qe, &rx->rxp_q);
+}
+
+void
+_init_rxmod_queues(struct bna_rx_mod *rx_mod)
+{
+        INIT_LIST_HEAD(&rx_mod->rx_free_q);
+        INIT_LIST_HEAD(&rx_mod->rxq_free_q);
+        INIT_LIST_HEAD(&rx_mod->rxp_free_q);
+        INIT_LIST_HEAD(&rx_mod->rx_active_q);
+
+        rx_mod->rx_free_count = 0;
+        rx_mod->rxq_free_count = 0;
+        rx_mod->rxp_free_count = 0;
+}
+
+void
+_rx_ctor(struct bna_rx *rx, int id)
+{
+        bfa_q_qe_init(&rx->qe);
+        INIT_LIST_HEAD(&rx->rxp_q);
+        rx->bna = NULL;
+
+        rx->rxf.rxf_id = id;
+
+        /* FIXME: mbox_qe ctor()?? */
+        bfa_q_qe_init(&rx->mbox_qe.qe);
+
+        rx->stop_cbfn = NULL;
+        rx->stop_cbarg = NULL;
+}
+
+void
+bna_rx_cb_multi_rxq_stopped(void *arg, int status)
+{
+        struct bna_rxp *rxp = (struct bna_rxp *)arg;
+
+        bfa_wc_down(&rxp->rx->rxq_stop_wc);
+}
+
+void
+bna_rx_cb_rxq_stopped_all(void *arg)
+{
+        struct bna_rx *rx = (struct bna_rx *)arg;
+
+        bfa_fsm_send_event(rx, RX_E_RXQ_STOPPED);
+}
+
+void
+bna_rx_mod_cb_rx_stopped(void *arg, struct bna_rx *rx,
+                         enum bna_cb_status status)
+{
+        struct bna_rx_mod *rx_mod = (struct bna_rx_mod *)arg;
+
+        bfa_wc_down(&rx_mod->rx_stop_wc);
+}
+
+void
+bna_rx_mod_cb_rx_stopped_all(void *arg)
+{
+        struct bna_rx_mod *rx_mod = (struct bna_rx_mod *)arg;
+
+        if (rx_mod->stop_cbfn)
+                rx_mod->stop_cbfn(&rx_mod->bna->port, BNA_CB_SUCCESS);
+        rx_mod->stop_cbfn = NULL;
+}
+
+void
+bna_rx_start(struct bna_rx *rx)
+{
+        rx->rx_flags |= BNA_RX_F_PORT_ENABLED;
+        if (rx->rx_flags & BNA_RX_F_ENABLE)
+                bfa_fsm_send_event(rx, RX_E_START);
+}
+
+void
+bna_rx_stop(struct bna_rx *rx)
+{
+        rx->rx_flags &= ~BNA_RX_F_PORT_ENABLED;
+        if (rx->fsm == (bfa_fsm_t) bna_rx_sm_stopped)
+                bna_rx_mod_cb_rx_stopped(&rx->bna->rx_mod, rx, BNA_CB_SUCCESS);
+        else {
+                rx->stop_cbfn = bna_rx_mod_cb_rx_stopped;
+                rx->stop_cbarg = &rx->bna->rx_mod;
+                bfa_fsm_send_event(rx, RX_E_STOP);
+        }
+}
+
+void
+bna_rx_fail(struct bna_rx *rx)
+{
+        /* Indicate port is not enabled, and failed */
+        rx->rx_flags &= ~BNA_RX_F_PORT_ENABLED;
+        rx->rx_flags |= BNA_RX_F_PORT_FAILED;
+        bfa_fsm_send_event(rx, RX_E_FAIL);
+}
+
+void
+bna_rx_cb_rxf_started(struct bna_rx *rx, enum bna_cb_status status)
+{
+        bfa_fsm_send_event(rx, RX_E_RXF_STARTED);
+        if (rx->rxf.rxf_id < 32)
+                rx->bna->rx_mod.rxf_bmap[0] |= ((u32)1 << rx->rxf.rxf_id);
+        else
+                rx->bna->rx_mod.rxf_bmap[1] |= ((u32)
+                                1 << (rx->rxf.rxf_id - 32));
+}
+
+void
+bna_rx_cb_rxf_stopped(struct bna_rx *rx, enum bna_cb_status status)
+{
+        bfa_fsm_send_event(rx, RX_E_RXF_STOPPED);
+        if (rx->rxf.rxf_id < 32)
+                rx->bna->rx_mod.rxf_bmap[0] &= ~(u32)1 << rx->rxf.rxf_id;
+        else
+                rx->bna->rx_mod.rxf_bmap[1] &= ~(u32)
+                                1 << (rx->rxf.rxf_id - 32);
+}
+
+void
+bna_rx_mod_start(struct bna_rx_mod *rx_mod, enum bna_rx_type type)
+{
+        struct bna_rx *rx;
+        struct list_head *qe;
+
+        rx_mod->flags |= BNA_RX_MOD_F_PORT_STARTED;
+        if (type == BNA_RX_T_LOOPBACK)
+                rx_mod->flags |= BNA_RX_MOD_F_PORT_LOOPBACK;
+
+        list_for_each(qe, &rx_mod->rx_active_q) {
+                rx = (struct bna_rx *)qe;
+                if (rx->type == type)
+                        bna_rx_start(rx);
+        }
+}
+
+void
+bna_rx_mod_stop(struct bna_rx_mod *rx_mod, enum bna_rx_type type)
+{
+        struct bna_rx *rx;
+        struct list_head *qe;
+
+        rx_mod->flags &= ~BNA_RX_MOD_F_PORT_STARTED;
+        rx_mod->flags &= ~BNA_RX_MOD_F_PORT_LOOPBACK;
+
+        rx_mod->stop_cbfn = bna_port_cb_rx_stopped;
+
+        /**
+         * Before calling bna_rx_stop(), increment rx_stop_wc as many times
+         * as we are going to call bna_rx_stop
+         */
+        list_for_each(qe, &rx_mod->rx_active_q) {
+                rx = (struct bna_rx *)qe;
+                if (rx->type == type)
+                        bfa_wc_up(&rx_mod->rx_stop_wc);
+        }
+
+        if (rx_mod->rx_stop_wc.wc_count == 0) {
+                rx_mod->stop_cbfn(&rx_mod->bna->port, BNA_CB_SUCCESS);
+                rx_mod->stop_cbfn = NULL;
+                return;
+        }
+
+        list_for_each(qe, &rx_mod->rx_active_q) {
+                rx = (struct bna_rx *)qe;
+                if (rx->type == type)
+                        bna_rx_stop(rx);
+        }
+}
+
+void
+bna_rx_mod_fail(struct bna_rx_mod *rx_mod)
+{
+        struct bna_rx *rx;
+        struct list_head *qe;
+
+        rx_mod->flags &= ~BNA_RX_MOD_F_PORT_STARTED;
+        rx_mod->flags &= ~BNA_RX_MOD_F_PORT_LOOPBACK;
+
+        list_for_each(qe, &rx_mod->rx_active_q) {
+                rx = (struct bna_rx *)qe;
+                bna_rx_fail(rx);
+        }
+}
+
+void bna_rx_mod_init(struct bna_rx_mod *rx_mod, struct bna *bna,
+                        struct bna_res_info *res_info)
+{
+        int     index;
+        struct bna_rx *rx_ptr;
+        struct bna_rxp *rxp_ptr;
+        struct bna_rxq *rxq_ptr;
+
+        rx_mod->bna = bna;
+        rx_mod->flags = 0;
+
+        rx_mod->rx = (struct bna_rx *)
+                res_info[BNA_RES_MEM_T_RX_ARRAY].res_u.mem_info.mdl[0].kva;
+        rx_mod->rxp = (struct bna_rxp *)
+                res_info[BNA_RES_MEM_T_RXP_ARRAY].res_u.mem_info.mdl[0].kva;
+        rx_mod->rxq = (struct bna_rxq *)
+                res_info[BNA_RES_MEM_T_RXQ_ARRAY].res_u.mem_info.mdl[0].kva;
+
+        /* Initialize the queues */
+        _init_rxmod_queues(rx_mod);
+
+        /* Build RX queues */
+        for (index = 0; index < BFI_MAX_RXQ; index++) {
+                rx_ptr = &rx_mod->rx[index];
+                _rx_ctor(rx_ptr, index);
+                list_add_tail(&rx_ptr->qe, &rx_mod->rx_free_q);
+                rx_mod->rx_free_count++;
+        }
+
+        /* build RX-path queue */
+        for (index = 0; index < BFI_MAX_RXQ; index++) {
+                rxp_ptr = &rx_mod->rxp[index];
+                rxp_ptr->cq.cq_id = index;
+                bfa_q_qe_init(&rxp_ptr->qe);
+                list_add_tail(&rxp_ptr->qe, &rx_mod->rxp_free_q);
+                rx_mod->rxp_free_count++;
+        }
+
+        /* build RXQ queue */
+        for (index = 0; index < BFI_MAX_RXQ; index++) {
+                rxq_ptr = &rx_mod->rxq[index];
+                rxq_ptr->rxq_id = index;
+
+                bfa_q_qe_init(&rxq_ptr->qe);
+                list_add_tail(&rxq_ptr->qe, &rx_mod->rxq_free_q);
+                rx_mod->rxq_free_count++;
+        }
+
+        rx_mod->rx_stop_wc.wc_resume = bna_rx_mod_cb_rx_stopped_all;
+        rx_mod->rx_stop_wc.wc_cbarg = rx_mod;
+        rx_mod->rx_stop_wc.wc_count = 0;
+}
+
+void
+bna_rx_mod_uninit(struct bna_rx_mod *rx_mod)
+{
+        struct list_head                *qe;
+        int i;
+
+        i = 0;
+        list_for_each(qe, &rx_mod->rx_free_q)
+                i++;
+
+        i = 0;
+        list_for_each(qe, &rx_mod->rxp_free_q)
+                i++;
+
+        i = 0;
+        list_for_each(qe, &rx_mod->rxq_free_q)
+                i++;
+
+        rx_mod->bna = NULL;
+}
+
+int
+bna_rx_state_get(struct bna_rx *rx)
+{
+        return bfa_sm_to_state(rx_sm_table, rx->fsm);
+}
+
+void
+bna_rx_res_req(struct bna_rx_config *q_cfg, struct bna_res_info *res_info)
+{
+        u32 cq_size, hq_size, dq_size;
+        u32 cpage_count, hpage_count, dpage_count;
+        struct bna_mem_info *mem_info;
+        u32 cq_depth;
+        u32 hq_depth;
+        u32 dq_depth;
+
+        dq_depth = q_cfg->q_depth;
+        hq_depth = ((q_cfg->rxp_type == BNA_RXP_SINGLE) ? 0 : q_cfg->q_depth);
+        cq_depth = dq_depth + hq_depth;
+
+        BNA_TO_POWER_OF_2_HIGH(cq_depth);
+        cq_size = cq_depth * BFI_CQ_WI_SIZE;
+        cq_size = ALIGN(cq_size, PAGE_SIZE);
+        cpage_count = SIZE_TO_PAGES(cq_size);
+
+        BNA_TO_POWER_OF_2_HIGH(dq_depth);
+        dq_size = dq_depth * BFI_RXQ_WI_SIZE;
+        dq_size = ALIGN(dq_size, PAGE_SIZE);
+        dpage_count = SIZE_TO_PAGES(dq_size);
+
+        if (BNA_RXP_SINGLE != q_cfg->rxp_type) {
+                BNA_TO_POWER_OF_2_HIGH(hq_depth);
+                hq_size = hq_depth * BFI_RXQ_WI_SIZE;
+                hq_size = ALIGN(hq_size, PAGE_SIZE);
+                hpage_count = SIZE_TO_PAGES(hq_size);
+        } else {
+                hpage_count = 0;
+        }
+
+        /* CCB structures */
+        res_info[BNA_RX_RES_MEM_T_CCB].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_CCB].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = sizeof(struct bna_ccb);
+        mem_info->num = q_cfg->num_paths;
+
+        /* RCB structures */
+        res_info[BNA_RX_RES_MEM_T_RCB].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_RCB].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = sizeof(struct bna_rcb);
+        mem_info->num = BNA_GET_RXQS(q_cfg);
+
+        /* Completion QPT */
+        res_info[BNA_RX_RES_MEM_T_CQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_CQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = cpage_count * sizeof(struct bna_dma_addr);
+        mem_info->num = q_cfg->num_paths;
+
+        /* Completion s/w QPT */
+        res_info[BNA_RX_RES_MEM_T_CSWQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_CSWQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = cpage_count * sizeof(void *);
+        mem_info->num = q_cfg->num_paths;
+
+        /* Completion QPT pages */
+        res_info[BNA_RX_RES_MEM_T_CQPT_PAGE].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_CQPT_PAGE].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = PAGE_SIZE;
+        mem_info->num = cpage_count * q_cfg->num_paths;
+
+        /* Data QPTs */
+        res_info[BNA_RX_RES_MEM_T_DQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_DQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = dpage_count * sizeof(struct bna_dma_addr);
+        mem_info->num = q_cfg->num_paths;
+
+        /* Data s/w QPTs */
+        res_info[BNA_RX_RES_MEM_T_DSWQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_DSWQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = dpage_count * sizeof(void *);
+        mem_info->num = q_cfg->num_paths;
+
+        /* Data QPT pages */
+        res_info[BNA_RX_RES_MEM_T_DPAGE].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_DPAGE].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = PAGE_SIZE;
+        mem_info->num = dpage_count * q_cfg->num_paths;
+
+        /* Hdr QPTs */
+        res_info[BNA_RX_RES_MEM_T_HQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_HQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = hpage_count * sizeof(struct bna_dma_addr);
+        mem_info->num = (hpage_count ? q_cfg->num_paths : 0);
+
+        /* Hdr s/w QPTs */
+        res_info[BNA_RX_RES_MEM_T_HSWQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_HSWQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = hpage_count * sizeof(void *);
+        mem_info->num = (hpage_count ? q_cfg->num_paths : 0);
+
+        /* Hdr QPT pages */
+        res_info[BNA_RX_RES_MEM_T_HPAGE].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_RX_RES_MEM_T_HPAGE].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = (hpage_count ? PAGE_SIZE : 0);
+        mem_info->num = (hpage_count ? (hpage_count * q_cfg->num_paths) : 0);
+
+        /* RX Interrupts */
+        res_info[BNA_RX_RES_T_INTR].res_type = BNA_RES_T_INTR;
+        res_info[BNA_RX_RES_T_INTR].res_u.intr_info.intr_type = BNA_INTR_T_MSIX;
+        res_info[BNA_RX_RES_T_INTR].res_u.intr_info.num = q_cfg->num_paths;
+}
+
+struct bna_rx *
+bna_rx_create(struct bna *bna, struct bnad *bnad,
+                struct bna_rx_config *rx_cfg,
+                struct bna_rx_event_cbfn *rx_cbfn,
+                struct bna_res_info *res_info,
+                void *priv)
+{
+        struct bna_rx_mod *rx_mod = &bna->rx_mod;
+        struct bna_rx *rx;
+        struct bna_rxp *rxp;
+        struct bna_rxq *q0;
+        struct bna_rxq *q1;
+        struct bna_intr_info *intr_info;
+        u32 page_count;
+        struct bna_mem_descr *ccb_mem;
+        struct bna_mem_descr *rcb_mem;
+        struct bna_mem_descr *unmapq_mem;
+        struct bna_mem_descr *cqpt_mem;
+        struct bna_mem_descr *cswqpt_mem;
+        struct bna_mem_descr *cpage_mem;
+        struct bna_mem_descr *hqpt_mem; /* Header/Small Q qpt */
+        struct bna_mem_descr *dqpt_mem; /* Data/Large Q qpt */
+        struct bna_mem_descr *hsqpt_mem;        /* s/w qpt for hdr */
+        struct bna_mem_descr *dsqpt_mem;        /* s/w qpt for data */
+        struct bna_mem_descr *hpage_mem;        /* hdr page mem */
+        struct bna_mem_descr *dpage_mem;        /* data page mem */
+        int i, cpage_idx = 0, dpage_idx = 0, hpage_idx = 0, ret;
+        int dpage_count, hpage_count, rcb_idx;
+        struct bna_ib_config ibcfg;
+        /* Fail if we don't have enough RXPs, RXQs */
+        if (!_rx_can_satisfy(rx_mod, rx_cfg))
+                return NULL;
+
+        /* Initialize resource pointers */
+        intr_info = &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
+        ccb_mem = &res_info[BNA_RX_RES_MEM_T_CCB].res_u.mem_info.mdl[0];
+        rcb_mem = &res_info[BNA_RX_RES_MEM_T_RCB].res_u.mem_info.mdl[0];
+        unmapq_mem = &res_info[BNA_RX_RES_MEM_T_UNMAPQ].res_u.mem_info.mdl[0];
+        cqpt_mem = &res_info[BNA_RX_RES_MEM_T_CQPT].res_u.mem_info.mdl[0];
+        cswqpt_mem = &res_info[BNA_RX_RES_MEM_T_CSWQPT].res_u.mem_info.mdl[0];
+        cpage_mem = &res_info[BNA_RX_RES_MEM_T_CQPT_PAGE].res_u.mem_info.mdl[0];
+        hqpt_mem = &res_info[BNA_RX_RES_MEM_T_HQPT].res_u.mem_info.mdl[0];
+        dqpt_mem = &res_info[BNA_RX_RES_MEM_T_DQPT].res_u.mem_info.mdl[0];
+        hsqpt_mem = &res_info[BNA_RX_RES_MEM_T_HSWQPT].res_u.mem_info.mdl[0];
+        dsqpt_mem = &res_info[BNA_RX_RES_MEM_T_DSWQPT].res_u.mem_info.mdl[0];
+        hpage_mem = &res_info[BNA_RX_RES_MEM_T_HPAGE].res_u.mem_info.mdl[0];
+        dpage_mem = &res_info[BNA_RX_RES_MEM_T_DPAGE].res_u.mem_info.mdl[0];
+
+        /* Compute q depth & page count */
+        page_count = res_info[BNA_RX_RES_MEM_T_CQPT_PAGE].res_u.mem_info.num /
+                        rx_cfg->num_paths;
+
+        dpage_count = res_info[BNA_RX_RES_MEM_T_DPAGE].res_u.mem_info.num /
+                        rx_cfg->num_paths;
+
+        hpage_count = res_info[BNA_RX_RES_MEM_T_HPAGE].res_u.mem_info.num /
+                        rx_cfg->num_paths;
+        /* Get RX pointer */
+        rx = _get_free_rx(rx_mod);
+        _rx_init(rx, bna);
+        rx->priv = priv;
+        rx->type = rx_cfg->rx_type;
+
+        rx->rcb_setup_cbfn = rx_cbfn->rcb_setup_cbfn;
+        rx->rcb_destroy_cbfn = rx_cbfn->rcb_destroy_cbfn;
+        rx->ccb_setup_cbfn = rx_cbfn->ccb_setup_cbfn;
+        rx->ccb_destroy_cbfn = rx_cbfn->ccb_destroy_cbfn;
+        /* Following callbacks are mandatory */
+        rx->rx_cleanup_cbfn = rx_cbfn->rx_cleanup_cbfn;
+        rx->rx_post_cbfn = rx_cbfn->rx_post_cbfn;
+
+        if (rx->bna->rx_mod.flags & BNA_RX_MOD_F_PORT_STARTED) {
+                switch (rx->type) {
+                case BNA_RX_T_REGULAR:
+                        if (!(rx->bna->rx_mod.flags &
+                                BNA_RX_MOD_F_PORT_LOOPBACK))
+                                rx->rx_flags |= BNA_RX_F_PORT_ENABLED;
+                        break;
+                case BNA_RX_T_LOOPBACK:
+                        if (rx->bna->rx_mod.flags & BNA_RX_MOD_F_PORT_LOOPBACK)
+                                rx->rx_flags |= BNA_RX_F_PORT_ENABLED;
+                        break;
+                }
+        }
+
+        for (i = 0, rcb_idx = 0; i < rx_cfg->num_paths; i++) {
+                rxp = _get_free_rxp(rx_mod);
+                rxp->type = rx_cfg->rxp_type;
+                rxp->rx = rx;
+                rxp->cq.rx = rx;
+
+                /* Get required RXQs, and queue them to rx-path */
+                q0 = _get_free_rxq(rx_mod);
+                if (BNA_RXP_SINGLE == rx_cfg->rxp_type)
+                        q1 = NULL;
+                else
+                        q1 = _get_free_rxq(rx_mod);
+
+                /* Initialize IB */
+                if (1 == intr_info->num) {
+                        rxp->cq.ib = bna_ib_get(&bna->ib_mod,
+                                        intr_info->intr_type,
+                                        intr_info->idl[0].vector);
+                        rxp->vector = intr_info->idl[0].vector;
+                } else {
+                        rxp->cq.ib = bna_ib_get(&bna->ib_mod,
+                                        intr_info->intr_type,
+                                        intr_info->idl[i].vector);
+
+                        /* Map the MSI-x vector used for this RXP */
+                        rxp->vector = intr_info->idl[i].vector;
+                }
+
+                rxp->cq.ib_seg_offset = bna_ib_reserve_idx(rxp->cq.ib);
+
+                ibcfg.coalescing_timeo = BFI_RX_COALESCING_TIMEO;
+                ibcfg.interpkt_count = BFI_RX_INTERPKT_COUNT;
+                ibcfg.interpkt_timeo = BFI_RX_INTERPKT_TIMEO;
+                ibcfg.ctrl_flags = BFI_IB_CF_INT_ENABLE;
+
+                ret = bna_ib_config(rxp->cq.ib, &ibcfg);
+
+                /* Link rxqs to rxp */
+                _rxp_add_rxqs(rxp, q0, q1);
+
+                /* Link rxp to rx */
+                _rx_add_rxp(rx, rxp);
+
+                q0->rx = rx;
+                q0->rxp = rxp;
+
+                /* Initialize RCB for the large / data q */
+                q0->rcb = (struct bna_rcb *) rcb_mem[rcb_idx].kva;
+                RXQ_RCB_INIT(q0, rxp, rx_cfg->q_depth, bna, 0,
+                        (void *)unmapq_mem[rcb_idx].kva);
+                rcb_idx++;
+                (q0)->rx_packets = (q0)->rx_bytes = 0;
+                (q0)->rx_packets_with_error = (q0)->rxbuf_alloc_failed = 0;
+
+                /* Initialize RXQs */
+                _rxq_qpt_init(q0, rxp, dpage_count, PAGE_SIZE,
+                        &dqpt_mem[i], &dsqpt_mem[i], &dpage_mem[dpage_idx]);
+                q0->rcb->page_idx = dpage_idx;
+                q0->rcb->page_count = dpage_count;
+                dpage_idx += dpage_count;
+
+                /* Call bnad to complete rcb setup */
+                if (rx->rcb_setup_cbfn)
+                        rx->rcb_setup_cbfn(bnad, q0->rcb);
+
+                if (q1) {
+                        q1->rx = rx;
+                        q1->rxp = rxp;
+
+                        q1->rcb = (struct bna_rcb *) rcb_mem[rcb_idx].kva;
+                        RXQ_RCB_INIT(q1, rxp, rx_cfg->q_depth, bna, 1,
+                                (void *)unmapq_mem[rcb_idx].kva);
+                        rcb_idx++;
+                        (q1)->buffer_size = (rx_cfg)->small_buff_size;
+                        (q1)->rx_packets = (q1)->rx_bytes = 0;
+                        (q1)->rx_packets_with_error =
+                                (q1)->rxbuf_alloc_failed = 0;
+
+                        _rxq_qpt_init(q1, rxp, hpage_count, PAGE_SIZE,
+                                &hqpt_mem[i], &hsqpt_mem[i],
+                                &hpage_mem[hpage_idx]);
+                        q1->rcb->page_idx = hpage_idx;
+                        q1->rcb->page_count = hpage_count;
+                        hpage_idx += hpage_count;
+
+                        /* Call bnad to complete rcb setup */
+                        if (rx->rcb_setup_cbfn)
+                                rx->rcb_setup_cbfn(bnad, q1->rcb);
+                }
+                /* Setup RXP::CQ */
+                rxp->cq.ccb = (struct bna_ccb *) ccb_mem[i].kva;
+                _rxp_cqpt_setup(rxp, page_count, PAGE_SIZE,
+                        &cqpt_mem[i], &cswqpt_mem[i], &cpage_mem[cpage_idx]);
+                rxp->cq.ccb->page_idx = cpage_idx;
+                rxp->cq.ccb->page_count = page_count;
+                cpage_idx += page_count;
+
+                rxp->cq.ccb->pkt_rate.small_pkt_cnt = 0;
+                rxp->cq.ccb->pkt_rate.large_pkt_cnt = 0;
+
+                rxp->cq.ccb->producer_index = 0;
+                rxp->cq.ccb->q_depth =  rx_cfg->q_depth +
+                                        ((rx_cfg->rxp_type == BNA_RXP_SINGLE) ?
+                                        0 : rx_cfg->q_depth);
+                rxp->cq.ccb->i_dbell = &rxp->cq.ib->door_bell;
+                rxp->cq.ccb->rcb[0] = q0->rcb;
+                if (q1)
+                        rxp->cq.ccb->rcb[1] = q1->rcb;
+                rxp->cq.ccb->cq = &rxp->cq;
+                rxp->cq.ccb->bnad = bna->bnad;
+                rxp->cq.ccb->hw_producer_index =
+                        ((volatile u32 *)rxp->cq.ib->ib_seg_host_addr_kva +
+                                      (rxp->cq.ib_seg_offset * BFI_IBIDX_SIZE));
+                *(rxp->cq.ccb->hw_producer_index) = 0;
+                rxp->cq.ccb->intr_type = intr_info->intr_type;
+                rxp->cq.ccb->intr_vector = (intr_info->num == 1) ?
+                                                intr_info->idl[0].vector :
+                                                intr_info->idl[i].vector;
+                rxp->cq.ccb->rx_coalescing_timeo =
+                                        rxp->cq.ib->ib_config.coalescing_timeo;
+                rxp->cq.ccb->id = i;
+
+                /* Call bnad to complete CCB setup */
+                if (rx->ccb_setup_cbfn)
+                        rx->ccb_setup_cbfn(bnad, rxp->cq.ccb);
+
+        } /* for each rx-path */
+
+        bna_rxf_init(&rx->rxf, rx, rx_cfg);
+
+        bfa_fsm_set_state(rx, bna_rx_sm_stopped);
+
+        return rx;
+}
+
+void
+bna_rx_destroy(struct bna_rx *rx)
+{
+        struct bna_rx_mod *rx_mod = &rx->bna->rx_mod;
+        struct bna_ib_mod *ib_mod = &rx->bna->ib_mod;
+        struct bna_rxq *q0 = NULL;
+        struct bna_rxq *q1 = NULL;
+        struct bna_rxp *rxp;
+        struct list_head *qe;
+
+        bna_rxf_uninit(&rx->rxf);
+
+        while (!list_empty(&rx->rxp_q)) {
+                bfa_q_deq(&rx->rxp_q, &rxp);
+                GET_RXQS(rxp, q0, q1);
+                /* Callback to bnad for destroying RCB */
+                if (rx->rcb_destroy_cbfn)
+                        rx->rcb_destroy_cbfn(rx->bna->bnad, q0->rcb);
+                q0->rcb = NULL;
+                q0->rxp = NULL;
+                q0->rx = NULL;
+                _put_free_rxq(rx_mod, q0);
+                if (q1) {
+                        /* Callback to bnad for destroying RCB */
+                        if (rx->rcb_destroy_cbfn)
+                                rx->rcb_destroy_cbfn(rx->bna->bnad, q1->rcb);
+                        q1->rcb = NULL;
+                        q1->rxp = NULL;
+                        q1->rx = NULL;
+                        _put_free_rxq(rx_mod, q1);
+                }
+                rxp->rxq.slr.large = NULL;
+                rxp->rxq.slr.small = NULL;
+                if (rxp->cq.ib) {
+                        if (rxp->cq.ib_seg_offset != 0xff)
+                                bna_ib_release_idx(rxp->cq.ib,
+                                                rxp->cq.ib_seg_offset);
+                        bna_ib_put(ib_mod, rxp->cq.ib);
+                        rxp->cq.ib = NULL;
+                }
+                /* Callback to bnad for destroying CCB */
+                if (rx->ccb_destroy_cbfn)
+                        rx->ccb_destroy_cbfn(rx->bna->bnad, rxp->cq.ccb);
+                rxp->cq.ccb = NULL;
+                rxp->rx = NULL;
+                _put_free_rxp(rx_mod, rxp);
+        }
+
+        list_for_each(qe, &rx_mod->rx_active_q) {
+                if (qe == &rx->qe) {
+                        list_del(&rx->qe);
+                        bfa_q_qe_init(&rx->qe);
+                        break;
+                }
+        }
+
+        rx->bna = NULL;
+        rx->priv = NULL;
+        _put_free_rx(rx_mod, rx);
+}
+
+void
+bna_rx_enable(struct bna_rx *rx)
+{
+        if (rx->fsm != (bfa_sm_t)bna_rx_sm_stopped)
+                return;
+
+        rx->rx_flags |= BNA_RX_F_ENABLE;
+        if (rx->rx_flags & BNA_RX_F_PORT_ENABLED)
+                bfa_fsm_send_event(rx, RX_E_START);
+}
+
+void
+bna_rx_disable(struct bna_rx *rx, enum bna_cleanup_type type,
+                void (*cbfn)(void *, struct bna_rx *,
+                                enum bna_cb_status))
+{
+        if (type == BNA_SOFT_CLEANUP) {
+                /* h/w should not be accessed. Treat we're stopped */
+                (*cbfn)(rx->bna->bnad, rx, BNA_CB_SUCCESS);
+        } else {
+                rx->stop_cbfn = cbfn;
+                rx->stop_cbarg = rx->bna->bnad;
+
+                rx->rx_flags &= ~BNA_RX_F_ENABLE;
+
+                bfa_fsm_send_event(rx, RX_E_STOP);
+        }
+}
+
+/**
+ * TX
+ */
+#define call_tx_stop_cbfn(tx, status)\
+do {\
+        if ((tx)->stop_cbfn)\
+                (tx)->stop_cbfn((tx)->stop_cbarg, (tx), status);\
+        (tx)->stop_cbfn = NULL;\
+        (tx)->stop_cbarg = NULL;\
+} while (0)
+
+#define call_tx_prio_change_cbfn(tx, status)\
+do {\
+        if ((tx)->prio_change_cbfn)\
+                (tx)->prio_change_cbfn((tx)->bna->bnad, (tx), status);\
+        (tx)->prio_change_cbfn = NULL;\
+} while (0)
+
+static void bna_tx_mod_cb_tx_stopped(void *tx_mod, struct bna_tx *tx,
+                                        enum bna_cb_status status);
+static void bna_tx_cb_txq_stopped(void *arg, int status);
+static void bna_tx_cb_stats_cleared(void *arg, int status);
+static void __bna_tx_stop(struct bna_tx *tx);
+static void __bna_tx_start(struct bna_tx *tx);
+static void __bna_txf_stat_clr(struct bna_tx *tx);
+
+enum bna_tx_event {
+        TX_E_START                      = 1,
+        TX_E_STOP                       = 2,
+        TX_E_FAIL                       = 3,
+        TX_E_TXQ_STOPPED                = 4,
+        TX_E_PRIO_CHANGE                = 5,
+        TX_E_STAT_CLEARED               = 6,
+};
+
+enum bna_tx_state {
+        BNA_TX_STOPPED                  = 1,
+        BNA_TX_STARTED                  = 2,
+        BNA_TX_TXQ_STOP_WAIT            = 3,
+        BNA_TX_PRIO_STOP_WAIT           = 4,
+        BNA_TX_STAT_CLR_WAIT            = 5,
+};
+
+bfa_fsm_state_decl(bna_tx, stopped, struct bna_tx,
+                        enum bna_tx_event);
+bfa_fsm_state_decl(bna_tx, started, struct bna_tx,
+                        enum bna_tx_event);
+bfa_fsm_state_decl(bna_tx, txq_stop_wait, struct bna_tx,
+                        enum bna_tx_event);
+bfa_fsm_state_decl(bna_tx, prio_stop_wait, struct bna_tx,
+                        enum bna_tx_event);
+bfa_fsm_state_decl(bna_tx, stat_clr_wait, struct bna_tx,
+                        enum bna_tx_event);
+
+static struct bfa_sm_table tx_sm_table[] = {
+        {BFA_SM(bna_tx_sm_stopped), BNA_TX_STOPPED},
+        {BFA_SM(bna_tx_sm_started), BNA_TX_STARTED},
+        {BFA_SM(bna_tx_sm_txq_stop_wait), BNA_TX_TXQ_STOP_WAIT},
+        {BFA_SM(bna_tx_sm_prio_stop_wait), BNA_TX_PRIO_STOP_WAIT},
+        {BFA_SM(bna_tx_sm_stat_clr_wait), BNA_TX_STAT_CLR_WAIT},
+};
+
+static void
+bna_tx_sm_stopped_entry(struct bna_tx *tx)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                (tx->tx_cleanup_cbfn)(tx->bna->bnad, txq->tcb);
+        }
+
+        call_tx_stop_cbfn(tx, BNA_CB_SUCCESS);
+}
+
+static void
+bna_tx_sm_stopped(struct bna_tx *tx, enum bna_tx_event event)
+{
+        switch (event) {
+        case TX_E_START:
+                bfa_fsm_set_state(tx, bna_tx_sm_started);
+                break;
+
+        case TX_E_STOP:
+                bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+                break;
+
+        case TX_E_FAIL:
+                /* No-op */
+                break;
+
+        case TX_E_PRIO_CHANGE:
+                call_tx_prio_change_cbfn(tx, BNA_CB_SUCCESS);
+                break;
+
+        case TX_E_TXQ_STOPPED:
+                /**
+                 * This event is received due to flushing of mbox when
+                 * device fails
+                 */
+                /* No-op */
+                break;
+
+        default:
+                bfa_sm_fault(tx->bna, event);
+        }
+}
+
+static void
+bna_tx_sm_started_entry(struct bna_tx *tx)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        __bna_tx_start(tx);
+
+        /* Start IB */
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                bna_ib_ack(&txq->ib->door_bell, 0);
+        }
+}
+
+static void
+bna_tx_sm_started(struct bna_tx *tx, enum bna_tx_event event)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        switch (event) {
+        case TX_E_STOP:
+                bfa_fsm_set_state(tx, bna_tx_sm_txq_stop_wait);
+                __bna_tx_stop(tx);
+                break;
+
+        case TX_E_FAIL:
+                list_for_each(qe, &tx->txq_q) {
+                        txq = (struct bna_txq *)qe;
+                        bna_ib_fail(txq->ib);
+                        (tx->tx_stall_cbfn)(tx->bna->bnad, txq->tcb);
+                }
+                bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+                break;
+
+        case TX_E_PRIO_CHANGE:
+                bfa_fsm_set_state(tx, bna_tx_sm_prio_stop_wait);
+                break;
+
+        default:
+                bfa_sm_fault(tx->bna, event);
+        }
+}
+
+static void
+bna_tx_sm_txq_stop_wait_entry(struct bna_tx *tx)
+{
+}
+
+static void
+bna_tx_sm_txq_stop_wait(struct bna_tx *tx, enum bna_tx_event event)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        switch (event) {
+        case TX_E_FAIL:
+                bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+                break;
+
+        case TX_E_TXQ_STOPPED:
+                list_for_each(qe, &tx->txq_q) {
+                        txq = (struct bna_txq *)qe;
+                        bna_ib_stop(txq->ib);
+                }
+                bfa_fsm_set_state(tx, bna_tx_sm_stat_clr_wait);
+                break;
+
+        case TX_E_PRIO_CHANGE:
+                /* No-op */
+                break;
+
+        default:
+                bfa_sm_fault(tx->bna, event);
+        }
+}
+
+static void
+bna_tx_sm_prio_stop_wait_entry(struct bna_tx *tx)
+{
+        __bna_tx_stop(tx);
+}
+
+static void
+bna_tx_sm_prio_stop_wait(struct bna_tx *tx, enum bna_tx_event event)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        switch (event) {
+        case TX_E_STOP:
+                bfa_fsm_set_state(tx, bna_tx_sm_txq_stop_wait);
+                break;
+
+        case TX_E_FAIL:
+                call_tx_prio_change_cbfn(tx, BNA_CB_FAIL);
+                bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+                break;
+
+        case TX_E_TXQ_STOPPED:
+                list_for_each(qe, &tx->txq_q) {
+                        txq = (struct bna_txq *)qe;
+                        bna_ib_stop(txq->ib);
+                        (tx->tx_cleanup_cbfn)(tx->bna->bnad, txq->tcb);
+                }
+                call_tx_prio_change_cbfn(tx, BNA_CB_SUCCESS);
+                bfa_fsm_set_state(tx, bna_tx_sm_started);
+                break;
+
+        case TX_E_PRIO_CHANGE:
+                /* No-op */
+                break;
+
+        default:
+                bfa_sm_fault(tx->bna, event);
+        }
+}
+
+static void
+bna_tx_sm_stat_clr_wait_entry(struct bna_tx *tx)
+{
+        __bna_txf_stat_clr(tx);
+}
+
+static void
+bna_tx_sm_stat_clr_wait(struct bna_tx *tx, enum bna_tx_event event)
+{
+        switch (event) {
+        case TX_E_FAIL:
+        case TX_E_STAT_CLEARED:
+                bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+                break;
+
+        default:
+                bfa_sm_fault(tx->bna, event);
+        }
+}
+
+static void
+__bna_txq_start(struct bna_tx *tx, struct bna_txq *txq)
+{
+        struct bna_rxtx_q_mem *q_mem;
+        struct bna_txq_mem txq_cfg;
+        struct bna_txq_mem *txq_mem;
+        struct bna_dma_addr cur_q_addr;
+        u32 pg_num;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        /* Fill out structure, to be subsequently written to hardware */
+        txq_cfg.pg_tbl_addr_lo = txq->qpt.hw_qpt_ptr.lsb;
+        txq_cfg.pg_tbl_addr_hi = txq->qpt.hw_qpt_ptr.msb;
+        cur_q_addr = *((struct bna_dma_addr *)(txq->qpt.kv_qpt_ptr));
+        txq_cfg.cur_q_entry_lo = cur_q_addr.lsb;
+        txq_cfg.cur_q_entry_hi = cur_q_addr.msb;
+
+        txq_cfg.pg_cnt_n_prd_ptr = (txq->qpt.page_count << 16) | 0x0;
+
+        txq_cfg.entry_n_pg_size = ((u32)(BFI_TXQ_WI_SIZE >> 2) << 16) |
+                        (txq->qpt.page_size >> 2);
+        txq_cfg.int_blk_n_cns_ptr = ((((u32)txq->ib_seg_offset) << 24) |
+                        ((u32)(txq->ib->ib_id & 0xff) << 16) | 0x0);
+
+        txq_cfg.cns_ptr2_n_q_state = BNA_Q_IDLE_STATE;
+        txq_cfg.nxt_qid_n_fid_n_pri = (((tx->txf.txf_id & 0x3f) << 3) |
+                        (txq->priority & 0x3));
+        txq_cfg.wvc_n_cquota_n_rquota =
+                        ((((u32)BFI_TX_MAX_WRR_QUOTA & 0xfff) << 12) |
+                        (BFI_TX_MAX_WRR_QUOTA & 0xfff));
+
+        /* Setup the page and write to H/W */
+
+        pg_num = BNA_GET_PAGE_NUM(HQM0_BLK_PG_NUM + tx->bna->port_num,
+                        HQM_RXTX_Q_RAM_BASE_OFFSET);
+        writel(pg_num, tx->bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(tx->bna->pcidev.pci_bar_kva,
+                                        HQM_RXTX_Q_RAM_BASE_OFFSET);
+        q_mem = (struct bna_rxtx_q_mem *)0;
+        txq_mem = &q_mem[txq->txq_id].txq;
+
+        /*
+         * The following 4 lines, is a hack b'cos the H/W needs to read
+         * these DMA addresses as little endian
+         */
+
+        off = (unsigned long)&txq_mem->pg_tbl_addr_lo;
+        writel(htonl(txq_cfg.pg_tbl_addr_lo), base_addr + off);
+
+        off = (unsigned long)&txq_mem->pg_tbl_addr_hi;
+        writel(htonl(txq_cfg.pg_tbl_addr_hi), base_addr + off);
+
+        off = (unsigned long)&txq_mem->cur_q_entry_lo;
+        writel(htonl(txq_cfg.cur_q_entry_lo), base_addr + off);
+
+        off = (unsigned long)&txq_mem->cur_q_entry_hi;
+        writel(htonl(txq_cfg.cur_q_entry_hi), base_addr + off);
+
+        off = (unsigned long)&txq_mem->pg_cnt_n_prd_ptr;
+        writel(txq_cfg.pg_cnt_n_prd_ptr, base_addr + off);
+
+        off = (unsigned long)&txq_mem->entry_n_pg_size;
+        writel(txq_cfg.entry_n_pg_size, base_addr + off);
+
+        off = (unsigned long)&txq_mem->int_blk_n_cns_ptr;
+        writel(txq_cfg.int_blk_n_cns_ptr, base_addr + off);
+
+        off = (unsigned long)&txq_mem->cns_ptr2_n_q_state;
+        writel(txq_cfg.cns_ptr2_n_q_state, base_addr + off);
+
+        off = (unsigned long)&txq_mem->nxt_qid_n_fid_n_pri;
+        writel(txq_cfg.nxt_qid_n_fid_n_pri, base_addr + off);
+
+        off = (unsigned long)&txq_mem->wvc_n_cquota_n_rquota;
+        writel(txq_cfg.wvc_n_cquota_n_rquota, base_addr + off);
+
+        txq->tcb->producer_index = 0;
+        txq->tcb->consumer_index = 0;
+        *(txq->tcb->hw_consumer_index) = 0;
+
+}
+
+static void
+__bna_txq_stop(struct bna_tx *tx, struct bna_txq *txq)
+{
+        struct bfi_ll_q_stop_req ll_req;
+        u32 bit_mask[2] = {0, 0};
+        if (txq->txq_id < 32)
+                bit_mask[0] = (u32)1 << txq->txq_id;
+        else
+                bit_mask[1] = (u32)1 << (txq->txq_id - 32);
+
+        memset(&ll_req, 0, sizeof(ll_req));
+        ll_req.mh.msg_class = BFI_MC_LL;
+        ll_req.mh.msg_id = BFI_LL_H2I_TXQ_STOP_REQ;
+        ll_req.mh.mtag.h2i.lpu_id = 0;
+        ll_req.q_id_mask[0] = htonl(bit_mask[0]);
+        ll_req.q_id_mask[1] = htonl(bit_mask[1]);
+
+        bna_mbox_qe_fill(&tx->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_tx_cb_txq_stopped, tx);
+
+        bna_mbox_send(tx->bna, &tx->mbox_qe);
+}
+
+static void
+__bna_txf_start(struct bna_tx *tx)
+{
+        struct bna_tx_fndb_ram *tx_fndb;
+        struct bna_txf *txf = &tx->txf;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        writel(BNA_GET_PAGE_NUM(LUT0_MEM_BLK_BASE_PG_NUM +
+                        (tx->bna->port_num * 2), TX_FNDB_RAM_BASE_OFFSET),
+                        tx->bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(tx->bna->pcidev.pci_bar_kva,
+                                        TX_FNDB_RAM_BASE_OFFSET);
+
+        tx_fndb = (struct bna_tx_fndb_ram *)0;
+        off = (unsigned long)&tx_fndb[txf->txf_id].vlan_n_ctrl_flags;
+
+        writel(((u32)txf->vlan << 16) | txf->ctrl_flags,
+                        base_addr + off);
+
+        if (tx->txf.txf_id < 32)
+                tx->bna->tx_mod.txf_bmap[0] |= ((u32)1 << tx->txf.txf_id);
+        else
+                tx->bna->tx_mod.txf_bmap[1] |= ((u32)
+                                                 1 << (tx->txf.txf_id - 32));
+}
+
+static void
+__bna_txf_stop(struct bna_tx *tx)
+{
+        struct bna_tx_fndb_ram *tx_fndb;
+        u32 page_num;
+        u32 ctl_flags;
+        struct bna_txf *txf = &tx->txf;
+        void __iomem *base_addr;
+        unsigned long off;
+
+        /* retrieve the running txf_flags & turn off enable bit */
+        page_num = BNA_GET_PAGE_NUM(LUT0_MEM_BLK_BASE_PG_NUM +
+                        (tx->bna->port_num * 2), TX_FNDB_RAM_BASE_OFFSET);
+        writel(page_num, tx->bna->regs.page_addr);
+
+        base_addr = BNA_GET_MEM_BASE_ADDR(tx->bna->pcidev.pci_bar_kva,
+                                        TX_FNDB_RAM_BASE_OFFSET);
+        tx_fndb = (struct bna_tx_fndb_ram *)0;
+        off = (unsigned long)&tx_fndb[txf->txf_id].vlan_n_ctrl_flags;
+
+        ctl_flags = readl(base_addr + off);
+        ctl_flags &= ~BFI_TXF_CF_ENABLE;
+
+        writel(ctl_flags, base_addr + off);
+
+        if (tx->txf.txf_id < 32)
+                tx->bna->tx_mod.txf_bmap[0] &= ~((u32)1 << tx->txf.txf_id);
+        else
+                tx->bna->tx_mod.txf_bmap[0] &= ~((u32)
+                                                 1 << (tx->txf.txf_id - 32));
+}
+
+static void
+__bna_txf_stat_clr(struct bna_tx *tx)
+{
+        struct bfi_ll_stats_req ll_req;
+        u32 txf_bmap[2] = {0, 0};
+        if (tx->txf.txf_id < 32)
+                txf_bmap[0] = ((u32)1 << tx->txf.txf_id);
+        else
+                txf_bmap[1] = ((u32)1 << (tx->txf.txf_id - 32));
+        bfi_h2i_set(ll_req.mh, BFI_MC_LL, BFI_LL_H2I_STATS_CLEAR_REQ, 0);
+        ll_req.stats_mask = 0;
+        ll_req.rxf_id_mask[0] = 0;
+        ll_req.rxf_id_mask[1] = 0;
+        ll_req.txf_id_mask[0] = htonl(txf_bmap[0]);
+        ll_req.txf_id_mask[1] = htonl(txf_bmap[1]);
+
+        bna_mbox_qe_fill(&tx->mbox_qe, &ll_req, sizeof(ll_req),
+                        bna_tx_cb_stats_cleared, tx);
+        bna_mbox_send(tx->bna, &tx->mbox_qe);
+}
+
+static void
+__bna_tx_start(struct bna_tx *tx)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                bna_ib_start(txq->ib);
+                __bna_txq_start(tx, txq);
+        }
+
+        __bna_txf_start(tx);
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                txq->tcb->priority = txq->priority;
+                (tx->tx_resume_cbfn)(tx->bna->bnad, txq->tcb);
+        }
+}
+
+static void
+__bna_tx_stop(struct bna_tx *tx)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                (tx->tx_stall_cbfn)(tx->bna->bnad, txq->tcb);
+        }
+
+        __bna_txf_stop(tx);
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                bfa_wc_up(&tx->txq_stop_wc);
+        }
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                __bna_txq_stop(tx, txq);
+        }
+}
+
+static void
+bna_txq_qpt_setup(struct bna_txq *txq, int page_count, int page_size,
+                struct bna_mem_descr *qpt_mem,
+                struct bna_mem_descr *swqpt_mem,
+                struct bna_mem_descr *page_mem)
+{
+        int i;
+
+        txq->qpt.hw_qpt_ptr.lsb = qpt_mem->dma.lsb;
+        txq->qpt.hw_qpt_ptr.msb = qpt_mem->dma.msb;
+        txq->qpt.kv_qpt_ptr = qpt_mem->kva;
+        txq->qpt.page_count = page_count;
+        txq->qpt.page_size = page_size;
+
+        txq->tcb->sw_qpt = (void **) swqpt_mem->kva;
+
+        for (i = 0; i < page_count; i++) {
+                txq->tcb->sw_qpt[i] = page_mem[i].kva;
+
+                ((struct bna_dma_addr *)txq->qpt.kv_qpt_ptr)[i].lsb =
+                        page_mem[i].dma.lsb;
+                ((struct bna_dma_addr *)txq->qpt.kv_qpt_ptr)[i].msb =
+                        page_mem[i].dma.msb;
+
+        }
+}
+
+static void
+bna_tx_free(struct bna_tx *tx)
+{
+        struct bna_tx_mod *tx_mod = &tx->bna->tx_mod;
+        struct bna_txq *txq;
+        struct bna_ib_mod *ib_mod = &tx->bna->ib_mod;
+        struct list_head *qe;
+
+        while (!list_empty(&tx->txq_q)) {
+                bfa_q_deq(&tx->txq_q, &txq);
+                bfa_q_qe_init(&txq->qe);
+                if (txq->ib) {
+                        if (txq->ib_seg_offset != -1)
+                                bna_ib_release_idx(txq->ib,
+                                                txq->ib_seg_offset);
+                        bna_ib_put(ib_mod, txq->ib);
+                        txq->ib = NULL;
+                }
+                txq->tcb = NULL;
+                txq->tx = NULL;
+                list_add_tail(&txq->qe, &tx_mod->txq_free_q);
+        }
+
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                if (qe == &tx->qe) {
+                        list_del(&tx->qe);
+                        bfa_q_qe_init(&tx->qe);
+                        break;
+                }
+        }
+
+        tx->bna = NULL;
+        tx->priv = NULL;
+        list_add_tail(&tx->qe, &tx_mod->tx_free_q);
+}
+
+static void
+bna_tx_cb_txq_stopped(void *arg, int status)
+{
+        struct bna_tx *tx = (struct bna_tx *)arg;
+
+        bfa_q_qe_init(&tx->mbox_qe.qe);
+        bfa_wc_down(&tx->txq_stop_wc);
+}
+
+static void
+bna_tx_cb_txq_stopped_all(void *arg)
+{
+        struct bna_tx *tx = (struct bna_tx *)arg;
+
+        bfa_fsm_send_event(tx, TX_E_TXQ_STOPPED);
+}
+
+static void
+bna_tx_cb_stats_cleared(void *arg, int status)
+{
+        struct bna_tx *tx = (struct bna_tx *)arg;
+
+        bfa_q_qe_init(&tx->mbox_qe.qe);
+
+        bfa_fsm_send_event(tx, TX_E_STAT_CLEARED);
+}
+
+static void
+bna_tx_start(struct bna_tx *tx)
+{
+        tx->flags |= BNA_TX_F_PORT_STARTED;
+        if (tx->flags & BNA_TX_F_ENABLED)
+                bfa_fsm_send_event(tx, TX_E_START);
+}
+
+static void
+bna_tx_stop(struct bna_tx *tx)
+{
+        tx->stop_cbfn = bna_tx_mod_cb_tx_stopped;
+        tx->stop_cbarg = &tx->bna->tx_mod;
+
+        tx->flags &= ~BNA_TX_F_PORT_STARTED;
+        bfa_fsm_send_event(tx, TX_E_STOP);
+}
+
+static void
+bna_tx_fail(struct bna_tx *tx)
+{
+        tx->flags &= ~BNA_TX_F_PORT_STARTED;
+        bfa_fsm_send_event(tx, TX_E_FAIL);
+}
+
+void
+bna_tx_prio_changed(struct bna_tx *tx, int prio)
+{
+        struct bna_txq *txq;
+        struct list_head                 *qe;
+
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                txq->priority = prio;
+        }
+
+        bfa_fsm_send_event(tx, TX_E_PRIO_CHANGE);
+}
+
+static void
+bna_tx_cee_link_status(struct bna_tx *tx, int cee_link)
+{
+        if (cee_link)
+                tx->flags |= BNA_TX_F_PRIO_LOCK;
+        else
+                tx->flags &= ~BNA_TX_F_PRIO_LOCK;
+}
+
+static void
+bna_tx_mod_cb_tx_stopped(void *arg, struct bna_tx *tx,
+                        enum bna_cb_status status)
+{
+        struct bna_tx_mod *tx_mod = (struct bna_tx_mod *)arg;
+
+        bfa_wc_down(&tx_mod->tx_stop_wc);
+}
+
+static void
+bna_tx_mod_cb_tx_stopped_all(void *arg)
+{
+        struct bna_tx_mod *tx_mod = (struct bna_tx_mod *)arg;
+
+        if (tx_mod->stop_cbfn)
+                tx_mod->stop_cbfn(&tx_mod->bna->port, BNA_CB_SUCCESS);
+        tx_mod->stop_cbfn = NULL;
+}
+
+void
+bna_tx_res_req(int num_txq, int txq_depth, struct bna_res_info *res_info)
+{
+        u32 q_size;
+        u32 page_count;
+        struct bna_mem_info *mem_info;
+
+        res_info[BNA_TX_RES_MEM_T_TCB].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_TX_RES_MEM_T_TCB].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = sizeof(struct bna_tcb);
+        mem_info->num = num_txq;
+
+        q_size = txq_depth * BFI_TXQ_WI_SIZE;
+        q_size = ALIGN(q_size, PAGE_SIZE);
+        page_count = q_size >> PAGE_SHIFT;
+
+        res_info[BNA_TX_RES_MEM_T_QPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_TX_RES_MEM_T_QPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = page_count * sizeof(struct bna_dma_addr);
+        mem_info->num = num_txq;
+
+        res_info[BNA_TX_RES_MEM_T_SWQPT].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_TX_RES_MEM_T_SWQPT].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_KVA;
+        mem_info->len = page_count * sizeof(void *);
+        mem_info->num = num_txq;
+
+        res_info[BNA_TX_RES_MEM_T_PAGE].res_type = BNA_RES_T_MEM;
+        mem_info = &res_info[BNA_TX_RES_MEM_T_PAGE].res_u.mem_info;
+        mem_info->mem_type = BNA_MEM_T_DMA;
+        mem_info->len = PAGE_SIZE;
+        mem_info->num = num_txq * page_count;
+
+        res_info[BNA_TX_RES_INTR_T_TXCMPL].res_type = BNA_RES_T_INTR;
+        res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info.intr_type =
+                        BNA_INTR_T_MSIX;
+        res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info.num = num_txq;
+}
+
+struct bna_tx *
+bna_tx_create(struct bna *bna, struct bnad *bnad,
+                struct bna_tx_config *tx_cfg,
+                struct bna_tx_event_cbfn *tx_cbfn,
+                struct bna_res_info *res_info, void *priv)
+{
+        struct bna_intr_info *intr_info;
+        struct bna_tx_mod *tx_mod = &bna->tx_mod;
+        struct bna_tx *tx;
+        struct bna_txq *txq;
+        struct list_head *qe;
+        struct bna_ib_mod *ib_mod = &bna->ib_mod;
+        struct bna_doorbell_qset *qset;
+        struct bna_ib_config ib_config;
+        int page_count;
+        int page_size;
+        int page_idx;
+        int i;
+        unsigned long off;
+
+        intr_info = &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
+        page_count = (res_info[BNA_TX_RES_MEM_T_PAGE].res_u.mem_info.num) /
+                        tx_cfg->num_txq;
+        page_size = res_info[BNA_TX_RES_MEM_T_PAGE].res_u.mem_info.len;
+
+        /**
+         * Get resources
+         */
+
+        if ((intr_info->num != 1) && (intr_info->num != tx_cfg->num_txq))
+                return NULL;
+
+        /* Tx */
+
+        if (list_empty(&tx_mod->tx_free_q))
+                return NULL;
+        bfa_q_deq(&tx_mod->tx_free_q, &tx);
+        bfa_q_qe_init(&tx->qe);
+
+        /* TxQs */
+
+        INIT_LIST_HEAD(&tx->txq_q);
+        for (i = 0; i < tx_cfg->num_txq; i++) {
+                if (list_empty(&tx_mod->txq_free_q))
+                        goto err_return;
+
+                bfa_q_deq(&tx_mod->txq_free_q, &txq);
+                bfa_q_qe_init(&txq->qe);
+                list_add_tail(&txq->qe, &tx->txq_q);
+                txq->ib = NULL;
+                txq->ib_seg_offset = -1;
+                txq->tx = tx;
+        }
+
+        /* IBs */
+        i = 0;
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+
+                if (intr_info->num == 1)
+                        txq->ib = bna_ib_get(ib_mod, intr_info->intr_type,
+                                                intr_info->idl[0].vector);
+                else
+                        txq->ib = bna_ib_get(ib_mod, intr_info->intr_type,
+                                                intr_info->idl[i].vector);
+
+                if (txq->ib == NULL)
+                        goto err_return;
+
+                txq->ib_seg_offset = bna_ib_reserve_idx(txq->ib);
+                if (txq->ib_seg_offset == -1)
+                        goto err_return;
+
+                i++;
+        }
+
+        /*
+         * Initialize
+         */
+
+        /* Tx */
+
+        tx->tcb_setup_cbfn = tx_cbfn->tcb_setup_cbfn;
+        tx->tcb_destroy_cbfn = tx_cbfn->tcb_destroy_cbfn;
+        /* Following callbacks are mandatory */
+        tx->tx_stall_cbfn = tx_cbfn->tx_stall_cbfn;
+        tx->tx_resume_cbfn = tx_cbfn->tx_resume_cbfn;
+        tx->tx_cleanup_cbfn = tx_cbfn->tx_cleanup_cbfn;
+
+        list_add_tail(&tx->qe, &tx_mod->tx_active_q);
+        tx->bna = bna;
+        tx->priv = priv;
+        tx->txq_stop_wc.wc_resume = bna_tx_cb_txq_stopped_all;
+        tx->txq_stop_wc.wc_cbarg = tx;
+        tx->txq_stop_wc.wc_count = 0;
+
+        tx->type = tx_cfg->tx_type;
+
+        tx->flags = 0;
+        if (tx->bna->tx_mod.flags & BNA_TX_MOD_F_PORT_STARTED) {
+                switch (tx->type) {
+                case BNA_TX_T_REGULAR:
+                        if (!(tx->bna->tx_mod.flags &
+                                BNA_TX_MOD_F_PORT_LOOPBACK))
+                                tx->flags |= BNA_TX_F_PORT_STARTED;
+                        break;
+                case BNA_TX_T_LOOPBACK:
+                        if (tx->bna->tx_mod.flags & BNA_TX_MOD_F_PORT_LOOPBACK)
+                                tx->flags |= BNA_TX_F_PORT_STARTED;
+                        break;
+                }
+        }
+        if (tx->bna->tx_mod.cee_link)
+                tx->flags |= BNA_TX_F_PRIO_LOCK;
+
+        /* TxQ */
+
+        i = 0;
+        page_idx = 0;
+        list_for_each(qe, &tx->txq_q) {
+                txq = (struct bna_txq *)qe;
+                txq->priority = tx_mod->priority;
+                txq->tcb = (struct bna_tcb *)
+                  res_info[BNA_TX_RES_MEM_T_TCB].res_u.mem_info.mdl[i].kva;
+                txq->tx_packets = 0;
+                txq->tx_bytes = 0;
+
+                /* IB */
+
+                ib_config.coalescing_timeo = BFI_TX_COALESCING_TIMEO;
+                ib_config.interpkt_timeo = 0; /* Not used */
+                ib_config.interpkt_count = BFI_TX_INTERPKT_COUNT;
+                ib_config.ctrl_flags = (BFI_IB_CF_INTER_PKT_DMA |
+                                        BFI_IB_CF_INT_ENABLE |
+                                        BFI_IB_CF_COALESCING_MODE);
+                bna_ib_config(txq->ib, &ib_config);
+
+                /* TCB */
+
+                txq->tcb->producer_index = 0;
+                txq->tcb->consumer_index = 0;
+                txq->tcb->hw_consumer_index = (volatile u32 *)
+                        ((volatile u8 *)txq->ib->ib_seg_host_addr_kva +
+                         (txq->ib_seg_offset * BFI_IBIDX_SIZE));
+                *(txq->tcb->hw_consumer_index) = 0;
+                txq->tcb->q_depth = tx_cfg->txq_depth;
+                txq->tcb->unmap_q = (void *)
+                res_info[BNA_TX_RES_MEM_T_UNMAPQ].res_u.mem_info.mdl[i].kva;
+                qset = (struct bna_doorbell_qset *)0;
+                off = (unsigned long)&qset[txq->txq_id].txq[0];
+                txq->tcb->q_dbell = off +
+                        BNA_GET_DOORBELL_BASE_ADDR(bna->pcidev.pci_bar_kva);
+                txq->tcb->i_dbell = &txq->ib->door_bell;
+                txq->tcb->intr_type = intr_info->intr_type;
+                txq->tcb->intr_vector = (intr_info->num == 1) ?
+                                        intr_info->idl[0].vector :
+                                        intr_info->idl[i].vector;
+                txq->tcb->txq = txq;
+                txq->tcb->bnad = bnad;
+                txq->tcb->id = i;
+
+                /* QPT, SWQPT, Pages */
+                bna_txq_qpt_setup(txq, page_count, page_size,
+                        &res_info[BNA_TX_RES_MEM_T_QPT].res_u.mem_info.mdl[i],
+                        &res_info[BNA_TX_RES_MEM_T_SWQPT].res_u.mem_info.mdl[i],
+                        &res_info[BNA_TX_RES_MEM_T_PAGE].
+                                  res_u.mem_info.mdl[page_idx]);
+                txq->tcb->page_idx = page_idx;
+                txq->tcb->page_count = page_count;
+                page_idx += page_count;
+
+                /* Callback to bnad for setting up TCB */
+                if (tx->tcb_setup_cbfn)
+                        (tx->tcb_setup_cbfn)(bna->bnad, txq->tcb);
+
+                i++;
+        }
+
+        /* TxF */
+
+        tx->txf.ctrl_flags = BFI_TXF_CF_ENABLE | BFI_TXF_CF_VLAN_WI_BASED;
+        tx->txf.vlan = 0;
+
+        /* Mbox element */
+        bfa_q_qe_init(&tx->mbox_qe.qe);
+
+        bfa_fsm_set_state(tx, bna_tx_sm_stopped);
+
+        return tx;
+
+err_return:
+        bna_tx_free(tx);
+        return NULL;
+}
+
+void
+bna_tx_destroy(struct bna_tx *tx)
+{
+        /* Callback to bnad for destroying TCB */
+        if (tx->tcb_destroy_cbfn) {
+                struct bna_txq *txq;
+                struct list_head *qe;
+
+                list_for_each(qe, &tx->txq_q) {
+                        txq = (struct bna_txq *)qe;
+                        (tx->tcb_destroy_cbfn)(tx->bna->bnad, txq->tcb);
+                }
+        }
+
+        bna_tx_free(tx);
+}
+
+void
+bna_tx_enable(struct bna_tx *tx)
+{
+        if (tx->fsm != (bfa_sm_t)bna_tx_sm_stopped)
+                return;
+
+        tx->flags |= BNA_TX_F_ENABLED;
+
+        if (tx->flags & BNA_TX_F_PORT_STARTED)
+                bfa_fsm_send_event(tx, TX_E_START);
+}
+
+void
+bna_tx_disable(struct bna_tx *tx, enum bna_cleanup_type type,
+                void (*cbfn)(void *, struct bna_tx *, enum bna_cb_status))
+{
+        if (type == BNA_SOFT_CLEANUP) {
+                (*cbfn)(tx->bna->bnad, tx, BNA_CB_SUCCESS);
+                return;
+        }
+
+        tx->stop_cbfn = cbfn;
+        tx->stop_cbarg = tx->bna->bnad;
+
+        tx->flags &= ~BNA_TX_F_ENABLED;
+
+        bfa_fsm_send_event(tx, TX_E_STOP);
+}
+
+int
+bna_tx_state_get(struct bna_tx *tx)
+{
+        return bfa_sm_to_state(tx_sm_table, tx->fsm);
+}
+
+void
+bna_tx_mod_init(struct bna_tx_mod *tx_mod, struct bna *bna,
+                struct bna_res_info *res_info)
+{
+        int i;
+
+        tx_mod->bna = bna;
+        tx_mod->flags = 0;
+
+        tx_mod->tx = (struct bna_tx *)
+                res_info[BNA_RES_MEM_T_TX_ARRAY].res_u.mem_info.mdl[0].kva;
+        tx_mod->txq = (struct bna_txq *)
+                res_info[BNA_RES_MEM_T_TXQ_ARRAY].res_u.mem_info.mdl[0].kva;
+
+        INIT_LIST_HEAD(&tx_mod->tx_free_q);
+        INIT_LIST_HEAD(&tx_mod->tx_active_q);
+
+        INIT_LIST_HEAD(&tx_mod->txq_free_q);
+
+        for (i = 0; i < BFI_MAX_TXQ; i++) {
+                tx_mod->tx[i].txf.txf_id = i;
+                bfa_q_qe_init(&tx_mod->tx[i].qe);
+                list_add_tail(&tx_mod->tx[i].qe, &tx_mod->tx_free_q);
+
+                tx_mod->txq[i].txq_id = i;
+                bfa_q_qe_init(&tx_mod->txq[i].qe);
+                list_add_tail(&tx_mod->txq[i].qe, &tx_mod->txq_free_q);
+        }
+
+        tx_mod->tx_stop_wc.wc_resume = bna_tx_mod_cb_tx_stopped_all;
+        tx_mod->tx_stop_wc.wc_cbarg = tx_mod;
+        tx_mod->tx_stop_wc.wc_count = 0;
+}
+
+void
+bna_tx_mod_uninit(struct bna_tx_mod *tx_mod)
+{
+        struct list_head                *qe;
+        int i;
+
+        i = 0;
+        list_for_each(qe, &tx_mod->tx_free_q)
+                i++;
+
+        i = 0;
+        list_for_each(qe, &tx_mod->txq_free_q)
+                i++;
+
+        tx_mod->bna = NULL;
+}
+
+void
+bna_tx_mod_start(struct bna_tx_mod *tx_mod, enum bna_tx_type type)
+{
+        struct bna_tx *tx;
+        struct list_head                *qe;
+
+        tx_mod->flags |= BNA_TX_MOD_F_PORT_STARTED;
+        if (type == BNA_TX_T_LOOPBACK)
+                tx_mod->flags |= BNA_TX_MOD_F_PORT_LOOPBACK;
+
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                if (tx->type == type)
+                        bna_tx_start(tx);
+        }
+}
+
+void
+bna_tx_mod_stop(struct bna_tx_mod *tx_mod, enum bna_tx_type type)
+{
+        struct bna_tx *tx;
+        struct list_head                *qe;
+
+        tx_mod->flags &= ~BNA_TX_MOD_F_PORT_STARTED;
+        tx_mod->flags &= ~BNA_TX_MOD_F_PORT_LOOPBACK;
+
+        tx_mod->stop_cbfn = bna_port_cb_tx_stopped;
+
+        /**
+         * Before calling bna_tx_stop(), increment tx_stop_wc as many times
+         * as we are going to call bna_tx_stop
+         */
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                if (tx->type == type)
+                        bfa_wc_up(&tx_mod->tx_stop_wc);
+        }
+
+        if (tx_mod->tx_stop_wc.wc_count == 0) {
+                tx_mod->stop_cbfn(&tx_mod->bna->port, BNA_CB_SUCCESS);
+                tx_mod->stop_cbfn = NULL;
+                return;
+        }
+
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                if (tx->type == type)
+                        bna_tx_stop(tx);
+        }
+}
+
+void
+bna_tx_mod_fail(struct bna_tx_mod *tx_mod)
+{
+        struct bna_tx *tx;
+        struct list_head                *qe;
+
+        tx_mod->flags &= ~BNA_TX_MOD_F_PORT_STARTED;
+        tx_mod->flags &= ~BNA_TX_MOD_F_PORT_LOOPBACK;
+
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                bna_tx_fail(tx);
+        }
+}
+
+void
+bna_tx_mod_prio_changed(struct bna_tx_mod *tx_mod, int prio)
+{
+        struct bna_tx *tx;
+        struct list_head                *qe;
+
+        if (prio != tx_mod->priority) {
+                tx_mod->priority = prio;
+
+                list_for_each(qe, &tx_mod->tx_active_q) {
+                        tx = (struct bna_tx *)qe;
+                        bna_tx_prio_changed(tx, prio);
+                }
+        }
+}
+
+void
+bna_tx_mod_cee_link_status(struct bna_tx_mod *tx_mod, int cee_link)
+{
+        struct bna_tx *tx;
+        struct list_head                *qe;
+
+        tx_mod->cee_link = cee_link;
+
+        list_for_each(qe, &tx_mod->tx_active_q) {
+                tx = (struct bna_tx *)qe;
+                bna_tx_cee_link_status(tx, cee_link);
+        }
+}
diff --git a/drivers/net/bna/bna_types.h b/drivers/net/bna/bna_types.h
new file mode 100644
index 000000000000..6877310f6ef4
--- /dev/null
+++ b/drivers/net/bna/bna_types.h
@@ -0,0 +1,1128 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BNA_TYPES_H__
+#define __BNA_TYPES_H__
+
+#include "cna.h"
+#include "bna_hw.h"
+#include "bfa_cee.h"
+
+/**
+ *
+ * Forward declarations
+ *
+ */
+
+struct bna_txq;
+struct bna_tx;
+struct bna_rxq;
+struct bna_cq;
+struct bna_rx;
+struct bna_rxf;
+struct bna_port;
+struct bna;
+struct bnad;
+
+/**
+ *
+ * Enums, primitive data types
+ *
+ */
+
+enum bna_status {
+        BNA_STATUS_T_DISABLED   = 0,
+        BNA_STATUS_T_ENABLED    = 1
+};
+
+enum bna_cleanup_type {
+        BNA_HARD_CLEANUP        = 0,
+        BNA_SOFT_CLEANUP        = 1
+};
+
+enum bna_cb_status {
+        BNA_CB_SUCCESS          = 0,
+        BNA_CB_FAIL             = 1,
+        BNA_CB_INTERRUPT        = 2,
+        BNA_CB_BUSY             = 3,
+        BNA_CB_INVALID_MAC      = 4,
+        BNA_CB_MCAST_LIST_FULL  = 5,
+        BNA_CB_UCAST_CAM_FULL   = 6,
+        BNA_CB_WAITING          = 7,
+        BNA_CB_NOT_EXEC         = 8
+};
+
+enum bna_res_type {
+        BNA_RES_T_MEM           = 1,
+        BNA_RES_T_INTR          = 2
+};
+
+enum bna_mem_type {
+        BNA_MEM_T_KVA           = 1,
+        BNA_MEM_T_DMA           = 2
+};
+
+enum bna_intr_type {
+        BNA_INTR_T_INTX         = 1,
+        BNA_INTR_T_MSIX         = 2
+};
+
+enum bna_res_req_type {
+        BNA_RES_MEM_T_COM               = 0,
+        BNA_RES_MEM_T_ATTR              = 1,
+        BNA_RES_MEM_T_FWTRC             = 2,
+        BNA_RES_MEM_T_STATS             = 3,
+        BNA_RES_MEM_T_SWSTATS           = 4,
+        BNA_RES_MEM_T_IBIDX             = 5,
+        BNA_RES_MEM_T_IB_ARRAY          = 6,
+        BNA_RES_MEM_T_INTR_ARRAY        = 7,
+        BNA_RES_MEM_T_IDXSEG_ARRAY      = 8,
+        BNA_RES_MEM_T_TX_ARRAY          = 9,
+        BNA_RES_MEM_T_TXQ_ARRAY         = 10,
+        BNA_RES_MEM_T_RX_ARRAY          = 11,
+        BNA_RES_MEM_T_RXP_ARRAY         = 12,
+        BNA_RES_MEM_T_RXQ_ARRAY         = 13,
+        BNA_RES_MEM_T_UCMAC_ARRAY       = 14,
+        BNA_RES_MEM_T_MCMAC_ARRAY       = 15,
+        BNA_RES_MEM_T_RIT_ENTRY         = 16,
+        BNA_RES_MEM_T_RIT_SEGMENT       = 17,
+        BNA_RES_INTR_T_MBOX             = 18,
+        BNA_RES_T_MAX
+};
+
+enum bna_tx_res_req_type {
+        BNA_TX_RES_MEM_T_TCB    = 0,
+        BNA_TX_RES_MEM_T_UNMAPQ = 1,
+        BNA_TX_RES_MEM_T_QPT    = 2,
+        BNA_TX_RES_MEM_T_SWQPT  = 3,
+        BNA_TX_RES_MEM_T_PAGE   = 4,
+        BNA_TX_RES_INTR_T_TXCMPL = 5,
+        BNA_TX_RES_T_MAX,
+};
+
+enum bna_rx_mem_type {
+        BNA_RX_RES_MEM_T_CCB            = 0,    /* CQ context */
+        BNA_RX_RES_MEM_T_RCB            = 1,    /* CQ context */
+        BNA_RX_RES_MEM_T_UNMAPQ         = 2,    /* UnmapQ for RxQs */
+        BNA_RX_RES_MEM_T_CQPT           = 3,    /* CQ QPT */
+        BNA_RX_RES_MEM_T_CSWQPT         = 4,    /* S/W QPT */
+        BNA_RX_RES_MEM_T_CQPT_PAGE      = 5,    /* CQPT page */
+        BNA_RX_RES_MEM_T_HQPT           = 6,    /* RX QPT */
+        BNA_RX_RES_MEM_T_DQPT           = 7,    /* RX QPT */
+        BNA_RX_RES_MEM_T_HSWQPT         = 8,    /* RX s/w QPT */
+        BNA_RX_RES_MEM_T_DSWQPT         = 9,    /* RX s/w QPT */
+        BNA_RX_RES_MEM_T_DPAGE          = 10,   /* RX s/w QPT */
+        BNA_RX_RES_MEM_T_HPAGE          = 11,   /* RX s/w QPT */
+        BNA_RX_RES_T_INTR               = 12,   /* Rx interrupts */
+        BNA_RX_RES_T_MAX                = 13
+};
+
+enum bna_mbox_state {
+        BNA_MBOX_FREE           = 0,
+        BNA_MBOX_POSTED         = 1
+};
+
+enum bna_tx_type {
+        BNA_TX_T_REGULAR        = 0,
+        BNA_TX_T_LOOPBACK       = 1,
+};
+
+enum bna_tx_flags {
+        BNA_TX_F_PORT_STARTED   = 1,
+        BNA_TX_F_ENABLED        = 2,
+        BNA_TX_F_PRIO_LOCK      = 4,
+};
+
+enum bna_tx_mod_flags {
+        BNA_TX_MOD_F_PORT_STARTED       = 1,
+        BNA_TX_MOD_F_PORT_LOOPBACK      = 2,
+};
+
+enum bna_rx_type {
+        BNA_RX_T_REGULAR        = 0,
+        BNA_RX_T_LOOPBACK       = 1,
+};
+
+enum bna_rxp_type {
+        BNA_RXP_SINGLE          = 1,
+        BNA_RXP_SLR             = 2,
+        BNA_RXP_HDS             = 3
+};
+
+enum bna_rxmode {
+        BNA_RXMODE_PROMISC      = 1,
+        BNA_RXMODE_DEFAULT      = 2,
+        BNA_RXMODE_ALLMULTI     = 4
+};
+
+enum bna_rx_event {
+        RX_E_START                      = 1,
+        RX_E_STOP                       = 2,
+        RX_E_FAIL                       = 3,
+        RX_E_RXF_STARTED                = 4,
+        RX_E_RXF_STOPPED                = 5,
+        RX_E_RXQ_STOPPED                = 6,
+};
+
+enum bna_rx_state {
+        BNA_RX_STOPPED                  = 1,
+        BNA_RX_RXF_START_WAIT           = 2,
+        BNA_RX_STARTED                  = 3,
+        BNA_RX_RXF_STOP_WAIT            = 4,
+        BNA_RX_RXQ_STOP_WAIT            = 5,
+};
+
+enum bna_rx_flags {
+        BNA_RX_F_ENABLE         = 0x01,         /* bnad enabled rxf */
+        BNA_RX_F_PORT_ENABLED   = 0x02,         /* Port object is enabled */
+        BNA_RX_F_PORT_FAILED    = 0x04,         /* Port in failed state */
+};
+
+enum bna_rx_mod_flags {
+        BNA_RX_MOD_F_PORT_STARTED       = 1,
+        BNA_RX_MOD_F_PORT_LOOPBACK      = 2,
+};
+
+enum bna_rxf_oper_state {
+        BNA_RXF_OPER_STATE_RUNNING      = 0x01, /* rxf operational */
+        BNA_RXF_OPER_STATE_PAUSED       = 0x02, /* rxf in PAUSED state */
+};
+
+enum bna_rxf_flags {
+        BNA_RXF_FL_STOP_PENDING         = 0x01,
+        BNA_RXF_FL_FAILED               = 0x02,
+        BNA_RXF_FL_RSS_CONFIG_PENDING   = 0x04,
+        BNA_RXF_FL_OPERSTATE_CHANGED    = 0x08,
+        BNA_RXF_FL_RXF_ENABLED          = 0x10,
+        BNA_RXF_FL_VLAN_CONFIG_PENDING  = 0x20,
+};
+
+enum bna_rxf_event {
+        RXF_E_START                     = 1,
+        RXF_E_STOP                      = 2,
+        RXF_E_FAIL                      = 3,
+        RXF_E_CAM_FLTR_MOD              = 4,
+        RXF_E_STARTED                   = 5,
+        RXF_E_STOPPED                   = 6,
+        RXF_E_CAM_FLTR_RESP             = 7,
+        RXF_E_PAUSE                     = 8,
+        RXF_E_RESUME                    = 9,
+        RXF_E_STAT_CLEARED              = 10,
+};
+
+enum bna_rxf_state {
+        BNA_RXF_STOPPED                 = 1,
+        BNA_RXF_START_WAIT              = 2,
+        BNA_RXF_CAM_FLTR_MOD_WAIT       = 3,
+        BNA_RXF_STARTED                 = 4,
+        BNA_RXF_CAM_FLTR_CLR_WAIT       = 5,
+        BNA_RXF_STOP_WAIT               = 6,
+        BNA_RXF_PAUSE_WAIT              = 7,
+        BNA_RXF_RESUME_WAIT             = 8,
+        BNA_RXF_STAT_CLR_WAIT           = 9,
+};
+
+enum bna_port_type {
+        BNA_PORT_T_REGULAR              = 0,
+        BNA_PORT_T_LOOPBACK_INTERNAL    = 1,
+        BNA_PORT_T_LOOPBACK_EXTERNAL    = 2,
+};
+
+enum bna_link_status {
+        BNA_LINK_DOWN           = 0,
+        BNA_LINK_UP             = 1,
+        BNA_CEE_UP              = 2
+};
+
+enum bna_llport_flags {
+        BNA_LLPORT_F_ENABLED    = 1,
+        BNA_LLPORT_F_RX_ENABLED = 2
+};
+
+enum bna_port_flags {
+        BNA_PORT_F_DEVICE_READY = 1,
+        BNA_PORT_F_ENABLED      = 2,
+        BNA_PORT_F_PAUSE_CHANGED = 4,
+        BNA_PORT_F_MTU_CHANGED  = 8
+};
+
+enum bna_pkt_rates {
+        BNA_PKT_RATE_10K                = 10000,
+        BNA_PKT_RATE_20K                = 20000,
+        BNA_PKT_RATE_30K                = 30000,
+        BNA_PKT_RATE_40K                = 40000,
+        BNA_PKT_RATE_50K                = 50000,
+        BNA_PKT_RATE_60K                = 60000,
+        BNA_PKT_RATE_70K                = 70000,
+        BNA_PKT_RATE_80K                = 80000,
+};
+
+enum bna_dim_load_types {
+        BNA_LOAD_T_HIGH_4               = 0, /* 80K <= r */
+        BNA_LOAD_T_HIGH_3               = 1, /* 60K <= r < 80K */
+        BNA_LOAD_T_HIGH_2               = 2, /* 50K <= r < 60K */
+        BNA_LOAD_T_HIGH_1               = 3, /* 40K <= r < 50K */
+        BNA_LOAD_T_LOW_1                = 4, /* 30K <= r < 40K */
+        BNA_LOAD_T_LOW_2                = 5, /* 20K <= r < 30K */
+        BNA_LOAD_T_LOW_3                = 6, /* 10K <= r < 20K */
+        BNA_LOAD_T_LOW_4                = 7, /* r < 10K */
+        BNA_LOAD_T_MAX                  = 8
+};
+
+enum bna_dim_bias_types {
+        BNA_BIAS_T_SMALL                = 0, /* small pkts > (large pkts * 2) */
+        BNA_BIAS_T_LARGE                = 1, /* Not BNA_BIAS_T_SMALL */
+        BNA_BIAS_T_MAX                  = 2
+};
+
+struct bna_mac {
+        /* This should be the first one */
+        struct list_head                        qe;
+        u8                      addr[ETH_ALEN];
+};
+
+struct bna_mem_descr {
+        u32             len;
+        void            *kva;
+        struct bna_dma_addr dma;
+};
+
+struct bna_mem_info {
+        enum bna_mem_type mem_type;
+        u32             len;
+        u32             num;
+        u32             align_sz; /* 0/1 = no alignment */
+        struct bna_mem_descr *mdl;
+        void                    *cookie; /* For bnad to unmap dma later */
+};
+
+struct bna_intr_descr {
+        int                     vector;
+};
+
+struct bna_intr_info {
+        enum bna_intr_type intr_type;
+        int                     num;
+        struct bna_intr_descr *idl;
+};
+
+union bna_res_u {
+        struct bna_mem_info mem_info;
+        struct bna_intr_info intr_info;
+};
+
+struct bna_res_info {
+        enum bna_res_type res_type;
+        union bna_res_u         res_u;
+};
+
+/* HW QPT */
+struct bna_qpt {
+        struct bna_dma_addr hw_qpt_ptr;
+        void            *kv_qpt_ptr;
+        u32             page_count;
+        u32             page_size;
+};
+
+/**
+ *
+ * Device
+ *
+ */
+
+struct bna_device {
+        bfa_fsm_t               fsm;
+        struct bfa_ioc ioc;
+
+        enum bna_intr_type intr_type;
+        int                     vector;
+
+        void (*ready_cbfn)(struct bnad *bnad, enum bna_cb_status status);
+        struct bnad *ready_cbarg;
+
+        void (*stop_cbfn)(struct bnad *bnad, enum bna_cb_status status);
+        struct bnad *stop_cbarg;
+
+        struct bna *bna;
+};
+
+/**
+ *
+ * Mail box
+ *
+ */
+
+struct bna_mbox_qe {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        struct bfa_mbox_cmd cmd;
+        u32             cmd_len;
+        /* Callback for port, tx, rx, rxf */
+        void (*cbfn)(void *arg, int status);
+        void                    *cbarg;
+};
+
+struct bna_mbox_mod {
+        enum bna_mbox_state state;
+        struct list_head                        posted_q;
+        u32             msg_pending;
+        u32             msg_ctr;
+        struct bna *bna;
+};
+
+/**
+ *
+ * Port
+ *
+ */
+
+/* Pause configuration */
+struct bna_pause_config {
+        enum bna_status tx_pause;
+        enum bna_status rx_pause;
+};
+
+struct bna_llport {
+        bfa_fsm_t               fsm;
+        enum bna_llport_flags flags;
+
+        enum bna_port_type type;
+
+        enum bna_link_status link_status;
+
+        int                     admin_up_count;
+
+        void (*stop_cbfn)(struct bna_port *, enum bna_cb_status);
+
+        struct bna_mbox_qe mbox_qe;
+
+        struct bna *bna;
+};
+
+struct bna_port {
+        bfa_fsm_t               fsm;
+        enum bna_port_flags flags;
+
+        enum bna_port_type type;
+
+        struct bna_llport llport;
+
+        struct bna_pause_config pause_config;
+        u8                      priority;
+        int                     mtu;
+
+        /* Callback for bna_port_disable(), port_stop() */
+        void (*stop_cbfn)(void *, enum bna_cb_status);
+        void                    *stop_cbarg;
+
+        /* Callback for bna_port_pause_config() */
+        void (*pause_cbfn)(struct bnad *, enum bna_cb_status);
+
+        /* Callback for bna_port_mtu_set() */
+        void (*mtu_cbfn)(struct bnad *, enum bna_cb_status);
+
+        void (*link_cbfn)(struct bnad *, enum bna_link_status);
+
+        struct bfa_wc           chld_stop_wc;
+
+        struct bna_mbox_qe mbox_qe;
+
+        struct bna *bna;
+};
+
+/**
+ *
+ * Interrupt Block
+ *
+ */
+
+/* IB index segment structure */
+struct bna_ibidx_seg {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        u8                      ib_seg_size;
+        u8                      ib_idx_tbl_offset;
+};
+
+/* Interrupt structure */
+struct bna_intr {
+        /* This should be the first one */
+        struct list_head                        qe;
+        int                     ref_count;
+
+        enum bna_intr_type intr_type;
+        int                     vector;
+
+        struct bna_ib *ib;
+};
+
+/* Doorbell structure */
+struct bna_ib_dbell {
+        void *__iomem doorbell_addr;
+        u32             doorbell_ack;
+};
+
+/* Interrupt timer configuration */
+struct bna_ib_config {
+        u8              coalescing_timeo;    /* Unit is 5usec. */
+
+        int                     interpkt_count;
+        int                     interpkt_timeo;
+
+        enum ib_flags ctrl_flags;
+};
+
+/* IB structure */
+struct bna_ib {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        int                     ib_id;
+
+        int                     ref_count;
+        int                     start_count;
+
+        struct bna_dma_addr ib_seg_host_addr;
+        void            *ib_seg_host_addr_kva;
+        u32             idx_mask; /* Size >= BNA_IBIDX_MAX_SEGSIZE */
+
+        struct bna_ibidx_seg *idx_seg;
+
+        struct bna_ib_dbell door_bell;
+
+        struct bna_intr *intr;
+
+        struct bna_ib_config ib_config;
+
+        struct bna *bna;
+};
+
+/* IB module - keeps track of IBs and interrupts */
+struct bna_ib_mod {
+        struct bna_ib *ib;              /* BFI_MAX_IB entries */
+        struct bna_intr *intr;          /* BFI_MAX_IB entries */
+        struct bna_ibidx_seg *idx_seg;  /* BNA_IBIDX_TOTAL_SEGS */
+
+        struct list_head                        ib_free_q;
+
+        struct list_head                ibidx_seg_pool[BFI_IBIDX_TOTAL_POOLS];
+
+        struct list_head                        intr_free_q;
+        struct list_head                        intr_active_q;
+
+        struct bna *bna;
+};
+
+/**
+ *
+ * Tx object
+ *
+ */
+
+/* Tx datapath control structure */
+#define BNA_Q_NAME_SIZE         16
+struct bna_tcb {
+        /* Fast path */
+        void                    **sw_qpt;
+        void                    *unmap_q;
+        u32             producer_index;
+        u32             consumer_index;
+        volatile u32    *hw_consumer_index;
+        u32             q_depth;
+        void *__iomem q_dbell;
+        struct bna_ib_dbell *i_dbell;
+        int                     page_idx;
+        int                     page_count;
+        /* Control path */
+        struct bna_txq *txq;
+        struct bnad *bnad;
+        enum bna_intr_type intr_type;
+        int                     intr_vector;
+        u8                      priority; /* Current priority */
+        unsigned long           flags; /* Used by bnad as required */
+        int                     id;
+        char                    name[BNA_Q_NAME_SIZE];
+};
+
+/* TxQ QPT and configuration */
+struct bna_txq {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        int                     txq_id;
+
+        u8                      priority;
+
+        struct bna_qpt qpt;
+        struct bna_tcb *tcb;
+        struct bna_ib *ib;
+        int                     ib_seg_offset;
+
+        struct bna_tx *tx;
+
+        u64             tx_packets;
+        u64             tx_bytes;
+};
+
+/* TxF structure (hardware Tx Function) */
+struct bna_txf {
+        int                     txf_id;
+        enum txf_flags ctrl_flags;
+        u16             vlan;
+};
+
+/* Tx object */
+struct bna_tx {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        bfa_fsm_t               fsm;
+        enum bna_tx_flags flags;
+
+        enum bna_tx_type type;
+
+        struct list_head                        txq_q;
+        struct bna_txf txf;
+
+        /* Tx event handlers */
+        void (*tcb_setup_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tcb_destroy_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tx_stall_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tx_resume_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tx_cleanup_cbfn)(struct bnad *, struct bna_tcb *);
+
+        /* callback for bna_tx_disable(), bna_tx_stop() */
+        void (*stop_cbfn)(void *arg, struct bna_tx *tx,
+                                enum bna_cb_status status);
+        void                    *stop_cbarg;
+
+        /* callback for bna_tx_prio_set() */
+        void (*prio_change_cbfn)(struct bnad *bnad, struct bna_tx *tx,
+                                enum bna_cb_status status);
+
+        struct bfa_wc           txq_stop_wc;
+
+        struct bna_mbox_qe mbox_qe;
+
+        struct bna *bna;
+        void                    *priv;  /* bnad's cookie */
+};
+
+struct bna_tx_config {
+        int                     num_txq;
+        int                     txq_depth;
+        enum bna_tx_type tx_type;
+};
+
+struct bna_tx_event_cbfn {
+        /* Optional */
+        void (*tcb_setup_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tcb_destroy_cbfn)(struct bnad *, struct bna_tcb *);
+        /* Mandatory */
+        void (*tx_stall_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tx_resume_cbfn)(struct bnad *, struct bna_tcb *);
+        void (*tx_cleanup_cbfn)(struct bnad *, struct bna_tcb *);
+};
+
+/* Tx module - keeps track of free, active tx objects */
+struct bna_tx_mod {
+        struct bna_tx *tx;              /* BFI_MAX_TXQ entries */
+        struct bna_txq *txq;            /* BFI_MAX_TXQ entries */
+
+        struct list_head                        tx_free_q;
+        struct list_head                        tx_active_q;
+
+        struct list_head                        txq_free_q;
+
+        /* callback for bna_tx_mod_stop() */
+        void (*stop_cbfn)(struct bna_port *port,
+                                enum bna_cb_status status);
+
+        struct bfa_wc           tx_stop_wc;
+
+        enum bna_tx_mod_flags flags;
+
+        int                     priority;
+        int                     cee_link;
+
+        u32             txf_bmap[2];
+
+        struct bna *bna;
+};
+
+/**
+ *
+ * Receive Indirection Table
+ *
+ */
+
+/* One row of RIT table */
+struct bna_rit_entry {
+        u8 large_rxq_id;        /* used for either large or data buffers */
+        u8 small_rxq_id;        /* used for either small or header buffers */
+};
+
+/* RIT segment */
+struct bna_rit_segment {
+        struct list_head                        qe;
+
+        u32             rit_offset;
+        u32             rit_size;
+        /**
+         * max_rit_size: Varies per RIT segment depending on how RIT is
+         * partitioned
+         */
+        u32             max_rit_size;
+
+        struct bna_rit_entry *rit;
+};
+
+struct bna_rit_mod {
+        struct bna_rit_entry *rit;
+        struct bna_rit_segment *rit_segment;
+
+        struct list_head                rit_seg_pool[BFI_RIT_SEG_TOTAL_POOLS];
+};
+
+/**
+ *
+ * Rx object
+ *
+ */
+
+/* Rx datapath control structure */
+struct bna_rcb {
+        /* Fast path */
+        void                    **sw_qpt;
+        void                    *unmap_q;
+        u32             producer_index;
+        u32             consumer_index;
+        u32             q_depth;
+        void *__iomem q_dbell;
+        int                     page_idx;
+        int                     page_count;
+        /* Control path */
+        struct bna_rxq *rxq;
+        struct bna_cq *cq;
+        struct bnad *bnad;
+        unsigned long           flags;
+        int                     id;
+};
+
+/* RxQ structure - QPT, configuration */
+struct bna_rxq {
+        struct list_head                        qe;
+        int                     rxq_id;
+
+        int                     buffer_size;
+        int                     q_depth;
+
+        struct bna_qpt qpt;
+        struct bna_rcb *rcb;
+
+        struct bna_rxp *rxp;
+        struct bna_rx *rx;
+
+        u64             rx_packets;
+        u64             rx_bytes;
+        u64             rx_packets_with_error;
+        u64             rxbuf_alloc_failed;
+};
+
+/* RxQ pair */
+union bna_rxq_u {
+        struct {
+                struct bna_rxq *hdr;
+                struct bna_rxq *data;
+        } hds;
+        struct {
+                struct bna_rxq *small;
+                struct bna_rxq *large;
+        } slr;
+        struct {
+                struct bna_rxq *only;
+                struct bna_rxq *reserved;
+        } single;
+};
+
+/* Packet rate for Dynamic Interrupt Moderation */
+struct bna_pkt_rate {
+        u32             small_pkt_cnt;
+        u32             large_pkt_cnt;
+};
+
+/* Completion control structure */
+struct bna_ccb {
+        /* Fast path */
+        void                    **sw_qpt;
+        u32             producer_index;
+        volatile u32    *hw_producer_index;
+        u32             q_depth;
+        struct bna_ib_dbell *i_dbell;
+        struct bna_rcb *rcb[2];
+        void                    *ctrl; /* For bnad */
+        struct bna_pkt_rate pkt_rate;
+        int                     page_idx;
+        int                     page_count;
+
+        /* Control path */
+        struct bna_cq *cq;
+        struct bnad *bnad;
+        enum bna_intr_type intr_type;
+        int                     intr_vector;
+        u8                      rx_coalescing_timeo; /* For NAPI */
+        int                     id;
+        char                    name[BNA_Q_NAME_SIZE];
+};
+
+/* CQ QPT, configuration  */
+struct bna_cq {
+        int                     cq_id;
+
+        struct bna_qpt qpt;
+        struct bna_ccb *ccb;
+
+        struct bna_ib *ib;
+        u8                      ib_seg_offset;
+
+        struct bna_rx *rx;
+};
+
+struct bna_rss_config {
+        enum rss_hash_type hash_type;
+        u8                      hash_mask;
+        u32             toeplitz_hash_key[BFI_RSS_HASH_KEY_LEN];
+};
+
+struct bna_hds_config {
+        enum hds_header_type hdr_type;
+        int                     header_size;
+};
+
+/* This structure is used during RX creation */
+struct bna_rx_config {
+        enum bna_rx_type rx_type;
+        int                     num_paths;
+        enum bna_rxp_type rxp_type;
+        int                     paused;
+        int                     q_depth;
+        /*
+         * Small/Large (or Header/Data) buffer size to be configured
+         * for SLR and HDS queue type. Large buffer size comes from
+         * port->mtu.
+         */
+        int                     small_buff_size;
+
+        enum bna_status rss_status;
+        struct bna_rss_config rss_config;
+
+        enum bna_status hds_status;
+        struct bna_hds_config hds_config;
+
+        enum bna_status vlan_strip_status;
+};
+
+/* Rx Path structure - one per MSIX vector/CPU */
+struct bna_rxp {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        enum bna_rxp_type type;
+        union   bna_rxq_u       rxq;
+        struct bna_cq cq;
+
+        struct bna_rx *rx;
+
+        /* MSI-x vector number for configuring RSS */
+        int                     vector;
+
+        struct bna_mbox_qe mbox_qe;
+};
+
+/* HDS configuration structure */
+struct bna_rxf_hds {
+        enum hds_header_type hdr_type;
+        int                     header_size;
+};
+
+/* RSS configuration structure */
+struct bna_rxf_rss {
+        enum rss_hash_type hash_type;
+        u8                      hash_mask;
+        u32             toeplitz_hash_key[BFI_RSS_HASH_KEY_LEN];
+};
+
+/* RxF structure (hardware Rx Function) */
+struct bna_rxf {
+        bfa_fsm_t               fsm;
+        int                     rxf_id;
+        enum rxf_flags ctrl_flags;
+        u16             default_vlan_tag;
+        enum bna_rxf_oper_state rxf_oper_state;
+        enum bna_status hds_status;
+        struct bna_rxf_hds hds_cfg;
+        enum bna_status rss_status;
+        struct bna_rxf_rss rss_cfg;
+        struct bna_rit_segment *rit_segment;
+        struct bna_rx *rx;
+        u32             forced_offset;
+        struct bna_mbox_qe mbox_qe;
+        int                     mcast_rxq_id;
+
+        /* callback for bna_rxf_start() */
+        void (*start_cbfn) (struct bna_rx *rx, enum bna_cb_status status);
+        struct bna_rx *start_cbarg;
+
+        /* callback for bna_rxf_stop() */
+        void (*stop_cbfn) (struct bna_rx *rx, enum bna_cb_status status);
+        struct bna_rx *stop_cbarg;
+
+        /* callback for bna_rxf_receive_enable() / bna_rxf_receive_disable() */
+        void (*oper_state_cbfn) (struct bnad *bnad, struct bna_rx *rx,
+                        enum bna_cb_status status);
+        struct bnad *oper_state_cbarg;
+
+        /**
+         * callback for:
+         *      bna_rxf_ucast_set()
+         *      bna_rxf_{ucast/mcast}_add(),
+         *      bna_rxf_{ucast/mcast}_del(),
+         *      bna_rxf_mode_set()
+         */
+        void (*cam_fltr_cbfn)(struct bnad *bnad, struct bna_rx *rx,
+                                enum bna_cb_status status);
+        struct bnad *cam_fltr_cbarg;
+
+        enum bna_rxf_flags rxf_flags;
+
+        /* List of unicast addresses yet to be applied to h/w */
+        struct list_head                        ucast_pending_add_q;
+        struct list_head                        ucast_pending_del_q;
+        int                     ucast_pending_set;
+        /* ucast addresses applied to the h/w */
+        struct list_head                        ucast_active_q;
+        struct bna_mac *ucast_active_mac;
+
+        /* List of multicast addresses yet to be applied to h/w */
+        struct list_head                        mcast_pending_add_q;
+        struct list_head                        mcast_pending_del_q;
+        /* multicast addresses applied to the h/w */
+        struct list_head                        mcast_active_q;
+
+        /* Rx modes yet to be applied to h/w */
+        enum bna_rxmode rxmode_pending;
+        enum bna_rxmode rxmode_pending_bitmask;
+        /* Rx modes applied to h/w */
+        enum bna_rxmode rxmode_active;
+
+        enum bna_status vlan_filter_status;
+        u32             vlan_filter_table[(BFI_MAX_VLAN + 1) / 32];
+};
+
+/* Rx object */
+struct bna_rx {
+        /* This should be the first one */
+        struct list_head                        qe;
+
+        bfa_fsm_t               fsm;
+
+        enum bna_rx_type type;
+
+        /* list-head for RX path objects */
+        struct list_head                        rxp_q;
+
+        struct bna_rxf rxf;
+
+        enum bna_rx_flags rx_flags;
+
+        struct bna_mbox_qe mbox_qe;
+
+        struct bfa_wc           rxq_stop_wc;
+
+        /* Rx event handlers */
+        void (*rcb_setup_cbfn)(struct bnad *, struct bna_rcb *);
+        void (*rcb_destroy_cbfn)(struct bnad *, struct bna_rcb *);
+        void (*ccb_setup_cbfn)(struct bnad *, struct bna_ccb *);
+        void (*ccb_destroy_cbfn)(struct bnad *, struct bna_ccb *);
+        void (*rx_cleanup_cbfn)(struct bnad *, struct bna_ccb *);
+        void (*rx_post_cbfn)(struct bnad *, struct bna_rcb *);
+
+        /* callback for bna_rx_disable(), bna_rx_stop() */
+        void (*stop_cbfn)(void *arg, struct bna_rx *rx,
+                                enum bna_cb_status status);
+        void                    *stop_cbarg;
+
+        struct bna *bna;
+        void                    *priv; /* bnad's cookie */
+};
+
+struct bna_rx_event_cbfn {
+        /* Optional */
+        void (*rcb_setup_cbfn)(struct bnad *, struct bna_rcb *);
+        void (*rcb_destroy_cbfn)(struct bnad *, struct bna_rcb *);
+        void (*ccb_setup_cbfn)(struct bnad *, struct bna_ccb *);
+        void (*ccb_destroy_cbfn)(struct bnad *, struct bna_ccb *);
+        /* Mandatory */
+        void (*rx_cleanup_cbfn)(struct bnad *, struct bna_ccb *);
+        void (*rx_post_cbfn)(struct bnad *, struct bna_rcb *);
+};
+
+/* Rx module - keeps track of free, active rx objects */
+struct bna_rx_mod {
+        struct bna *bna;                /* back pointer to parent */
+        struct bna_rx *rx;              /* BFI_MAX_RXQ entries */
+        struct bna_rxp *rxp;            /* BFI_MAX_RXQ entries */
+        struct bna_rxq *rxq;            /* BFI_MAX_RXQ entries */
+
+        struct list_head                        rx_free_q;
+        struct list_head                        rx_active_q;
+        int                     rx_free_count;
+
+        struct list_head                        rxp_free_q;
+        int                     rxp_free_count;
+
+        struct list_head                        rxq_free_q;
+        int                     rxq_free_count;
+
+        enum bna_rx_mod_flags flags;
+
+        /* callback for bna_rx_mod_stop() */
+        void (*stop_cbfn)(struct bna_port *port,
+                                enum bna_cb_status status);
+
+        struct bfa_wc           rx_stop_wc;
+        u32             dim_vector[BNA_LOAD_T_MAX][BNA_BIAS_T_MAX];
+        u32             rxf_bmap[2];
+};
+
+/**
+ *
+ * CAM
+ *
+ */
+
+struct bna_ucam_mod {
+        struct bna_mac *ucmac;          /* BFI_MAX_UCMAC entries */
+        struct list_head                        free_q;
+
+        struct bna *bna;
+};
+
+struct bna_mcam_mod {
+        struct bna_mac *mcmac;          /* BFI_MAX_MCMAC entries */
+        struct list_head                        free_q;
+
+        struct bna *bna;
+};
+
+/**
+ *
+ * Statistics
+ *
+ */
+
+struct bna_tx_stats {
+        int                     tx_state;
+        int                     tx_flags;
+        int                     num_txqs;
+        u32             txq_bmap[2];
+        int                     txf_id;
+};
+
+struct bna_rx_stats {
+        int                     rx_state;
+        int                     rx_flags;
+        int                     num_rxps;
+        int                     num_rxqs;
+        u32             rxq_bmap[2];
+        u32             cq_bmap[2];
+        int                     rxf_id;
+        int                     rxf_state;
+        int                     rxf_oper_state;
+        int                     num_active_ucast;
+        int                     num_active_mcast;
+        int                     rxmode_active;
+        int                     vlan_filter_status;
+        u32             vlan_filter_table[(BFI_MAX_VLAN + 1) / 32];
+        int                     rss_status;
+        int                     hds_status;
+};
+
+struct bna_sw_stats {
+        int                     device_state;
+        int                     port_state;
+        int                     port_flags;
+        int                     llport_state;
+        int                     priority;
+        int                     num_active_tx;
+        int                     num_active_rx;
+        struct bna_tx_stats tx_stats[BFI_MAX_TXQ];
+        struct bna_rx_stats rx_stats[BFI_MAX_RXQ];
+};
+
+struct bna_stats {
+        u32             txf_bmap[2];
+        u32             rxf_bmap[2];
+        struct bfi_ll_stats     *hw_stats;
+        struct bna_sw_stats *sw_stats;
+};
+
+/**
+ *
+ * BNA
+ *
+ */
+
+struct bna {
+        struct bfa_pcidev pcidev;
+
+        int                     port_num;
+
+        struct bna_chip_regs regs;
+
+        struct bna_dma_addr hw_stats_dma;
+        struct bna_stats stats;
+
+        struct bna_device device;
+        struct bfa_cee cee;
+
+        struct bna_mbox_mod mbox_mod;
+
+        struct bna_port port;
+
+        struct bna_tx_mod tx_mod;
+
+        struct bna_rx_mod rx_mod;
+
+        struct bna_ib_mod ib_mod;
+
+        struct bna_ucam_mod ucam_mod;
+        struct bna_mcam_mod mcam_mod;
+
+        struct bna_rit_mod rit_mod;
+
+        int                     rxf_default_id;
+        int                     rxf_promisc_id;
+
+        struct bna_mbox_qe mbox_qe;
+
+        struct bnad *bnad;
+};
+
+#endif  /* __BNA_TYPES_H__ */
diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
new file mode 100644
index 000000000000..e380c0e88f4f
--- /dev/null
+++ b/drivers/net/bna/bnad.c
@@ -0,0 +1,3267 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/etherdevice.h>
+#include <linux/in.h>
+#include <linux/ethtool.h>
+#include <linux/if_vlan.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+
+#include "bnad.h"
+#include "bna.h"
+#include "cna.h"
+
+DEFINE_MUTEX(bnad_fwimg_mutex);
+
+/*
+ * Module params
+ */
+static uint bnad_msix_disable;
+module_param(bnad_msix_disable, uint, 0444);
+MODULE_PARM_DESC(bnad_msix_disable, "Disable MSIX mode");
+
+static uint bnad_ioc_auto_recover = 1;
+module_param(bnad_ioc_auto_recover, uint, 0444);
+MODULE_PARM_DESC(bnad_ioc_auto_recover, "Enable / Disable auto recovery");
+
+/*
+ * Global variables
+ */
+u32 bnad_rxqs_per_cq = 2;
+
+const u8 bnad_bcast_addr[] =  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+/*
+ * Local MACROS
+ */
+#define BNAD_TX_UNMAPQ_DEPTH (bnad->txq_depth * 2)
+
+#define BNAD_RX_UNMAPQ_DEPTH (bnad->rxq_depth)
+
+#define BNAD_GET_MBOX_IRQ(_bnad)                                \
+        (((_bnad)->cfg_flags & BNAD_CF_MSIX) ?                  \
+         ((_bnad)->msix_table[(_bnad)->msix_num - 1].vector) :  \
+         ((_bnad)->pcidev->irq))
+
+#define BNAD_FILL_UNMAPQ_MEM_REQ(_res_info, _num, _depth)       \
+do {                                                            \
+        (_res_info)->res_type = BNA_RES_T_MEM;                  \
+        (_res_info)->res_u.mem_info.mem_type = BNA_MEM_T_KVA;   \
+        (_res_info)->res_u.mem_info.num = (_num);               \
+        (_res_info)->res_u.mem_info.len =                       \
+        sizeof(struct bnad_unmap_q) +                           \
+        (sizeof(struct bnad_skb_unmap) * ((_depth) - 1));       \
+} while (0)
+
+/*
+ * Reinitialize completions in CQ, once Rx is taken down
+ */
+static void
+bnad_cq_cmpl_init(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        struct bna_cq_entry *cmpl, *next_cmpl;
+        unsigned int wi_range, wis = 0, ccb_prod = 0;
+        int i;
+
+        BNA_CQ_QPGE_PTR_GET(ccb_prod, ccb->sw_qpt, cmpl,
+                            wi_range);
+
+        for (i = 0; i < ccb->q_depth; i++) {
+                wis++;
+                if (likely(--wi_range))
+                        next_cmpl = cmpl + 1;
+                else {
+                        BNA_QE_INDX_ADD(ccb_prod, wis, ccb->q_depth);
+                        wis = 0;
+                        BNA_CQ_QPGE_PTR_GET(ccb_prod, ccb->sw_qpt,
+                                                next_cmpl, wi_range);
+                }
+                cmpl->valid = 0;
+                cmpl = next_cmpl;
+        }
+}
+
+/*
+ * Frees all pending Tx Bufs
+ * At this point no activity is expected on the Q,
+ * so DMA unmap & freeing is fine.
+ */
+static void
+bnad_free_all_txbufs(struct bnad *bnad,
+                 struct bna_tcb *tcb)
+{
+        u16             unmap_cons;
+        struct bnad_unmap_q *unmap_q = tcb->unmap_q;
+        struct bnad_skb_unmap *unmap_array;
+        struct sk_buff          *skb = NULL;
+        int                     i;
+
+        unmap_array = unmap_q->unmap_array;
+
+        unmap_cons = 0;
+        while (unmap_cons < unmap_q->q_depth) {
+                skb = unmap_array[unmap_cons].skb;
+                if (!skb) {
+                        unmap_cons++;
+                        continue;
+                }
+                unmap_array[unmap_cons].skb = NULL;
+
+                pci_unmap_single(bnad->pcidev,
+                                 pci_unmap_addr(&unmap_array[unmap_cons],
+                                                dma_addr), skb_headlen(skb),
+                                                PCI_DMA_TODEVICE);
+
+                pci_unmap_addr_set(&unmap_array[unmap_cons], dma_addr, 0);
+                unmap_cons++;
+                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                        pci_unmap_page(bnad->pcidev,
+                                       pci_unmap_addr(&unmap_array[unmap_cons],
+                                                      dma_addr),
+                                       skb_shinfo(skb)->frags[i].size,
+                                       PCI_DMA_TODEVICE);
+                        pci_unmap_addr_set(&unmap_array[unmap_cons], dma_addr,
+                                           0);
+                        unmap_cons++;
+                }
+                dev_kfree_skb_any(skb);
+        }
+}
+
+/* Data Path Handlers */
+
+/*
+ * bnad_free_txbufs : Frees the Tx bufs on Tx completion
+ * Can be called in a) Interrupt context
+ *                  b) Sending context
+ *                  c) Tasklet context
+ */
+static u32
+bnad_free_txbufs(struct bnad *bnad,
+                 struct bna_tcb *tcb)
+{
+        u32             sent_packets = 0, sent_bytes = 0;
+        u16             wis, unmap_cons, updated_hw_cons;
+        struct bnad_unmap_q *unmap_q = tcb->unmap_q;
+        struct bnad_skb_unmap *unmap_array;
+        struct sk_buff          *skb;
+        int i;
+
+        /*
+         * Just return if TX is stopped. This check is useful
+         * when bnad_free_txbufs() runs out of a tasklet scheduled
+         * before bnad_cb_tx_cleanup() cleared BNAD_RF_TX_STARTED bit
+         * but this routine runs actually after the cleanup has been
+         * executed.
+         */
+        if (!test_bit(BNAD_RF_TX_STARTED, &bnad->run_flags))
+                return 0;
+
+        updated_hw_cons = *(tcb->hw_consumer_index);
+
+        wis = BNA_Q_INDEX_CHANGE(tcb->consumer_index,
+                                  updated_hw_cons, tcb->q_depth);
+
+        BUG_ON(!(wis <= BNA_QE_IN_USE_CNT(tcb, tcb->q_depth)));
+
+        unmap_array = unmap_q->unmap_array;
+        unmap_cons = unmap_q->consumer_index;
+
+        prefetch(&unmap_array[unmap_cons + 1]);
+        while (wis) {
+                skb = unmap_array[unmap_cons].skb;
+
+                unmap_array[unmap_cons].skb = NULL;
+
+                sent_packets++;
+                sent_bytes += skb->len;
+                wis -= BNA_TXQ_WI_NEEDED(1 + skb_shinfo(skb)->nr_frags);
+
+                pci_unmap_single(bnad->pcidev,
+                                 pci_unmap_addr(&unmap_array[unmap_cons],
+                                                dma_addr), skb_headlen(skb),
+                                 PCI_DMA_TODEVICE);
+                pci_unmap_addr_set(&unmap_array[unmap_cons], dma_addr, 0);
+                BNA_QE_INDX_ADD(unmap_cons, 1, unmap_q->q_depth);
+
+                prefetch(&unmap_array[unmap_cons + 1]);
+                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                        prefetch(&unmap_array[unmap_cons + 1]);
+
+                        pci_unmap_page(bnad->pcidev,
+                                       pci_unmap_addr(&unmap_array[unmap_cons],
+                                                      dma_addr),
+                                       skb_shinfo(skb)->frags[i].size,
+                                       PCI_DMA_TODEVICE);
+                        pci_unmap_addr_set(&unmap_array[unmap_cons], dma_addr,
+                                           0);
+                        BNA_QE_INDX_ADD(unmap_cons, 1, unmap_q->q_depth);
+                }
+                dev_kfree_skb_any(skb);
+        }
+
+        /* Update consumer pointers. */
+        tcb->consumer_index = updated_hw_cons;
+        unmap_q->consumer_index = unmap_cons;
+
+        tcb->txq->tx_packets += sent_packets;
+        tcb->txq->tx_bytes += sent_bytes;
+
+        return sent_packets;
+}
+
+/* Tx Free Tasklet function */
+/* Frees for all the tcb's in all the Tx's */
+/*
+ * Scheduled from sending context, so that
+ * the fat Tx lock is not held for too long
+ * in the sending context.
+ */
+static void
+bnad_tx_free_tasklet(unsigned long bnad_ptr)
+{
+        struct bnad *bnad = (struct bnad *)bnad_ptr;
+        struct bna_tcb *tcb;
+        u32             acked;
+        int                     i, j;
+
+        for (i = 0; i < bnad->num_tx; i++) {
+                for (j = 0; j < bnad->num_txq_per_tx; j++) {
+                        tcb = bnad->tx_info[i].tcb[j];
+                        if (!tcb)
+                                continue;
+                        if (((u16) (*tcb->hw_consumer_index) !=
+                                tcb->consumer_index) &&
+                                (!test_and_set_bit(BNAD_TXQ_FREE_SENT,
+                                                  &tcb->flags))) {
+                                acked = bnad_free_txbufs(bnad, tcb);
+                                bna_ib_ack(tcb->i_dbell, acked);
+                                smp_mb__before_clear_bit();
+                                clear_bit(BNAD_TXQ_FREE_SENT, &tcb->flags);
+                        }
+                }
+        }
+}
+
+static u32
+bnad_tx(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        struct net_device *netdev = bnad->netdev;
+        u32 sent;
+
+        if (test_and_set_bit(BNAD_TXQ_FREE_SENT, &tcb->flags))
+                return 0;
+
+        sent = bnad_free_txbufs(bnad, tcb);
+        if (sent) {
+                if (netif_queue_stopped(netdev) &&
+                    netif_carrier_ok(netdev) &&
+                    BNA_QE_FREE_CNT(tcb, tcb->q_depth) >=
+                                    BNAD_NETIF_WAKE_THRESHOLD) {
+                        netif_wake_queue(netdev);
+                        BNAD_UPDATE_CTR(bnad, netif_queue_wakeup);
+                }
+                bna_ib_ack(tcb->i_dbell, sent);
+        } else
+                bna_ib_ack(tcb->i_dbell, 0);
+
+        smp_mb__before_clear_bit();
+        clear_bit(BNAD_TXQ_FREE_SENT, &tcb->flags);
+
+        return sent;
+}
+
+/* MSIX Tx Completion Handler */
+static irqreturn_t
+bnad_msix_tx(int irq, void *data)
+{
+        struct bna_tcb *tcb = (struct bna_tcb *)data;
+        struct bnad *bnad = tcb->bnad;
+
+        bnad_tx(bnad, tcb);
+
+        return IRQ_HANDLED;
+}
+
+static void
+bnad_reset_rcb(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        struct bnad_unmap_q *unmap_q = rcb->unmap_q;
+
+        rcb->producer_index = 0;
+        rcb->consumer_index = 0;
+
+        unmap_q->producer_index = 0;
+        unmap_q->consumer_index = 0;
+}
+
+static void
+bnad_free_rxbufs(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        struct bnad_unmap_q *unmap_q;
+        struct sk_buff *skb;
+
+        unmap_q = rcb->unmap_q;
+        while (BNA_QE_IN_USE_CNT(unmap_q, unmap_q->q_depth)) {
+                skb = unmap_q->unmap_array[unmap_q->consumer_index].skb;
+                BUG_ON(!(skb));
+                unmap_q->unmap_array[unmap_q->consumer_index].skb = NULL;
+                pci_unmap_single(bnad->pcidev, pci_unmap_addr(&unmap_q->
+                                        unmap_array[unmap_q->consumer_index],
+                                        dma_addr), rcb->rxq->buffer_size +
+                                        NET_IP_ALIGN, PCI_DMA_FROMDEVICE);
+                dev_kfree_skb(skb);
+                BNA_QE_INDX_ADD(unmap_q->consumer_index, 1, unmap_q->q_depth);
+                BNA_QE_INDX_ADD(rcb->consumer_index, 1, rcb->q_depth);
+        }
+
+        bnad_reset_rcb(bnad, rcb);
+}
+
+static void
+bnad_alloc_n_post_rxbufs(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        u16 to_alloc, alloced, unmap_prod, wi_range;
+        struct bnad_unmap_q *unmap_q = rcb->unmap_q;
+        struct bnad_skb_unmap *unmap_array;
+        struct bna_rxq_entry *rxent;
+        struct sk_buff *skb;
+        dma_addr_t dma_addr;
+
+        alloced = 0;
+        to_alloc =
+                BNA_QE_FREE_CNT(unmap_q, unmap_q->q_depth);
+
+        unmap_array = unmap_q->unmap_array;
+        unmap_prod = unmap_q->producer_index;
+
+        BNA_RXQ_QPGE_PTR_GET(unmap_prod, rcb->sw_qpt, rxent, wi_range);
+
+        while (to_alloc--) {
+                if (!wi_range) {
+                        BNA_RXQ_QPGE_PTR_GET(unmap_prod, rcb->sw_qpt, rxent,
+                                             wi_range);
+                }
+                skb = alloc_skb(rcb->rxq->buffer_size + NET_IP_ALIGN,
+                                     GFP_ATOMIC);
+                if (unlikely(!skb)) {
+                        BNAD_UPDATE_CTR(bnad, rxbuf_alloc_failed);
+                        goto finishing;
+                }
+                skb->dev = bnad->netdev;
+                skb_reserve(skb, NET_IP_ALIGN);
+                unmap_array[unmap_prod].skb = skb;
+                dma_addr = pci_map_single(bnad->pcidev, skb->data,
+                        rcb->rxq->buffer_size, PCI_DMA_FROMDEVICE);
+                pci_unmap_addr_set(&unmap_array[unmap_prod], dma_addr,
+                                   dma_addr);
+                BNA_SET_DMA_ADDR(dma_addr, &rxent->host_addr);
+                BNA_QE_INDX_ADD(unmap_prod, 1, unmap_q->q_depth);
+
+                rxent++;
+                wi_range--;
+                alloced++;
+        }
+
+finishing:
+        if (likely(alloced)) {
+                unmap_q->producer_index = unmap_prod;
+                rcb->producer_index = unmap_prod;
+                smp_mb();
+                bna_rxq_prod_indx_doorbell(rcb);
+        }
+}
+
+/*
+ * Locking is required in the enable path
+ * because it is called from a napi poll
+ * context, where the bna_lock is not held
+ * unlike the IRQ context.
+ */
+static void
+bnad_enable_txrx_irqs(struct bnad *bnad)
+{
+        struct bna_tcb *tcb;
+        struct bna_ccb *ccb;
+        int i, j;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        for (i = 0; i < bnad->num_tx; i++) {
+                for (j = 0; j < bnad->num_txq_per_tx; j++) {
+                        tcb = bnad->tx_info[i].tcb[j];
+                        bna_ib_coalescing_timer_set(tcb->i_dbell,
+                                tcb->txq->ib->ib_config.coalescing_timeo);
+                        bna_ib_ack(tcb->i_dbell, 0);
+                }
+        }
+
+        for (i = 0; i < bnad->num_rx; i++) {
+                for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                        ccb = bnad->rx_info[i].rx_ctrl[j].ccb;
+                        bnad_enable_rx_irq_unsafe(ccb);
+                }
+        }
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+static inline void
+bnad_refill_rxq(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        struct bnad_unmap_q *unmap_q = rcb->unmap_q;
+
+        if (!test_and_set_bit(BNAD_RXQ_REFILL, &rcb->flags)) {
+                if (BNA_QE_FREE_CNT(unmap_q, unmap_q->q_depth)
+                         >> BNAD_RXQ_REFILL_THRESHOLD_SHIFT)
+                        bnad_alloc_n_post_rxbufs(bnad, rcb);
+                smp_mb__before_clear_bit();
+                clear_bit(BNAD_RXQ_REFILL, &rcb->flags);
+        }
+}
+
+static u32
+bnad_poll_cq(struct bnad *bnad, struct bna_ccb *ccb, int budget)
+{
+        struct bna_cq_entry *cmpl, *next_cmpl;
+        struct bna_rcb *rcb = NULL;
+        unsigned int wi_range, packets = 0, wis = 0;
+        struct bnad_unmap_q *unmap_q;
+        struct sk_buff *skb;
+        u32 flags;
+        u32 qid0 = ccb->rcb[0]->rxq->rxq_id;
+        struct bna_pkt_rate *pkt_rt = &ccb->pkt_rate;
+
+        prefetch(bnad->netdev);
+        BNA_CQ_QPGE_PTR_GET(ccb->producer_index, ccb->sw_qpt, cmpl,
+                            wi_range);
+        BUG_ON(!(wi_range <= ccb->q_depth));
+        while (cmpl->valid && packets < budget) {
+                packets++;
+                BNA_UPDATE_PKT_CNT(pkt_rt, ntohs(cmpl->length));
+
+                if (qid0 == cmpl->rxq_id)
+                        rcb = ccb->rcb[0];
+                else
+                        rcb = ccb->rcb[1];
+
+                unmap_q = rcb->unmap_q;
+
+                skb = unmap_q->unmap_array[unmap_q->consumer_index].skb;
+                BUG_ON(!(skb));
+                unmap_q->unmap_array[unmap_q->consumer_index].skb = NULL;
+                pci_unmap_single(bnad->pcidev,
+                                 pci_unmap_addr(&unmap_q->
+                                                unmap_array[unmap_q->
+                                                            consumer_index],
+                                                dma_addr),
+                                                rcb->rxq->buffer_size,
+                                                PCI_DMA_FROMDEVICE);
+                BNA_QE_INDX_ADD(unmap_q->consumer_index, 1, unmap_q->q_depth);
+
+                /* Should be more efficient ? Performance ? */
+                BNA_QE_INDX_ADD(rcb->consumer_index, 1, rcb->q_depth);
+
+                wis++;
+                if (likely(--wi_range))
+                        next_cmpl = cmpl + 1;
+                else {
+                        BNA_QE_INDX_ADD(ccb->producer_index, wis, ccb->q_depth);
+                        wis = 0;
+                        BNA_CQ_QPGE_PTR_GET(ccb->producer_index, ccb->sw_qpt,
+                                                next_cmpl, wi_range);
+                        BUG_ON(!(wi_range <= ccb->q_depth));
+                }
+                prefetch(next_cmpl);
+
+                flags = ntohl(cmpl->flags);
+                if (unlikely
+                    (flags &
+                     (BNA_CQ_EF_MAC_ERROR | BNA_CQ_EF_FCS_ERROR |
+                      BNA_CQ_EF_TOO_LONG))) {
+                        dev_kfree_skb_any(skb);
+                        rcb->rxq->rx_packets_with_error++;
+                        goto next;
+                }
+
+                skb_put(skb, ntohs(cmpl->length));
+                if (likely
+                    (bnad->rx_csum &&
+                     (((flags & BNA_CQ_EF_IPV4) &&
+                      (flags & BNA_CQ_EF_L3_CKSUM_OK)) ||
+                      (flags & BNA_CQ_EF_IPV6)) &&
+                      (flags & (BNA_CQ_EF_TCP | BNA_CQ_EF_UDP)) &&
+                      (flags & BNA_CQ_EF_L4_CKSUM_OK)))
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                else
+                        skb_checksum_none_assert(skb);
+
+                rcb->rxq->rx_packets++;
+                rcb->rxq->rx_bytes += skb->len;
+                skb->protocol = eth_type_trans(skb, bnad->netdev);
+
+                if (bnad->vlan_grp && (flags & BNA_CQ_EF_VLAN)) {
+                        struct bnad_rx_ctrl *rx_ctrl =
+                                (struct bnad_rx_ctrl *)ccb->ctrl;
+                        if (skb->ip_summed == CHECKSUM_UNNECESSARY)
+                                vlan_gro_receive(&rx_ctrl->napi, bnad->vlan_grp,
+                                                ntohs(cmpl->vlan_tag), skb);
+                        else
+                                vlan_hwaccel_receive_skb(skb,
+                                                         bnad->vlan_grp,
+                                                         ntohs(cmpl->vlan_tag));
+
+                } else { /* Not VLAN tagged/stripped */
+                        struct bnad_rx_ctrl *rx_ctrl =
+                                (struct bnad_rx_ctrl *)ccb->ctrl;
+                        if (skb->ip_summed == CHECKSUM_UNNECESSARY)
+                                napi_gro_receive(&rx_ctrl->napi, skb);
+                        else
+                                netif_receive_skb(skb);
+                }
+
+next:
+                cmpl->valid = 0;
+                cmpl = next_cmpl;
+        }
+
+        BNA_QE_INDX_ADD(ccb->producer_index, wis, ccb->q_depth);
+
+        if (likely(ccb)) {
+                bna_ib_ack(ccb->i_dbell, packets);
+                bnad_refill_rxq(bnad, ccb->rcb[0]);
+                if (ccb->rcb[1])
+                        bnad_refill_rxq(bnad, ccb->rcb[1]);
+        } else
+                bna_ib_ack(ccb->i_dbell, 0);
+
+        return packets;
+}
+
+static void
+bnad_disable_rx_irq(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        bna_ib_coalescing_timer_set(ccb->i_dbell, 0);
+        bna_ib_ack(ccb->i_dbell, 0);
+}
+
+static void
+bnad_enable_rx_irq(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        spin_lock_irq(&bnad->bna_lock); /* Because of polling context */
+        bnad_enable_rx_irq_unsafe(ccb);
+        spin_unlock_irq(&bnad->bna_lock);
+}
+
+static void
+bnad_netif_rx_schedule_poll(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        struct bnad_rx_ctrl *rx_ctrl = (struct bnad_rx_ctrl *)(ccb->ctrl);
+        if (likely(napi_schedule_prep((&rx_ctrl->napi)))) {
+                bnad_disable_rx_irq(bnad, ccb);
+                __napi_schedule((&rx_ctrl->napi));
+        }
+        BNAD_UPDATE_CTR(bnad, netif_rx_schedule);
+}
+
+/* MSIX Rx Path Handler */
+static irqreturn_t
+bnad_msix_rx(int irq, void *data)
+{
+        struct bna_ccb *ccb = (struct bna_ccb *)data;
+        struct bnad *bnad = ccb->bnad;
+
+        bnad_netif_rx_schedule_poll(bnad, ccb);
+
+        return IRQ_HANDLED;
+}
+
+/* Interrupt handlers */
+
+/* Mbox Interrupt Handlers */
+static irqreturn_t
+bnad_msix_mbox_handler(int irq, void *data)
+{
+        u32 intr_status;
+        unsigned long  flags;
+        struct net_device *netdev = data;
+        struct bnad *bnad;
+
+        bnad = netdev_priv(netdev);
+
+        /* BNA_ISR_GET(bnad); Inc Ref count */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        bna_intr_status_get(&bnad->bna, intr_status);
+
+        if (BNA_IS_MBOX_ERR_INTR(intr_status))
+                bna_mbox_handler(&bnad->bna, intr_status);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* BNAD_ISR_PUT(bnad); Dec Ref count */
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t
+bnad_isr(int irq, void *data)
+{
+        int i, j;
+        u32 intr_status;
+        unsigned long flags;
+        struct net_device *netdev = data;
+        struct bnad *bnad = netdev_priv(netdev);
+        struct bnad_rx_info *rx_info;
+        struct bnad_rx_ctrl *rx_ctrl;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        bna_intr_status_get(&bnad->bna, intr_status);
+        if (!intr_status) {
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+                return IRQ_NONE;
+        }
+
+        if (BNA_IS_MBOX_ERR_INTR(intr_status)) {
+                bna_mbox_handler(&bnad->bna, intr_status);
+                if (!BNA_IS_INTX_DATA_INTR(intr_status)) {
+                        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+                        goto done;
+                }
+        }
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Process data interrupts */
+        for (i = 0; i < bnad->num_rx; i++) {
+                rx_info = &bnad->rx_info[i];
+                if (!rx_info->rx)
+                        continue;
+                for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                        rx_ctrl = &rx_info->rx_ctrl[j];
+                        if (rx_ctrl->ccb)
+                                bnad_netif_rx_schedule_poll(bnad,
+                                                            rx_ctrl->ccb);
+                }
+        }
+done:
+        return IRQ_HANDLED;
+}
+
+/*
+ * Called in interrupt / callback context
+ * with bna_lock held, so cfg_flags access is OK
+ */
+static void
+bnad_enable_mbox_irq(struct bnad *bnad)
+{
+        int irq = BNAD_GET_MBOX_IRQ(bnad);
+
+        if (!(bnad->cfg_flags & BNAD_CF_MSIX))
+                return;
+
+        if (test_and_clear_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags))
+                enable_irq(irq);
+        BNAD_UPDATE_CTR(bnad, mbox_intr_enabled);
+}
+
+/*
+ * Called with bnad->bna_lock held b'cos of
+ * bnad->cfg_flags access.
+ */
+void
+bnad_disable_mbox_irq(struct bnad *bnad)
+{
+        int irq = BNAD_GET_MBOX_IRQ(bnad);
+
+        if (!(bnad->cfg_flags & BNAD_CF_MSIX))
+                return;
+
+        if (!test_and_set_bit(BNAD_RF_MBOX_IRQ_DISABLED, &bnad->run_flags))
+                disable_irq_nosync(irq);
+        BNAD_UPDATE_CTR(bnad, mbox_intr_disabled);
+}
+
+/* Control Path Handlers */
+
+/* Callbacks */
+void
+bnad_cb_device_enable_mbox_intr(struct bnad *bnad)
+{
+        bnad_enable_mbox_irq(bnad);
+}
+
+void
+bnad_cb_device_disable_mbox_intr(struct bnad *bnad)
+{
+        bnad_disable_mbox_irq(bnad);
+}
+
+void
+bnad_cb_device_enabled(struct bnad *bnad, enum bna_cb_status status)
+{
+        complete(&bnad->bnad_completions.ioc_comp);
+        bnad->bnad_completions.ioc_comp_status = status;
+}
+
+void
+bnad_cb_device_disabled(struct bnad *bnad, enum bna_cb_status status)
+{
+        complete(&bnad->bnad_completions.ioc_comp);
+        bnad->bnad_completions.ioc_comp_status = status;
+}
+
+static void
+bnad_cb_port_disabled(void *arg, enum bna_cb_status status)
+{
+        struct bnad *bnad = (struct bnad *)arg;
+
+        complete(&bnad->bnad_completions.port_comp);
+
+        netif_carrier_off(bnad->netdev);
+}
+
+void
+bnad_cb_port_link_status(struct bnad *bnad,
+                        enum bna_link_status link_status)
+{
+        bool link_up = 0;
+
+        link_up = (link_status == BNA_LINK_UP) || (link_status == BNA_CEE_UP);
+
+        if (link_status == BNA_CEE_UP) {
+                set_bit(BNAD_RF_CEE_RUNNING, &bnad->run_flags);
+                BNAD_UPDATE_CTR(bnad, cee_up);
+        } else
+                clear_bit(BNAD_RF_CEE_RUNNING, &bnad->run_flags);
+
+        if (link_up) {
+                if (!netif_carrier_ok(bnad->netdev)) {
+                        pr_warn("bna: %s link up\n",
+                                bnad->netdev->name);
+                        netif_carrier_on(bnad->netdev);
+                        BNAD_UPDATE_CTR(bnad, link_toggle);
+                        if (test_bit(BNAD_RF_TX_STARTED, &bnad->run_flags)) {
+                                /* Force an immediate Transmit Schedule */
+                                pr_info("bna: %s TX_STARTED\n",
+                                        bnad->netdev->name);
+                                netif_wake_queue(bnad->netdev);
+                                BNAD_UPDATE_CTR(bnad, netif_queue_wakeup);
+                        } else {
+                                netif_stop_queue(bnad->netdev);
+                                BNAD_UPDATE_CTR(bnad, netif_queue_stop);
+                        }
+                }
+        } else {
+                if (netif_carrier_ok(bnad->netdev)) {
+                        pr_warn("bna: %s link down\n",
+                                bnad->netdev->name);
+                        netif_carrier_off(bnad->netdev);
+                        BNAD_UPDATE_CTR(bnad, link_toggle);
+                }
+        }
+}
+
+static void
+bnad_cb_tx_disabled(void *arg, struct bna_tx *tx,
+                        enum bna_cb_status status)
+{
+        struct bnad *bnad = (struct bnad *)arg;
+
+        complete(&bnad->bnad_completions.tx_comp);
+}
+
+static void
+bnad_cb_tcb_setup(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        struct bnad_tx_info *tx_info =
+                        (struct bnad_tx_info *)tcb->txq->tx->priv;
+        struct bnad_unmap_q *unmap_q = tcb->unmap_q;
+
+        tx_info->tcb[tcb->id] = tcb;
+        unmap_q->producer_index = 0;
+        unmap_q->consumer_index = 0;
+        unmap_q->q_depth = BNAD_TX_UNMAPQ_DEPTH;
+}
+
+static void
+bnad_cb_tcb_destroy(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        struct bnad_tx_info *tx_info =
+                        (struct bnad_tx_info *)tcb->txq->tx->priv;
+
+        tx_info->tcb[tcb->id] = NULL;
+}
+
+static void
+bnad_cb_rcb_setup(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        struct bnad_unmap_q *unmap_q = rcb->unmap_q;
+
+        unmap_q->producer_index = 0;
+        unmap_q->consumer_index = 0;
+        unmap_q->q_depth = BNAD_RX_UNMAPQ_DEPTH;
+}
+
+static void
+bnad_cb_ccb_setup(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        struct bnad_rx_info *rx_info =
+                        (struct bnad_rx_info *)ccb->cq->rx->priv;
+
+        rx_info->rx_ctrl[ccb->id].ccb = ccb;
+        ccb->ctrl = &rx_info->rx_ctrl[ccb->id];
+}
+
+static void
+bnad_cb_ccb_destroy(struct bnad *bnad, struct bna_ccb *ccb)
+{
+        struct bnad_rx_info *rx_info =
+                        (struct bnad_rx_info *)ccb->cq->rx->priv;
+
+        rx_info->rx_ctrl[ccb->id].ccb = NULL;
+}
+
+static void
+bnad_cb_tx_stall(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        struct bnad_tx_info *tx_info =
+                        (struct bnad_tx_info *)tcb->txq->tx->priv;
+
+        if (tx_info != &bnad->tx_info[0])
+                return;
+
+        clear_bit(BNAD_RF_TX_STARTED, &bnad->run_flags);
+        netif_stop_queue(bnad->netdev);
+        pr_info("bna: %s TX_STOPPED\n", bnad->netdev->name);
+}
+
+static void
+bnad_cb_tx_resume(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        if (test_and_set_bit(BNAD_RF_TX_STARTED, &bnad->run_flags))
+                return;
+
+        if (netif_carrier_ok(bnad->netdev)) {
+                pr_info("bna: %s TX_STARTED\n", bnad->netdev->name);
+                netif_wake_queue(bnad->netdev);
+                BNAD_UPDATE_CTR(bnad, netif_queue_wakeup);
+        }
+}
+
+static void
+bnad_cb_tx_cleanup(struct bnad *bnad, struct bna_tcb *tcb)
+{
+        struct bnad_unmap_q *unmap_q;
+
+        if (!tcb || (!tcb->unmap_q))
+                return;
+
+        unmap_q = tcb->unmap_q;
+        if (!unmap_q->unmap_array)
+                return;
+
+        if (test_and_set_bit(BNAD_TXQ_FREE_SENT, &tcb->flags))
+                return;
+
+        bnad_free_all_txbufs(bnad, tcb);
+
+        unmap_q->producer_index = 0;
+        unmap_q->consumer_index = 0;
+
+        smp_mb__before_clear_bit();
+        clear_bit(BNAD_TXQ_FREE_SENT, &tcb->flags);
+}
+
+static void
+bnad_cb_rx_cleanup(struct bnad *bnad,
+                        struct bna_ccb *ccb)
+{
+        bnad_cq_cmpl_init(bnad, ccb);
+
+        bnad_free_rxbufs(bnad, ccb->rcb[0]);
+        clear_bit(BNAD_RXQ_STARTED, &ccb->rcb[0]->flags);
+
+        if (ccb->rcb[1]) {
+                bnad_free_rxbufs(bnad, ccb->rcb[1]);
+                clear_bit(BNAD_RXQ_STARTED, &ccb->rcb[1]->flags);
+        }
+}
+
+static void
+bnad_cb_rx_post(struct bnad *bnad, struct bna_rcb *rcb)
+{
+        struct bnad_unmap_q *unmap_q = rcb->unmap_q;
+
+        set_bit(BNAD_RXQ_STARTED, &rcb->flags);
+
+        /* Now allocate & post buffers for this RCB */
+        /* !!Allocation in callback context */
+        if (!test_and_set_bit(BNAD_RXQ_REFILL, &rcb->flags)) {
+                if (BNA_QE_FREE_CNT(unmap_q, unmap_q->q_depth)
+                         >> BNAD_RXQ_REFILL_THRESHOLD_SHIFT)
+                        bnad_alloc_n_post_rxbufs(bnad, rcb);
+                smp_mb__before_clear_bit();
+                clear_bit(BNAD_RXQ_REFILL, &rcb->flags);
+        }
+}
+
+static void
+bnad_cb_rx_disabled(void *arg, struct bna_rx *rx,
+                        enum bna_cb_status status)
+{
+        struct bnad *bnad = (struct bnad *)arg;
+
+        complete(&bnad->bnad_completions.rx_comp);
+}
+
+static void
+bnad_cb_rx_mcast_add(struct bnad *bnad, struct bna_rx *rx,
+                                enum bna_cb_status status)
+{
+        bnad->bnad_completions.mcast_comp_status = status;
+        complete(&bnad->bnad_completions.mcast_comp);
+}
+
+void
+bnad_cb_stats_get(struct bnad *bnad, enum bna_cb_status status,
+                       struct bna_stats *stats)
+{
+        if (status == BNA_CB_SUCCESS)
+                BNAD_UPDATE_CTR(bnad, hw_stats_updates);
+
+        if (!netif_running(bnad->netdev) ||
+                !test_bit(BNAD_RF_STATS_TIMER_RUNNING, &bnad->run_flags))
+                return;
+
+        mod_timer(&bnad->stats_timer,
+                  jiffies + msecs_to_jiffies(BNAD_STATS_TIMER_FREQ));
+}
+
+void
+bnad_cb_stats_clr(struct bnad *bnad)
+{
+}
+
+/* Resource allocation, free functions */
+
+static void
+bnad_mem_free(struct bnad *bnad,
+              struct bna_mem_info *mem_info)
+{
+        int i;
+        dma_addr_t dma_pa;
+
+        if (mem_info->mdl == NULL)
+                return;
+
+        for (i = 0; i < mem_info->num; i++) {
+                if (mem_info->mdl[i].kva != NULL) {
+                        if (mem_info->mem_type == BNA_MEM_T_DMA) {
+                                BNA_GET_DMA_ADDR(&(mem_info->mdl[i].dma),
+                                                dma_pa);
+                                pci_free_consistent(bnad->pcidev,
+                                                mem_info->mdl[i].len,
+                                                mem_info->mdl[i].kva, dma_pa);
+                        } else
+                                kfree(mem_info->mdl[i].kva);
+                }
+        }
+        kfree(mem_info->mdl);
+        mem_info->mdl = NULL;
+}
+
+static int
+bnad_mem_alloc(struct bnad *bnad,
+               struct bna_mem_info *mem_info)
+{
+        int i;
+        dma_addr_t dma_pa;
+
+        if ((mem_info->num == 0) || (mem_info->len == 0)) {
+                mem_info->mdl = NULL;
+                return 0;
+        }
+
+        mem_info->mdl = kcalloc(mem_info->num, sizeof(struct bna_mem_descr),
+                                GFP_KERNEL);
+        if (mem_info->mdl == NULL)
+                return -ENOMEM;
+
+        if (mem_info->mem_type == BNA_MEM_T_DMA) {
+                for (i = 0; i < mem_info->num; i++) {
+                        mem_info->mdl[i].len = mem_info->len;
+                        mem_info->mdl[i].kva =
+                                pci_alloc_consistent(bnad->pcidev,
+                                                mem_info->len, &dma_pa);
+
+                        if (mem_info->mdl[i].kva == NULL)
+                                goto err_return;
+
+                        BNA_SET_DMA_ADDR(dma_pa,
+                                         &(mem_info->mdl[i].dma));
+                }
+        } else {
+                for (i = 0; i < mem_info->num; i++) {
+                        mem_info->mdl[i].len = mem_info->len;
+                        mem_info->mdl[i].kva = kzalloc(mem_info->len,
+                                                        GFP_KERNEL);
+                        if (mem_info->mdl[i].kva == NULL)
+                                goto err_return;
+                }
+        }
+
+        return 0;
+
+err_return:
+        bnad_mem_free(bnad, mem_info);
+        return -ENOMEM;
+}
+
+/* Free IRQ for Mailbox */
+static void
+bnad_mbox_irq_free(struct bnad *bnad,
+                   struct bna_intr_info *intr_info)
+{
+        int irq;
+        unsigned long flags;
+
+        if (intr_info->idl == NULL)
+                return;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        bnad_disable_mbox_irq(bnad);
+
+        irq = BNAD_GET_MBOX_IRQ(bnad);
+        free_irq(irq, bnad->netdev);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        kfree(intr_info->idl);
+}
+
+/*
+ * Allocates IRQ for Mailbox, but keep it disabled
+ * This will be enabled once we get the mbox enable callback
+ * from bna
+ */
+static int
+bnad_mbox_irq_alloc(struct bnad *bnad,
+                    struct bna_intr_info *intr_info)
+{
+        int             err;
+        unsigned long   flags;
+        u32     irq;
+        irq_handler_t   irq_handler;
+
+        /* Mbox should use only 1 vector */
+
+        intr_info->idl = kzalloc(sizeof(*(intr_info->idl)), GFP_KERNEL);
+        if (!intr_info->idl)
+                return -ENOMEM;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (bnad->cfg_flags & BNAD_CF_MSIX) {
+                irq_handler = (irq_handler_t)bnad_msix_mbox_handler;
+                irq = bnad->msix_table[bnad->msix_num - 1].vector;
+                flags = 0;
+                intr_info->intr_type = BNA_INTR_T_MSIX;
+                intr_info->idl[0].vector = bnad->msix_num - 1;
+        } else {
+                irq_handler = (irq_handler_t)bnad_isr;
+                irq = bnad->pcidev->irq;
+                flags = IRQF_SHARED;
+                intr_info->intr_type = BNA_INTR_T_INTX;
+                /* intr_info->idl.vector = 0 ? */
+        }
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        sprintf(bnad->mbox_irq_name, "%s", BNAD_NAME);
+
+        err = request_irq(irq, irq_handler, flags,
+                          bnad->mbox_irq_name, bnad->netdev);
+        if (err) {
+                kfree(intr_info->idl);
+                intr_info->idl = NULL;
+                return err;
+        }
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bnad_disable_mbox_irq(bnad);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        return 0;
+}
+
+static void
+bnad_txrx_irq_free(struct bnad *bnad, struct bna_intr_info *intr_info)
+{
+        kfree(intr_info->idl);
+        intr_info->idl = NULL;
+}
+
+/* Allocates Interrupt Descriptor List for MSIX/INT-X vectors */
+static int
+bnad_txrx_irq_alloc(struct bnad *bnad, enum bnad_intr_source src,
+                    uint txrx_id, struct bna_intr_info *intr_info)
+{
+        int i, vector_start = 0;
+        u32 cfg_flags;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        cfg_flags = bnad->cfg_flags;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        if (cfg_flags & BNAD_CF_MSIX) {
+                intr_info->intr_type = BNA_INTR_T_MSIX;
+                intr_info->idl = kcalloc(intr_info->num,
+                                        sizeof(struct bna_intr_descr),
+                                        GFP_KERNEL);
+                if (!intr_info->idl)
+                        return -ENOMEM;
+
+                switch (src) {
+                case BNAD_INTR_TX:
+                        vector_start = txrx_id;
+                        break;
+
+                case BNAD_INTR_RX:
+                        vector_start = bnad->num_tx * bnad->num_txq_per_tx +
+                                        txrx_id;
+                        break;
+
+                default:
+                        BUG();
+                }
+
+                for (i = 0; i < intr_info->num; i++)
+                        intr_info->idl[i].vector = vector_start + i;
+        } else {
+                intr_info->intr_type = BNA_INTR_T_INTX;
+                intr_info->num = 1;
+                intr_info->idl = kcalloc(intr_info->num,
+                                        sizeof(struct bna_intr_descr),
+                                        GFP_KERNEL);
+                if (!intr_info->idl)
+                        return -ENOMEM;
+
+                switch (src) {
+                case BNAD_INTR_TX:
+                        intr_info->idl[0].vector = 0x1; /* Bit mask : Tx IB */
+                        break;
+
+                case BNAD_INTR_RX:
+                        intr_info->idl[0].vector = 0x2; /* Bit mask : Rx IB */
+                        break;
+                }
+        }
+        return 0;
+}
+
+/**
+ * NOTE: Should be called for MSIX only
+ * Unregisters Tx MSIX vector(s) from the kernel
+ */
+static void
+bnad_tx_msix_unregister(struct bnad *bnad, struct bnad_tx_info *tx_info,
+                        int num_txqs)
+{
+        int i;
+        int vector_num;
+
+        for (i = 0; i < num_txqs; i++) {
+                if (tx_info->tcb[i] == NULL)
+                        continue;
+
+                vector_num = tx_info->tcb[i]->intr_vector;
+                free_irq(bnad->msix_table[vector_num].vector, tx_info->tcb[i]);
+        }
+}
+
+/**
+ * NOTE: Should be called for MSIX only
+ * Registers Tx MSIX vector(s) and ISR(s), cookie with the kernel
+ */
+static int
+bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info,
+                        uint tx_id, int num_txqs)
+{
+        int i;
+        int err;
+        int vector_num;
+
+        for (i = 0; i < num_txqs; i++) {
+                vector_num = tx_info->tcb[i]->intr_vector;
+                sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name,
+                                tx_id + tx_info->tcb[i]->id);
+                err = request_irq(bnad->msix_table[vector_num].vector,
+                                  (irq_handler_t)bnad_msix_tx, 0,
+                                  tx_info->tcb[i]->name,
+                                  tx_info->tcb[i]);
+                if (err)
+                        goto err_return;
+        }
+
+        return 0;
+
+err_return:
+        if (i > 0)
+                bnad_tx_msix_unregister(bnad, tx_info, (i - 1));
+        return -1;
+}
+
+/**
+ * NOTE: Should be called for MSIX only
+ * Unregisters Rx MSIX vector(s) from the kernel
+ */
+static void
+bnad_rx_msix_unregister(struct bnad *bnad, struct bnad_rx_info *rx_info,
+                        int num_rxps)
+{
+        int i;
+        int vector_num;
+
+        for (i = 0; i < num_rxps; i++) {
+                if (rx_info->rx_ctrl[i].ccb == NULL)
+                        continue;
+
+                vector_num = rx_info->rx_ctrl[i].ccb->intr_vector;
+                free_irq(bnad->msix_table[vector_num].vector,
+                         rx_info->rx_ctrl[i].ccb);
+        }
+}
+
+/**
+ * NOTE: Should be called for MSIX only
+ * Registers Tx MSIX vector(s) and ISR(s), cookie with the kernel
+ */
+static int
+bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info,
+                        uint rx_id, int num_rxps)
+{
+        int i;
+        int err;
+        int vector_num;
+
+        for (i = 0; i < num_rxps; i++) {
+                vector_num = rx_info->rx_ctrl[i].ccb->intr_vector;
+                sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d",
+                        bnad->netdev->name,
+                        rx_id + rx_info->rx_ctrl[i].ccb->id);
+                err = request_irq(bnad->msix_table[vector_num].vector,
+                                  (irq_handler_t)bnad_msix_rx, 0,
+                                  rx_info->rx_ctrl[i].ccb->name,
+                                  rx_info->rx_ctrl[i].ccb);
+                if (err)
+                        goto err_return;
+        }
+
+        return 0;
+
+err_return:
+        if (i > 0)
+                bnad_rx_msix_unregister(bnad, rx_info, (i - 1));
+        return -1;
+}
+
+/* Free Tx object Resources */
+static void
+bnad_tx_res_free(struct bnad *bnad, struct bna_res_info *res_info)
+{
+        int i;
+
+        for (i = 0; i < BNA_TX_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        bnad_mem_free(bnad, &res_info[i].res_u.mem_info);
+                else if (res_info[i].res_type == BNA_RES_T_INTR)
+                        bnad_txrx_irq_free(bnad, &res_info[i].res_u.intr_info);
+        }
+}
+
+/* Allocates memory and interrupt resources for Tx object */
+static int
+bnad_tx_res_alloc(struct bnad *bnad, struct bna_res_info *res_info,
+                  uint tx_id)
+{
+        int i, err = 0;
+
+        for (i = 0; i < BNA_TX_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        err = bnad_mem_alloc(bnad,
+                                        &res_info[i].res_u.mem_info);
+                else if (res_info[i].res_type == BNA_RES_T_INTR)
+                        err = bnad_txrx_irq_alloc(bnad, BNAD_INTR_TX, tx_id,
+                                        &res_info[i].res_u.intr_info);
+                if (err)
+                        goto err_return;
+        }
+        return 0;
+
+err_return:
+        bnad_tx_res_free(bnad, res_info);
+        return err;
+}
+
+/* Free Rx object Resources */
+static void
+bnad_rx_res_free(struct bnad *bnad, struct bna_res_info *res_info)
+{
+        int i;
+
+        for (i = 0; i < BNA_RX_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        bnad_mem_free(bnad, &res_info[i].res_u.mem_info);
+                else if (res_info[i].res_type == BNA_RES_T_INTR)
+                        bnad_txrx_irq_free(bnad, &res_info[i].res_u.intr_info);
+        }
+}
+
+/* Allocates memory and interrupt resources for Rx object */
+static int
+bnad_rx_res_alloc(struct bnad *bnad, struct bna_res_info *res_info,
+                  uint rx_id)
+{
+        int i, err = 0;
+
+        /* All memory needs to be allocated before setup_ccbs */
+        for (i = 0; i < BNA_RX_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        err = bnad_mem_alloc(bnad,
+                                        &res_info[i].res_u.mem_info);
+                else if (res_info[i].res_type == BNA_RES_T_INTR)
+                        err = bnad_txrx_irq_alloc(bnad, BNAD_INTR_RX, rx_id,
+                                        &res_info[i].res_u.intr_info);
+                if (err)
+                        goto err_return;
+        }
+        return 0;
+
+err_return:
+        bnad_rx_res_free(bnad, res_info);
+        return err;
+}
+
+/* Timer callbacks */
+/* a) IOC timer */
+static void
+bnad_ioc_timeout(unsigned long data)
+{
+        struct bnad *bnad = (struct bnad *)data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bfa_nw_ioc_timeout((void *) &bnad->bna.device.ioc);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+static void
+bnad_ioc_hb_check(unsigned long data)
+{
+        struct bnad *bnad = (struct bnad *)data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bfa_nw_ioc_hb_check((void *) &bnad->bna.device.ioc);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+static void
+bnad_ioc_sem_timeout(unsigned long data)
+{
+        struct bnad *bnad = (struct bnad *)data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bfa_nw_ioc_sem_timeout((void *) &bnad->bna.device.ioc);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+/*
+ * All timer routines use bnad->bna_lock to protect against
+ * the following race, which may occur in case of no locking:
+ *      Time    CPU m           CPU n
+ *      0       1 = test_bit
+ *      1                       clear_bit
+ *      2                       del_timer_sync
+ *      3       mod_timer
+ */
+
+/* b) Dynamic Interrupt Moderation Timer */
+static void
+bnad_dim_timeout(unsigned long data)
+{
+        struct bnad *bnad = (struct bnad *)data;
+        struct bnad_rx_info *rx_info;
+        struct bnad_rx_ctrl *rx_ctrl;
+        int i, j;
+        unsigned long flags;
+
+        if (!netif_carrier_ok(bnad->netdev))
+                return;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        for (i = 0; i < bnad->num_rx; i++) {
+                rx_info = &bnad->rx_info[i];
+                if (!rx_info->rx)
+                        continue;
+                for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                        rx_ctrl = &rx_info->rx_ctrl[j];
+                        if (!rx_ctrl->ccb)
+                                continue;
+                        bna_rx_dim_update(rx_ctrl->ccb);
+                }
+        }
+
+        /* Check for BNAD_CF_DIM_ENABLED, does not eleminate a race */
+        if (test_bit(BNAD_RF_DIM_TIMER_RUNNING, &bnad->run_flags))
+                mod_timer(&bnad->dim_timer,
+                          jiffies + msecs_to_jiffies(BNAD_DIM_TIMER_FREQ));
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+/* c)  Statistics Timer */
+static void
+bnad_stats_timeout(unsigned long data)
+{
+        struct bnad *bnad = (struct bnad *)data;
+        unsigned long flags;
+
+        if (!netif_running(bnad->netdev) ||
+                !test_bit(BNAD_RF_STATS_TIMER_RUNNING, &bnad->run_flags))
+                return;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_stats_get(&bnad->bna);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+/*
+ * Set up timer for DIM
+ * Called with bnad->bna_lock held
+ */
+void
+bnad_dim_timer_start(struct bnad *bnad)
+{
+        if (bnad->cfg_flags & BNAD_CF_DIM_ENABLED &&
+            !test_bit(BNAD_RF_DIM_TIMER_RUNNING, &bnad->run_flags)) {
+                setup_timer(&bnad->dim_timer, bnad_dim_timeout,
+                            (unsigned long)bnad);
+                set_bit(BNAD_RF_DIM_TIMER_RUNNING, &bnad->run_flags);
+                mod_timer(&bnad->dim_timer,
+                          jiffies + msecs_to_jiffies(BNAD_DIM_TIMER_FREQ));
+        }
+}
+
+/*
+ * Set up timer for statistics
+ * Called with mutex_lock(&bnad->conf_mutex) held
+ */
+static void
+bnad_stats_timer_start(struct bnad *bnad)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (!test_and_set_bit(BNAD_RF_STATS_TIMER_RUNNING, &bnad->run_flags)) {
+                setup_timer(&bnad->stats_timer, bnad_stats_timeout,
+                            (unsigned long)bnad);
+                mod_timer(&bnad->stats_timer,
+                          jiffies + msecs_to_jiffies(BNAD_STATS_TIMER_FREQ));
+        }
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+}
+
+/*
+ * Stops the stats timer
+ * Called with mutex_lock(&bnad->conf_mutex) held
+ */
+static void
+bnad_stats_timer_stop(struct bnad *bnad)
+{
+        int to_del = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (test_and_clear_bit(BNAD_RF_STATS_TIMER_RUNNING, &bnad->run_flags))
+                to_del = 1;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        if (to_del)
+                del_timer_sync(&bnad->stats_timer);
+}
+
+/* Utilities */
+
+static void
+bnad_netdev_mc_list_get(struct net_device *netdev, u8 *mc_list)
+{
+        int i = 1; /* Index 0 has broadcast address */
+        struct netdev_hw_addr *mc_addr;
+
+        netdev_for_each_mc_addr(mc_addr, netdev) {
+                memcpy(&mc_list[i * ETH_ALEN], &mc_addr->addr[0],
+                                                        ETH_ALEN);
+                i++;
+        }
+}
+
+static int
+bnad_napi_poll_rx(struct napi_struct *napi, int budget)
+{
+        struct bnad_rx_ctrl *rx_ctrl =
+                container_of(napi, struct bnad_rx_ctrl, napi);
+        struct bna_ccb *ccb;
+        struct bnad *bnad;
+        int rcvd = 0;
+
+        ccb = rx_ctrl->ccb;
+
+        bnad = ccb->bnad;
+
+        if (!netif_carrier_ok(bnad->netdev))
+                goto poll_exit;
+
+        rcvd = bnad_poll_cq(bnad, ccb, budget);
+        if (rcvd == budget)
+                return rcvd;
+
+poll_exit:
+        napi_complete((napi));
+
+        BNAD_UPDATE_CTR(bnad, netif_rx_complete);
+
+        bnad_enable_rx_irq(bnad, ccb);
+        return rcvd;
+}
+
+static int
+bnad_napi_poll_txrx(struct napi_struct *napi, int budget)
+{
+        struct bnad_rx_ctrl *rx_ctrl =
+                container_of(napi, struct bnad_rx_ctrl, napi);
+        struct bna_ccb *ccb;
+        struct bnad *bnad;
+        int                     rcvd = 0;
+        int                     i, j;
+
+        ccb = rx_ctrl->ccb;
+
+        bnad = ccb->bnad;
+
+        if (!netif_carrier_ok(bnad->netdev))
+                goto poll_exit;
+
+        /* Handle Tx Completions, if any */
+        for (i = 0; i < bnad->num_tx; i++) {
+                for (j = 0; j < bnad->num_txq_per_tx; j++)
+                        bnad_tx(bnad, bnad->tx_info[i].tcb[j]);
+        }
+
+        /* Handle Rx Completions */
+        rcvd = bnad_poll_cq(bnad, ccb, budget);
+        if (rcvd == budget)
+                return rcvd;
+poll_exit:
+        napi_complete((napi));
+
+        BNAD_UPDATE_CTR(bnad, netif_rx_complete);
+
+        bnad_enable_txrx_irqs(bnad);
+        return rcvd;
+}
+
+static void
+bnad_napi_enable(struct bnad *bnad, u32 rx_id)
+{
+        int (*napi_poll) (struct napi_struct *, int);
+        struct bnad_rx_ctrl *rx_ctrl;
+        int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (bnad->cfg_flags & BNAD_CF_MSIX)
+                napi_poll = bnad_napi_poll_rx;
+        else
+                napi_poll = bnad_napi_poll_txrx;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Initialize & enable NAPI */
+        for (i = 0; i < bnad->num_rxp_per_rx; i++) {
+                rx_ctrl = &bnad->rx_info[rx_id].rx_ctrl[i];
+                netif_napi_add(bnad->netdev, &rx_ctrl->napi,
+                               napi_poll, 64);
+                napi_enable(&rx_ctrl->napi);
+        }
+}
+
+static void
+bnad_napi_disable(struct bnad *bnad, u32 rx_id)
+{
+        int i;
+
+        /* First disable and then clean up */
+        for (i = 0; i < bnad->num_rxp_per_rx; i++) {
+                napi_disable(&bnad->rx_info[rx_id].rx_ctrl[i].napi);
+                netif_napi_del(&bnad->rx_info[rx_id].rx_ctrl[i].napi);
+        }
+}
+
+/* Should be held with conf_lock held */
+void
+bnad_cleanup_tx(struct bnad *bnad, uint tx_id)
+{
+        struct bnad_tx_info *tx_info = &bnad->tx_info[tx_id];
+        struct bna_res_info *res_info = &bnad->tx_res_info[tx_id].res_info[0];
+        unsigned long flags;
+
+        if (!tx_info->tx)
+                return;
+
+        init_completion(&bnad->bnad_completions.tx_comp);
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_tx_disable(tx_info->tx, BNA_HARD_CLEANUP, bnad_cb_tx_disabled);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        wait_for_completion(&bnad->bnad_completions.tx_comp);
+
+        if (tx_info->tcb[0]->intr_type == BNA_INTR_T_MSIX)
+                bnad_tx_msix_unregister(bnad, tx_info,
+                        bnad->num_txq_per_tx);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_tx_destroy(tx_info->tx);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        tx_info->tx = NULL;
+
+        if (0 == tx_id)
+                tasklet_kill(&bnad->tx_free_tasklet);
+
+        bnad_tx_res_free(bnad, res_info);
+}
+
+/* Should be held with conf_lock held */
+int
+bnad_setup_tx(struct bnad *bnad, uint tx_id)
+{
+        int err;
+        struct bnad_tx_info *tx_info = &bnad->tx_info[tx_id];
+        struct bna_res_info *res_info = &bnad->tx_res_info[tx_id].res_info[0];
+        struct bna_intr_info *intr_info =
+                        &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
+        struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
+        struct bna_tx_event_cbfn tx_cbfn;
+        struct bna_tx *tx;
+        unsigned long flags;
+
+        /* Initialize the Tx object configuration */
+        tx_config->num_txq = bnad->num_txq_per_tx;
+        tx_config->txq_depth = bnad->txq_depth;
+        tx_config->tx_type = BNA_TX_T_REGULAR;
+
+        /* Initialize the tx event handlers */
+        tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
+        tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
+        tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
+        tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
+        tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
+
+        /* Get BNA's resource requirement for one tx object */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_tx_res_req(bnad->num_txq_per_tx,
+                bnad->txq_depth, res_info);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Fill Unmap Q memory requirements */
+        BNAD_FILL_UNMAPQ_MEM_REQ(
+                        &res_info[BNA_TX_RES_MEM_T_UNMAPQ],
+                        bnad->num_txq_per_tx,
+                        BNAD_TX_UNMAPQ_DEPTH);
+
+        /* Allocate resources */
+        err = bnad_tx_res_alloc(bnad, res_info, tx_id);
+        if (err)
+                return err;
+
+        /* Ask BNA to create one Tx object, supplying required resources */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        tx = bna_tx_create(&bnad->bna, bnad, tx_config, &tx_cbfn, res_info,
+                        tx_info);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        if (!tx)
+                goto err_return;
+        tx_info->tx = tx;
+
+        /* Register ISR for the Tx object */
+        if (intr_info->intr_type == BNA_INTR_T_MSIX) {
+                err = bnad_tx_msix_register(bnad, tx_info,
+                        tx_id, bnad->num_txq_per_tx);
+                if (err)
+                        goto err_return;
+        }
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_tx_enable(tx);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        return 0;
+
+err_return:
+        bnad_tx_res_free(bnad, res_info);
+        return err;
+}
+
+/* Setup the rx config for bna_rx_create */
+/* bnad decides the configuration */
+static void
+bnad_init_rx_config(struct bnad *bnad, struct bna_rx_config *rx_config)
+{
+        rx_config->rx_type = BNA_RX_T_REGULAR;
+        rx_config->num_paths = bnad->num_rxp_per_rx;
+
+        if (bnad->num_rxp_per_rx > 1) {
+                rx_config->rss_status = BNA_STATUS_T_ENABLED;
+                rx_config->rss_config.hash_type =
+                                (BFI_RSS_T_V4_TCP |
+                                 BFI_RSS_T_V6_TCP |
+                                 BFI_RSS_T_V4_IP  |
+                                 BFI_RSS_T_V6_IP);
+                rx_config->rss_config.hash_mask =
+                                bnad->num_rxp_per_rx - 1;
+                get_random_bytes(rx_config->rss_config.toeplitz_hash_key,
+                        sizeof(rx_config->rss_config.toeplitz_hash_key));
+        } else {
+                rx_config->rss_status = BNA_STATUS_T_DISABLED;
+                memset(&rx_config->rss_config, 0,
+                       sizeof(rx_config->rss_config));
+        }
+        rx_config->rxp_type = BNA_RXP_SLR;
+        rx_config->q_depth = bnad->rxq_depth;
+
+        rx_config->small_buff_size = BFI_SMALL_RXBUF_SIZE;
+
+        rx_config->vlan_strip_status = BNA_STATUS_T_ENABLED;
+}
+
+/* Called with mutex_lock(&bnad->conf_mutex) held */
+void
+bnad_cleanup_rx(struct bnad *bnad, uint rx_id)
+{
+        struct bnad_rx_info *rx_info = &bnad->rx_info[rx_id];
+        struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
+        struct bna_res_info *res_info = &bnad->rx_res_info[rx_id].res_info[0];
+        unsigned long flags;
+        int dim_timer_del = 0;
+
+        if (!rx_info->rx)
+                return;
+
+        if (0 == rx_id) {
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+                dim_timer_del = bnad_dim_timer_running(bnad);
+                if (dim_timer_del)
+                        clear_bit(BNAD_RF_DIM_TIMER_RUNNING, &bnad->run_flags);
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+                if (dim_timer_del)
+                        del_timer_sync(&bnad->dim_timer);
+        }
+
+        bnad_napi_disable(bnad, rx_id);
+
+        init_completion(&bnad->bnad_completions.rx_comp);
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_rx_disable(rx_info->rx, BNA_HARD_CLEANUP, bnad_cb_rx_disabled);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        wait_for_completion(&bnad->bnad_completions.rx_comp);
+
+        if (rx_info->rx_ctrl[0].ccb->intr_type == BNA_INTR_T_MSIX)
+                bnad_rx_msix_unregister(bnad, rx_info, rx_config->num_paths);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_rx_destroy(rx_info->rx);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        rx_info->rx = NULL;
+
+        bnad_rx_res_free(bnad, res_info);
+}
+
+/* Called with mutex_lock(&bnad->conf_mutex) held */
+int
+bnad_setup_rx(struct bnad *bnad, uint rx_id)
+{
+        int err;
+        struct bnad_rx_info *rx_info = &bnad->rx_info[rx_id];
+        struct bna_res_info *res_info = &bnad->rx_res_info[rx_id].res_info[0];
+        struct bna_intr_info *intr_info =
+                        &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
+        struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
+        struct bna_rx_event_cbfn rx_cbfn;
+        struct bna_rx *rx;
+        unsigned long flags;
+
+        /* Initialize the Rx object configuration */
+        bnad_init_rx_config(bnad, rx_config);
+
+        /* Initialize the Rx event handlers */
+        rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
+        rx_cbfn.rcb_destroy_cbfn = NULL;
+        rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
+        rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
+        rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
+        rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
+
+        /* Get BNA's resource requirement for one Rx object */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_rx_res_req(rx_config, res_info);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Fill Unmap Q memory requirements */
+        BNAD_FILL_UNMAPQ_MEM_REQ(
+                        &res_info[BNA_RX_RES_MEM_T_UNMAPQ],
+                        rx_config->num_paths +
+                        ((rx_config->rxp_type == BNA_RXP_SINGLE) ? 0 :
+                                rx_config->num_paths), BNAD_RX_UNMAPQ_DEPTH);
+
+        /* Allocate resource */
+        err = bnad_rx_res_alloc(bnad, res_info, rx_id);
+        if (err)
+                return err;
+
+        /* Ask BNA to create one Rx object, supplying required resources */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        rx = bna_rx_create(&bnad->bna, bnad, rx_config, &rx_cbfn, res_info,
+                        rx_info);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        if (!rx)
+                goto err_return;
+        rx_info->rx = rx;
+
+        /* Register ISR for the Rx object */
+        if (intr_info->intr_type == BNA_INTR_T_MSIX) {
+                err = bnad_rx_msix_register(bnad, rx_info, rx_id,
+                                                rx_config->num_paths);
+                if (err)
+                        goto err_return;
+        }
+
+        /* Enable NAPI */
+        bnad_napi_enable(bnad, rx_id);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (0 == rx_id) {
+                /* Set up Dynamic Interrupt Moderation Vector */
+                if (bnad->cfg_flags & BNAD_CF_DIM_ENABLED)
+                        bna_rx_dim_reconfig(&bnad->bna, bna_napi_dim_vector);
+
+                /* Enable VLAN filtering only on the default Rx */
+                bna_rx_vlanfilter_enable(rx);
+
+                /* Start the DIM timer */
+                bnad_dim_timer_start(bnad);
+        }
+
+        bna_rx_enable(rx);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        return 0;
+
+err_return:
+        bnad_cleanup_rx(bnad, rx_id);
+        return err;
+}
+
+/* Called with conf_lock & bnad->bna_lock held */
+void
+bnad_tx_coalescing_timeo_set(struct bnad *bnad)
+{
+        struct bnad_tx_info *tx_info;
+
+        tx_info = &bnad->tx_info[0];
+        if (!tx_info->tx)
+                return;
+
+        bna_tx_coalescing_timeo_set(tx_info->tx, bnad->tx_coalescing_timeo);
+}
+
+/* Called with conf_lock & bnad->bna_lock held */
+void
+bnad_rx_coalescing_timeo_set(struct bnad *bnad)
+{
+        struct bnad_rx_info *rx_info;
+        int     i;
+
+        for (i = 0; i < bnad->num_rx; i++) {
+                rx_info = &bnad->rx_info[i];
+                if (!rx_info->rx)
+                        continue;
+                bna_rx_coalescing_timeo_set(rx_info->rx,
+                                bnad->rx_coalescing_timeo);
+        }
+}
+
+/*
+ * Called with bnad->bna_lock held
+ */
+static int
+bnad_mac_addr_set_locked(struct bnad *bnad, u8 *mac_addr)
+{
+        int ret;
+
+        if (!is_valid_ether_addr(mac_addr))
+                return -EADDRNOTAVAIL;
+
+        /* If datapath is down, pretend everything went through */
+        if (!bnad->rx_info[0].rx)
+                return 0;
+
+        ret = bna_rx_ucast_set(bnad->rx_info[0].rx, mac_addr, NULL);
+        if (ret != BNA_CB_SUCCESS)
+                return -EADDRNOTAVAIL;
+
+        return 0;
+}
+
+/* Should be called with conf_lock held */
+static int
+bnad_enable_default_bcast(struct bnad *bnad)
+{
+        struct bnad_rx_info *rx_info = &bnad->rx_info[0];
+        int ret;
+        unsigned long flags;
+
+        init_completion(&bnad->bnad_completions.mcast_comp);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        ret = bna_rx_mcast_add(rx_info->rx, (u8 *)bnad_bcast_addr,
+                                bnad_cb_rx_mcast_add);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        if (ret == BNA_CB_SUCCESS)
+                wait_for_completion(&bnad->bnad_completions.mcast_comp);
+        else
+                return -ENODEV;
+
+        if (bnad->bnad_completions.mcast_comp_status != BNA_CB_SUCCESS)
+                return -ENODEV;
+
+        return 0;
+}
+
+/* Statistics utilities */
+void
+bnad_netdev_qstats_fill(struct bnad *bnad, struct rtnl_link_stats64 *stats)
+{
+        int i, j;
+
+        for (i = 0; i < bnad->num_rx; i++) {
+                for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                        if (bnad->rx_info[i].rx_ctrl[j].ccb) {
+                                stats->rx_packets += bnad->rx_info[i].
+                                rx_ctrl[j].ccb->rcb[0]->rxq->rx_packets;
+                                stats->rx_bytes += bnad->rx_info[i].
+                                        rx_ctrl[j].ccb->rcb[0]->rxq->rx_bytes;
+                                if (bnad->rx_info[i].rx_ctrl[j].ccb->rcb[1] &&
+                                        bnad->rx_info[i].rx_ctrl[j].ccb->
+                                        rcb[1]->rxq) {
+                                        stats->rx_packets +=
+                                                bnad->rx_info[i].rx_ctrl[j].
+                                                ccb->rcb[1]->rxq->rx_packets;
+                                        stats->rx_bytes +=
+                                                bnad->rx_info[i].rx_ctrl[j].
+                                                ccb->rcb[1]->rxq->rx_bytes;
+                                }
+                        }
+                }
+        }
+        for (i = 0; i < bnad->num_tx; i++) {
+                for (j = 0; j < bnad->num_txq_per_tx; j++) {
+                        if (bnad->tx_info[i].tcb[j]) {
+                                stats->tx_packets +=
+                                bnad->tx_info[i].tcb[j]->txq->tx_packets;
+                                stats->tx_bytes +=
+                                        bnad->tx_info[i].tcb[j]->txq->tx_bytes;
+                        }
+                }
+        }
+}
+
+/*
+ * Must be called with the bna_lock held.
+ */
+void
+bnad_netdev_hwstats_fill(struct bnad *bnad, struct rtnl_link_stats64 *stats)
+{
+        struct bfi_ll_stats_mac *mac_stats;
+        u64 bmap;
+        int i;
+
+        mac_stats = &bnad->stats.bna_stats->hw_stats->mac_stats;
+        stats->rx_errors =
+                mac_stats->rx_fcs_error + mac_stats->rx_alignment_error +
+                mac_stats->rx_frame_length_error + mac_stats->rx_code_error +
+                mac_stats->rx_undersize;
+        stats->tx_errors = mac_stats->tx_fcs_error +
+                                        mac_stats->tx_undersize;
+        stats->rx_dropped = mac_stats->rx_drop;
+        stats->tx_dropped = mac_stats->tx_drop;
+        stats->multicast = mac_stats->rx_multicast;
+        stats->collisions = mac_stats->tx_total_collision;
+
+        stats->rx_length_errors = mac_stats->rx_frame_length_error;
+
+        /* receive ring buffer overflow  ?? */
+
+        stats->rx_crc_errors = mac_stats->rx_fcs_error;
+        stats->rx_frame_errors = mac_stats->rx_alignment_error;
+        /* recv'r fifo overrun */
+        bmap = (u64)bnad->stats.bna_stats->rxf_bmap[0] |
+                ((u64)bnad->stats.bna_stats->rxf_bmap[1] << 32);
+        for (i = 0; bmap && (i < BFI_LL_RXF_ID_MAX); i++) {
+                if (bmap & 1) {
+                        stats->rx_fifo_errors +=
+                                bnad->stats.bna_stats->
+                                        hw_stats->rxf_stats[i].frame_drops;
+                        break;
+                }
+                bmap >>= 1;
+        }
+}
+
+static void
+bnad_mbox_irq_sync(struct bnad *bnad)
+{
+        u32 irq;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (bnad->cfg_flags & BNAD_CF_MSIX)
+                irq = bnad->msix_table[bnad->msix_num - 1].vector;
+        else
+                irq = bnad->pcidev->irq;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        synchronize_irq(irq);
+}
+
+/* Utility used by bnad_start_xmit, for doing TSO */
+static int
+bnad_tso_prepare(struct bnad *bnad, struct sk_buff *skb)
+{
+        int err;
+
+        /* SKB_GSO_TCPV4 and SKB_GSO_TCPV6 is defined since 2.6.18. */
+        BUG_ON(!(skb_shinfo(skb)->gso_type == SKB_GSO_TCPV4 ||
+                   skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6));
+        if (skb_header_cloned(skb)) {
+                err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+                if (err) {
+                        BNAD_UPDATE_CTR(bnad, tso_err);
+                        return err;
+                }
+        }
+
+        /*
+         * For TSO, the TCP checksum field is seeded with pseudo-header sum
+         * excluding the length field.
+         */
+        if (skb->protocol == htons(ETH_P_IP)) {
+                struct iphdr *iph = ip_hdr(skb);
+
+                /* Do we really need these? */
+                iph->tot_len = 0;
+                iph->check = 0;
+
+                tcp_hdr(skb)->check =
+                        ~csum_tcpudp_magic(iph->saddr, iph->daddr, 0,
+                                           IPPROTO_TCP, 0);
+                BNAD_UPDATE_CTR(bnad, tso4);
+        } else {
+                struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+
+                BUG_ON(!(skb->protocol == htons(ETH_P_IPV6)));
+                ipv6h->payload_len = 0;
+                tcp_hdr(skb)->check =
+                        ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, 0,
+                                         IPPROTO_TCP, 0);
+                BNAD_UPDATE_CTR(bnad, tso6);
+        }
+
+        return 0;
+}
+
+/*
+ * Initialize Q numbers depending on Rx Paths
+ * Called with bnad->bna_lock held, because of cfg_flags
+ * access.
+ */
+static void
+bnad_q_num_init(struct bnad *bnad)
+{
+        int rxps;
+
+        rxps = min((uint)num_online_cpus(),
+                        (uint)(BNAD_MAX_RXS * BNAD_MAX_RXPS_PER_RX));
+
+        if (!(bnad->cfg_flags & BNAD_CF_MSIX))
+                rxps = 1;       /* INTx */
+
+        bnad->num_rx = 1;
+        bnad->num_tx = 1;
+        bnad->num_rxp_per_rx = rxps;
+        bnad->num_txq_per_tx = BNAD_TXQ_NUM;
+}
+
+/*
+ * Adjusts the Q numbers, given a number of msix vectors
+ * Give preference to RSS as opposed to Tx priority Queues,
+ * in such a case, just use 1 Tx Q
+ * Called with bnad->bna_lock held b'cos of cfg_flags access
+ */
+static void
+bnad_q_num_adjust(struct bnad *bnad, int msix_vectors)
+{
+        bnad->num_txq_per_tx = 1;
+        if ((msix_vectors >= (bnad->num_tx * bnad->num_txq_per_tx)  +
+             bnad_rxqs_per_cq + BNAD_MAILBOX_MSIX_VECTORS) &&
+            (bnad->cfg_flags & BNAD_CF_MSIX)) {
+                bnad->num_rxp_per_rx = msix_vectors -
+                        (bnad->num_tx * bnad->num_txq_per_tx) -
+                        BNAD_MAILBOX_MSIX_VECTORS;
+        } else
+                bnad->num_rxp_per_rx = 1;
+}
+
+static void
+bnad_set_netdev_perm_addr(struct bnad *bnad)
+{
+        struct net_device *netdev = bnad->netdev;
+
+        memcpy(netdev->perm_addr, &bnad->perm_addr, netdev->addr_len);
+        if (is_zero_ether_addr(netdev->dev_addr))
+                memcpy(netdev->dev_addr, &bnad->perm_addr, netdev->addr_len);
+}
+
+/* Enable / disable device */
+static void
+bnad_device_disable(struct bnad *bnad)
+{
+        unsigned long flags;
+
+        init_completion(&bnad->bnad_completions.ioc_comp);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_device_disable(&bnad->bna.device, BNA_HARD_CLEANUP);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        wait_for_completion(&bnad->bnad_completions.ioc_comp);
+
+}
+
+static int
+bnad_device_enable(struct bnad *bnad)
+{
+        int err = 0;
+        unsigned long flags;
+
+        init_completion(&bnad->bnad_completions.ioc_comp);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_device_enable(&bnad->bna.device);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        wait_for_completion(&bnad->bnad_completions.ioc_comp);
+
+        if (bnad->bnad_completions.ioc_comp_status)
+                err = bnad->bnad_completions.ioc_comp_status;
+
+        return err;
+}
+
+/* Free BNA resources */
+static void
+bnad_res_free(struct bnad *bnad)
+{
+        int i;
+        struct bna_res_info *res_info = &bnad->res_info[0];
+
+        for (i = 0; i < BNA_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        bnad_mem_free(bnad, &res_info[i].res_u.mem_info);
+                else
+                        bnad_mbox_irq_free(bnad, &res_info[i].res_u.intr_info);
+        }
+}
+
+/* Allocates memory and interrupt resources for BNA */
+static int
+bnad_res_alloc(struct bnad *bnad)
+{
+        int i, err;
+        struct bna_res_info *res_info = &bnad->res_info[0];
+
+        for (i = 0; i < BNA_RES_T_MAX; i++) {
+                if (res_info[i].res_type == BNA_RES_T_MEM)
+                        err = bnad_mem_alloc(bnad, &res_info[i].res_u.mem_info);
+                else
+                        err = bnad_mbox_irq_alloc(bnad,
+                                                  &res_info[i].res_u.intr_info);
+                if (err)
+                        goto err_return;
+        }
+        return 0;
+
+err_return:
+        bnad_res_free(bnad);
+        return err;
+}
+
+/* Interrupt enable / disable */
+static void
+bnad_enable_msix(struct bnad *bnad)
+{
+        int i, ret;
+        u32 tot_msix_num;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (!(bnad->cfg_flags & BNAD_CF_MSIX)) {
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+                return;
+        }
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        if (bnad->msix_table)
+                return;
+
+        tot_msix_num = bnad->msix_num + bnad->msix_diag_num;
+
+        bnad->msix_table =
+                kcalloc(tot_msix_num, sizeof(struct msix_entry), GFP_KERNEL);
+
+        if (!bnad->msix_table)
+                goto intx_mode;
+
+        for (i = 0; i < tot_msix_num; i++)
+                bnad->msix_table[i].entry = i;
+
+        ret = pci_enable_msix(bnad->pcidev, bnad->msix_table, tot_msix_num);
+        if (ret > 0) {
+                /* Not enough MSI-X vectors. */
+
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+                /* ret = #of vectors that we got */
+                bnad_q_num_adjust(bnad, ret);
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+                bnad->msix_num = (bnad->num_tx * bnad->num_txq_per_tx)
+                        + (bnad->num_rx
+                        * bnad->num_rxp_per_rx) +
+                         BNAD_MAILBOX_MSIX_VECTORS;
+                tot_msix_num = bnad->msix_num + bnad->msix_diag_num;
+
+                /* Try once more with adjusted numbers */
+                /* If this fails, fall back to INTx */
+                ret = pci_enable_msix(bnad->pcidev, bnad->msix_table,
+                                      tot_msix_num);
+                if (ret)
+                        goto intx_mode;
+
+        } else if (ret < 0)
+                goto intx_mode;
+        return;
+
+intx_mode:
+
+        kfree(bnad->msix_table);
+        bnad->msix_table = NULL;
+        bnad->msix_num = 0;
+        bnad->msix_diag_num = 0;
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bnad->cfg_flags &= ~BNAD_CF_MSIX;
+        bnad_q_num_init(bnad);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+static void
+bnad_disable_msix(struct bnad *bnad)
+{
+        u32 cfg_flags;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        cfg_flags = bnad->cfg_flags;
+        if (bnad->cfg_flags & BNAD_CF_MSIX)
+                bnad->cfg_flags &= ~BNAD_CF_MSIX;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        if (cfg_flags & BNAD_CF_MSIX) {
+                pci_disable_msix(bnad->pcidev);
+                kfree(bnad->msix_table);
+                bnad->msix_table = NULL;
+        }
+}
+
+/* Netdev entry points */
+static int
+bnad_open(struct net_device *netdev)
+{
+        int err;
+        struct bnad *bnad = netdev_priv(netdev);
+        struct bna_pause_config pause_config;
+        int mtu;
+        unsigned long flags;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        /* Tx */
+        err = bnad_setup_tx(bnad, 0);
+        if (err)
+                goto err_return;
+
+        /* Rx */
+        err = bnad_setup_rx(bnad, 0);
+        if (err)
+                goto cleanup_tx;
+
+        /* Port */
+        pause_config.tx_pause = 0;
+        pause_config.rx_pause = 0;
+
+        mtu = ETH_HLEN + bnad->netdev->mtu + ETH_FCS_LEN;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_port_mtu_set(&bnad->bna.port, mtu, NULL);
+        bna_port_pause_config(&bnad->bna.port, &pause_config, NULL);
+        bna_port_enable(&bnad->bna.port);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Enable broadcast */
+        bnad_enable_default_bcast(bnad);
+
+        /* Set the UCAST address */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bnad_mac_addr_set_locked(bnad, netdev->dev_addr);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        /* Start the stats timer */
+        bnad_stats_timer_start(bnad);
+
+        mutex_unlock(&bnad->conf_mutex);
+
+        return 0;
+
+cleanup_tx:
+        bnad_cleanup_tx(bnad, 0);
+
+err_return:
+        mutex_unlock(&bnad->conf_mutex);
+        return err;
+}
+
+static int
+bnad_stop(struct net_device *netdev)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        /* Stop the stats timer */
+        bnad_stats_timer_stop(bnad);
+
+        init_completion(&bnad->bnad_completions.port_comp);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_port_disable(&bnad->bna.port, BNA_HARD_CLEANUP,
+                        bnad_cb_port_disabled);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        wait_for_completion(&bnad->bnad_completions.port_comp);
+
+        bnad_cleanup_tx(bnad, 0);
+        bnad_cleanup_rx(bnad, 0);
+
+        /* Synchronize mailbox IRQ */
+        bnad_mbox_irq_sync(bnad);
+
+        mutex_unlock(&bnad->conf_mutex);
+
+        return 0;
+}
+
+/* TX */
+/*
+ * bnad_start_xmit : Netdev entry point for Transmit
+ *                   Called under lock held by net_device
+ */
+static netdev_tx_t
+bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        u16             txq_prod, vlan_tag = 0;
+        u32             unmap_prod, wis, wis_used, wi_range;
+        u32             vectors, vect_id, i, acked;
+        u32             tx_id;
+        int                     err;
+
+        struct bnad_tx_info *tx_info;
+        struct bna_tcb *tcb;
+        struct bnad_unmap_q *unmap_q;
+        dma_addr_t              dma_addr;
+        struct bna_txq_entry *txqent;
+        bna_txq_wi_ctrl_flag_t  flags;
+
+        if (unlikely
+            (skb->len <= ETH_HLEN || skb->len > BFI_TX_MAX_DATA_PER_PKT)) {
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        /*
+         * Takes care of the Tx that is scheduled between clearing the flag
+         * and the netif_stop_queue() call.
+         */
+        if (unlikely(!test_bit(BNAD_RF_TX_STARTED, &bnad->run_flags))) {
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        tx_id = 0;
+
+        tx_info = &bnad->tx_info[tx_id];
+        tcb = tx_info->tcb[tx_id];
+        unmap_q = tcb->unmap_q;
+
+        vectors = 1 + skb_shinfo(skb)->nr_frags;
+        if (vectors > BFI_TX_MAX_VECTORS_PER_PKT) {
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+        wis = BNA_TXQ_WI_NEEDED(vectors);       /* 4 vectors per work item */
+        acked = 0;
+        if (unlikely
+            (wis > BNA_QE_FREE_CNT(tcb, tcb->q_depth) ||
+             vectors > BNA_QE_FREE_CNT(unmap_q, unmap_q->q_depth))) {
+                if ((u16) (*tcb->hw_consumer_index) !=
+                    tcb->consumer_index &&
+                    !test_and_set_bit(BNAD_TXQ_FREE_SENT, &tcb->flags)) {
+                        acked = bnad_free_txbufs(bnad, tcb);
+                        bna_ib_ack(tcb->i_dbell, acked);
+                        smp_mb__before_clear_bit();
+                        clear_bit(BNAD_TXQ_FREE_SENT, &tcb->flags);
+                } else {
+                        netif_stop_queue(netdev);
+                        BNAD_UPDATE_CTR(bnad, netif_queue_stop);
+                }
+
+                smp_mb();
+                /*
+                 * Check again to deal with race condition between
+                 * netif_stop_queue here, and netif_wake_queue in
+                 * interrupt handler which is not inside netif tx lock.
+                 */
+                if (likely
+                    (wis > BNA_QE_FREE_CNT(tcb, tcb->q_depth) ||
+                     vectors > BNA_QE_FREE_CNT(unmap_q, unmap_q->q_depth))) {
+                        BNAD_UPDATE_CTR(bnad, netif_queue_stop);
+                        return NETDEV_TX_BUSY;
+                } else {
+                        netif_wake_queue(netdev);
+                        BNAD_UPDATE_CTR(bnad, netif_queue_wakeup);
+                }
+        }
+
+        unmap_prod = unmap_q->producer_index;
+        wis_used = 1;
+        vect_id = 0;
+        flags = 0;
+
+        txq_prod = tcb->producer_index;
+        BNA_TXQ_QPGE_PTR_GET(txq_prod, tcb->sw_qpt, txqent, wi_range);
+        BUG_ON(!(wi_range <= tcb->q_depth));
+        txqent->hdr.wi.reserved = 0;
+        txqent->hdr.wi.num_vectors = vectors;
+        txqent->hdr.wi.opcode =
+                htons((skb_is_gso(skb) ? BNA_TXQ_WI_SEND_LSO :
+                       BNA_TXQ_WI_SEND));
+
+        if (bnad->vlan_grp && vlan_tx_tag_present(skb)) {
+                vlan_tag = (u16) vlan_tx_tag_get(skb);
+                flags |= (BNA_TXQ_WI_CF_INS_PRIO | BNA_TXQ_WI_CF_INS_VLAN);
+        }
+        if (test_bit(BNAD_RF_CEE_RUNNING, &bnad->run_flags)) {
+                vlan_tag =
+                        (tcb->priority & 0x7) << 13 | (vlan_tag & 0x1fff);
+                flags |= (BNA_TXQ_WI_CF_INS_PRIO | BNA_TXQ_WI_CF_INS_VLAN);
+        }
+
+        txqent->hdr.wi.vlan_tag = htons(vlan_tag);
+
+        if (skb_is_gso(skb)) {
+                err = bnad_tso_prepare(bnad, skb);
+                if (err) {
+                        dev_kfree_skb(skb);
+                        return NETDEV_TX_OK;
+                }
+                txqent->hdr.wi.lso_mss = htons(skb_is_gso(skb));
+                flags |= (BNA_TXQ_WI_CF_IP_CKSUM | BNA_TXQ_WI_CF_TCP_CKSUM);
+                txqent->hdr.wi.l4_hdr_size_n_offset =
+                        htons(BNA_TXQ_WI_L4_HDR_N_OFFSET
+                              (tcp_hdrlen(skb) >> 2,
+                               skb_transport_offset(skb)));
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                u8 proto = 0;
+
+                txqent->hdr.wi.lso_mss = 0;
+
+                if (skb->protocol == htons(ETH_P_IP))
+                        proto = ip_hdr(skb)->protocol;
+                else if (skb->protocol == htons(ETH_P_IPV6)) {
+                        /* nexthdr may not be TCP immediately. */
+                        proto = ipv6_hdr(skb)->nexthdr;
+                }
+                if (proto == IPPROTO_TCP) {
+                        flags |= BNA_TXQ_WI_CF_TCP_CKSUM;
+                        txqent->hdr.wi.l4_hdr_size_n_offset =
+                                htons(BNA_TXQ_WI_L4_HDR_N_OFFSET
+                                      (0, skb_transport_offset(skb)));
+
+                        BNAD_UPDATE_CTR(bnad, tcpcsum_offload);
+
+                        BUG_ON(!(skb_headlen(skb) >=
+                                skb_transport_offset(skb) + tcp_hdrlen(skb)));
+
+                } else if (proto == IPPROTO_UDP) {
+                        flags |= BNA_TXQ_WI_CF_UDP_CKSUM;
+                        txqent->hdr.wi.l4_hdr_size_n_offset =
+                                htons(BNA_TXQ_WI_L4_HDR_N_OFFSET
+                                      (0, skb_transport_offset(skb)));
+
+                        BNAD_UPDATE_CTR(bnad, udpcsum_offload);
+
+                        BUG_ON(!(skb_headlen(skb) >=
+                                   skb_transport_offset(skb) +
+                                   sizeof(struct udphdr)));
+                } else {
+                        err = skb_checksum_help(skb);
+                        BNAD_UPDATE_CTR(bnad, csum_help);
+                        if (err) {
+                                dev_kfree_skb(skb);
+                                BNAD_UPDATE_CTR(bnad, csum_help_err);
+                                return NETDEV_TX_OK;
+                        }
+                }
+        } else {
+                txqent->hdr.wi.lso_mss = 0;
+                txqent->hdr.wi.l4_hdr_size_n_offset = 0;
+        }
+
+        txqent->hdr.wi.flags = htons(flags);
+
+        txqent->hdr.wi.frame_length = htonl(skb->len);
+
+        unmap_q->unmap_array[unmap_prod].skb = skb;
+        BUG_ON(!(skb_headlen(skb) <= BFI_TX_MAX_DATA_PER_VECTOR));
+        txqent->vector[vect_id].length = htons(skb_headlen(skb));
+        dma_addr = pci_map_single(bnad->pcidev, skb->data, skb_headlen(skb),
+                PCI_DMA_TODEVICE);
+        pci_unmap_addr_set(&unmap_q->unmap_array[unmap_prod], dma_addr,
+                           dma_addr);
+
+        BNA_SET_DMA_ADDR(dma_addr, &txqent->vector[vect_id].host_addr);
+        BNA_QE_INDX_ADD(unmap_prod, 1, unmap_q->q_depth);
+
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i];
+                u32             size = frag->size;
+
+                if (++vect_id == BFI_TX_MAX_VECTORS_PER_WI) {
+                        vect_id = 0;
+                        if (--wi_range)
+                                txqent++;
+                        else {
+                                BNA_QE_INDX_ADD(txq_prod, wis_used,
+                                                tcb->q_depth);
+                                wis_used = 0;
+                                BNA_TXQ_QPGE_PTR_GET(txq_prod, tcb->sw_qpt,
+                                                     txqent, wi_range);
+                                BUG_ON(!(wi_range <= tcb->q_depth));
+                        }
+                        wis_used++;
+                        txqent->hdr.wi_ext.opcode = htons(BNA_TXQ_WI_EXTENSION);
+                }
+
+                BUG_ON(!(size <= BFI_TX_MAX_DATA_PER_VECTOR));
+                txqent->vector[vect_id].length = htons(size);
+                dma_addr =
+                        pci_map_page(bnad->pcidev, frag->page,
+                                     frag->page_offset, size,
+                                     PCI_DMA_TODEVICE);
+                pci_unmap_addr_set(&unmap_q->unmap_array[unmap_prod], dma_addr,
+                                   dma_addr);
+                BNA_SET_DMA_ADDR(dma_addr, &txqent->vector[vect_id].host_addr);
+                BNA_QE_INDX_ADD(unmap_prod, 1, unmap_q->q_depth);
+        }
+
+        unmap_q->producer_index = unmap_prod;
+        BNA_QE_INDX_ADD(txq_prod, wis_used, tcb->q_depth);
+        tcb->producer_index = txq_prod;
+
+        smp_mb();
+        bna_txq_prod_indx_doorbell(tcb);
+
+        if ((u16) (*tcb->hw_consumer_index) != tcb->consumer_index)
+                tasklet_schedule(&bnad->tx_free_tasklet);
+
+        return NETDEV_TX_OK;
+}
+
+/*
+ * Used spin_lock to synchronize reading of stats structures, which
+ * is written by BNA under the same lock.
+ */
+static struct rtnl_link_stats64 *
+bnad_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        bnad_netdev_qstats_fill(bnad, stats);
+        bnad_netdev_hwstats_fill(bnad, stats);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        return stats;
+}
+
+static void
+bnad_set_rx_mode(struct net_device *netdev)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        u32     new_mask, valid_mask;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        new_mask = valid_mask = 0;
+
+        if (netdev->flags & IFF_PROMISC) {
+                if (!(bnad->cfg_flags & BNAD_CF_PROMISC)) {
+                        new_mask = BNAD_RXMODE_PROMISC_DEFAULT;
+                        valid_mask = BNAD_RXMODE_PROMISC_DEFAULT;
+                        bnad->cfg_flags |= BNAD_CF_PROMISC;
+                }
+        } else {
+                if (bnad->cfg_flags & BNAD_CF_PROMISC) {
+                        new_mask = ~BNAD_RXMODE_PROMISC_DEFAULT;
+                        valid_mask = BNAD_RXMODE_PROMISC_DEFAULT;
+                        bnad->cfg_flags &= ~BNAD_CF_PROMISC;
+                }
+        }
+
+        if (netdev->flags & IFF_ALLMULTI) {
+                if (!(bnad->cfg_flags & BNAD_CF_ALLMULTI)) {
+                        new_mask |= BNA_RXMODE_ALLMULTI;
+                        valid_mask |= BNA_RXMODE_ALLMULTI;
+                        bnad->cfg_flags |= BNAD_CF_ALLMULTI;
+                }
+        } else {
+                if (bnad->cfg_flags & BNAD_CF_ALLMULTI) {
+                        new_mask &= ~BNA_RXMODE_ALLMULTI;
+                        valid_mask |= BNA_RXMODE_ALLMULTI;
+                        bnad->cfg_flags &= ~BNAD_CF_ALLMULTI;
+                }
+        }
+
+        bna_rx_mode_set(bnad->rx_info[0].rx, new_mask, valid_mask, NULL);
+
+        if (!netdev_mc_empty(netdev)) {
+                u8 *mcaddr_list;
+                int mc_count = netdev_mc_count(netdev);
+
+                /* Index 0 holds the broadcast address */
+                mcaddr_list =
+                        kzalloc((mc_count + 1) * ETH_ALEN,
+                                GFP_ATOMIC);
+                if (!mcaddr_list)
+                        goto unlock;
+
+                memcpy(&mcaddr_list[0], &bnad_bcast_addr[0], ETH_ALEN);
+
+                /* Copy rest of the MC addresses */
+                bnad_netdev_mc_list_get(netdev, mcaddr_list);
+
+                bna_rx_mcast_listset(bnad->rx_info[0].rx, mc_count + 1,
+                                        mcaddr_list, NULL);
+
+                /* Should we enable BNAD_CF_ALLMULTI for err != 0 ? */
+                kfree(mcaddr_list);
+        }
+unlock:
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+}
+
+/*
+ * bna_lock is used to sync writes to netdev->addr
+ * conf_lock cannot be used since this call may be made
+ * in a non-blocking context.
+ */
+static int
+bnad_set_mac_address(struct net_device *netdev, void *mac_addr)
+{
+        int err;
+        struct bnad *bnad = netdev_priv(netdev);
+        struct sockaddr *sa = (struct sockaddr *)mac_addr;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        err = bnad_mac_addr_set_locked(bnad, sa->sa_data);
+
+        if (!err)
+                memcpy(netdev->dev_addr, sa->sa_data, netdev->addr_len);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        return err;
+}
+
+static int
+bnad_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        int mtu, err = 0;
+        unsigned long flags;
+
+        struct bnad *bnad = netdev_priv(netdev);
+
+        if (new_mtu + ETH_HLEN < ETH_ZLEN || new_mtu > BNAD_JUMBO_MTU)
+                return -EINVAL;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        netdev->mtu = new_mtu;
+
+        mtu = ETH_HLEN + new_mtu + ETH_FCS_LEN;
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_port_mtu_set(&bnad->bna.port, mtu, NULL);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+        return err;
+}
+
+static void
+bnad_vlan_rx_register(struct net_device *netdev,
+                                  struct vlan_group *vlan_grp)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        bnad->vlan_grp = vlan_grp;
+        mutex_unlock(&bnad->conf_mutex);
+}
+
+static void
+bnad_vlan_rx_add_vid(struct net_device *netdev,
+                                 unsigned short vid)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+
+        if (!bnad->rx_info[0].rx)
+                return;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_rx_vlan_add(bnad->rx_info[0].rx, vid);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+}
+
+static void
+bnad_vlan_rx_kill_vid(struct net_device *netdev,
+                                  unsigned short vid)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+
+        if (!bnad->rx_info[0].rx)
+                return;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_rx_vlan_del(bnad->rx_info[0].rx, vid);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void
+bnad_netpoll(struct net_device *netdev)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        struct bnad_rx_info *rx_info;
+        struct bnad_rx_ctrl *rx_ctrl;
+        u32 curr_mask;
+        int i, j;
+
+        if (!(bnad->cfg_flags & BNAD_CF_MSIX)) {
+                bna_intx_disable(&bnad->bna, curr_mask);
+                bnad_isr(bnad->pcidev->irq, netdev);
+                bna_intx_enable(&bnad->bna, curr_mask);
+        } else {
+                for (i = 0; i < bnad->num_rx; i++) {
+                        rx_info = &bnad->rx_info[i];
+                        if (!rx_info->rx)
+                                continue;
+                        for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                                rx_ctrl = &rx_info->rx_ctrl[j];
+                                if (rx_ctrl->ccb) {
+                                        bnad_disable_rx_irq(bnad,
+                                                            rx_ctrl->ccb);
+                                        bnad_netif_rx_schedule_poll(bnad,
+                                                            rx_ctrl->ccb);
+                                }
+                        }
+                }
+        }
+}
+#endif
+
+static const struct net_device_ops bnad_netdev_ops = {
+        .ndo_open               = bnad_open,
+        .ndo_stop               = bnad_stop,
+        .ndo_start_xmit         = bnad_start_xmit,
+        .ndo_get_stats64                = bnad_get_stats64,
+        .ndo_set_rx_mode        = bnad_set_rx_mode,
+        .ndo_set_multicast_list = bnad_set_rx_mode,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = bnad_set_mac_address,
+        .ndo_change_mtu         = bnad_change_mtu,
+        .ndo_vlan_rx_register   = bnad_vlan_rx_register,
+        .ndo_vlan_rx_add_vid    = bnad_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid   = bnad_vlan_rx_kill_vid,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = bnad_netpoll
+#endif
+};
+
+static void
+bnad_netdev_init(struct bnad *bnad, bool using_dac)
+{
+        struct net_device *netdev = bnad->netdev;
+
+        netdev->features |= NETIF_F_IPV6_CSUM;
+        netdev->features |= NETIF_F_TSO;
+        netdev->features |= NETIF_F_TSO6;
+
+        netdev->features |= NETIF_F_GRO;
+        pr_warn("bna: GRO enabled, using kernel stack GRO\n");
+
+        netdev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+
+        if (using_dac)
+                netdev->features |= NETIF_F_HIGHDMA;
+
+        netdev->features |=
+                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
+                NETIF_F_HW_VLAN_FILTER;
+
+        netdev->vlan_features = netdev->features;
+        netdev->mem_start = bnad->mmio_start;
+        netdev->mem_end = bnad->mmio_start + bnad->mmio_len - 1;
+
+        netdev->netdev_ops = &bnad_netdev_ops;
+        bnad_set_ethtool_ops(netdev);
+}
+
+/*
+ * 1. Initialize the bnad structure
+ * 2. Setup netdev pointer in pci_dev
+ * 3. Initialze Tx free tasklet
+ * 4. Initialize no. of TxQ & CQs & MSIX vectors
+ */
+static int
+bnad_init(struct bnad *bnad,
+          struct pci_dev *pdev, struct net_device *netdev)
+{
+        unsigned long flags;
+
+        SET_NETDEV_DEV(netdev, &pdev->dev);
+        pci_set_drvdata(pdev, netdev);
+
+        bnad->netdev = netdev;
+        bnad->pcidev = pdev;
+        bnad->mmio_start = pci_resource_start(pdev, 0);
+        bnad->mmio_len = pci_resource_len(pdev, 0);
+        bnad->bar0 = ioremap_nocache(bnad->mmio_start, bnad->mmio_len);
+        if (!bnad->bar0) {
+                dev_err(&pdev->dev, "ioremap for bar0 failed\n");
+                pci_set_drvdata(pdev, NULL);
+                return -ENOMEM;
+        }
+        pr_info("bar0 mapped to %p, len %llu\n", bnad->bar0,
+               (unsigned long long) bnad->mmio_len);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (!bnad_msix_disable)
+                bnad->cfg_flags = BNAD_CF_MSIX;
+
+        bnad->cfg_flags |= BNAD_CF_DIM_ENABLED;
+
+        bnad_q_num_init(bnad);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        bnad->msix_num = (bnad->num_tx * bnad->num_txq_per_tx) +
+                (bnad->num_rx * bnad->num_rxp_per_rx) +
+                         BNAD_MAILBOX_MSIX_VECTORS;
+        bnad->msix_diag_num = 2;        /* 1 for Tx, 1 for Rx */
+
+        bnad->txq_depth = BNAD_TXQ_DEPTH;
+        bnad->rxq_depth = BNAD_RXQ_DEPTH;
+        bnad->rx_csum = true;
+
+        bnad->tx_coalescing_timeo = BFI_TX_COALESCING_TIMEO;
+        bnad->rx_coalescing_timeo = BFI_RX_COALESCING_TIMEO;
+
+        tasklet_init(&bnad->tx_free_tasklet, bnad_tx_free_tasklet,
+                     (unsigned long)bnad);
+
+        return 0;
+}
+
+/*
+ * Must be called after bnad_pci_uninit()
+ * so that iounmap() and pci_set_drvdata(NULL)
+ * happens only after PCI uninitialization.
+ */
+static void
+bnad_uninit(struct bnad *bnad)
+{
+        if (bnad->bar0)
+                iounmap(bnad->bar0);
+        pci_set_drvdata(bnad->pcidev, NULL);
+}
+
+/*
+ * Initialize locks
+        a) Per device mutes used for serializing configuration
+           changes from OS interface
+        b) spin lock used to protect bna state machine
+ */
+static void
+bnad_lock_init(struct bnad *bnad)
+{
+        spin_lock_init(&bnad->bna_lock);
+        mutex_init(&bnad->conf_mutex);
+}
+
+static void
+bnad_lock_uninit(struct bnad *bnad)
+{
+        mutex_destroy(&bnad->conf_mutex);
+}
+
+/* PCI Initialization */
+static int
+bnad_pci_init(struct bnad *bnad,
+              struct pci_dev *pdev, bool *using_dac)
+{
+        int err;
+
+        err = pci_enable_device(pdev);
+        if (err)
+                return err;
+        err = pci_request_regions(pdev, BNAD_NAME);
+        if (err)
+                goto disable_device;
+        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
+            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+                *using_dac = 1;
+        } else {
+                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                if (err) {
+                        err = pci_set_consistent_dma_mask(pdev,
+                                                DMA_BIT_MASK(32));
+                        if (err)
+                                goto release_regions;
+                }
+                *using_dac = 0;
+        }
+        pci_set_master(pdev);
+        return 0;
+
+release_regions:
+        pci_release_regions(pdev);
+disable_device:
+        pci_disable_device(pdev);
+
+        return err;
+}
+
+static void
+bnad_pci_uninit(struct pci_dev *pdev)
+{
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+}
+
+static int __devinit
+bnad_pci_probe(struct pci_dev *pdev,
+                const struct pci_device_id *pcidev_id)
+{
+        bool    using_dac;
+        int     err;
+        struct bnad *bnad;
+        struct bna *bna;
+        struct net_device *netdev;
+        struct bfa_pcidev pcidev_info;
+        unsigned long flags;
+
+        pr_info("bnad_pci_probe : (0x%p, 0x%p) PCI Func : (%d)\n",
+               pdev, pcidev_id, PCI_FUNC(pdev->devfn));
+
+        mutex_lock(&bnad_fwimg_mutex);
+        if (!cna_get_firmware_buf(pdev)) {
+                mutex_unlock(&bnad_fwimg_mutex);
+                pr_warn("Failed to load Firmware Image!\n");
+                return -ENODEV;
+        }
+        mutex_unlock(&bnad_fwimg_mutex);
+
+        /*
+         * Allocates sizeof(struct net_device + struct bnad)
+         * bnad = netdev->priv
+         */
+        netdev = alloc_etherdev(sizeof(struct bnad));
+        if (!netdev) {
+                dev_err(&pdev->dev, "alloc_etherdev failed\n");
+                err = -ENOMEM;
+                return err;
+        }
+        bnad = netdev_priv(netdev);
+
+        /*
+         * PCI initialization
+         *      Output : using_dac = 1 for 64 bit DMA
+         *                         = 0 for 32 bit DMA
+         */
+        err = bnad_pci_init(bnad, pdev, &using_dac);
+        if (err)
+                goto free_netdev;
+
+        bnad_lock_init(bnad);
+        /*
+         * Initialize bnad structure
+         * Setup relation between pci_dev & netdev
+         * Init Tx free tasklet
+         */
+        err = bnad_init(bnad, pdev, netdev);
+        if (err)
+                goto pci_uninit;
+        /* Initialize netdev structure, set up ethtool ops */
+        bnad_netdev_init(bnad, using_dac);
+
+        bnad_enable_msix(bnad);
+
+        /* Get resource requirement form bna */
+        bna_res_req(&bnad->res_info[0]);
+
+        /* Allocate resources from bna */
+        err = bnad_res_alloc(bnad);
+        if (err)
+                goto free_netdev;
+
+        bna = &bnad->bna;
+
+        /* Setup pcidev_info for bna_init() */
+        pcidev_info.pci_slot = PCI_SLOT(bnad->pcidev->devfn);
+        pcidev_info.pci_func = PCI_FUNC(bnad->pcidev->devfn);
+        pcidev_info.device_id = bnad->pcidev->device;
+        pcidev_info.pci_bar_kva = bnad->bar0;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_init(bna, bnad, &pcidev_info, &bnad->res_info[0]);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        bnad->stats.bna_stats = &bna->stats;
+
+        /* Set up timers */
+        setup_timer(&bnad->bna.device.ioc.ioc_timer, bnad_ioc_timeout,
+                                ((unsigned long)bnad));
+        setup_timer(&bnad->bna.device.ioc.hb_timer, bnad_ioc_hb_check,
+                                ((unsigned long)bnad));
+        setup_timer(&bnad->bna.device.ioc.sem_timer, bnad_ioc_sem_timeout,
+                                ((unsigned long)bnad));
+
+        /* Now start the timer before calling IOC */
+        mod_timer(&bnad->bna.device.ioc.ioc_timer,
+                  jiffies + msecs_to_jiffies(BNA_IOC_TIMER_FREQ));
+
+        /*
+         * Start the chip
+         * Don't care even if err != 0, bna state machine will
+         * deal with it
+         */
+        err = bnad_device_enable(bnad);
+
+        /* Get the burnt-in mac */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_port_mac_get(&bna->port, &bnad->perm_addr);
+        bnad_set_netdev_perm_addr(bnad);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+
+        /*
+         * Make sure the link appears down to the stack
+         */
+        netif_carrier_off(netdev);
+
+        /* Finally, reguister with net_device layer */
+        err = register_netdev(netdev);
+        if (err) {
+                pr_err("BNA : Registering with netdev failed\n");
+                goto disable_device;
+        }
+
+        return 0;
+
+disable_device:
+        mutex_lock(&bnad->conf_mutex);
+        bnad_device_disable(bnad);
+        del_timer_sync(&bnad->bna.device.ioc.ioc_timer);
+        del_timer_sync(&bnad->bna.device.ioc.sem_timer);
+        del_timer_sync(&bnad->bna.device.ioc.hb_timer);
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_uninit(bna);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        mutex_unlock(&bnad->conf_mutex);
+
+        bnad_res_free(bnad);
+        bnad_disable_msix(bnad);
+pci_uninit:
+        bnad_pci_uninit(pdev);
+        bnad_lock_uninit(bnad);
+        bnad_uninit(bnad);
+free_netdev:
+        free_netdev(netdev);
+        return err;
+}
+
+static void __devexit
+bnad_pci_remove(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct bnad *bnad;
+        struct bna *bna;
+        unsigned long flags;
+
+        if (!netdev)
+                return;
+
+        pr_info("%s bnad_pci_remove\n", netdev->name);
+        bnad = netdev_priv(netdev);
+        bna = &bnad->bna;
+
+        unregister_netdev(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        bnad_device_disable(bnad);
+        del_timer_sync(&bnad->bna.device.ioc.ioc_timer);
+        del_timer_sync(&bnad->bna.device.ioc.sem_timer);
+        del_timer_sync(&bnad->bna.device.ioc.hb_timer);
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bna_uninit(bna);
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        mutex_unlock(&bnad->conf_mutex);
+
+        bnad_res_free(bnad);
+        bnad_disable_msix(bnad);
+        bnad_pci_uninit(pdev);
+        bnad_lock_uninit(bnad);
+        bnad_uninit(bnad);
+        free_netdev(netdev);
+}
+
+const struct pci_device_id bnad_pci_id_table[] = {
+        {
+                PCI_DEVICE(PCI_VENDOR_ID_BROCADE,
+                        PCI_DEVICE_ID_BROCADE_CT),
+                .class = PCI_CLASS_NETWORK_ETHERNET << 8,
+                .class_mask =  0xffff00
+        }, {0,  }
+};
+
+MODULE_DEVICE_TABLE(pci, bnad_pci_id_table);
+
+static struct pci_driver bnad_pci_driver = {
+        .name = BNAD_NAME,
+        .id_table = bnad_pci_id_table,
+        .probe = bnad_pci_probe,
+        .remove = __devexit_p(bnad_pci_remove),
+};
+
+static int __init
+bnad_module_init(void)
+{
+        int err;
+
+        pr_info("Brocade 10G Ethernet driver\n");
+
+        bfa_nw_ioc_auto_recover(bnad_ioc_auto_recover);
+
+        err = pci_register_driver(&bnad_pci_driver);
+        if (err < 0) {
+                pr_err("bna : PCI registration failed in module init "
+                       "(%d)\n", err);
+                return err;
+        }
+
+        return 0;
+}
+
+static void __exit
+bnad_module_exit(void)
+{
+        pci_unregister_driver(&bnad_pci_driver);
+
+        if (bfi_fw)
+                release_firmware(bfi_fw);
+}
+
+module_init(bnad_module_init);
+module_exit(bnad_module_exit);
+
+MODULE_AUTHOR("Brocade");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Brocade 10G PCIe Ethernet driver");
+MODULE_VERSION(BNAD_VERSION);
+MODULE_FIRMWARE(CNA_FW_FILE_CT);
diff --git a/drivers/net/bna/bnad.h b/drivers/net/bna/bnad.h
new file mode 100644
index 000000000000..ee377888b905
--- /dev/null
+++ b/drivers/net/bna/bnad.h
@@ -0,0 +1,333 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#ifndef __BNAD_H__
+#define __BNAD_H__
+
+#include <linux/rtnetlink.h>
+#include <linux/workqueue.h>
+#include <linux/ipv6.h>
+#include <linux/etherdevice.h>
+#include <linux/mutex.h>
+#include <linux/firmware.h>
+
+/* Fix for IA64 */
+#include <asm/checksum.h>
+#include <net/ip6_checksum.h>
+
+#include <net/ip.h>
+#include <net/tcp.h>
+
+#include "bna.h"
+
+#define BNAD_TXQ_DEPTH          2048
+#define BNAD_RXQ_DEPTH          2048
+
+#define BNAD_MAX_TXS            1
+#define BNAD_MAX_TXQ_PER_TX     8       /* 8 priority queues */
+#define BNAD_TXQ_NUM            1
+
+#define BNAD_MAX_RXS            1
+#define BNAD_MAX_RXPS_PER_RX    16
+
+/*
+ * Control structure pointed to ccb->ctrl, which
+ * determines the NAPI / LRO behavior CCB
+ * There is 1:1 corres. between ccb & ctrl
+ */
+struct bnad_rx_ctrl {
+        struct bna_ccb *ccb;
+        struct napi_struct      napi;
+};
+
+#define BNAD_RXMODE_PROMISC_DEFAULT     BNA_RXMODE_PROMISC
+
+#define BNAD_GET_TX_ID(_skb)    (0)
+
+/*
+ * GLOBAL #defines (CONSTANTS)
+ */
+#define BNAD_NAME                       "bna"
+#define BNAD_NAME_LEN                   64
+
+#define BNAD_VERSION                    "2.3.2.0"
+
+#define BNAD_MAILBOX_MSIX_VECTORS       1
+
+#define BNAD_STATS_TIMER_FREQ           1000    /* in msecs */
+#define BNAD_DIM_TIMER_FREQ             1000    /* in msecs */
+
+#define BNAD_MAX_Q_DEPTH                0x10000
+#define BNAD_MIN_Q_DEPTH                0x200
+
+#define BNAD_JUMBO_MTU                  9000
+
+#define BNAD_NETIF_WAKE_THRESHOLD       8
+
+#define BNAD_RXQ_REFILL_THRESHOLD_SHIFT 3
+
+/* Bit positions for tcb->flags */
+#define BNAD_TXQ_FREE_SENT              0
+
+/* Bit positions for rcb->flags */
+#define BNAD_RXQ_REFILL                 0
+#define BNAD_RXQ_STARTED                1
+
+/*
+ * DATA STRUCTURES
+ */
+
+/* enums */
+enum bnad_intr_source {
+        BNAD_INTR_TX            = 1,
+        BNAD_INTR_RX            = 2
+};
+
+enum bnad_link_state {
+        BNAD_LS_DOWN            = 0,
+        BNAD_LS_UP              = 1
+};
+
+struct bnad_completion {
+        struct completion       ioc_comp;
+        struct completion       ucast_comp;
+        struct completion       mcast_comp;
+        struct completion       tx_comp;
+        struct completion       rx_comp;
+        struct completion       stats_comp;
+        struct completion       port_comp;
+
+        u8                      ioc_comp_status;
+        u8                      ucast_comp_status;
+        u8                      mcast_comp_status;
+        u8                      tx_comp_status;
+        u8                      rx_comp_status;
+        u8                      stats_comp_status;
+        u8                      port_comp_status;
+};
+
+/* Tx Rx Control Stats */
+struct bnad_drv_stats {
+        u64             netif_queue_stop;
+        u64             netif_queue_wakeup;
+        u64             tso4;
+        u64             tso6;
+        u64             tso_err;
+        u64             tcpcsum_offload;
+        u64             udpcsum_offload;
+        u64             csum_help;
+        u64             csum_help_err;
+
+        u64             hw_stats_updates;
+        u64             netif_rx_schedule;
+        u64             netif_rx_complete;
+        u64             netif_rx_dropped;
+
+        u64             link_toggle;
+        u64             cee_up;
+
+        u64             rxp_info_alloc_failed;
+        u64             mbox_intr_disabled;
+        u64             mbox_intr_enabled;
+        u64             tx_unmap_q_alloc_failed;
+        u64             rx_unmap_q_alloc_failed;
+
+        u64             rxbuf_alloc_failed;
+};
+
+/* Complete driver stats */
+struct bnad_stats {
+        struct bnad_drv_stats drv_stats;
+        struct bna_stats *bna_stats;
+};
+
+/* Tx / Rx Resources */
+struct bnad_tx_res_info {
+        struct bna_res_info res_info[BNA_TX_RES_T_MAX];
+};
+
+struct bnad_rx_res_info {
+        struct bna_res_info res_info[BNA_RX_RES_T_MAX];
+};
+
+struct bnad_tx_info {
+        struct bna_tx *tx; /* 1:1 between tx_info & tx */
+        struct bna_tcb *tcb[BNAD_MAX_TXQ_PER_TX];
+} ____cacheline_aligned;
+
+struct bnad_rx_info {
+        struct bna_rx *rx; /* 1:1 between rx_info & rx */
+
+        struct bnad_rx_ctrl rx_ctrl[BNAD_MAX_RXPS_PER_RX];
+} ____cacheline_aligned;
+
+/* Unmap queues for Tx / Rx cleanup */
+struct bnad_skb_unmap {
+        struct sk_buff          *skb;
+        DECLARE_PCI_UNMAP_ADDR(dma_addr)
+};
+
+struct bnad_unmap_q {
+        u32             producer_index;
+        u32             consumer_index;
+        u32             q_depth;
+        /* This should be the last one */
+        struct bnad_skb_unmap unmap_array[1];
+};
+
+/* Bit mask values for bnad->cfg_flags */
+#define BNAD_CF_DIM_ENABLED             0x01    /* DIM */
+#define BNAD_CF_PROMISC                 0x02
+#define BNAD_CF_ALLMULTI                0x04
+#define BNAD_CF_MSIX                    0x08    /* If in MSIx mode */
+
+/* Defines for run_flags bit-mask */
+/* Set, tested & cleared using xxx_bit() functions */
+/* Values indicated bit positions */
+#define BNAD_RF_CEE_RUNNING             1
+#define BNAD_RF_HW_ERROR                2
+#define BNAD_RF_MBOX_IRQ_DISABLED       3
+#define BNAD_RF_TX_STARTED              4
+#define BNAD_RF_RX_STARTED              5
+#define BNAD_RF_DIM_TIMER_RUNNING       6
+#define BNAD_RF_STATS_TIMER_RUNNING     7
+
+struct bnad {
+        struct net_device       *netdev;
+
+        /* Data path */
+        struct bnad_tx_info tx_info[BNAD_MAX_TXS];
+        struct bnad_rx_info rx_info[BNAD_MAX_RXS];
+
+        struct vlan_group       *vlan_grp;
+        /*
+         * These q numbers are global only because
+         * they are used to calculate MSIx vectors.
+         * Actually the exact # of queues are per Tx/Rx
+         * object.
+         */
+        u32             num_tx;
+        u32             num_rx;
+        u32             num_txq_per_tx;
+        u32             num_rxp_per_rx;
+
+        u32             txq_depth;
+        u32             rxq_depth;
+
+        u8                      tx_coalescing_timeo;
+        u8                      rx_coalescing_timeo;
+
+        struct bna_rx_config rx_config[BNAD_MAX_RXS];
+        struct bna_tx_config tx_config[BNAD_MAX_TXS];
+
+        u32             rx_csum;
+
+        void __iomem            *bar0;  /* BAR0 address */
+
+        struct bna bna;
+
+        u32             cfg_flags;
+        unsigned long           run_flags;
+
+        struct pci_dev          *pcidev;
+        u64             mmio_start;
+        u64             mmio_len;
+
+        u32             msix_num;
+        u32             msix_diag_num;
+        struct msix_entry       *msix_table;
+
+        struct mutex            conf_mutex;
+        spinlock_t              bna_lock ____cacheline_aligned;
+
+        /* Timers */
+        struct timer_list       ioc_timer;
+        struct timer_list       dim_timer;
+        struct timer_list       stats_timer;
+
+        /* Control path resources, memory & irq */
+        struct bna_res_info res_info[BNA_RES_T_MAX];
+        struct bnad_tx_res_info tx_res_info[BNAD_MAX_TXS];
+        struct bnad_rx_res_info rx_res_info[BNAD_MAX_RXS];
+
+        struct bnad_completion bnad_completions;
+
+        /* Burnt in MAC address */
+        mac_t                   perm_addr;
+
+        struct tasklet_struct   tx_free_tasklet;
+
+        /* Statistics */
+        struct bnad_stats stats;
+
+        struct bnad_diag *diag;
+
+        char                    adapter_name[BNAD_NAME_LEN];
+        char                    port_name[BNAD_NAME_LEN];
+        char                    mbox_irq_name[BNAD_NAME_LEN];
+};
+
+/*
+ * EXTERN VARIABLES
+ */
+extern struct firmware *bfi_fw;
+extern u32              bnad_rxqs_per_cq;
+
+/*
+ * EXTERN PROTOTYPES
+ */
+extern u32 *cna_get_firmware_buf(struct pci_dev *pdev);
+/* Netdev entry point prototypes */
+extern void bnad_set_ethtool_ops(struct net_device *netdev);
+
+/* Configuration & setup */
+extern void bnad_tx_coalescing_timeo_set(struct bnad *bnad);
+extern void bnad_rx_coalescing_timeo_set(struct bnad *bnad);
+
+extern int bnad_setup_rx(struct bnad *bnad, uint rx_id);
+extern int bnad_setup_tx(struct bnad *bnad, uint tx_id);
+extern void bnad_cleanup_tx(struct bnad *bnad, uint tx_id);
+extern void bnad_cleanup_rx(struct bnad *bnad, uint rx_id);
+
+/* Timer start/stop protos */
+extern void bnad_dim_timer_start(struct bnad *bnad);
+
+/* Statistics */
+extern void bnad_netdev_qstats_fill(struct bnad *bnad, struct rtnl_link_stats64 *stats);
+extern void bnad_netdev_hwstats_fill(struct bnad *bnad, struct rtnl_link_stats64 *stats);
+
+/**
+ * MACROS
+ */
+/* To set & get the stats counters */
+#define BNAD_UPDATE_CTR(_bnad, _ctr)                            \
+                                (((_bnad)->stats.drv_stats._ctr)++)
+
+#define BNAD_GET_CTR(_bnad, _ctr) ((_bnad)->stats.drv_stats._ctr)
+
+#define bnad_enable_rx_irq_unsafe(_ccb)                 \
+{                                                       \
+        bna_ib_coalescing_timer_set((_ccb)->i_dbell,    \
+                (_ccb)->rx_coalescing_timeo);           \
+        bna_ib_ack((_ccb)->i_dbell, 0);                 \
+}
+
+#define bnad_dim_timer_running(_bnad)                           \
+        (((_bnad)->cfg_flags & BNAD_CF_DIM_ENABLED) &&          \
+        (test_bit(BNAD_RF_DIM_TIMER_RUNNING, &((_bnad)->run_flags))))
+
+#endif /* __BNAD_H__ */
diff --git a/drivers/net/bna/bnad_ethtool.c b/drivers/net/bna/bnad_ethtool.c
new file mode 100644
index 000000000000..11fa2ea842c1
--- /dev/null
+++ b/drivers/net/bna/bnad_ethtool.c
@@ -0,0 +1,1277 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#include "cna.h"
+
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/rtnetlink.h>
+
+#include "bna.h"
+
+#include "bnad.h"
+
+#define BNAD_NUM_TXF_COUNTERS 12
+#define BNAD_NUM_RXF_COUNTERS 10
+#define BNAD_NUM_CQ_COUNTERS 3
+#define BNAD_NUM_RXQ_COUNTERS 6
+#define BNAD_NUM_TXQ_COUNTERS 5
+
+#define BNAD_ETHTOOL_STATS_NUM                                          \
+        (sizeof(struct rtnl_link_stats64) / sizeof(u64) +       \
+        sizeof(struct bnad_drv_stats) / sizeof(u64) +           \
+        offsetof(struct bfi_ll_stats, rxf_stats[0]) / sizeof(u64))
+
+static char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
+        "rx_packets",
+        "tx_packets",
+        "rx_bytes",
+        "tx_bytes",
+        "rx_errors",
+        "tx_errors",
+        "rx_dropped",
+        "tx_dropped",
+        "multicast",
+        "collisions",
+
+        "rx_length_errors",
+        "rx_over_errors",
+        "rx_crc_errors",
+        "rx_frame_errors",
+        "rx_fifo_errors",
+        "rx_missed_errors",
+
+        "tx_aborted_errors",
+        "tx_carrier_errors",
+        "tx_fifo_errors",
+        "tx_heartbeat_errors",
+        "tx_window_errors",
+
+        "rx_compressed",
+        "tx_compressed",
+
+        "netif_queue_stop",
+        "netif_queue_wakeup",
+        "tso4",
+        "tso6",
+        "tso_err",
+        "tcpcsum_offload",
+        "udpcsum_offload",
+        "csum_help",
+        "csum_help_err",
+        "hw_stats_updates",
+        "netif_rx_schedule",
+        "netif_rx_complete",
+        "netif_rx_dropped",
+
+        "link_toggle",
+        "cee_up",
+
+        "rxp_info_alloc_failed",
+        "mbox_intr_disabled",
+        "mbox_intr_enabled",
+        "tx_unmap_q_alloc_failed",
+        "rx_unmap_q_alloc_failed",
+        "rxbuf_alloc_failed",
+
+        "mac_frame_64",
+        "mac_frame_65_127",
+        "mac_frame_128_255",
+        "mac_frame_256_511",
+        "mac_frame_512_1023",
+        "mac_frame_1024_1518",
+        "mac_frame_1518_1522",
+        "mac_rx_bytes",
+        "mac_rx_packets",
+        "mac_rx_fcs_error",
+        "mac_rx_multicast",
+        "mac_rx_broadcast",
+        "mac_rx_control_frames",
+        "mac_rx_pause",
+        "mac_rx_unknown_opcode",
+        "mac_rx_alignment_error",
+        "mac_rx_frame_length_error",
+        "mac_rx_code_error",
+        "mac_rx_carrier_sense_error",
+        "mac_rx_undersize",
+        "mac_rx_oversize",
+        "mac_rx_fragments",
+        "mac_rx_jabber",
+        "mac_rx_drop",
+
+        "mac_tx_bytes",
+        "mac_tx_packets",
+        "mac_tx_multicast",
+        "mac_tx_broadcast",
+        "mac_tx_pause",
+        "mac_tx_deferral",
+        "mac_tx_excessive_deferral",
+        "mac_tx_single_collision",
+        "mac_tx_muliple_collision",
+        "mac_tx_late_collision",
+        "mac_tx_excessive_collision",
+        "mac_tx_total_collision",
+        "mac_tx_pause_honored",
+        "mac_tx_drop",
+        "mac_tx_jabber",
+        "mac_tx_fcs_error",
+        "mac_tx_control_frame",
+        "mac_tx_oversize",
+        "mac_tx_undersize",
+        "mac_tx_fragments",
+
+        "bpc_tx_pause_0",
+        "bpc_tx_pause_1",
+        "bpc_tx_pause_2",
+        "bpc_tx_pause_3",
+        "bpc_tx_pause_4",
+        "bpc_tx_pause_5",
+        "bpc_tx_pause_6",
+        "bpc_tx_pause_7",
+        "bpc_tx_zero_pause_0",
+        "bpc_tx_zero_pause_1",
+        "bpc_tx_zero_pause_2",
+        "bpc_tx_zero_pause_3",
+        "bpc_tx_zero_pause_4",
+        "bpc_tx_zero_pause_5",
+        "bpc_tx_zero_pause_6",
+        "bpc_tx_zero_pause_7",
+        "bpc_tx_first_pause_0",
+        "bpc_tx_first_pause_1",
+        "bpc_tx_first_pause_2",
+        "bpc_tx_first_pause_3",
+        "bpc_tx_first_pause_4",
+        "bpc_tx_first_pause_5",
+        "bpc_tx_first_pause_6",
+        "bpc_tx_first_pause_7",
+
+        "bpc_rx_pause_0",
+        "bpc_rx_pause_1",
+        "bpc_rx_pause_2",
+        "bpc_rx_pause_3",
+        "bpc_rx_pause_4",
+        "bpc_rx_pause_5",
+        "bpc_rx_pause_6",
+        "bpc_rx_pause_7",
+        "bpc_rx_zero_pause_0",
+        "bpc_rx_zero_pause_1",
+        "bpc_rx_zero_pause_2",
+        "bpc_rx_zero_pause_3",
+        "bpc_rx_zero_pause_4",
+        "bpc_rx_zero_pause_5",
+        "bpc_rx_zero_pause_6",
+        "bpc_rx_zero_pause_7",
+        "bpc_rx_first_pause_0",
+        "bpc_rx_first_pause_1",
+        "bpc_rx_first_pause_2",
+        "bpc_rx_first_pause_3",
+        "bpc_rx_first_pause_4",
+        "bpc_rx_first_pause_5",
+        "bpc_rx_first_pause_6",
+        "bpc_rx_first_pause_7",
+
+        "rad_rx_frames",
+        "rad_rx_octets",
+        "rad_rx_vlan_frames",
+        "rad_rx_ucast",
+        "rad_rx_ucast_octets",
+        "rad_rx_ucast_vlan",
+        "rad_rx_mcast",
+        "rad_rx_mcast_octets",
+        "rad_rx_mcast_vlan",
+        "rad_rx_bcast",
+        "rad_rx_bcast_octets",
+        "rad_rx_bcast_vlan",
+        "rad_rx_drops",
+
+        "fc_rx_ucast_octets",
+        "fc_rx_ucast",
+        "fc_rx_ucast_vlan",
+        "fc_rx_mcast_octets",
+        "fc_rx_mcast",
+        "fc_rx_mcast_vlan",
+        "fc_rx_bcast_octets",
+        "fc_rx_bcast",
+        "fc_rx_bcast_vlan",
+
+        "fc_tx_ucast_octets",
+        "fc_tx_ucast",
+        "fc_tx_ucast_vlan",
+        "fc_tx_mcast_octets",
+        "fc_tx_mcast",
+        "fc_tx_mcast_vlan",
+        "fc_tx_bcast_octets",
+        "fc_tx_bcast",
+        "fc_tx_bcast_vlan",
+        "fc_tx_parity_errors",
+        "fc_tx_timeout",
+        "fc_tx_fid_parity_errors",
+};
+
+static int
+bnad_get_settings(struct net_device *netdev, struct ethtool_cmd *cmd)
+{
+        cmd->supported = SUPPORTED_10000baseT_Full;
+        cmd->advertising = ADVERTISED_10000baseT_Full;
+        cmd->autoneg = AUTONEG_DISABLE;
+        cmd->supported |= SUPPORTED_FIBRE;
+        cmd->advertising |= ADVERTISED_FIBRE;
+        cmd->port = PORT_FIBRE;
+        cmd->phy_address = 0;
+
+        if (netif_carrier_ok(netdev)) {
+                cmd->speed = SPEED_10000;
+                cmd->duplex = DUPLEX_FULL;
+        } else {
+                cmd->speed = -1;
+                cmd->duplex = -1;
+        }
+        cmd->transceiver = XCVR_EXTERNAL;
+        cmd->maxtxpkt = 0;
+        cmd->maxrxpkt = 0;
+
+        return 0;
+}
+
+static int
+bnad_set_settings(struct net_device *netdev, struct ethtool_cmd *cmd)
+{
+        /* 10G full duplex setting supported only */
+        if (cmd->autoneg == AUTONEG_ENABLE)
+                return -EOPNOTSUPP; else {
+                if ((cmd->speed == SPEED_10000) && (cmd->duplex == DUPLEX_FULL))
+                        return 0;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static void
+bnad_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        struct bfa_ioc_attr *ioc_attr;
+        unsigned long flags;
+
+        strcpy(drvinfo->driver, BNAD_NAME);
+        strcpy(drvinfo->version, BNAD_VERSION);
+
+        ioc_attr = kzalloc(sizeof(*ioc_attr), GFP_KERNEL);
+        if (ioc_attr) {
+                memset(ioc_attr, 0, sizeof(*ioc_attr));
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+                bfa_nw_ioc_get_attr(&bnad->bna.device.ioc, ioc_attr);
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+                strncpy(drvinfo->fw_version, ioc_attr->adapter_attr.fw_ver,
+                        sizeof(drvinfo->fw_version) - 1);
+                kfree(ioc_attr);
+        }
+
+        strncpy(drvinfo->bus_info, pci_name(bnad->pcidev), ETHTOOL_BUSINFO_LEN);
+}
+
+static int
+get_regs(struct bnad *bnad, u32 * regs)
+{
+        int num = 0, i;
+        u32 reg_addr;
+        unsigned long flags;
+
+#define BNAD_GET_REG(addr)                                      \
+do {                                                            \
+        if (regs)                                               \
+                regs[num++] = readl(bnad->bar0 + (addr));       \
+        else                                                    \
+                num++;                                          \
+} while (0)
+
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+
+        /* DMA Block Internal Registers */
+        BNAD_GET_REG(DMA_CTRL_REG0);
+        BNAD_GET_REG(DMA_CTRL_REG1);
+        BNAD_GET_REG(DMA_ERR_INT_STATUS);
+        BNAD_GET_REG(DMA_ERR_INT_ENABLE);
+        BNAD_GET_REG(DMA_ERR_INT_STATUS_SET);
+
+        /* APP Block Register Address Offset from BAR0 */
+        BNAD_GET_REG(HOSTFN0_INT_STATUS);
+        BNAD_GET_REG(HOSTFN0_INT_MASK);
+        BNAD_GET_REG(HOST_PAGE_NUM_FN0);
+        BNAD_GET_REG(HOST_MSIX_ERR_INDEX_FN0);
+        BNAD_GET_REG(FN0_PCIE_ERR_REG);
+        BNAD_GET_REG(FN0_ERR_TYPE_STATUS_REG);
+        BNAD_GET_REG(FN0_ERR_TYPE_MSK_STATUS_REG);
+
+        BNAD_GET_REG(HOSTFN1_INT_STATUS);
+        BNAD_GET_REG(HOSTFN1_INT_MASK);
+        BNAD_GET_REG(HOST_PAGE_NUM_FN1);
+        BNAD_GET_REG(HOST_MSIX_ERR_INDEX_FN1);
+        BNAD_GET_REG(FN1_PCIE_ERR_REG);
+        BNAD_GET_REG(FN1_ERR_TYPE_STATUS_REG);
+        BNAD_GET_REG(FN1_ERR_TYPE_MSK_STATUS_REG);
+
+        BNAD_GET_REG(PCIE_MISC_REG);
+
+        BNAD_GET_REG(HOST_SEM0_REG);
+        BNAD_GET_REG(HOST_SEM1_REG);
+        BNAD_GET_REG(HOST_SEM2_REG);
+        BNAD_GET_REG(HOST_SEM3_REG);
+        BNAD_GET_REG(HOST_SEM0_INFO_REG);
+        BNAD_GET_REG(HOST_SEM1_INFO_REG);
+        BNAD_GET_REG(HOST_SEM2_INFO_REG);
+        BNAD_GET_REG(HOST_SEM3_INFO_REG);
+
+        BNAD_GET_REG(TEMPSENSE_CNTL_REG);
+        BNAD_GET_REG(TEMPSENSE_STAT_REG);
+
+        BNAD_GET_REG(APP_LOCAL_ERR_STAT);
+        BNAD_GET_REG(APP_LOCAL_ERR_MSK);
+
+        BNAD_GET_REG(PCIE_LNK_ERR_STAT);
+        BNAD_GET_REG(PCIE_LNK_ERR_MSK);
+
+        BNAD_GET_REG(FCOE_FIP_ETH_TYPE);
+        BNAD_GET_REG(RESV_ETH_TYPE);
+
+        BNAD_GET_REG(HOSTFN2_INT_STATUS);
+        BNAD_GET_REG(HOSTFN2_INT_MASK);
+        BNAD_GET_REG(HOST_PAGE_NUM_FN2);
+        BNAD_GET_REG(HOST_MSIX_ERR_INDEX_FN2);
+        BNAD_GET_REG(FN2_PCIE_ERR_REG);
+        BNAD_GET_REG(FN2_ERR_TYPE_STATUS_REG);
+        BNAD_GET_REG(FN2_ERR_TYPE_MSK_STATUS_REG);
+
+        BNAD_GET_REG(HOSTFN3_INT_STATUS);
+        BNAD_GET_REG(HOSTFN3_INT_MASK);
+        BNAD_GET_REG(HOST_PAGE_NUM_FN3);
+        BNAD_GET_REG(HOST_MSIX_ERR_INDEX_FN3);
+        BNAD_GET_REG(FN3_PCIE_ERR_REG);
+        BNAD_GET_REG(FN3_ERR_TYPE_STATUS_REG);
+        BNAD_GET_REG(FN3_ERR_TYPE_MSK_STATUS_REG);
+
+        /* Host Command Status Registers */
+        reg_addr = HOST_CMDSTS0_CLR_REG;
+        for (i = 0; i < 16; i++) {
+                BNAD_GET_REG(reg_addr);
+                BNAD_GET_REG(reg_addr + 4);
+                BNAD_GET_REG(reg_addr + 8);
+                reg_addr += 0x10;
+        }
+
+        /* Function ID register */
+        BNAD_GET_REG(FNC_ID_REG);
+
+        /* Function personality register */
+        BNAD_GET_REG(FNC_PERS_REG);
+
+        /* Operation mode register */
+        BNAD_GET_REG(OP_MODE);
+
+        /* LPU0 Registers */
+        BNAD_GET_REG(LPU0_MBOX_CTL_REG);
+        BNAD_GET_REG(LPU0_MBOX_CMD_REG);
+        BNAD_GET_REG(LPU0_MBOX_LINK_0REG);
+        BNAD_GET_REG(LPU1_MBOX_LINK_0REG);
+        BNAD_GET_REG(LPU0_MBOX_STATUS_0REG);
+        BNAD_GET_REG(LPU1_MBOX_STATUS_0REG);
+        BNAD_GET_REG(LPU0_ERR_STATUS_REG);
+        BNAD_GET_REG(LPU0_ERR_SET_REG);
+
+        /* LPU1 Registers */
+        BNAD_GET_REG(LPU1_MBOX_CTL_REG);
+        BNAD_GET_REG(LPU1_MBOX_CMD_REG);
+        BNAD_GET_REG(LPU0_MBOX_LINK_1REG);
+        BNAD_GET_REG(LPU1_MBOX_LINK_1REG);
+        BNAD_GET_REG(LPU0_MBOX_STATUS_1REG);
+        BNAD_GET_REG(LPU1_MBOX_STATUS_1REG);
+        BNAD_GET_REG(LPU1_ERR_STATUS_REG);
+        BNAD_GET_REG(LPU1_ERR_SET_REG);
+
+        /* PSS Registers */
+        BNAD_GET_REG(PSS_CTL_REG);
+        BNAD_GET_REG(PSS_ERR_STATUS_REG);
+        BNAD_GET_REG(ERR_STATUS_SET);
+        BNAD_GET_REG(PSS_RAM_ERR_STATUS_REG);
+
+        /* Catapult CPQ Registers */
+        BNAD_GET_REG(HOSTFN0_LPU0_MBOX0_CMD_STAT);
+        BNAD_GET_REG(HOSTFN0_LPU1_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN0_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN0_MBOX0_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN0_LPU0_MBOX1_CMD_STAT);
+        BNAD_GET_REG(HOSTFN0_LPU1_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN0_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN0_MBOX1_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN1_LPU0_MBOX0_CMD_STAT);
+        BNAD_GET_REG(HOSTFN1_LPU1_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN1_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN1_MBOX0_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN1_LPU0_MBOX1_CMD_STAT);
+        BNAD_GET_REG(HOSTFN1_LPU1_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN1_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN1_MBOX1_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN2_LPU0_MBOX0_CMD_STAT);
+        BNAD_GET_REG(HOSTFN2_LPU1_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN2_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN2_MBOX0_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN2_LPU0_MBOX1_CMD_STAT);
+        BNAD_GET_REG(HOSTFN2_LPU1_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN2_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN2_MBOX1_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN3_LPU0_MBOX0_CMD_STAT);
+        BNAD_GET_REG(HOSTFN3_LPU1_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN3_MBOX0_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN3_MBOX0_CMD_STAT);
+
+        BNAD_GET_REG(HOSTFN3_LPU0_MBOX1_CMD_STAT);
+        BNAD_GET_REG(HOSTFN3_LPU1_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU0_HOSTFN3_MBOX1_CMD_STAT);
+        BNAD_GET_REG(LPU1_HOSTFN3_MBOX1_CMD_STAT);
+
+        /* Host Function Force Parity Error Registers */
+        BNAD_GET_REG(HOSTFN0_LPU_FORCE_PERR);
+        BNAD_GET_REG(HOSTFN1_LPU_FORCE_PERR);
+        BNAD_GET_REG(HOSTFN2_LPU_FORCE_PERR);
+        BNAD_GET_REG(HOSTFN3_LPU_FORCE_PERR);
+
+        /* LL Port[0|1] Halt Mask Registers */
+        BNAD_GET_REG(LL_HALT_MSK_P0);
+        BNAD_GET_REG(LL_HALT_MSK_P1);
+
+        /* LL Port[0|1] Error Mask Registers */
+        BNAD_GET_REG(LL_ERR_MSK_P0);
+        BNAD_GET_REG(LL_ERR_MSK_P1);
+
+        /* EMC FLI Registers */
+        BNAD_GET_REG(FLI_CMD_REG);
+        BNAD_GET_REG(FLI_ADDR_REG);
+        BNAD_GET_REG(FLI_CTL_REG);
+        BNAD_GET_REG(FLI_WRDATA_REG);
+        BNAD_GET_REG(FLI_RDDATA_REG);
+        BNAD_GET_REG(FLI_DEV_STATUS_REG);
+        BNAD_GET_REG(FLI_SIG_WD_REG);
+
+        BNAD_GET_REG(FLI_DEV_VENDOR_REG);
+        BNAD_GET_REG(FLI_ERR_STATUS_REG);
+
+        /* RxAdm 0 Registers */
+        BNAD_GET_REG(RAD0_CTL_REG);
+        BNAD_GET_REG(RAD0_PE_PARM_REG);
+        BNAD_GET_REG(RAD0_BCN_REG);
+        BNAD_GET_REG(RAD0_DEFAULT_REG);
+        BNAD_GET_REG(RAD0_PROMISC_REG);
+        BNAD_GET_REG(RAD0_BCNQ_REG);
+        BNAD_GET_REG(RAD0_DEFAULTQ_REG);
+
+        BNAD_GET_REG(RAD0_ERR_STS);
+        BNAD_GET_REG(RAD0_SET_ERR_STS);
+        BNAD_GET_REG(RAD0_ERR_INT_EN);
+        BNAD_GET_REG(RAD0_FIRST_ERR);
+        BNAD_GET_REG(RAD0_FORCE_ERR);
+
+        BNAD_GET_REG(RAD0_MAC_MAN_1H);
+        BNAD_GET_REG(RAD0_MAC_MAN_1L);
+        BNAD_GET_REG(RAD0_MAC_MAN_2H);
+        BNAD_GET_REG(RAD0_MAC_MAN_2L);
+        BNAD_GET_REG(RAD0_MAC_MAN_3H);
+        BNAD_GET_REG(RAD0_MAC_MAN_3L);
+        BNAD_GET_REG(RAD0_MAC_MAN_4H);
+        BNAD_GET_REG(RAD0_MAC_MAN_4L);
+
+        BNAD_GET_REG(RAD0_LAST4_IP);
+
+        /* RxAdm 1 Registers */
+        BNAD_GET_REG(RAD1_CTL_REG);
+        BNAD_GET_REG(RAD1_PE_PARM_REG);
+        BNAD_GET_REG(RAD1_BCN_REG);
+        BNAD_GET_REG(RAD1_DEFAULT_REG);
+        BNAD_GET_REG(RAD1_PROMISC_REG);
+        BNAD_GET_REG(RAD1_BCNQ_REG);
+        BNAD_GET_REG(RAD1_DEFAULTQ_REG);
+
+        BNAD_GET_REG(RAD1_ERR_STS);
+        BNAD_GET_REG(RAD1_SET_ERR_STS);
+        BNAD_GET_REG(RAD1_ERR_INT_EN);
+
+        /* TxA0 Registers */
+        BNAD_GET_REG(TXA0_CTRL_REG);
+        /* TxA0 TSO Sequence # Registers (RO) */
+        for (i = 0; i < 8; i++) {
+                BNAD_GET_REG(TXA0_TSO_TCP_SEQ_REG(i));
+                BNAD_GET_REG(TXA0_TSO_IP_INFO_REG(i));
+        }
+
+        /* TxA1 Registers */
+        BNAD_GET_REG(TXA1_CTRL_REG);
+        /* TxA1 TSO Sequence # Registers (RO) */
+        for (i = 0; i < 8; i++) {
+                BNAD_GET_REG(TXA1_TSO_TCP_SEQ_REG(i));
+                BNAD_GET_REG(TXA1_TSO_IP_INFO_REG(i));
+        }
+
+        /* RxA Registers */
+        BNAD_GET_REG(RXA0_CTL_REG);
+        BNAD_GET_REG(RXA1_CTL_REG);
+
+        /* PLB0 Registers */
+        BNAD_GET_REG(PLB0_ECM_TIMER_REG);
+        BNAD_GET_REG(PLB0_RL_CTL);
+        for (i = 0; i < 8; i++)
+                BNAD_GET_REG(PLB0_RL_MAX_BC(i));
+        BNAD_GET_REG(PLB0_RL_TU_PRIO);
+        for (i = 0; i < 8; i++)
+                BNAD_GET_REG(PLB0_RL_BYTE_CNT(i));
+        BNAD_GET_REG(PLB0_RL_MIN_REG);
+        BNAD_GET_REG(PLB0_RL_MAX_REG);
+        BNAD_GET_REG(PLB0_EMS_ADD_REG);
+
+        /* PLB1 Registers */
+        BNAD_GET_REG(PLB1_ECM_TIMER_REG);
+        BNAD_GET_REG(PLB1_RL_CTL);
+        for (i = 0; i < 8; i++)
+                BNAD_GET_REG(PLB1_RL_MAX_BC(i));
+        BNAD_GET_REG(PLB1_RL_TU_PRIO);
+        for (i = 0; i < 8; i++)
+                BNAD_GET_REG(PLB1_RL_BYTE_CNT(i));
+        BNAD_GET_REG(PLB1_RL_MIN_REG);
+        BNAD_GET_REG(PLB1_RL_MAX_REG);
+        BNAD_GET_REG(PLB1_EMS_ADD_REG);
+
+        /* HQM Control Register */
+        BNAD_GET_REG(HQM0_CTL_REG);
+        BNAD_GET_REG(HQM0_RXQ_STOP_SEM);
+        BNAD_GET_REG(HQM0_TXQ_STOP_SEM);
+        BNAD_GET_REG(HQM1_CTL_REG);
+        BNAD_GET_REG(HQM1_RXQ_STOP_SEM);
+        BNAD_GET_REG(HQM1_TXQ_STOP_SEM);
+
+        /* LUT Registers */
+        BNAD_GET_REG(LUT0_ERR_STS);
+        BNAD_GET_REG(LUT0_SET_ERR_STS);
+        BNAD_GET_REG(LUT1_ERR_STS);
+        BNAD_GET_REG(LUT1_SET_ERR_STS);
+
+        /* TRC Registers */
+        BNAD_GET_REG(TRC_CTL_REG);
+        BNAD_GET_REG(TRC_MODS_REG);
+        BNAD_GET_REG(TRC_TRGC_REG);
+        BNAD_GET_REG(TRC_CNT1_REG);
+        BNAD_GET_REG(TRC_CNT2_REG);
+        BNAD_GET_REG(TRC_NXTS_REG);
+        BNAD_GET_REG(TRC_DIRR_REG);
+        for (i = 0; i < 10; i++)
+                BNAD_GET_REG(TRC_TRGM_REG(i));
+        for (i = 0; i < 10; i++)
+                BNAD_GET_REG(TRC_NXTM_REG(i));
+        for (i = 0; i < 10; i++)
+                BNAD_GET_REG(TRC_STRM_REG(i));
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+#undef BNAD_GET_REG
+        return num;
+}
+static int
+bnad_get_regs_len(struct net_device *netdev)
+{
+        int ret = get_regs(netdev_priv(netdev), NULL) * sizeof(u32);
+        return ret;
+}
+
+static void
+bnad_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *buf)
+{
+        memset(buf, 0, bnad_get_regs_len(netdev));
+        get_regs(netdev_priv(netdev), buf);
+}
+
+static void
+bnad_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wolinfo)
+{
+        wolinfo->supported = 0;
+        wolinfo->wolopts = 0;
+}
+
+static int
+bnad_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+
+        /* Lock rqd. to access bnad->bna_lock */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        coalesce->use_adaptive_rx_coalesce =
+                (bnad->cfg_flags & BNAD_CF_DIM_ENABLED) ? true : false;
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        coalesce->rx_coalesce_usecs = bnad->rx_coalescing_timeo *
+                                        BFI_COALESCING_TIMER_UNIT;
+        coalesce->tx_coalesce_usecs = bnad->tx_coalescing_timeo *
+                                        BFI_COALESCING_TIMER_UNIT;
+        coalesce->tx_max_coalesced_frames = BFI_TX_INTERPKT_COUNT;
+
+        return 0;
+}
+
+static int
+bnad_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        unsigned long flags;
+        int dim_timer_del = 0;
+
+        if (coalesce->rx_coalesce_usecs == 0 ||
+            coalesce->rx_coalesce_usecs >
+            BFI_MAX_COALESCING_TIMEO * BFI_COALESCING_TIMER_UNIT)
+                return -EINVAL;
+
+        if (coalesce->tx_coalesce_usecs == 0 ||
+            coalesce->tx_coalesce_usecs >
+            BFI_MAX_COALESCING_TIMEO * BFI_COALESCING_TIMER_UNIT)
+                return -EINVAL;
+
+        mutex_lock(&bnad->conf_mutex);
+        /*
+         * Do not need to store rx_coalesce_usecs here
+         * Every time DIM is disabled, we can get it from the
+         * stack.
+         */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        if (coalesce->use_adaptive_rx_coalesce) {
+                if (!(bnad->cfg_flags & BNAD_CF_DIM_ENABLED)) {
+                        bnad->cfg_flags |= BNAD_CF_DIM_ENABLED;
+                        bnad_dim_timer_start(bnad);
+                }
+        } else {
+                if (bnad->cfg_flags & BNAD_CF_DIM_ENABLED) {
+                        bnad->cfg_flags &= ~BNAD_CF_DIM_ENABLED;
+                        dim_timer_del = bnad_dim_timer_running(bnad);
+                        if (dim_timer_del) {
+                                clear_bit(BNAD_RF_DIM_TIMER_RUNNING,
+                                                        &bnad->run_flags);
+                                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+                                del_timer_sync(&bnad->dim_timer);
+                                spin_lock_irqsave(&bnad->bna_lock, flags);
+                        }
+                        bnad_rx_coalescing_timeo_set(bnad);
+                }
+        }
+        if (bnad->tx_coalescing_timeo != coalesce->tx_coalesce_usecs /
+                                        BFI_COALESCING_TIMER_UNIT) {
+                bnad->tx_coalescing_timeo = coalesce->tx_coalesce_usecs /
+                                                BFI_COALESCING_TIMER_UNIT;
+                bnad_tx_coalescing_timeo_set(bnad);
+        }
+
+        if (bnad->rx_coalescing_timeo != coalesce->rx_coalesce_usecs /
+                                        BFI_COALESCING_TIMER_UNIT) {
+                bnad->rx_coalescing_timeo = coalesce->rx_coalesce_usecs /
+                                                BFI_COALESCING_TIMER_UNIT;
+
+                if (!(bnad->cfg_flags & BNAD_CF_DIM_ENABLED))
+                        bnad_rx_coalescing_timeo_set(bnad);
+
+        }
+
+        /* Add Tx Inter-pkt DMA count?  */
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+        return 0;
+}
+
+static void
+bnad_get_ringparam(struct net_device *netdev,
+                   struct ethtool_ringparam *ringparam)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        ringparam->rx_max_pending = BNAD_MAX_Q_DEPTH / bnad_rxqs_per_cq;
+        ringparam->rx_mini_max_pending = 0;
+        ringparam->rx_jumbo_max_pending = 0;
+        ringparam->tx_max_pending = BNAD_MAX_Q_DEPTH;
+
+        ringparam->rx_pending = bnad->rxq_depth;
+        ringparam->rx_mini_max_pending = 0;
+        ringparam->rx_jumbo_max_pending = 0;
+        ringparam->tx_pending = bnad->txq_depth;
+}
+
+static int
+bnad_set_ringparam(struct net_device *netdev,
+                   struct ethtool_ringparam *ringparam)
+{
+        int i, current_err, err = 0;
+        struct bnad *bnad = netdev_priv(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        if (ringparam->rx_pending == bnad->rxq_depth &&
+            ringparam->tx_pending == bnad->txq_depth) {
+                mutex_unlock(&bnad->conf_mutex);
+                return 0;
+        }
+
+        if (ringparam->rx_pending < BNAD_MIN_Q_DEPTH ||
+            ringparam->rx_pending > BNAD_MAX_Q_DEPTH / bnad_rxqs_per_cq ||
+            !BNA_POWER_OF_2(ringparam->rx_pending)) {
+                mutex_unlock(&bnad->conf_mutex);
+                return -EINVAL;
+        }
+        if (ringparam->tx_pending < BNAD_MIN_Q_DEPTH ||
+            ringparam->tx_pending > BNAD_MAX_Q_DEPTH ||
+            !BNA_POWER_OF_2(ringparam->tx_pending)) {
+                mutex_unlock(&bnad->conf_mutex);
+                return -EINVAL;
+        }
+
+        if (ringparam->rx_pending != bnad->rxq_depth) {
+                bnad->rxq_depth = ringparam->rx_pending;
+                for (i = 0; i < bnad->num_rx; i++) {
+                        if (!bnad->rx_info[i].rx)
+                                continue;
+                        bnad_cleanup_rx(bnad, i);
+                        current_err = bnad_setup_rx(bnad, i);
+                        if (current_err && !err)
+                                err = current_err;
+                }
+        }
+        if (ringparam->tx_pending != bnad->txq_depth) {
+                bnad->txq_depth = ringparam->tx_pending;
+                for (i = 0; i < bnad->num_tx; i++) {
+                        if (!bnad->tx_info[i].tx)
+                                continue;
+                        bnad_cleanup_tx(bnad, i);
+                        current_err = bnad_setup_tx(bnad, i);
+                        if (current_err && !err)
+                                err = current_err;
+                }
+        }
+
+        mutex_unlock(&bnad->conf_mutex);
+        return err;
+}
+
+static void
+bnad_get_pauseparam(struct net_device *netdev,
+                    struct ethtool_pauseparam *pauseparam)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        pauseparam->autoneg = 0;
+        pauseparam->rx_pause = bnad->bna.port.pause_config.rx_pause;
+        pauseparam->tx_pause = bnad->bna.port.pause_config.tx_pause;
+}
+
+static int
+bnad_set_pauseparam(struct net_device *netdev,
+                    struct ethtool_pauseparam *pauseparam)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        struct bna_pause_config pause_config;
+        unsigned long flags;
+
+        if (pauseparam->autoneg == AUTONEG_ENABLE)
+                return -EINVAL;
+
+        mutex_lock(&bnad->conf_mutex);
+        if (pauseparam->rx_pause != bnad->bna.port.pause_config.rx_pause ||
+            pauseparam->tx_pause != bnad->bna.port.pause_config.tx_pause) {
+                pause_config.rx_pause = pauseparam->rx_pause;
+                pause_config.tx_pause = pauseparam->tx_pause;
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+                bna_port_pause_config(&bnad->bna.port, &pause_config, NULL);
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        }
+        mutex_unlock(&bnad->conf_mutex);
+        return 0;
+}
+
+static u32
+bnad_get_rx_csum(struct net_device *netdev)
+{
+        u32 rx_csum;
+        struct bnad *bnad = netdev_priv(netdev);
+
+        rx_csum = bnad->rx_csum;
+        return rx_csum;
+}
+
+static int
+bnad_set_rx_csum(struct net_device *netdev, u32 rx_csum)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        bnad->rx_csum = rx_csum;
+        mutex_unlock(&bnad->conf_mutex);
+        return 0;
+}
+
+static int
+bnad_set_tx_csum(struct net_device *netdev, u32 tx_csum)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        if (tx_csum) {
+                netdev->features |= NETIF_F_IP_CSUM;
+                netdev->features |= NETIF_F_IPV6_CSUM;
+        } else {
+                netdev->features &= ~NETIF_F_IP_CSUM;
+                netdev->features &= ~NETIF_F_IPV6_CSUM;
+        }
+        mutex_unlock(&bnad->conf_mutex);
+        return 0;
+}
+
+static int
+bnad_set_tso(struct net_device *netdev, u32 tso)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+
+        mutex_lock(&bnad->conf_mutex);
+        if (tso) {
+                netdev->features |= NETIF_F_TSO;
+                netdev->features |= NETIF_F_TSO6;
+        } else {
+                netdev->features &= ~NETIF_F_TSO;
+                netdev->features &= ~NETIF_F_TSO6;
+        }
+        mutex_unlock(&bnad->conf_mutex);
+        return 0;
+}
+
+static void
+bnad_get_strings(struct net_device *netdev, u32 stringset, u8 * string)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        int i, j, q_num;
+        u64 bmap;
+
+        mutex_lock(&bnad->conf_mutex);
+
+        switch (stringset) {
+        case ETH_SS_STATS:
+                for (i = 0; i < BNAD_ETHTOOL_STATS_NUM; i++) {
+                        BUG_ON(!(strlen(bnad_net_stats_strings[i]) <
+                                   ETH_GSTRING_LEN));
+                        memcpy(string, bnad_net_stats_strings[i],
+                               ETH_GSTRING_LEN);
+                        string += ETH_GSTRING_LEN;
+                }
+                bmap = (u64)bnad->bna.tx_mod.txf_bmap[0] |
+                        ((u64)bnad->bna.tx_mod.txf_bmap[1] << 32);
+                for (i = 0; bmap && (i < BFI_LL_TXF_ID_MAX); i++) {
+                        if (bmap & 1) {
+                                sprintf(string, "txf%d_ucast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_ucast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_ucast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_mcast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_mcast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_mcast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_bcast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_bcast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_bcast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_errors", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_filter_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txf%d_filter_mac_sa", i);
+                                string += ETH_GSTRING_LEN;
+                        }
+                        bmap >>= 1;
+                }
+
+                bmap = (u64)bnad->bna.rx_mod.rxf_bmap[0] |
+                        ((u64)bnad->bna.rx_mod.rxf_bmap[1] << 32);
+                for (i = 0; bmap && (i < BFI_LL_RXF_ID_MAX); i++) {
+                        if (bmap & 1) {
+                                sprintf(string, "rxf%d_ucast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_ucast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_ucast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_mcast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_mcast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_mcast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_bcast_octets", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_bcast", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_bcast_vlan", i);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxf%d_frame_drops", i);
+                                string += ETH_GSTRING_LEN;
+                        }
+                        bmap >>= 1;
+                }
+
+                q_num = 0;
+                for (i = 0; i < bnad->num_rx; i++) {
+                        if (!bnad->rx_info[i].rx)
+                                continue;
+                        for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                                sprintf(string, "cq%d_producer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "cq%d_consumer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "cq%d_hw_producer_index",
+                                        q_num);
+                                string += ETH_GSTRING_LEN;
+                                q_num++;
+                        }
+                }
+
+                q_num = 0;
+                for (i = 0; i < bnad->num_rx; i++) {
+                        if (!bnad->rx_info[i].rx)
+                                continue;
+                        for (j = 0; j < bnad->num_rxp_per_rx; j++) {
+                                sprintf(string, "rxq%d_packets", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_bytes", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_packets_with_error",
+                                                                q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_allocbuf_failed", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_producer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_consumer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                q_num++;
+                                if (bnad->rx_info[i].rx_ctrl[j].ccb &&
+                                        bnad->rx_info[i].rx_ctrl[j].ccb->
+                                        rcb[1] &&
+                                        bnad->rx_info[i].rx_ctrl[j].ccb->
+                                        rcb[1]->rxq) {
+                                        sprintf(string, "rxq%d_packets", q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_bytes", q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        sprintf(string,
+                                        "rxq%d_packets_with_error", q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_allocbuf_failed",
+                                                                q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_producer_index",
+                                                                q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_consumer_index",
+                                                                q_num);
+                                        string += ETH_GSTRING_LEN;
+                                        q_num++;
+                                }
+                        }
+                }
+
+                q_num = 0;
+                for (i = 0; i < bnad->num_tx; i++) {
+                        if (!bnad->tx_info[i].tx)
+                                continue;
+                        for (j = 0; j < bnad->num_txq_per_tx; j++) {
+                                sprintf(string, "txq%d_packets", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txq%d_bytes", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txq%d_producer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txq%d_consumer_index", q_num);
+                                string += ETH_GSTRING_LEN;
+                                sprintf(string, "txq%d_hw_consumer_index",
+                                                                        q_num);
+                                string += ETH_GSTRING_LEN;
+                                q_num++;
+                        }
+                }
+
+                break;
+
+        default:
+                break;
+        }
+
+        mutex_unlock(&bnad->conf_mutex);
+}
+
+static int
+bnad_get_stats_count_locked(struct net_device *netdev)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        int i, j, count, rxf_active_num = 0, txf_active_num = 0;
+        u64 bmap;
+
+        bmap = (u64)bnad->bna.tx_mod.txf_bmap[0] |
+                        ((u64)bnad->bna.tx_mod.txf_bmap[1] << 32);
+        for (i = 0; bmap && (i < BFI_LL_TXF_ID_MAX); i++) {
+                if (bmap & 1)
+                        txf_active_num++;
+                bmap >>= 1;
+        }
+        bmap = (u64)bnad->bna.rx_mod.rxf_bmap[0] |
+                        ((u64)bnad->bna.rx_mod.rxf_bmap[1] << 32);
+        for (i = 0; bmap && (i < BFI_LL_RXF_ID_MAX); i++) {
+                if (bmap & 1)
+                        rxf_active_num++;
+                bmap >>= 1;
+        }
+        count = BNAD_ETHTOOL_STATS_NUM +
+                txf_active_num * BNAD_NUM_TXF_COUNTERS +
+                rxf_active_num * BNAD_NUM_RXF_COUNTERS;
+
+        for (i = 0; i < bnad->num_rx; i++) {
+                if (!bnad->rx_info[i].rx)
+                        continue;
+                count += bnad->num_rxp_per_rx * BNAD_NUM_CQ_COUNTERS;
+                count += bnad->num_rxp_per_rx * BNAD_NUM_RXQ_COUNTERS;
+                for (j = 0; j < bnad->num_rxp_per_rx; j++)
+                        if (bnad->rx_info[i].rx_ctrl[j].ccb &&
+                                bnad->rx_info[i].rx_ctrl[j].ccb->rcb[1] &&
+                                bnad->rx_info[i].rx_ctrl[j].ccb->rcb[1]->rxq)
+                                count +=  BNAD_NUM_RXQ_COUNTERS;
+        }
+
+        for (i = 0; i < bnad->num_tx; i++) {
+                if (!bnad->tx_info[i].tx)
+                        continue;
+                count += bnad->num_txq_per_tx * BNAD_NUM_TXQ_COUNTERS;
+        }
+        return count;
+}
+
+static int
+bnad_per_q_stats_fill(struct bnad *bnad, u64 *buf, int bi)
+{
+        int i, j;
+        struct bna_rcb *rcb = NULL;
+        struct bna_tcb *tcb = NULL;
+
+        for (i = 0; i < bnad->num_rx; i++) {
+                if (!bnad->rx_info[i].rx)
+                        continue;
+                for (j = 0; j < bnad->num_rxp_per_rx; j++)
+                        if (bnad->rx_info[i].rx_ctrl[j].ccb &&
+                                bnad->rx_info[i].rx_ctrl[j].ccb->rcb[0] &&
+                                bnad->rx_info[i].rx_ctrl[j].ccb->rcb[0]->rxq) {
+                                buf[bi++] = bnad->rx_info[i].rx_ctrl[j].
+                                                ccb->producer_index;
+                                buf[bi++] = 0; /* ccb->consumer_index */
+                                buf[bi++] = *(bnad->rx_info[i].rx_ctrl[j].
+                                                ccb->hw_producer_index);
+                        }
+        }
+        for (i = 0; i < bnad->num_rx; i++) {
+                if (!bnad->rx_info[i].rx)
+                        continue;
+                for (j = 0; j < bnad->num_rxp_per_rx; j++)
+                        if (bnad->rx_info[i].rx_ctrl[j].ccb) {
+                                if (bnad->rx_info[i].rx_ctrl[j].ccb->rcb[0] &&
+                                        bnad->rx_info[i].rx_ctrl[j].ccb->
+                                        rcb[0]->rxq) {
+                                        rcb = bnad->rx_info[i].rx_ctrl[j].
+                                                        ccb->rcb[0];
+                                        buf[bi++] = rcb->rxq->rx_packets;
+                                        buf[bi++] = rcb->rxq->rx_bytes;
+                                        buf[bi++] = rcb->rxq->
+                                                        rx_packets_with_error;
+                                        buf[bi++] = rcb->rxq->
+                                                        rxbuf_alloc_failed;
+                                        buf[bi++] = rcb->producer_index;
+                                        buf[bi++] = rcb->consumer_index;
+                                }
+                                if (bnad->rx_info[i].rx_ctrl[j].ccb->rcb[1] &&
+                                        bnad->rx_info[i].rx_ctrl[j].ccb->
+                                        rcb[1]->rxq) {
+                                        rcb = bnad->rx_info[i].rx_ctrl[j].
+                                                                ccb->rcb[1];
+                                        buf[bi++] = rcb->rxq->rx_packets;
+                                        buf[bi++] = rcb->rxq->rx_bytes;
+                                        buf[bi++] = rcb->rxq->
+                                                        rx_packets_with_error;
+                                        buf[bi++] = rcb->rxq->
+                                                        rxbuf_alloc_failed;
+                                        buf[bi++] = rcb->producer_index;
+                                        buf[bi++] = rcb->consumer_index;
+                                }
+                        }
+        }
+
+        for (i = 0; i < bnad->num_tx; i++) {
+                if (!bnad->tx_info[i].tx)
+                        continue;
+                for (j = 0; j < bnad->num_txq_per_tx; j++)
+                        if (bnad->tx_info[i].tcb[j] &&
+                                bnad->tx_info[i].tcb[j]->txq) {
+                                tcb = bnad->tx_info[i].tcb[j];
+                                buf[bi++] = tcb->txq->tx_packets;
+                                buf[bi++] = tcb->txq->tx_bytes;
+                                buf[bi++] = tcb->producer_index;
+                                buf[bi++] = tcb->consumer_index;
+                                buf[bi++] = *(tcb->hw_consumer_index);
+                        }
+        }
+
+        return bi;
+}
+
+static void
+bnad_get_ethtool_stats(struct net_device *netdev, struct ethtool_stats *stats,
+                       u64 *buf)
+{
+        struct bnad *bnad = netdev_priv(netdev);
+        int i, j, bi;
+        unsigned long flags;
+        struct rtnl_link_stats64 *net_stats64;
+        u64 *stats64;
+        u64 bmap;
+
+        mutex_lock(&bnad->conf_mutex);
+        if (bnad_get_stats_count_locked(netdev) != stats->n_stats) {
+                mutex_unlock(&bnad->conf_mutex);
+                return;
+        }
+
+        /*
+         * Used bna_lock to sync reads from bna_stats, which is written
+         * under the same lock
+         */
+        spin_lock_irqsave(&bnad->bna_lock, flags);
+        bi = 0;
+        memset(buf, 0, stats->n_stats * sizeof(u64));
+
+        net_stats64 = (struct rtnl_link_stats64 *)buf;
+        bnad_netdev_qstats_fill(bnad, net_stats64);
+        bnad_netdev_hwstats_fill(bnad, net_stats64);
+
+        bi = sizeof(*net_stats64) / sizeof(u64);
+
+        /* Fill driver stats into ethtool buffers */
+        stats64 = (u64 *)&bnad->stats.drv_stats;
+        for (i = 0; i < sizeof(struct bnad_drv_stats) / sizeof(u64); i++)
+                buf[bi++] = stats64[i];
+
+        /* Fill hardware stats excluding the rxf/txf into ethtool bufs */
+        stats64 = (u64 *) bnad->stats.bna_stats->hw_stats;
+        for (i = 0;
+             i < offsetof(struct bfi_ll_stats, rxf_stats[0]) / sizeof(u64);
+             i++)
+                buf[bi++] = stats64[i];
+
+        /* Fill txf stats into ethtool buffers */
+        bmap = (u64)bnad->bna.tx_mod.txf_bmap[0] |
+                        ((u64)bnad->bna.tx_mod.txf_bmap[1] << 32);
+        for (i = 0; bmap && (i < BFI_LL_TXF_ID_MAX); i++) {
+                if (bmap & 1) {
+                        stats64 = (u64 *)&bnad->stats.bna_stats->
+                                                hw_stats->txf_stats[i];
+                        for (j = 0; j < sizeof(struct bfi_ll_stats_txf) /
+                                        sizeof(u64); j++)
+                                buf[bi++] = stats64[j];
+                }
+                bmap >>= 1;
+        }
+
+        /*  Fill rxf stats into ethtool buffers */
+        bmap = (u64)bnad->bna.rx_mod.rxf_bmap[0] |
+                        ((u64)bnad->bna.rx_mod.rxf_bmap[1] << 32);
+        for (i = 0; bmap && (i < BFI_LL_RXF_ID_MAX); i++) {
+                if (bmap & 1) {
+                        stats64 = (u64 *)&bnad->stats.bna_stats->
+                                                hw_stats->rxf_stats[i];
+                        for (j = 0; j < sizeof(struct bfi_ll_stats_rxf) /
+                                        sizeof(u64); j++)
+                                buf[bi++] = stats64[j];
+                }
+                bmap >>= 1;
+        }
+
+        /* Fill per Q stats into ethtool buffers */
+        bi = bnad_per_q_stats_fill(bnad, buf, bi);
+
+        spin_unlock_irqrestore(&bnad->bna_lock, flags);
+
+        mutex_unlock(&bnad->conf_mutex);
+}
+
+static int
+bnad_get_sset_count(struct net_device *netdev, int sset)
+{
+        switch (sset) {
+        case ETH_SS_STATS:
+                return bnad_get_stats_count_locked(netdev);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static struct ethtool_ops bnad_ethtool_ops = {
+        .get_settings = bnad_get_settings,
+        .set_settings = bnad_set_settings,
+        .get_drvinfo = bnad_get_drvinfo,
+        .get_regs_len = bnad_get_regs_len,
+        .get_regs = bnad_get_regs,
+        .get_wol = bnad_get_wol,
+        .get_link = ethtool_op_get_link,
+        .get_coalesce = bnad_get_coalesce,
+        .set_coalesce = bnad_set_coalesce,
+        .get_ringparam = bnad_get_ringparam,
+        .set_ringparam = bnad_set_ringparam,
+        .get_pauseparam = bnad_get_pauseparam,
+        .set_pauseparam = bnad_set_pauseparam,
+        .get_rx_csum = bnad_get_rx_csum,
+        .set_rx_csum = bnad_set_rx_csum,
+        .get_tx_csum = ethtool_op_get_tx_csum,
+        .set_tx_csum = bnad_set_tx_csum,
+        .get_sg = ethtool_op_get_sg,
+        .set_sg = ethtool_op_set_sg,
+        .get_tso = ethtool_op_get_tso,
+        .set_tso = bnad_set_tso,
+        .get_strings = bnad_get_strings,
+        .get_ethtool_stats = bnad_get_ethtool_stats,
+        .get_sset_count = bnad_get_sset_count
+};
+
+void
+bnad_set_ethtool_ops(struct net_device *netdev)
+{
+        SET_ETHTOOL_OPS(netdev, &bnad_ethtool_ops);
+}
diff --git a/drivers/net/bna/cna.h b/drivers/net/bna/cna.h
new file mode 100644
index 000000000000..bbd39dc65972
--- /dev/null
+++ b/drivers/net/bna/cna.h
@@ -0,0 +1,81 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2006-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+
+#ifndef __CNA_H__
+#define __CNA_H__
+
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/bitops.h>
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/if_ether.h>
+#include <asm/page.h>
+#include <asm/io.h>
+#include <asm/string.h>
+
+#include <linux/list.h>
+
+#define bfa_sm_fault(__mod, __event)    do {                            \
+        pr_err("SM Assertion failure: %s: %d: event = %d", __FILE__, __LINE__, \
+                __event); \
+} while (0)
+
+extern char bfa_version[];
+
+#define CNA_FW_FILE_CT  "ctfw_cna.bin"
+#define FC_SYMNAME_MAX  256     /*!< max name server symbolic name size */
+
+#pragma pack(1)
+
+#define MAC_ADDRLEN     (6)
+typedef struct mac { u8 mac[MAC_ADDRLEN]; } mac_t;
+
+#pragma pack()
+
+#define bfa_q_first(_q) ((void *)(((struct list_head *) (_q))->next))
+#define bfa_q_next(_qe) (((struct list_head *) (_qe))->next)
+#define bfa_q_prev(_qe) (((struct list_head *) (_qe))->prev)
+
+/*
+ * bfa_q_qe_init - to initialize a queue element
+ */
+#define bfa_q_qe_init(_qe) {                                            \
+        bfa_q_next(_qe) = (struct list_head *) NULL;                    \
+        bfa_q_prev(_qe) = (struct list_head *) NULL;                    \
+}
+
+/*
+ * bfa_q_deq - dequeue an element from head of the queue
+ */
+#define bfa_q_deq(_q, _qe) {                                            \
+        if (!list_empty(_q)) {                                          \
+                (*((struct list_head **) (_qe))) = bfa_q_next(_q);      \
+                bfa_q_prev(bfa_q_next(*((struct list_head **) _qe))) =  \
+                                                (struct list_head *) (_q); \
+                bfa_q_next(_q) = bfa_q_next(*((struct list_head **) _qe)); \
+                bfa_q_qe_init(*((struct list_head **) _qe));            \
+        } else {                                                        \
+                *((struct list_head **) (_qe)) = (struct list_head *) NULL; \
+        }                                                               \
+}
+
+#endif /* __CNA_H__ */
diff --git a/drivers/net/bna/cna_fwimg.c b/drivers/net/bna/cna_fwimg.c
new file mode 100644
index 000000000000..0bd1d3790a27
--- /dev/null
+++ b/drivers/net/bna/cna_fwimg.c
@@ -0,0 +1,64 @@
+/*
+ * Linux network driver for Brocade Converged Network Adapter.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License (GPL) Version 2 as
+ * published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+/*
+ * Copyright (c) 2005-2010 Brocade Communications Systems, Inc.
+ * All rights reserved
+ * www.brocade.com
+ */
+#include <linux/firmware.h>
+#include "cna.h"
+
+const struct firmware *bfi_fw;
+static u32 *bfi_image_ct_cna;
+static u32 bfi_image_ct_cna_size;
+
+u32 *
+cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
+                        u32 *bfi_image_size, char *fw_name)
+{
+        const struct firmware *fw;
+
+        if (request_firmware(&fw, fw_name, &pdev->dev)) {
+                pr_alert("Can't locate firmware %s\n", fw_name);
+                goto error;
+        }
+
+        *bfi_image = (u32 *)fw->data;
+        *bfi_image_size = fw->size/sizeof(u32);
+        bfi_fw = fw;
+
+        return *bfi_image;
+error:
+        return NULL;
+}
+
+u32 *
+cna_get_firmware_buf(struct pci_dev *pdev)
+{
+        if (bfi_image_ct_cna_size == 0)
+                cna_read_firmware(pdev, &bfi_image_ct_cna,
+                        &bfi_image_ct_cna_size, CNA_FW_FILE_CT);
+        return bfi_image_ct_cna;
+}
+
+u32 *
+bfa_cb_image_get_chunk(int type, u32 off)
+{
+        return (u32 *)(bfi_image_ct_cna + off);
+}
+
+u32
+bfa_cb_image_get_size(int type)
+{
+        return bfi_image_ct_cna_size;
+}
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index e6a803f1c507..3d1a5da98622 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -49,6 +49,7 @@
 #include <linux/cache.h>
 #include <linux/firmware.h>
 #include <linux/log2.h>
+#include <linux/aer.h>
 
 #if defined(CONFIG_CNIC) || defined(CONFIG_CNIC_MODULE)
 #define BCM_CNIC 1
@@ -265,7 +266,7 @@ static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
                 if (diff == TX_DESC_CNT)
                         diff = MAX_TX_DESC_CNT;
         }
-        return (bp->tx_ring_size - diff);
+        return bp->tx_ring_size - diff;
 }
 
 static u32
@@ -298,7 +299,7 @@ bnx2_shmem_wr(struct bnx2 *bp, u32 offset, u32 val)
 static u32
 bnx2_shmem_rd(struct bnx2 *bp, u32 offset)
 {
-        return (bnx2_reg_rd_ind(bp, bp->shmem_base + offset));
+        return bnx2_reg_rd_ind(bp, bp->shmem_base + offset);
 }
 
 static void
@@ -976,9 +977,9 @@ bnx2_report_fw_link(struct bnx2 *bp)
 static char *
 bnx2_xceiver_str(struct bnx2 *bp)
 {
-        return ((bp->phy_port == PORT_FIBRE) ? "SerDes" :
+        return (bp->phy_port == PORT_FIBRE) ? "SerDes" :
                 ((bp->phy_flags & BNX2_PHY_FLAG_SERDES) ? "Remote Copper" :
-                 "Copper"));
+                 "Copper");
 }
 
 static void
@@ -1757,7 +1758,7 @@ __acquires(&bp->phy_lock)
         u32 new_adv = 0;
 
         if (bp->phy_flags & BNX2_PHY_FLAG_REMOTE_PHY_CAP)
-                return (bnx2_setup_remote_phy(bp, port));
+                return bnx2_setup_remote_phy(bp, port);
 
         if (!(bp->autoneg & AUTONEG_SPEED)) {
                 u32 new_bmcr;
@@ -2170,10 +2171,10 @@ __acquires(&bp->phy_lock)
                 return 0;
 
         if (bp->phy_flags & BNX2_PHY_FLAG_SERDES) {
-                return (bnx2_setup_serdes_phy(bp, port));
+                return bnx2_setup_serdes_phy(bp, port);
         }
         else {
-                return (bnx2_setup_copper_phy(bp));
+                return bnx2_setup_copper_phy(bp);
         }
 }
 
@@ -3217,7 +3218,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
 
                 }
 
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 if (bp->rx_csum &&
                         (status & (L2_FHDR_STATUS_TCP_SEGMENT |
                         L2_FHDR_STATUS_UDP_DATAGRAM))) {
@@ -7581,9 +7582,9 @@ bnx2_set_tx_csum(struct net_device *dev, u32 data)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (CHIP_NUM(bp) == CHIP_NUM_5709)
-                return (ethtool_op_set_tx_ipv6_csum(dev, data));
+                return ethtool_op_set_tx_ipv6_csum(dev, data);
         else
-                return (ethtool_op_set_tx_csum(dev, data));
+                return ethtool_op_set_tx_csum(dev, data);
 }
 
 static int
@@ -7704,7 +7705,7 @@ bnx2_change_mtu(struct net_device *dev, int new_mtu)
                 return -EINVAL;
 
         dev->mtu = new_mtu;
-        return (bnx2_change_ring_size(bp, bp->rx_ring_size, bp->tx_ring_size));
+        return bnx2_change_ring_size(bp, bp->rx_ring_size, bp->tx_ring_size);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -7890,6 +7891,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         int rc, i, j;
         u32 reg;
         u64 dma_mask, persist_dma_mask;
+        int err;
 
         SET_NETDEV_DEV(dev, &pdev->dev);
         bp = netdev_priv(dev);
@@ -7925,6 +7927,14 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 goto err_out_disable;
         }
 
+        /* AER (Advanced Error Reporting) hooks */
+        err = pci_enable_pcie_error_reporting(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+                                    "0x%x\n", err);
+                /* non-fatal, continue */
+        }
+
         pci_set_master(pdev);
         pci_save_state(pdev);
 
@@ -8246,6 +8256,7 @@ err_out_unmap:
         }
 
 err_out_release:
+        pci_disable_pcie_error_reporting(pdev);
         pci_release_regions(pdev);
 
 err_out_disable:
@@ -8436,6 +8447,9 @@ bnx2_remove_one(struct pci_dev *pdev)
         kfree(bp->temp_stats_blk);
 
         free_netdev(dev);
+
+        pci_disable_pcie_error_reporting(pdev);
+
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
@@ -8527,25 +8541,35 @@ static pci_ers_result_t bnx2_io_slot_reset(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct bnx2 *bp = netdev_priv(dev);
+        pci_ers_result_t result;
+        int err;
 
         rtnl_lock();
         if (pci_enable_device(pdev)) {
                 dev_err(&pdev->dev,
                         "Cannot re-enable PCI device after reset\n");
-                rtnl_unlock();
-                return PCI_ERS_RESULT_DISCONNECT;
+                result = PCI_ERS_RESULT_DISCONNECT;
+        } else {
+                pci_set_master(pdev);
+                pci_restore_state(pdev);
+                pci_save_state(pdev);
+
+                if (netif_running(dev)) {
+                        bnx2_set_power_state(bp, PCI_D0);
+                        bnx2_init_nic(bp, 1);
+                }
+                result = PCI_ERS_RESULT_RECOVERED;
         }
-        pci_set_master(pdev);
-        pci_restore_state(pdev);
-        pci_save_state(pdev);
+        rtnl_unlock();
 
-        if (netif_running(dev)) {
-                bnx2_set_power_state(bp, PCI_D0);
-                bnx2_init_nic(bp, 1);
+        err = pci_cleanup_aer_uncorrect_error_status(pdev);
+        if (err) {
+                dev_err(&pdev->dev,
+                        "pci_cleanup_aer_uncorrect_error_status failed 0x%0x\n",
+                         err); /* non-fatal, continue */
         }
 
-        rtnl_unlock();
-        return PCI_ERS_RESULT_RECOVERED;
+        return result;
 }
 
 /**
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 0c2d96ed561c..64329c5fbdea 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -20,8 +20,8 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.52.53-4"
-#define DRV_MODULE_RELDATE      "2010/16/08"
+#define DRV_MODULE_VERSION      "1.52.53-7"
+#define DRV_MODULE_RELDATE      "2010/09/12"
 #define BNX2X_BC_VER            0x040200
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
@@ -369,6 +369,7 @@ struct bnx2x_fastpath {
 #define NUM_RX_BD                       (RX_DESC_CNT * NUM_RX_RINGS)
 #define MAX_RX_BD                       (NUM_RX_BD - 1)
 #define MAX_RX_AVAIL                    (MAX_RX_DESC_CNT * NUM_RX_RINGS - 2)
+#define MIN_RX_AVAIL                    128
 #define NEXT_RX_IDX(x)          ((((x) & RX_DESC_MASK) == \
                                   (MAX_RX_DESC_CNT - 1)) ? (x) + 3 : (x) + 1)
 #define RX_BD(x)                        ((x) & MAX_RX_BD)
@@ -566,13 +567,13 @@ struct bnx2x_common {
 struct bnx2x_port {
         u32                     pmf;
 
-        u32                     link_config;
+        u32                     link_config[LINK_CONFIG_SIZE];
 
-        u32                     supported;
+        u32                     supported[LINK_CONFIG_SIZE];
 /* link settings - missing defines */
 #define SUPPORTED_2500baseX_Full        (1 << 15)
 
-        u32                     advertising;
+        u32                     advertising[LINK_CONFIG_SIZE];
 /* link settings - missing defines */
 #define ADVERTISED_2500baseX_Full       (1 << 15)
 
@@ -931,7 +932,7 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
 int bnx2x_get_gpio(struct bnx2x *bp, int gpio_num, u8 port);
 int bnx2x_set_gpio(struct bnx2x *bp, int gpio_num, u32 mode, u8 port);
 int bnx2x_set_gpio_int(struct bnx2x *bp, int gpio_num, u32 mode, u8 port);
-u32 bnx2x_fw_command(struct bnx2x *bp, u32 command);
+u32 bnx2x_fw_command(struct bnx2x *bp, u32 command, u32 param);
 void bnx2x_reg_wr_ind(struct bnx2x *bp, u32 addr, u32 val);
 void bnx2x_write_dmae_phys_len(struct bnx2x *bp, dma_addr_t phys_addr,
                                u32 addr, u32 len);
@@ -939,7 +940,7 @@ void bnx2x_calc_fc_adv(struct bnx2x *bp);
 int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
                   u32 data_hi, u32 data_lo, int common);
 void bnx2x_update_coalesce(struct bnx2x *bp);
-
+int bnx2x_get_link_cfg_idx(struct bnx2x *bp);
 static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
                            int wait)
 {
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 02bf710629a3..efc7be4aefb5 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -20,6 +20,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <linux/firmware.h>
 #include "bnx2x_cmn.h"
 
 #ifdef BCM_VLAN
@@ -622,7 +623,7 @@ reuse_rx:
                         /* Set Toeplitz hash for a none-LRO skb */
                         bnx2x_set_skb_rxhash(bp, cqe, skb);
 
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
                         if (bp->rx_csum) {
                                 if (likely(BNX2X_RX_CSUM_OK(cqe)))
                                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -780,6 +781,10 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                                               ETH_MAX_AGGREGATION_QUEUES_E1H;
         u16 ring_prod, cqe_ring_prod;
         int i, j;
+        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
+                                              MAX_RX_AVAIL/bp->num_queues;
+
+        rx_ring_size = max_t(int, MIN_RX_AVAIL, rx_ring_size);
 
         bp->rx_buf_size = bp->dev->mtu + ETH_OVREHEAD + BNX2X_RX_ALIGN;
         DP(NETIF_MSG_IFUP,
@@ -882,7 +887,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                 /* Allocate BDs and initialize BD ring */
                 fp->rx_comp_cons = 0;
                 cqe_ring_prod = ring_prod = 0;
-                for (i = 0; i < bp->rx_ring_size; i++) {
+                for (i = 0; i < rx_ring_size; i++) {
                         if (bnx2x_alloc_rx_skb(bp, fp, ring_prod) < 0) {
                                 BNX2X_ERR("was only able to allocate "
                                           "%d rx skbs on queue[%d]\n", i, j);
@@ -1206,12 +1211,27 @@ static int bnx2x_set_num_queues(struct bnx2x *bp)
         return rc;
 }
 
+static void bnx2x_release_firmware(struct bnx2x *bp)
+{
+        kfree(bp->init_ops_offsets);
+        kfree(bp->init_ops);
+        kfree(bp->init_data);
+        release_firmware(bp->firmware);
+}
+
 /* must be called with rtnl_lock */
 int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 {
         u32 load_code;
         int i, rc;
 
+        /* Set init arrays */
+        rc = bnx2x_init_firmware(bp);
+        if (rc) {
+                BNX2X_ERR("Error loading firmware\n");
+                return rc;
+        }
+
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
                 return -EPERM;
@@ -1267,7 +1287,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
            common blocks should be initialized, otherwise - not
         */
         if (!BP_NOMCP(bp)) {
-                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ, 0);
                 if (!load_code) {
                         BNX2X_ERR("MCP response failure, aborting\n");
                         rc = -EBUSY;
@@ -1306,9 +1326,9 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         rc = bnx2x_init_hw(bp, load_code);
         if (rc) {
                 BNX2X_ERR("HW init failed, aborting\n");
-                bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE, 0);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP, 0);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
                 goto load_error2;
         }
 
@@ -1323,7 +1343,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         /* Send LOAD_DONE command to MCP */
         if (!BP_NOMCP(bp)) {
-                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE);
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE, 0);
                 if (!load_code) {
                         BNX2X_ERR("MCP response failure, aborting\n");
                         rc = -EBUSY;
@@ -1427,6 +1447,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 #endif
         bnx2x_inc_load_cnt(bp);
 
+        bnx2x_release_firmware(bp);
+
         return 0;
 
 #ifdef BCM_CNIC
@@ -1437,8 +1459,8 @@ load_error4:
 load_error3:
         bnx2x_int_disable_sync(bp, 1);
         if (!BP_NOMCP(bp)) {
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP, 0);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
         }
         bp->port.pmf = 0;
         /* Free SKBs, SGEs, TPA pool and driver internals */
@@ -1454,6 +1476,8 @@ load_error1:
                 netif_napi_del(&bnx2x_fp(bp, i, napi));
         bnx2x_free_mem(bp);
 
+        bnx2x_release_firmware(bp);
+
         return rc;
 }
 
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index d1979b1a7ed2..1ad08e4e88f4 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -49,10 +49,11 @@ void bnx2x_link_set(struct bnx2x *bp);
  * Query link status
  *
  * @param bp
+ * @param is_serdes
  *
  * @return 0 - link is UP
  */
-u8 bnx2x_link_test(struct bnx2x *bp);
+u8 bnx2x_link_test(struct bnx2x *bp, u8 is_serdes);
 
 /**
  * Handles link status change
@@ -115,6 +116,15 @@ void bnx2x_int_enable(struct bnx2x *bp);
 void bnx2x_int_disable_sync(struct bnx2x *bp, int disable_hw);
 
 /**
+ * Loads device firmware
+ *
+ * @param bp
+ *
+ * @return int
+ */
+int bnx2x_init_firmware(struct bnx2x *bp);
+
+/**
  * Init HW blocks according to current initialization stage:
  * COMMON, PORT or FUNCTION.
  *
@@ -389,7 +399,7 @@ static inline int bnx2x_has_tx_work_unload(struct bnx2x_fastpath *fp)
 {
         /* Tell compiler that consumer and producer can change */
         barrier();
-        return (fp->tx_pkt_prod != fp->tx_pkt_cons);
+        return fp->tx_pkt_prod != fp->tx_pkt_cons;
 }
 
 static inline u16 bnx2x_tx_avail(struct bnx2x_fastpath *fp)
@@ -622,7 +632,7 @@ static inline int bnx2x_has_rx_work(struct bnx2x_fastpath *fp)
         rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
         if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
                 rx_cons_sb++;
-        return (fp->rx_comp_cons != rx_cons_sb);
+        return fp->rx_comp_cons != rx_cons_sb;
 }
 
 /* HW Lock for shared dual port PHYs */
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 8b75b05e34c5..d9748e97fad3 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -29,9 +29,12 @@
 static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct bnx2x *bp = netdev_priv(dev);
-
-        cmd->supported = bp->port.supported;
-        cmd->advertising = bp->port.advertising;
+        int cfg_idx = bnx2x_get_link_cfg_idx(bp);
+        /* Dual Media boards present all available port types */
+        cmd->supported = bp->port.supported[cfg_idx] |
+                (bp->port.supported[cfg_idx ^ 1] &
+                 (SUPPORTED_TP | SUPPORTED_FIBRE));
+        cmd->advertising = bp->port.advertising[cfg_idx];
 
         if ((bp->state == BNX2X_STATE_OPEN) &&
             !(bp->flags & MF_FUNC_DIS) &&
@@ -48,47 +51,21 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 cmd->speed = vn_max_rate;
                 }
         } else {
-                cmd->speed = -1;
-                cmd->duplex = -1;
+                cmd->speed = bp->link_params.req_line_speed[cfg_idx];
+                cmd->duplex = bp->link_params.req_duplex[cfg_idx];
         }
 
-        if (bp->link_params.switch_cfg == SWITCH_CFG_10G) {
-                u32 ext_phy_type =
-                        XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
-
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                        cmd->port = PORT_FIBRE;
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-                        cmd->port = PORT_TP;
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
-                        BNX2X_ERR("XGXS PHY Failure detected 0x%x\n",
-                                  bp->link_params.ext_phy_config);
-                        break;
-
-                default:
-                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
-                           bp->link_params.ext_phy_config);
-                        break;
-                }
-        } else
+        if (bp->port.supported[cfg_idx] & SUPPORTED_TP)
                 cmd->port = PORT_TP;
+        else if (bp->port.supported[cfg_idx] & SUPPORTED_FIBRE)
+                cmd->port = PORT_FIBRE;
+        else
+                BNX2X_ERR("XGXS PHY Failure detected\n");
 
         cmd->phy_address = bp->mdio.prtad;
         cmd->transceiver = XCVR_INTERNAL;
 
-        if (bp->link_params.req_line_speed == SPEED_AUTO_NEG)
+        if (bp->link_params.req_line_speed[cfg_idx] == SPEED_AUTO_NEG)
                 cmd->autoneg = AUTONEG_ENABLE;
         else
                 cmd->autoneg = AUTONEG_DISABLE;
@@ -110,7 +87,7 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct bnx2x *bp = netdev_priv(dev);
-        u32 advertising;
+        u32 advertising, cfg_idx, old_multi_phy_config, new_multi_phy_config;
 
         if (IS_E1HMF(bp))
                 return 0;
@@ -123,26 +100,81 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
            cmd->duplex, cmd->port, cmd->phy_address, cmd->transceiver,
            cmd->autoneg, cmd->maxtxpkt, cmd->maxrxpkt);
 
+        cfg_idx = bnx2x_get_link_cfg_idx(bp);
+        old_multi_phy_config = bp->link_params.multi_phy_config;
+        switch (cmd->port) {
+        case PORT_TP:
+                if (bp->port.supported[cfg_idx] & SUPPORTED_TP)
+                        break; /* no port change */
+
+                if (!(bp->port.supported[0] & SUPPORTED_TP ||
+                      bp->port.supported[1] & SUPPORTED_TP)) {
+                        DP(NETIF_MSG_LINK, "Unsupported port type\n");
+                        return -EINVAL;
+                }
+                bp->link_params.multi_phy_config &=
+                        ~PORT_HW_CFG_PHY_SELECTION_MASK;
+                if (bp->link_params.multi_phy_config &
+                    PORT_HW_CFG_PHY_SWAPPED_ENABLED)
+                        bp->link_params.multi_phy_config |=
+                        PORT_HW_CFG_PHY_SELECTION_SECOND_PHY;
+                else
+                        bp->link_params.multi_phy_config |=
+                        PORT_HW_CFG_PHY_SELECTION_FIRST_PHY;
+                break;
+        case PORT_FIBRE:
+                if (bp->port.supported[cfg_idx] & SUPPORTED_FIBRE)
+                        break; /* no port change */
+
+                if (!(bp->port.supported[0] & SUPPORTED_FIBRE ||
+                      bp->port.supported[1] & SUPPORTED_FIBRE)) {
+                        DP(NETIF_MSG_LINK, "Unsupported port type\n");
+                        return -EINVAL;
+                }
+                bp->link_params.multi_phy_config &=
+                        ~PORT_HW_CFG_PHY_SELECTION_MASK;
+                if (bp->link_params.multi_phy_config &
+                    PORT_HW_CFG_PHY_SWAPPED_ENABLED)
+                        bp->link_params.multi_phy_config |=
+                        PORT_HW_CFG_PHY_SELECTION_FIRST_PHY;
+                else
+                        bp->link_params.multi_phy_config |=
+                        PORT_HW_CFG_PHY_SELECTION_SECOND_PHY;
+                break;
+        default:
+                DP(NETIF_MSG_LINK, "Unsupported port type\n");
+                return -EINVAL;
+        }
+        /* Save new config in case command complete successuly */
+        new_multi_phy_config = bp->link_params.multi_phy_config;
+        /* Get the new cfg_idx */
+        cfg_idx = bnx2x_get_link_cfg_idx(bp);
+        /* Restore old config in case command failed */
+        bp->link_params.multi_phy_config = old_multi_phy_config;
+        DP(NETIF_MSG_LINK, "cfg_idx = %x\n", cfg_idx);
+
         if (cmd->autoneg == AUTONEG_ENABLE) {
-                if (!(bp->port.supported & SUPPORTED_Autoneg)) {
+                if (!(bp->port.supported[cfg_idx] & SUPPORTED_Autoneg)) {
                         DP(NETIF_MSG_LINK, "Autoneg not supported\n");
                         return -EINVAL;
                 }
 
                 /* advertise the requested speed and duplex if supported */
-                cmd->advertising &= bp->port.supported;
+                cmd->advertising &= bp->port.supported[cfg_idx];
 
-                bp->link_params.req_line_speed = SPEED_AUTO_NEG;
-                bp->link_params.req_duplex = DUPLEX_FULL;
-                bp->port.advertising |= (ADVERTISED_Autoneg |
+                bp->link_params.req_line_speed[cfg_idx] = SPEED_AUTO_NEG;
+                bp->link_params.req_duplex[cfg_idx] = DUPLEX_FULL;
+                bp->port.advertising[cfg_idx] |= (ADVERTISED_Autoneg |
                                          cmd->advertising);
 
         } else { /* forced speed */
                 /* advertise the requested speed and duplex if supported */
-                switch (cmd->speed) {
+                u32 speed = cmd->speed;
+                speed |= (cmd->speed_hi << 16);
+                switch (speed) {
                 case SPEED_10:
                         if (cmd->duplex == DUPLEX_FULL) {
-                                if (!(bp->port.supported &
+                                if (!(bp->port.supported[cfg_idx] &
                                       SUPPORTED_10baseT_Full)) {
                                         DP(NETIF_MSG_LINK,
                                            "10M full not supported\n");
@@ -152,7 +184,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 advertising = (ADVERTISED_10baseT_Full |
                                                ADVERTISED_TP);
                         } else {
-                                if (!(bp->port.supported &
+                                if (!(bp->port.supported[cfg_idx] &
                                       SUPPORTED_10baseT_Half)) {
                                         DP(NETIF_MSG_LINK,
                                            "10M half not supported\n");
@@ -166,7 +198,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 
                 case SPEED_100:
                         if (cmd->duplex == DUPLEX_FULL) {
-                                if (!(bp->port.supported &
+                                if (!(bp->port.supported[cfg_idx] &
                                                 SUPPORTED_100baseT_Full)) {
                                         DP(NETIF_MSG_LINK,
                                            "100M full not supported\n");
@@ -176,7 +208,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 advertising = (ADVERTISED_100baseT_Full |
                                                ADVERTISED_TP);
                         } else {
-                                if (!(bp->port.supported &
+                                if (!(bp->port.supported[cfg_idx] &
                                                 SUPPORTED_100baseT_Half)) {
                                         DP(NETIF_MSG_LINK,
                                            "100M half not supported\n");
@@ -194,7 +226,8 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 return -EINVAL;
                         }
 
-                        if (!(bp->port.supported & SUPPORTED_1000baseT_Full)) {
+                        if (!(bp->port.supported[cfg_idx] &
+                              SUPPORTED_1000baseT_Full)) {
                                 DP(NETIF_MSG_LINK, "1G full not supported\n");
                                 return -EINVAL;
                         }
@@ -210,7 +243,8 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 return -EINVAL;
                         }
 
-                        if (!(bp->port.supported & SUPPORTED_2500baseX_Full)) {
+                        if (!(bp->port.supported[cfg_idx]
+                              & SUPPORTED_2500baseX_Full)) {
                                 DP(NETIF_MSG_LINK,
                                    "2.5G full not supported\n");
                                 return -EINVAL;
@@ -226,7 +260,8 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                 return -EINVAL;
                         }
 
-                        if (!(bp->port.supported & SUPPORTED_10000baseT_Full)) {
+                        if (!(bp->port.supported[cfg_idx]
+                              & SUPPORTED_10000baseT_Full)) {
                                 DP(NETIF_MSG_LINK, "10G full not supported\n");
                                 return -EINVAL;
                         }
@@ -236,20 +271,23 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         break;
 
                 default:
-                        DP(NETIF_MSG_LINK, "Unsupported speed\n");
+                        DP(NETIF_MSG_LINK, "Unsupported speed %d\n", speed);
                         return -EINVAL;
                 }
 
-                bp->link_params.req_line_speed = cmd->speed;
-                bp->link_params.req_duplex = cmd->duplex;
-                bp->port.advertising = advertising;
+                bp->link_params.req_line_speed[cfg_idx] = speed;
+                bp->link_params.req_duplex[cfg_idx] = cmd->duplex;
+                bp->port.advertising[cfg_idx] = advertising;
         }
 
         DP(NETIF_MSG_LINK, "req_line_speed %d\n"
            DP_LEVEL "  req_duplex %d  advertising 0x%x\n",
-           bp->link_params.req_line_speed, bp->link_params.req_duplex,
-           bp->port.advertising);
+           bp->link_params.req_line_speed[cfg_idx],
+           bp->link_params.req_duplex[cfg_idx],
+           bp->port.advertising[cfg_idx]);
 
+        /* Set new config */
+        bp->link_params.multi_phy_config = new_multi_phy_config;
         if (netif_running(dev)) {
                 bnx2x_stats_handle(bp, STATS_EVENT_STOP);
                 bnx2x_link_set(bp);
@@ -811,7 +849,7 @@ static int bnx2x_set_eeprom(struct net_device *dev,
         struct bnx2x *bp = netdev_priv(dev);
         int port = BP_PORT(bp);
         int rc = 0;
-
+        u32 ext_phy_config;
         if (!netif_running(dev))
                 return -EAGAIN;
 
@@ -827,6 +865,10 @@ static int bnx2x_set_eeprom(struct net_device *dev,
             !bp->port.pmf)
                 return -EINVAL;
 
+        ext_phy_config =
+                SHMEM_RD(bp,
+                         dev_info.port_hw_config[port].external_phy_config);
+
         if (eeprom->magic == 0x50485950) {
                 /* 'PHYP' (0x50485950): prepare phy for FW upgrade */
                 bnx2x_stats_handle(bp, STATS_EVENT_STOP);
@@ -834,7 +876,7 @@ static int bnx2x_set_eeprom(struct net_device *dev,
                 bnx2x_acquire_phy_lock(bp);
                 rc |= bnx2x_link_reset(&bp->link_params,
                                        &bp->link_vars, 0);
-                if (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config) ==
+                if (XGXS_EXT_PHY_TYPE(ext_phy_config) ==
                                         PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101)
                         bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_0,
                                        MISC_REGISTERS_GPIO_HIGH, port);
@@ -855,10 +897,8 @@ static int bnx2x_set_eeprom(struct net_device *dev,
                 }
         } else if (eeprom->magic == 0x53985943) {
                 /* 'PHYC' (0x53985943): PHY FW upgrade completed */
-                if (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config) ==
+                if (XGXS_EXT_PHY_TYPE(ext_phy_config) ==
                                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101) {
-                        u8 ext_phy_addr =
-                             XGXS_EXT_PHY_ADDR(bp->link_params.ext_phy_config);
 
                         /* DSP Remove Download Mode */
                         bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_0,
@@ -866,7 +906,8 @@ static int bnx2x_set_eeprom(struct net_device *dev,
 
                         bnx2x_acquire_phy_lock(bp);
 
-                        bnx2x_sfx7101_sp_sw_reset(bp, port, ext_phy_addr);
+                        bnx2x_sfx7101_sp_sw_reset(bp,
+                                                &bp->link_params.phy[EXT_PHY1]);
 
                         /* wait 0.5 sec to allow it to run */
                         msleep(500);
@@ -920,7 +961,14 @@ static void bnx2x_get_ringparam(struct net_device *dev,
         ering->rx_mini_max_pending = 0;
         ering->rx_jumbo_max_pending = 0;
 
-        ering->rx_pending = bp->rx_ring_size;
+        if (bp->rx_ring_size)
+                ering->rx_pending = bp->rx_ring_size;
+        else
+                if (bp->state == BNX2X_STATE_OPEN && bp->num_queues)
+                        ering->rx_pending = MAX_RX_AVAIL/bp->num_queues;
+                else
+                        ering->rx_pending = MAX_RX_AVAIL;
+
         ering->rx_mini_pending = 0;
         ering->rx_jumbo_pending = 0;
 
@@ -940,6 +988,7 @@ static int bnx2x_set_ringparam(struct net_device *dev,
         }
 
         if ((ering->rx_pending > MAX_RX_AVAIL) ||
+            (ering->rx_pending < MIN_RX_AVAIL) ||
             (ering->tx_pending > MAX_TX_AVAIL) ||
             (ering->tx_pending <= MAX_SKB_FRAGS + 4))
                 return -EINVAL;
@@ -959,10 +1008,9 @@ static void bnx2x_get_pauseparam(struct net_device *dev,
                                  struct ethtool_pauseparam *epause)
 {
         struct bnx2x *bp = netdev_priv(dev);
-
-        epause->autoneg = (bp->link_params.req_flow_ctrl ==
-                           BNX2X_FLOW_CTRL_AUTO) &&
-                          (bp->link_params.req_line_speed == SPEED_AUTO_NEG);
+        int cfg_idx = bnx2x_get_link_cfg_idx(bp);
+        epause->autoneg = (bp->link_params.req_flow_ctrl[cfg_idx] ==
+                           BNX2X_FLOW_CTRL_AUTO);
 
         epause->rx_pause = ((bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_RX) ==
                             BNX2X_FLOW_CTRL_RX);
@@ -978,7 +1026,7 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
                                 struct ethtool_pauseparam *epause)
 {
         struct bnx2x *bp = netdev_priv(dev);
-
+        u32 cfg_idx = bnx2x_get_link_cfg_idx(bp);
         if (IS_E1HMF(bp))
                 return 0;
 
@@ -986,29 +1034,31 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
            DP_LEVEL "  autoneg %d  rx_pause %d  tx_pause %d\n",
            epause->cmd, epause->autoneg, epause->rx_pause, epause->tx_pause);
 
-        bp->link_params.req_flow_ctrl = BNX2X_FLOW_CTRL_AUTO;
+        bp->link_params.req_flow_ctrl[cfg_idx] = BNX2X_FLOW_CTRL_AUTO;
 
         if (epause->rx_pause)
-                bp->link_params.req_flow_ctrl |= BNX2X_FLOW_CTRL_RX;
+                bp->link_params.req_flow_ctrl[cfg_idx] |= BNX2X_FLOW_CTRL_RX;
 
         if (epause->tx_pause)
-                bp->link_params.req_flow_ctrl |= BNX2X_FLOW_CTRL_TX;
+                bp->link_params.req_flow_ctrl[cfg_idx] |= BNX2X_FLOW_CTRL_TX;
 
-        if (bp->link_params.req_flow_ctrl == BNX2X_FLOW_CTRL_AUTO)
-                bp->link_params.req_flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+        if (bp->link_params.req_flow_ctrl[cfg_idx] == BNX2X_FLOW_CTRL_AUTO)
+                bp->link_params.req_flow_ctrl[cfg_idx] = BNX2X_FLOW_CTRL_NONE;
 
         if (epause->autoneg) {
-                if (!(bp->port.supported & SUPPORTED_Autoneg)) {
+                if (!(bp->port.supported[cfg_idx] & SUPPORTED_Autoneg)) {
                         DP(NETIF_MSG_LINK, "autoneg not supported\n");
                         return -EINVAL;
                 }
 
-                if (bp->link_params.req_line_speed == SPEED_AUTO_NEG)
-                        bp->link_params.req_flow_ctrl = BNX2X_FLOW_CTRL_AUTO;
+                if (bp->link_params.req_line_speed[cfg_idx] == SPEED_AUTO_NEG) {
+                        bp->link_params.req_flow_ctrl[cfg_idx] =
+                                BNX2X_FLOW_CTRL_AUTO;
+                }
         }
 
         DP(NETIF_MSG_LINK,
-           "req_flow_ctrl 0x%x\n", bp->link_params.req_flow_ctrl);
+           "req_flow_ctrl 0x%x\n", bp->link_params.req_flow_ctrl[cfg_idx]);
 
         if (netif_running(dev)) {
                 bnx2x_stats_handle(bp, STATS_EVENT_STOP);
@@ -1272,12 +1322,12 @@ test_mem_exit:
         return rc;
 }
 
-static void bnx2x_wait_for_link(struct bnx2x *bp, u8 link_up)
+static void bnx2x_wait_for_link(struct bnx2x *bp, u8 link_up, u8 is_serdes)
 {
         int cnt = 1000;
 
         if (link_up)
-                while (bnx2x_link_test(bp) && cnt--)
+                while (bnx2x_link_test(bp, is_serdes) && cnt--)
                         msleep(10);
 }
 
@@ -1304,7 +1354,7 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
         /* check the loopback mode */
         switch (loopback_mode) {
         case BNX2X_PHY_LOOPBACK:
-                if (bp->link_params.loopback_mode != LOOPBACK_XGXS_10)
+                if (bp->link_params.loopback_mode != LOOPBACK_XGXS)
                         return -EINVAL;
                 break;
         case BNX2X_MAC_LOOPBACK:
@@ -1549,7 +1599,7 @@ static void bnx2x_self_test(struct net_device *dev,
                             struct ethtool_test *etest, u64 *buf)
 {
         struct bnx2x *bp = netdev_priv(dev);
-
+        u8 is_serdes;
         if (bp->recovery_state != BNX2X_RECOVERY_DONE) {
                 printk(KERN_ERR "Handling parity error recovery. Try again later\n");
                 etest->flags |= ETH_TEST_FL_FAILED;
@@ -1564,6 +1614,7 @@ static void bnx2x_self_test(struct net_device *dev,
         /* offline tests are not supported in MF mode */
         if (IS_E1HMF(bp))
                 etest->flags &= ~ETH_TEST_FL_OFFLINE;
+        is_serdes = (bp->link_vars.link_status & LINK_STATUS_SERDES_LINK) > 0;
 
         if (etest->flags & ETH_TEST_FL_OFFLINE) {
                 int port = BP_PORT(bp);
@@ -1575,11 +1626,12 @@ static void bnx2x_self_test(struct net_device *dev,
                 /* disable input for TX port IF */
                 REG_WR(bp, NIG_REG_EGRESS_UMP0_IN_EN + port*4, 0);
 
-                link_up = (bnx2x_link_test(bp) == 0);
+                link_up = bp->link_vars.link_up;
+
                 bnx2x_nic_unload(bp, UNLOAD_NORMAL);
                 bnx2x_nic_load(bp, LOAD_DIAG);
                 /* wait until link state is restored */
-                bnx2x_wait_for_link(bp, link_up);
+                bnx2x_wait_for_link(bp, link_up, is_serdes);
 
                 if (bnx2x_test_registers(bp) != 0) {
                         buf[0] = 1;
@@ -1600,7 +1652,7 @@ static void bnx2x_self_test(struct net_device *dev,
 
                 bnx2x_nic_load(bp, LOAD_NORMAL);
                 /* wait until link state is restored */
-                bnx2x_wait_for_link(bp, link_up);
+                bnx2x_wait_for_link(bp, link_up, is_serdes);
         }
         if (bnx2x_test_nvram(bp) != 0) {
                 buf[3] = 1;
@@ -1611,7 +1663,7 @@ static void bnx2x_self_test(struct net_device *dev,
                 etest->flags |= ETH_TEST_FL_FAILED;
         }
         if (bp->port.pmf)
-                if (bnx2x_link_test(bp) != 0) {
+                if (bnx2x_link_test(bp, is_serdes) != 0) {
                         buf[5] = 1;
                         etest->flags |= ETH_TEST_FL_FAILED;
                 }
@@ -1910,10 +1962,11 @@ static int bnx2x_phys_id(struct net_device *dev, u32 data)
 
         for (i = 0; i < (data * 2); i++) {
                 if ((i % 2) == 0)
-                        bnx2x_set_led(&bp->link_params, LED_MODE_OPER,
-                                      SPEED_1000);
+                        bnx2x_set_led(&bp->link_params, &bp->link_vars,
+                                      LED_MODE_OPER, SPEED_1000);
                 else
-                        bnx2x_set_led(&bp->link_params, LED_MODE_OFF, 0);
+                        bnx2x_set_led(&bp->link_params, &bp->link_vars,
+                                      LED_MODE_OFF, 0);
 
                 msleep_interruptible(500);
                 if (signal_pending(current))
@@ -1921,7 +1974,7 @@ static int bnx2x_phys_id(struct net_device *dev, u32 data)
         }
 
         if (bp->link_vars.link_up)
-                bnx2x_set_led(&bp->link_params, LED_MODE_OPER,
+                bnx2x_set_led(&bp->link_params, &bp->link_vars, LED_MODE_OPER,
                               bp->link_vars.line_speed);
 
         return 0;
diff --git a/drivers/net/bnx2x/bnx2x_hsi.h b/drivers/net/bnx2x/bnx2x_hsi.h
index fd1f29e0317d..60d141cd9950 100644
--- a/drivers/net/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/bnx2x/bnx2x_hsi.h
@@ -78,6 +78,8 @@ struct shared_hw_cfg {					 /* NVRAM Offset */
 #define SHARED_HW_CFG_LED_PHY11                     0x000b0000
 #define SHARED_HW_CFG_LED_MAC4                      0x000c0000
 #define SHARED_HW_CFG_LED_PHY8                      0x000d0000
+#define SHARED_HW_CFG_LED_EXTPHY1                   0x000e0000
+
 
 #define SHARED_HW_CFG_AN_ENABLE_MASK                0x3f000000
 #define SHARED_HW_CFG_AN_ENABLE_SHIFT               24
@@ -120,6 +122,23 @@ struct shared_hw_cfg {					 /* NVRAM Offset */
 #define SHARED_HW_CFG_FAN_FAILURE_DISABLED                    0x00080000
 #define SHARED_HW_CFG_FAN_FAILURE_ENABLED                     0x00100000
 
+        /* Set the MDC/MDIO access for the first external phy */
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_MASK         0x1C000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_SHIFT        26
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_PHY_TYPE     0x00000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC0        0x04000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC1        0x08000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH         0x0c000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS1_SWAPPED      0x10000000
+
+        /* Set the MDC/MDIO access for the second external phy */
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_MASK         0xE0000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_SHIFT        29
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_PHY_TYPE     0x00000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_EMAC0        0x20000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_EMAC1        0x40000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_BOTH         0x60000000
+#define SHARED_HW_CFG_MDC_MDIO_ACCESS2_SWAPPED      0x80000000
         u32 power_dissipated;                                   /* 0x11c */
 #define SHARED_HW_CFG_POWER_DIS_CMN_MASK            0xff000000
 #define SHARED_HW_CFG_POWER_DIS_CMN_SHIFT           24
@@ -221,7 +240,88 @@ struct port_hw_cfg {			    /* port 0: 0x12c  port 1: 0x2bc */
 
         u16 xgxs_config_tx[4];                              /* 0x1A0 */
 
-        u32 Reserved1[64];                                  /* 0x1A8 */
+        u32 Reserved1[57];                                  /* 0x1A8 */
+        u32 speed_capability_mask2;                         /* 0x28C */
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_MASK                 0x0000FFFF
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_SHIFT                0
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_10M_FULL             0x00000001
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3__                    0x00000002
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3___                   0x00000004
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_100M_FULL            0x00000008
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_1G                   0x00000010
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_2_DOT_5G             0x00000020
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_10G                  0x00000040
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_12G                  0x00000080
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_12_DOT_5G            0x00000100
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_13G                  0x00000200
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_15G                  0x00000400
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D3_16G                  0x00000800
+
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_MASK                 0xFFFF0000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_SHIFT                16
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_10M_FULL             0x00010000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0__                    0x00020000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0___                   0x00040000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_100M_FULL            0x00080000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_1G                   0x00100000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_2_DOT_5G             0x00200000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_10G                  0x00400000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_12G                  0x00800000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_12_DOT_5G            0x01000000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_13G                  0x02000000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_15G                  0x04000000
+#define PORT_HW_CFG_SPEED_CAPABILITY2_D0_16G                  0x08000000
+
+        /* In the case where two media types (e.g. copper and fiber) are
+          present and electrically active at the same time, PHY Selection
+          will determine which of the two PHYs will be designated as the
+          Active PHY and used for a connection to the network.  */
+        u32 multi_phy_config;                           /* 0x290 */
+#define PORT_HW_CFG_PHY_SELECTION_MASK               0x00000007
+#define PORT_HW_CFG_PHY_SELECTION_SHIFT              0
+#define PORT_HW_CFG_PHY_SELECTION_HARDWARE_DEFAULT   0x00000000
+#define PORT_HW_CFG_PHY_SELECTION_FIRST_PHY          0x00000001
+#define PORT_HW_CFG_PHY_SELECTION_SECOND_PHY         0x00000002
+#define PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY 0x00000003
+#define PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY 0x00000004
+
+        /* When enabled, all second phy nvram parameters will be swapped
+          with the first phy parameters */
+#define PORT_HW_CFG_PHY_SWAPPED_MASK                 0x00000008
+#define PORT_HW_CFG_PHY_SWAPPED_SHIFT                3
+#define PORT_HW_CFG_PHY_SWAPPED_DISABLED             0x00000000
+#define PORT_HW_CFG_PHY_SWAPPED_ENABLED              0x00000008
+
+
+        /* Address of the second external phy */
+        u32 external_phy_config2;                               /* 0x294 */
+#define PORT_HW_CFG_XGXS_EXT_PHY2_ADDR_MASK         0x000000FF
+#define PORT_HW_CFG_XGXS_EXT_PHY2_ADDR_SHIFT        0
+
+        /* The second XGXS external PHY type */
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_MASK         0x0000FF00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_SHIFT        8
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_DIRECT       0x00000000
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8071      0x00000100
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8072      0x00000200
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8073      0x00000300
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8705      0x00000400
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8706      0x00000500
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8726      0x00000600
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8481      0x00000700
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_SFX7101      0x00000800
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8727      0x00000900
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM8727_NOC  0x00000a00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM84823     0x00000b00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM54640     0x00000c00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_BCM84833     0x00000d00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_FAILURE      0x0000fd00
+#define PORT_HW_CFG_XGXS_EXT_PHY2_TYPE_NOT_CONN     0x0000ff00
+
+        /* 4 times 16 bits for all 4 lanes. For some external PHYs (such as
+          8706, 8726 and 8727) not all 4 values are needed. */
+        u16 xgxs_config2_rx[4];                         /* 0x296 */
+        u16 xgxs_config2_tx[4];                         /* 0x2A0 */
 
         u32 lane_config;
 #define PORT_HW_CFG_LANE_SWAP_CFG_MASK              0x0000ffff
@@ -515,10 +615,17 @@ struct port_feat_cfg {			    /* port 0: 0x454  port 1: 0x4c8 */
 #define PORT_FEATURE_FLOW_CONTROL_NONE              0x00000400
 
         /* The default for MCP link configuration,
-           uses the same defines as link_config */
+        uses the same defines as link_config */
         u32 mfw_wol_link_cfg;
+        /* The default for the driver of the second external phy,
+        uses the same defines as link_config */
+        u32 link_config2;                                       /* 0x47C */
+
+        /* The default for MCP of the second external phy,
+        uses the same defines as link_config */
+        u32 mfw_wol_link_cfg2;                          /* 0x480 */
 
-        u32 reserved[19];
+        u32 Reserved2[17];                                      /* 0x484 */
 
 };
 
@@ -686,8 +793,14 @@ struct drv_func_mb {
          * The optic module verification commands require bootcode
          * v5.0.6 or later
          */
-#define DRV_MSG_CODE_VRFY_OPT_MDL                       0xa0000000
-#define REQ_BC_VER_4_VRFY_OPT_MDL                       0x00050006
+#define DRV_MSG_CODE_VRFY_FIRST_PHY_OPT_MDL     0xa0000000
+#define REQ_BC_VER_4_VRFY_FIRST_PHY_OPT_MDL     0x00050006
+        /*
+         * The specific optic module verification command requires bootcode
+         * v5.2.12 or later
+         */
+#define DRV_MSG_CODE_VRFY_SPECIFIC_PHY_OPT_MDL      0xa1000000
+#define REQ_BC_VER_4_VRFY_SPECIFIC_PHY_OPT_MDL      0x00050234
 
 #define BIOS_MSG_CODE_LIC_CHALLENGE                     0xff010000
 #define BIOS_MSG_CODE_LIC_RESPONSE                      0xff020000
@@ -922,7 +1035,12 @@ struct shmem2_region {
 #define SHMEM_DCC_SUPPORT_SET_PROTOCOL_TLV          0x00000040
 #define SHMEM_DCC_SUPPORT_SET_PRIORITY_TLV          0x00000080
 #define SHMEM_DCC_SUPPORT_DEFAULT                   SHMEM_DCC_SUPPORT_NONE
-
+        u32 ext_phy_fw_version2[PORT_MAX];
+        /*
+         * For backwards compatibility, if the mf_cfg_addr does not exist
+         * (the size filed is smaller than 0xc) the mf_cfg resides at the
+         * end of struct shmem_region
+         */
 };
 
 
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index 0383e3066313..a07a3a6abd40 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -168,50 +168,19 @@
 /**********************************************************/
 /*                     INTERFACE                          */
 /**********************************************************/
-#define CL45_WR_OVER_CL22(_bp, _port, _phy_addr, _bank, _addr, _val) \
-        bnx2x_cl45_write(_bp, _port, 0, _phy_addr, \
-                DEFAULT_PHY_DEV_ADDR, \
+
+#define CL45_WR_OVER_CL22(_bp, _phy, _bank, _addr, _val) \
+        bnx2x_cl45_write(_bp, _phy, \
+                (_phy)->def_md_devad, \
                 (_bank + (_addr & 0xf)), \
                 _val)
 
-#define CL45_RD_OVER_CL22(_bp, _port, _phy_addr, _bank, _addr, _val) \
-        bnx2x_cl45_read(_bp, _port, 0, _phy_addr, \
-                DEFAULT_PHY_DEV_ADDR, \
+#define CL45_RD_OVER_CL22(_bp, _phy, _bank, _addr, _val) \
+        bnx2x_cl45_read(_bp, _phy, \
+                (_phy)->def_md_devad, \
                 (_bank + (_addr & 0xf)), \
                 _val)
 
-static void bnx2x_set_serdes_access(struct link_params *params)
-{
-        struct bnx2x *bp = params->bp;
-        u32 emac_base = (params->port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
-
-        /* Set Clause 22 */
-        REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_ST + params->port*0x10, 1);
-        REG_WR(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM, 0x245f8000);
-        udelay(500);
-        REG_WR(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM, 0x245d000f);
-        udelay(500);
-         /* Set Clause 45 */
-        REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_ST + params->port*0x10, 0);
-}
-static void bnx2x_set_phy_mdio(struct link_params *params, u8 phy_flags)
-{
-        struct bnx2x *bp = params->bp;
-
-        if (phy_flags & PHY_XGXS_FLAG) {
-                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_ST +
-                           params->port*0x18, 0);
-                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + params->port*0x18,
-                           DEFAULT_PHY_DEV_ADDR);
-        } else {
-                bnx2x_set_serdes_access(params);
-
-                REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_DEVAD +
-                           params->port*0x10,
-                           DEFAULT_PHY_DEV_ADDR);
-        }
-}
-
 static u32 bnx2x_bits_en(struct bnx2x *bp, u32 reg, u32 bits)
 {
         u32 val = REG_RD(bp, reg);
@@ -527,162 +496,6 @@ static u8 bnx2x_bmac_enable(struct link_params *params, struct link_vars *vars,
         return 0;
 }
 
-static void bnx2x_phy_deassert(struct link_params *params, u8 phy_flags)
-{
-        struct bnx2x *bp = params->bp;
-        u32 val;
-
-        if (phy_flags & PHY_XGXS_FLAG) {
-                DP(NETIF_MSG_LINK, "bnx2x_phy_deassert:XGXS\n");
-                val = XGXS_RESET_BITS;
-
-        } else { /* SerDes */
-                DP(NETIF_MSG_LINK, "bnx2x_phy_deassert:SerDes\n");
-                val = SERDES_RESET_BITS;
-        }
-
-        val = val << (params->port*16);
-
-        /* reset and unreset the SerDes/XGXS */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR,
-                    val);
-        udelay(500);
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_SET,
-                    val);
-        bnx2x_set_phy_mdio(params, phy_flags);
-}
-
-void bnx2x_link_status_update(struct link_params *params,
-                            struct link_vars   *vars)
-{
-        struct bnx2x *bp = params->bp;
-        u8 link_10g;
-        u8 port = params->port;
-
-        if (params->switch_cfg ==  SWITCH_CFG_1G)
-                vars->phy_flags = PHY_SERDES_FLAG;
-        else
-                vars->phy_flags = PHY_XGXS_FLAG;
-        vars->link_status = REG_RD(bp, params->shmem_base +
-                                          offsetof(struct shmem_region,
-                                           port_mb[port].link_status));
-
-        vars->link_up = (vars->link_status & LINK_STATUS_LINK_UP);
-
-        if (vars->link_up) {
-                DP(NETIF_MSG_LINK, "phy link up\n");
-
-                vars->phy_link_up = 1;
-                vars->duplex = DUPLEX_FULL;
-                switch (vars->link_status &
-                                        LINK_STATUS_SPEED_AND_DUPLEX_MASK) {
-                        case LINK_10THD:
-                                vars->duplex = DUPLEX_HALF;
-                                /* fall thru */
-                        case LINK_10TFD:
-                                vars->line_speed = SPEED_10;
-                                break;
-
-                        case LINK_100TXHD:
-                                vars->duplex = DUPLEX_HALF;
-                                /* fall thru */
-                        case LINK_100T4:
-                        case LINK_100TXFD:
-                                vars->line_speed = SPEED_100;
-                                break;
-
-                        case LINK_1000THD:
-                                vars->duplex = DUPLEX_HALF;
-                                /* fall thru */
-                        case LINK_1000TFD:
-                                vars->line_speed = SPEED_1000;
-                                break;
-
-                        case LINK_2500THD:
-                                vars->duplex = DUPLEX_HALF;
-                                /* fall thru */
-                        case LINK_2500TFD:
-                                vars->line_speed = SPEED_2500;
-                                break;
-
-                        case LINK_10GTFD:
-                                vars->line_speed = SPEED_10000;
-                                break;
-
-                        case LINK_12GTFD:
-                                vars->line_speed = SPEED_12000;
-                                break;
-
-                        case LINK_12_5GTFD:
-                                vars->line_speed = SPEED_12500;
-                                break;
-
-                        case LINK_13GTFD:
-                                vars->line_speed = SPEED_13000;
-                                break;
-
-                        case LINK_15GTFD:
-                                vars->line_speed = SPEED_15000;
-                                break;
-
-                        case LINK_16GTFD:
-                                vars->line_speed = SPEED_16000;
-                                break;
-
-                        default:
-                                break;
-                }
-
-                if (vars->link_status & LINK_STATUS_TX_FLOW_CONTROL_ENABLED)
-                        vars->flow_ctrl |= BNX2X_FLOW_CTRL_TX;
-                else
-                        vars->flow_ctrl &= ~BNX2X_FLOW_CTRL_TX;
-
-                if (vars->link_status & LINK_STATUS_RX_FLOW_CONTROL_ENABLED)
-                        vars->flow_ctrl |= BNX2X_FLOW_CTRL_RX;
-                else
-                        vars->flow_ctrl &= ~BNX2X_FLOW_CTRL_RX;
-
-                if (vars->phy_flags & PHY_XGXS_FLAG) {
-                        if (vars->line_speed &&
-                            ((vars->line_speed == SPEED_10) ||
-                             (vars->line_speed == SPEED_100))) {
-                                vars->phy_flags |= PHY_SGMII_FLAG;
-                        } else {
-                                vars->phy_flags &= ~PHY_SGMII_FLAG;
-                        }
-                }
-
-                /* anything 10 and over uses the bmac */
-                link_10g = ((vars->line_speed == SPEED_10000) ||
-                            (vars->line_speed == SPEED_12000) ||
-                            (vars->line_speed == SPEED_12500) ||
-                            (vars->line_speed == SPEED_13000) ||
-                            (vars->line_speed == SPEED_15000) ||
-                            (vars->line_speed == SPEED_16000));
-                if (link_10g)
-                        vars->mac_type = MAC_TYPE_BMAC;
-                else
-                        vars->mac_type = MAC_TYPE_EMAC;
-
-        } else { /* link down */
-                DP(NETIF_MSG_LINK, "phy link down\n");
-
-                vars->phy_link_up = 0;
-
-                vars->line_speed = 0;
-                vars->duplex = DUPLEX_FULL;
-                vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
-
-                /* indicate no mac active */
-                vars->mac_type = MAC_TYPE_NONE;
-        }
-
-        DP(NETIF_MSG_LINK, "link_status 0x%x  phy_link_up %x\n",
-                 vars->link_status, vars->phy_link_up);
-        DP(NETIF_MSG_LINK, "line_speed %x  duplex %x  flow_ctrl 0x%x\n",
-                 vars->line_speed, vars->duplex, vars->flow_ctrl);
-}
 
 static void bnx2x_update_mng(struct link_params *params, u32 link_status)
 {
@@ -800,62 +613,69 @@ static u8 bnx2x_pbf_update(struct link_params *params, u32 flow_ctrl,
         return 0;
 }
 
-static u32 bnx2x_get_emac_base(struct bnx2x *bp, u32 ext_phy_type, u8 port)
+static u32 bnx2x_get_emac_base(struct bnx2x *bp,
+                               u32 mdc_mdio_access, u8 port)
 {
-        u32 emac_base;
-
-        switch (ext_phy_type) {
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                /* All MDC/MDIO is directed through single EMAC */
+        u32 emac_base = 0;
+        switch (mdc_mdio_access) {
+        case SHARED_HW_CFG_MDC_MDIO_ACCESS1_PHY_TYPE:
+                break;
+        case SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC0:
+                if (REG_RD(bp, NIG_REG_PORT_SWAP))
+                        emac_base = GRCBASE_EMAC1;
+                else
+                        emac_base = GRCBASE_EMAC0;
+                break;
+        case SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC1:
                 if (REG_RD(bp, NIG_REG_PORT_SWAP))
                         emac_base = GRCBASE_EMAC0;
                 else
                         emac_base = GRCBASE_EMAC1;
                 break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
+        case SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH:
+                emac_base = (port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+                break;
+        case SHARED_HW_CFG_MDC_MDIO_ACCESS1_SWAPPED:
                 emac_base = (port) ? GRCBASE_EMAC0 : GRCBASE_EMAC1;
                 break;
         default:
-                emac_base = (port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                 break;
         }
         return emac_base;
 
 }
 
-u8 bnx2x_cl45_write(struct bnx2x *bp, u8 port, u32 ext_phy_type,
-                  u8 phy_addr, u8 devad, u16 reg, u16 val)
+u8 bnx2x_cl45_write(struct bnx2x *bp, struct bnx2x_phy *phy,
+                    u8 devad, u16 reg, u16 val)
 {
         u32 tmp, saved_mode;
         u8 i, rc = 0;
-        u32 mdio_ctrl = bnx2x_get_emac_base(bp, ext_phy_type, port);
 
         /* set clause 45 mode, slow down the MDIO clock to 2.5MHz
          * (a value of 49==0x31) and make sure that the AUTO poll is off
          */
 
-        saved_mode = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        saved_mode = REG_RD(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
         tmp = saved_mode & ~(EMAC_MDIO_MODE_AUTO_POLL |
                              EMAC_MDIO_MODE_CLOCK_CNT);
         tmp |= (EMAC_MDIO_MODE_CLAUSE_45 |
                 (49 << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT));
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, tmp);
-        REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, tmp);
+        REG_RD(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
         udelay(40);
 
         /* address */
 
-        tmp = ((phy_addr << 21) | (devad << 16) | reg |
+        tmp = ((phy->addr << 21) | (devad << 16) | reg |
                EMAC_MDIO_COMM_COMMAND_ADDRESS |
                EMAC_MDIO_COMM_START_BUSY);
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
 
         for (i = 0; i < 50; i++) {
                 udelay(10);
 
-                tmp = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
+                tmp = REG_RD(bp, phy->mdio_ctrl +
+                                   EMAC_REG_EMAC_MDIO_COMM);
                 if (!(tmp & EMAC_MDIO_COMM_START_BUSY)) {
                         udelay(5);
                         break;
@@ -866,15 +686,15 @@ u8 bnx2x_cl45_write(struct bnx2x *bp, u8 port, u32 ext_phy_type,
                 rc = -EFAULT;
         } else {
                 /* data */
-                tmp = ((phy_addr << 21) | (devad << 16) | val |
+                tmp = ((phy->addr << 21) | (devad << 16) | val |
                        EMAC_MDIO_COMM_COMMAND_WRITE_45 |
                        EMAC_MDIO_COMM_START_BUSY);
-                REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
+                REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
 
                 for (i = 0; i < 50; i++) {
                         udelay(10);
 
-                        tmp = REG_RD(bp, mdio_ctrl +
+                        tmp = REG_RD(bp, phy->mdio_ctrl +
                                          EMAC_REG_EMAC_MDIO_COMM);
                         if (!(tmp & EMAC_MDIO_COMM_START_BUSY)) {
                                 udelay(5);
@@ -888,42 +708,41 @@ u8 bnx2x_cl45_write(struct bnx2x *bp, u8 port, u32 ext_phy_type,
         }
 
         /* Restore the saved mode */
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, saved_mode);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, saved_mode);
 
         return rc;
 }
 
-u8 bnx2x_cl45_read(struct bnx2x *bp, u8 port, u32 ext_phy_type,
-                 u8 phy_addr, u8 devad, u16 reg, u16 *ret_val)
+u8 bnx2x_cl45_read(struct bnx2x *bp, struct bnx2x_phy *phy,
+                   u8 devad, u16 reg, u16 *ret_val)
 {
         u32 val, saved_mode;
         u16 i;
         u8 rc = 0;
 
-        u32 mdio_ctrl = bnx2x_get_emac_base(bp, ext_phy_type, port);
         /* set clause 45 mode, slow down the MDIO clock to 2.5MHz
          * (a value of 49==0x31) and make sure that the AUTO poll is off
          */
 
-        saved_mode = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
-        val = saved_mode & ((EMAC_MDIO_MODE_AUTO_POLL |
+        saved_mode = REG_RD(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        val = saved_mode & ~((EMAC_MDIO_MODE_AUTO_POLL |
                              EMAC_MDIO_MODE_CLOCK_CNT));
         val |= (EMAC_MDIO_MODE_CLAUSE_45 |
                 (49L << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT));
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, val);
-        REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, val);
+        REG_RD(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
         udelay(40);
 
         /* address */
-        val = ((phy_addr << 21) | (devad << 16) | reg |
+        val = ((phy->addr << 21) | (devad << 16) | reg |
                EMAC_MDIO_COMM_COMMAND_ADDRESS |
                EMAC_MDIO_COMM_START_BUSY);
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
 
         for (i = 0; i < 50; i++) {
                 udelay(10);
 
-                val = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
+                val = REG_RD(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
                 if (!(val & EMAC_MDIO_COMM_START_BUSY)) {
                         udelay(5);
                         break;
@@ -937,15 +756,15 @@ u8 bnx2x_cl45_read(struct bnx2x *bp, u8 port, u32 ext_phy_type,
 
         } else {
                 /* data */
-                val = ((phy_addr << 21) | (devad << 16) |
+                val = ((phy->addr << 21) | (devad << 16) |
                        EMAC_MDIO_COMM_COMMAND_READ_45 |
                        EMAC_MDIO_COMM_START_BUSY);
-                REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
+                REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
 
                 for (i = 0; i < 50; i++) {
                         udelay(10);
 
-                        val = REG_RD(bp, mdio_ctrl +
+                        val = REG_RD(bp, phy->mdio_ctrl +
                                           EMAC_REG_EMAC_MDIO_COMM);
                         if (!(val & EMAC_MDIO_COMM_START_BUSY)) {
                                 *ret_val = (u16)(val & EMAC_MDIO_COMM_DATA);
@@ -961,13 +780,49 @@ u8 bnx2x_cl45_read(struct bnx2x *bp, u8 port, u32 ext_phy_type,
         }
 
         /* Restore the saved mode */
-        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, saved_mode);
+        REG_WR(bp, phy->mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, saved_mode);
 
         return rc;
 }
 
+u8 bnx2x_phy_read(struct link_params *params, u8 phy_addr,
+                  u8 devad, u16 reg, u16 *ret_val)
+{
+        u8 phy_index;
+        /**
+         * Probe for the phy according to the given phy_addr, and execute
+         * the read request on it
+         */
+        for (phy_index = 0; phy_index < params->num_phys; phy_index++) {
+                if (params->phy[phy_index].addr == phy_addr) {
+                        return bnx2x_cl45_read(params->bp,
+                                               &params->phy[phy_index], devad,
+                                               reg, ret_val);
+                }
+        }
+        return -EINVAL;
+}
+
+u8 bnx2x_phy_write(struct link_params *params, u8 phy_addr,
+                   u8 devad, u16 reg, u16 val)
+{
+        u8 phy_index;
+        /**
+         * Probe for the phy according to the given phy_addr, and execute
+         * the write request on it
+         */
+        for (phy_index = 0; phy_index < params->num_phys; phy_index++) {
+                if (params->phy[phy_index].addr == phy_addr) {
+                        return bnx2x_cl45_write(params->bp,
+                                                &params->phy[phy_index], devad,
+                                                reg, val);
+                }
+        }
+        return -EINVAL;
+}
+
 static void bnx2x_set_aer_mmd(struct link_params *params,
-                            struct link_vars   *vars)
+                              struct bnx2x_phy *phy)
 {
         struct bnx2x *bp = params->bp;
         u32 ser_lane;
@@ -977,16 +832,202 @@ static void bnx2x_set_aer_mmd(struct link_params *params,
                      PORT_HW_CFG_LANE_SWAP_CFG_MASTER_MASK) >>
                      PORT_HW_CFG_LANE_SWAP_CFG_MASTER_SHIFT);
 
-        offset = (vars->phy_flags & PHY_XGXS_FLAG) ?
-                (params->phy_addr + ser_lane) : 0;
+        offset = (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) ?
+                (phy->addr + ser_lane) : 0;
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_AER_BLOCK,
                               MDIO_AER_BLOCK_AER_REG, 0x3800 + offset);
 }
 
-static void bnx2x_set_master_ln(struct link_params *params)
+/******************************************************************/
+/*                      Internal phy section                      */
+/******************************************************************/
+
+static void bnx2x_set_serdes_access(struct bnx2x *bp, u8 port)
+{
+        u32 emac_base = (port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+
+        /* Set Clause 22 */
+        REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_ST + port*0x10, 1);
+        REG_WR(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM, 0x245f8000);
+        udelay(500);
+        REG_WR(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM, 0x245d000f);
+        udelay(500);
+         /* Set Clause 45 */
+        REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_ST + port*0x10, 0);
+}
+
+static void bnx2x_serdes_deassert(struct bnx2x *bp, u8 port)
+{
+        u32 val;
+
+        DP(NETIF_MSG_LINK, "bnx2x_serdes_deassert\n");
+
+        val = SERDES_RESET_BITS << (port*16);
+
+        /* reset and unreset the SerDes/XGXS */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR, val);
+        udelay(500);
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_SET, val);
+
+        bnx2x_set_serdes_access(bp, port);
+
+        REG_WR(bp, NIG_REG_SERDES0_CTRL_MD_DEVAD +
+                     port*0x10,
+                     DEFAULT_PHY_DEV_ADDR);
+}
+
+static void bnx2x_xgxs_deassert(struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port;
+        u32 val;
+        DP(NETIF_MSG_LINK, "bnx2x_xgxs_deassert\n");
+        port = params->port;
+
+        val = XGXS_RESET_BITS << (port*16);
+
+        /* reset and unreset the SerDes/XGXS */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR, val);
+        udelay(500);
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_SET, val);
+
+        REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_ST +
+                     port*0x18, 0);
+        REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18,
+                     params->phy[INT_PHY].def_md_devad);
+}
+
+
+void bnx2x_link_status_update(struct link_params *params,
+                            struct link_vars   *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u8 link_10g;
+        u8 port = params->port;
+
+        vars->link_status = REG_RD(bp, params->shmem_base +
+                                          offsetof(struct shmem_region,
+                                           port_mb[port].link_status));
+
+        vars->link_up = (vars->link_status & LINK_STATUS_LINK_UP);
+
+        if (vars->link_up) {
+                DP(NETIF_MSG_LINK, "phy link up\n");
+
+                vars->phy_link_up = 1;
+                vars->duplex = DUPLEX_FULL;
+                switch (vars->link_status &
+                                        LINK_STATUS_SPEED_AND_DUPLEX_MASK) {
+                        case LINK_10THD:
+                                vars->duplex = DUPLEX_HALF;
+                                /* fall thru */
+                        case LINK_10TFD:
+                                vars->line_speed = SPEED_10;
+                                break;
+
+                        case LINK_100TXHD:
+                                vars->duplex = DUPLEX_HALF;
+                                /* fall thru */
+                        case LINK_100T4:
+                        case LINK_100TXFD:
+                                vars->line_speed = SPEED_100;
+                                break;
+
+                        case LINK_1000THD:
+                                vars->duplex = DUPLEX_HALF;
+                                /* fall thru */
+                        case LINK_1000TFD:
+                                vars->line_speed = SPEED_1000;
+                                break;
+
+                        case LINK_2500THD:
+                                vars->duplex = DUPLEX_HALF;
+                                /* fall thru */
+                        case LINK_2500TFD:
+                                vars->line_speed = SPEED_2500;
+                                break;
+
+                        case LINK_10GTFD:
+                                vars->line_speed = SPEED_10000;
+                                break;
+
+                        case LINK_12GTFD:
+                                vars->line_speed = SPEED_12000;
+                                break;
+
+                        case LINK_12_5GTFD:
+                                vars->line_speed = SPEED_12500;
+                                break;
+
+                        case LINK_13GTFD:
+                                vars->line_speed = SPEED_13000;
+                                break;
+
+                        case LINK_15GTFD:
+                                vars->line_speed = SPEED_15000;
+                                break;
+
+                        case LINK_16GTFD:
+                                vars->line_speed = SPEED_16000;
+                                break;
+
+                        default:
+                                break;
+                }
+                vars->flow_ctrl = 0;
+                if (vars->link_status & LINK_STATUS_TX_FLOW_CONTROL_ENABLED)
+                        vars->flow_ctrl |= BNX2X_FLOW_CTRL_TX;
+
+                if (vars->link_status & LINK_STATUS_RX_FLOW_CONTROL_ENABLED)
+                        vars->flow_ctrl |= BNX2X_FLOW_CTRL_RX;
+
+                if (!vars->flow_ctrl)
+                        vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+
+                if (vars->line_speed &&
+                    ((vars->line_speed == SPEED_10) ||
+                     (vars->line_speed == SPEED_100))) {
+                        vars->phy_flags |= PHY_SGMII_FLAG;
+                } else {
+                        vars->phy_flags &= ~PHY_SGMII_FLAG;
+                }
+
+                /* anything 10 and over uses the bmac */
+                link_10g = ((vars->line_speed == SPEED_10000) ||
+                            (vars->line_speed == SPEED_12000) ||
+                            (vars->line_speed == SPEED_12500) ||
+                            (vars->line_speed == SPEED_13000) ||
+                            (vars->line_speed == SPEED_15000) ||
+                            (vars->line_speed == SPEED_16000));
+                if (link_10g)
+                        vars->mac_type = MAC_TYPE_BMAC;
+                else
+                        vars->mac_type = MAC_TYPE_EMAC;
+
+        } else { /* link down */
+                DP(NETIF_MSG_LINK, "phy link down\n");
+
+                vars->phy_link_up = 0;
+
+                vars->line_speed = 0;
+                vars->duplex = DUPLEX_FULL;
+                vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+
+                /* indicate no mac active */
+                vars->mac_type = MAC_TYPE_NONE;
+        }
+
+        DP(NETIF_MSG_LINK, "link_status 0x%x  phy_link_up %x\n",
+                 vars->link_status, vars->phy_link_up);
+        DP(NETIF_MSG_LINK, "line_speed %x  duplex %x  flow_ctrl 0x%x\n",
+                 vars->line_speed, vars->duplex, vars->flow_ctrl);
+}
+
+
+static void bnx2x_set_master_ln(struct link_params *params,
+                                struct bnx2x_phy *phy)
 {
         struct bnx2x *bp = params->bp;
         u16 new_master_ln, ser_lane;
@@ -995,47 +1036,44 @@ static void bnx2x_set_master_ln(struct link_params *params)
                      PORT_HW_CFG_LANE_SWAP_CFG_MASTER_SHIFT);
 
         /* set the master_ln for AN */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_XGXS_BLOCK2,
                               MDIO_XGXS_BLOCK2_TEST_MODE_LANE,
                               &new_master_ln);
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_XGXS_BLOCK2 ,
                               MDIO_XGXS_BLOCK2_TEST_MODE_LANE,
                               (new_master_ln | ser_lane));
 }
 
-static u8 bnx2x_reset_unicore(struct link_params *params)
+static u8 bnx2x_reset_unicore(struct link_params *params,
+                              struct bnx2x_phy *phy,
+                              u8 set_serdes)
 {
         struct bnx2x *bp = params->bp;
         u16 mii_control;
         u16 i;
 
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL, &mii_control);
 
         /* reset the unicore */
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL,
                               (mii_control |
                                MDIO_COMBO_IEEO_MII_CONTROL_RESET));
-        if (params->switch_cfg == SWITCH_CFG_1G)
-                bnx2x_set_serdes_access(params);
+        if (set_serdes)
+                bnx2x_set_serdes_access(bp, params->port);
 
         /* wait for the reset to self clear */
         for (i = 0; i < MDIO_ACCESS_TIMEOUT; i++) {
                 udelay(5);
 
                 /* the reset erased the previous bank value */
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL,
                               &mii_control);
@@ -1051,7 +1089,8 @@ static u8 bnx2x_reset_unicore(struct link_params *params)
 
 }
 
-static void bnx2x_set_swap_lanes(struct link_params *params)
+static void bnx2x_set_swap_lanes(struct link_params *params,
+                                 struct bnx2x_phy *phy)
 {
         struct bnx2x *bp = params->bp;
         /* Each two bits represents a lane number:
@@ -1069,71 +1108,62 @@ static void bnx2x_set_swap_lanes(struct link_params *params)
                             PORT_HW_CFG_LANE_SWAP_CFG_TX_SHIFT);
 
         if (rx_lane_swap != 0x1b) {
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                     MDIO_REG_BANK_XGXS_BLOCK2,
                                     MDIO_XGXS_BLOCK2_RX_LN_SWAP,
                                     (rx_lane_swap |
                                     MDIO_XGXS_BLOCK2_RX_LN_SWAP_ENABLE |
                                     MDIO_XGXS_BLOCK2_RX_LN_SWAP_FORCE_ENABLE));
         } else {
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_XGXS_BLOCK2,
                                       MDIO_XGXS_BLOCK2_RX_LN_SWAP, 0);
         }
 
         if (tx_lane_swap != 0x1b) {
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_XGXS_BLOCK2,
                                       MDIO_XGXS_BLOCK2_TX_LN_SWAP,
                                       (tx_lane_swap |
                                        MDIO_XGXS_BLOCK2_TX_LN_SWAP_ENABLE));
         } else {
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_XGXS_BLOCK2,
                                       MDIO_XGXS_BLOCK2_TX_LN_SWAP, 0);
         }
 }
 
-static void bnx2x_set_parallel_detection(struct link_params *params,
-                                       u8                phy_flags)
+static void bnx2x_set_parallel_detection(struct bnx2x_phy *phy,
+                                         struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 control2;
-
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL2,
                               &control2);
-        if (params->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
+        if (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
                 control2 |= MDIO_SERDES_DIGITAL_A_1000X_CONTROL2_PRL_DT_EN;
         else
                 control2 &= ~MDIO_SERDES_DIGITAL_A_1000X_CONTROL2_PRL_DT_EN;
-        DP(NETIF_MSG_LINK, "params->speed_cap_mask = 0x%x, control2 = 0x%x\n",
-                params->speed_cap_mask, control2);
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        DP(NETIF_MSG_LINK, "phy->speed_cap_mask = 0x%x, control2 = 0x%x\n",
+                phy->speed_cap_mask, control2);
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL2,
                               control2);
 
-        if ((phy_flags & PHY_XGXS_FLAG) &&
-             (params->speed_cap_mask &
+        if ((phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
+             (phy->speed_cap_mask &
                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)) {
                 DP(NETIF_MSG_LINK, "XGXS\n");
 
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                 MDIO_REG_BANK_10G_PARALLEL_DETECT,
                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_LINK,
                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_LINK_CNT);
 
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                 MDIO_REG_BANK_10G_PARALLEL_DETECT,
                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
                                 &control2);
@@ -1142,15 +1172,13 @@ static void bnx2x_set_parallel_detection(struct link_params *params,
                 control2 |=
                     MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL_PARDET10G_EN;
 
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                 MDIO_REG_BANK_10G_PARALLEL_DETECT,
                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
                                 control2);
 
                 /* Disable parallel detection of HiG */
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                 MDIO_REG_BANK_XGXS_BLOCK2,
                                 MDIO_XGXS_BLOCK2_UNICORE_MODE_10G,
                                 MDIO_XGXS_BLOCK2_UNICORE_MODE_10G_CX4_XGXS |
@@ -1158,7 +1186,8 @@ static void bnx2x_set_parallel_detection(struct link_params *params,
         }
 }
 
-static void bnx2x_set_autoneg(struct link_params *params,
+static void bnx2x_set_autoneg(struct bnx2x_phy *phy,
+                              struct link_params *params,
                             struct link_vars *vars,
                             u8 enable_cl73)
 {
@@ -1166,9 +1195,7 @@ static void bnx2x_set_autoneg(struct link_params *params,
         u16 reg_val;
 
         /* CL37 Autoneg */
-
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL, &reg_val);
 
@@ -1179,15 +1206,13 @@ static void bnx2x_set_autoneg(struct link_params *params,
                 reg_val &= ~(MDIO_COMBO_IEEO_MII_CONTROL_AN_EN |
                              MDIO_COMBO_IEEO_MII_CONTROL_RESTART_AN);
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL, reg_val);
 
         /* Enable/Disable Autodetection */
 
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL1, &reg_val);
         reg_val &= ~(MDIO_SERDES_DIGITAL_A_1000X_CONTROL1_SIGNAL_DETECT_EN |
@@ -1198,14 +1223,12 @@ static void bnx2x_set_autoneg(struct link_params *params,
         else
                 reg_val &= ~MDIO_SERDES_DIGITAL_A_1000X_CONTROL1_AUTODET;
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL1, reg_val);
 
         /* Enable TetonII and BAM autoneg */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_BAM_NEXT_PAGE,
                               MDIO_BAM_NEXT_PAGE_MP5_NEXT_PAGE_CTRL,
                           &reg_val);
@@ -1218,23 +1241,20 @@ static void bnx2x_set_autoneg(struct link_params *params,
                 reg_val &= ~(MDIO_BAM_NEXT_PAGE_MP5_NEXT_PAGE_CTRL_BAM_MODE |
                              MDIO_BAM_NEXT_PAGE_MP5_NEXT_PAGE_CTRL_TETON_AN);
         }
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_BAM_NEXT_PAGE,
                               MDIO_BAM_NEXT_PAGE_MP5_NEXT_PAGE_CTRL,
                               reg_val);
 
         if (enable_cl73) {
                 /* Enable Cl73 FSM status bits */
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_CL73_USERB0,
                                     MDIO_CL73_USERB0_CL73_UCTRL,
                                       0xe);
 
                 /* Enable BAM Station Manager*/
-                CL45_WR_OVER_CL22(bp, params->port,
-                        params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                         MDIO_REG_BANK_CL73_USERB0,
                         MDIO_CL73_USERB0_CL73_BAM_CTRL1,
                         MDIO_CL73_USERB0_CL73_BAM_CTRL1_BAM_EN |
@@ -1242,20 +1262,18 @@ static void bnx2x_set_autoneg(struct link_params *params,
                         MDIO_CL73_USERB0_CL73_BAM_CTRL1_BAM_NP_AFTER_BP_EN);
 
                 /* Advertise CL73 link speeds */
-                        CL45_RD_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                               MDIO_REG_BANK_CL73_IEEEB1,
                                               MDIO_CL73_IEEEB1_AN_ADV2,
                                               &reg_val);
-                if (params->speed_cap_mask &
+                if (phy->speed_cap_mask &
                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)
                         reg_val |= MDIO_CL73_IEEEB1_AN_ADV2_ADVR_10G_KX4;
-                if (params->speed_cap_mask &
+                if (phy->speed_cap_mask &
                     PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
                         reg_val |= MDIO_CL73_IEEEB1_AN_ADV2_ADVR_1000M_KX;
 
-                        CL45_WR_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                               MDIO_REG_BANK_CL73_IEEEB1,
                                               MDIO_CL73_IEEEB1_AN_ADV2,
                                       reg_val);
@@ -1266,38 +1284,35 @@ static void bnx2x_set_autoneg(struct link_params *params,
         } else /* CL73 Autoneg Disabled */
                 reg_val = 0;
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_CL73_IEEEB0,
                               MDIO_CL73_IEEEB0_CL73_AN_CONTROL, reg_val);
 }
 
 /* program SerDes, forced speed */
-static void bnx2x_program_serdes(struct link_params *params,
+static void bnx2x_program_serdes(struct bnx2x_phy *phy,
+                                 struct link_params *params,
                                struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
         u16 reg_val;
 
         /* program duplex, disable autoneg and sgmii*/
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL, &reg_val);
         reg_val &= ~(MDIO_COMBO_IEEO_MII_CONTROL_FULL_DUPLEX |
                      MDIO_COMBO_IEEO_MII_CONTROL_AN_EN |
                      MDIO_COMBO_IEEO_MII_CONTROL_MAN_SGMII_SP_MASK);
-        if (params->req_duplex == DUPLEX_FULL)
+        if (phy->req_duplex == DUPLEX_FULL)
                 reg_val |= MDIO_COMBO_IEEO_MII_CONTROL_FULL_DUPLEX;
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_MII_CONTROL, reg_val);
 
         /* program speed
            - needed only if the speed is greater than 1G (2.5G or 10G) */
-        CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_SERDES_DIGITAL,
                                       MDIO_SERDES_DIGITAL_MISC1, &reg_val);
         /* clearing the speed value before setting the right speed */
@@ -1320,14 +1335,14 @@ static void bnx2x_program_serdes(struct link_params *params,
                                 MDIO_SERDES_DIGITAL_MISC1_FORCE_SPEED_13G;
         }
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_SERDES_DIGITAL,
                                       MDIO_SERDES_DIGITAL_MISC1, reg_val);
 
 }
 
-static void bnx2x_set_brcm_cl37_advertisment(struct link_params *params)
+static void bnx2x_set_brcm_cl37_advertisment(struct bnx2x_phy *phy,
+                                             struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 val = 0;
@@ -1335,29 +1350,28 @@ static void bnx2x_set_brcm_cl37_advertisment(struct link_params *params)
         /* configure the 48 bits for BAM AN */
 
         /* set extended capabilities */
-        if (params->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G)
+        if (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G)
                 val |= MDIO_OVER_1G_UP1_2_5G;
-        if (params->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)
+        if (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)
                 val |= MDIO_OVER_1G_UP1_10G;
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_OVER_1G,
                               MDIO_OVER_1G_UP1, val);
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_OVER_1G,
                               MDIO_OVER_1G_UP3, 0x400);
 }
 
-static void bnx2x_calc_ieee_aneg_adv(struct link_params *params, u16 *ieee_fc)
+static void bnx2x_calc_ieee_aneg_adv(struct bnx2x_phy *phy,
+                                     struct link_params *params, u16 *ieee_fc)
 {
         struct bnx2x *bp = params->bp;
         *ieee_fc = MDIO_COMBO_IEEE0_AUTO_NEG_ADV_FULL_DUPLEX;
         /* resolve pause mode and advertisement
          * Please refer to Table 28B-3 of the 802.3ab-1999 spec */
 
-        switch (params->req_flow_ctrl) {
+        switch (phy->req_flow_ctrl) {
         case BNX2X_FLOW_CTRL_AUTO:
                 if (params->req_fc_auto_adv == BNX2X_FLOW_CTRL_BOTH) {
                         *ieee_fc |=
@@ -1385,30 +1399,30 @@ static void bnx2x_calc_ieee_aneg_adv(struct link_params *params, u16 *ieee_fc)
         DP(NETIF_MSG_LINK, "ieee_fc = 0x%x\n", *ieee_fc);
 }
 
-static void bnx2x_set_ieee_aneg_advertisment(struct link_params *params,
+static void bnx2x_set_ieee_aneg_advertisment(struct bnx2x_phy *phy,
+                                             struct link_params *params,
                                            u16 ieee_fc)
 {
         struct bnx2x *bp = params->bp;
         u16 val;
         /* for AN, we are always publishing full duplex */
 
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_COMBO_IEEE0,
                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV, ieee_fc);
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_CL73_IEEEB1,
                               MDIO_CL73_IEEEB1_AN_ADV1, &val);
         val &= ~MDIO_CL73_IEEEB1_AN_ADV1_PAUSE_BOTH;
         val |= ((ieee_fc<<3) & MDIO_CL73_IEEEB1_AN_ADV1_PAUSE_MASK);
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_CL73_IEEEB1,
                               MDIO_CL73_IEEEB1_AN_ADV1, val);
 }
 
-static void bnx2x_restart_autoneg(struct link_params *params, u8 enable_cl73)
+static void bnx2x_restart_autoneg(struct bnx2x_phy *phy,
+                                  struct link_params *params,
+                                  u8 enable_cl73)
 {
         struct bnx2x *bp = params->bp;
         u16 mii_control;
@@ -1417,14 +1431,12 @@ static void bnx2x_restart_autoneg(struct link_params *params, u8 enable_cl73)
         /* Enable and restart BAM/CL37 aneg */
 
         if (enable_cl73) {
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_CL73_IEEEB0,
                                       MDIO_CL73_IEEEB0_CL73_AN_CONTROL,
                                       &mii_control);
 
-                CL45_WR_OVER_CL22(bp, params->port,
-                                params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                 MDIO_REG_BANK_CL73_IEEEB0,
                                 MDIO_CL73_IEEEB0_CL73_AN_CONTROL,
                                 (mii_control |
@@ -1432,16 +1444,14 @@ static void bnx2x_restart_autoneg(struct link_params *params, u8 enable_cl73)
                                 MDIO_CL73_IEEEB0_CL73_AN_CONTROL_RESTART_AN));
         } else {
 
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_COMBO_IEEE0,
                                       MDIO_COMBO_IEEE0_MII_CONTROL,
                                       &mii_control);
                 DP(NETIF_MSG_LINK,
                          "bnx2x_restart_autoneg mii_control before = 0x%x\n",
                          mii_control);
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_COMBO_IEEE0,
                                       MDIO_COMBO_IEEE0_MII_CONTROL,
                                       (mii_control |
@@ -1450,7 +1460,8 @@ static void bnx2x_restart_autoneg(struct link_params *params, u8 enable_cl73)
         }
 }
 
-static void bnx2x_initialize_sgmii_process(struct link_params *params,
+static void bnx2x_initialize_sgmii_process(struct bnx2x_phy *phy,
+                                           struct link_params *params,
                                          struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
@@ -1458,8 +1469,7 @@ static void bnx2x_initialize_sgmii_process(struct link_params *params,
 
         /* in SGMII mode, the unicore is always slave */
 
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL1,
                       &control1);
@@ -1468,8 +1478,7 @@ static void bnx2x_initialize_sgmii_process(struct link_params *params,
         control1 &= ~(MDIO_SERDES_DIGITAL_A_1000X_CONTROL1_FIBER_MODE |
                       MDIO_SERDES_DIGITAL_A_1000X_CONTROL1_AUTODET |
                       MDIO_SERDES_DIGITAL_A_1000X_CONTROL1_MSTR_MODE);
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_CONTROL1,
                               control1);
@@ -1479,8 +1488,7 @@ static void bnx2x_initialize_sgmii_process(struct link_params *params,
                 /* set speed, disable autoneg */
                 u16 mii_control;
 
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_COMBO_IEEE0,
                                       MDIO_COMBO_IEEE0_MII_CONTROL,
                                       &mii_control);
@@ -1508,18 +1516,17 @@ static void bnx2x_initialize_sgmii_process(struct link_params *params,
                 }
 
                 /* setting the full duplex */
-                if (params->req_duplex == DUPLEX_FULL)
+                if (phy->req_duplex == DUPLEX_FULL)
                         mii_control |=
                                 MDIO_COMBO_IEEO_MII_CONTROL_FULL_DUPLEX;
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_COMBO_IEEE0,
                                       MDIO_COMBO_IEEE0_MII_CONTROL,
                                       mii_control);
 
         } else { /* AN mode */
                 /* enable and restart AN */
-                bnx2x_restart_autoneg(params, 0);
+                bnx2x_restart_autoneg(phy, params, 0);
         }
 }
 
@@ -1549,91 +1556,24 @@ static void bnx2x_pause_resolve(struct link_vars *vars, u32 pause_result)
         default:
                 break;
         }
+        if (pause_result & (1<<0))
+                vars->link_status |= LINK_STATUS_LINK_PARTNER_SYMMETRIC_PAUSE;
+        if (pause_result & (1<<1))
+                vars->link_status |= LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE;
 }
 
-static u8 bnx2x_ext_phy_resolve_fc(struct link_params *params,
-                                  struct link_vars *vars)
-{
-        struct bnx2x *bp = params->bp;
-        u8 ext_phy_addr;
-        u16 ld_pause;           /* local */
-        u16 lp_pause;           /* link partner */
-        u16 an_complete;        /* AN complete */
-        u16 pause_result;
-        u8 ret = 0;
-        u32 ext_phy_type;
-        u8 port = params->port;
-        ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-        /* read twice */
-
-        bnx2x_cl45_read(bp, port,
-                      ext_phy_type,
-                      ext_phy_addr,
-                      MDIO_AN_DEVAD,
-                      MDIO_AN_REG_STATUS, &an_complete);
-        bnx2x_cl45_read(bp, port,
-                      ext_phy_type,
-                      ext_phy_addr,
-                      MDIO_AN_DEVAD,
-                      MDIO_AN_REG_STATUS, &an_complete);
-
-        if (an_complete & MDIO_AN_REG_STATUS_AN_COMPLETE) {
-                ret = 1;
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
-                              MDIO_AN_DEVAD,
-                              MDIO_AN_REG_ADV_PAUSE, &ld_pause);
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
-                              MDIO_AN_DEVAD,
-                              MDIO_AN_REG_LP_AUTO_NEG, &lp_pause);
-                pause_result = (ld_pause &
-                                MDIO_AN_REG_ADV_PAUSE_MASK) >> 8;
-                pause_result |= (lp_pause &
-                                 MDIO_AN_REG_ADV_PAUSE_MASK) >> 10;
-                DP(NETIF_MSG_LINK, "Ext PHY pause result 0x%x\n",
-                   pause_result);
-                bnx2x_pause_resolve(vars, pause_result);
-                if (vars->flow_ctrl == BNX2X_FLOW_CTRL_NONE &&
-                     ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073) {
-                        bnx2x_cl45_read(bp, port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_AN_DEVAD,
-                                      MDIO_AN_REG_CL37_FC_LD, &ld_pause);
-
-                        bnx2x_cl45_read(bp, port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_AN_DEVAD,
-                                      MDIO_AN_REG_CL37_FC_LP, &lp_pause);
-                        pause_result = (ld_pause &
-                                MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) >> 5;
-                        pause_result |= (lp_pause &
-                                MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) >> 7;
-
-                        bnx2x_pause_resolve(vars, pause_result);
-                        DP(NETIF_MSG_LINK, "Ext PHY CL37 pause result 0x%x\n",
-                                 pause_result);
-                }
-        }
-        return ret;
-}
-
-static u8 bnx2x_direct_parallel_detect_used(struct link_params *params)
+static u8 bnx2x_direct_parallel_detect_used(struct bnx2x_phy *phy,
+                                            struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 pd_10g, status2_1000x;
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        if (phy->req_line_speed != SPEED_AUTO_NEG)
+                return 0;
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_STATUS2,
                               &status2_1000x);
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_SERDES_DIGITAL,
                               MDIO_SERDES_DIGITAL_A_1000X_STATUS2,
                               &status2_1000x);
@@ -1643,8 +1583,7 @@ static u8 bnx2x_direct_parallel_detect_used(struct link_params *params)
                 return 1;
         }
 
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_10G_PARALLEL_DETECT,
                               MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_STATUS,
                               &pd_10g);
@@ -1657,9 +1596,10 @@ static u8 bnx2x_direct_parallel_detect_used(struct link_params *params)
         return 0;
 }
 
-static void bnx2x_flow_ctrl_resolve(struct link_params *params,
-                                  struct link_vars *vars,
-                                  u32 gp_status)
+static void bnx2x_flow_ctrl_resolve(struct bnx2x_phy *phy,
+                                    struct link_params *params,
+                                    struct link_vars *vars,
+                                    u32 gp_status)
 {
         struct bnx2x *bp = params->bp;
         u16 ld_pause;   /* local driver */
@@ -1669,12 +1609,13 @@ static void bnx2x_flow_ctrl_resolve(struct link_params *params,
         vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
 
         /* resolve from gp_status in case of AN complete and not sgmii */
-        if ((params->req_flow_ctrl == BNX2X_FLOW_CTRL_AUTO) &&
-            (gp_status & MDIO_AN_CL73_OR_37_COMPLETE) &&
-            (!(vars->phy_flags & PHY_SGMII_FLAG)) &&
-            (XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)) {
-                if (bnx2x_direct_parallel_detect_used(params)) {
+        if (phy->req_flow_ctrl != BNX2X_FLOW_CTRL_AUTO)
+                vars->flow_ctrl = phy->req_flow_ctrl;
+        else if (phy->req_line_speed != SPEED_AUTO_NEG)
+                vars->flow_ctrl = params->req_fc_auto_adv;
+        else if ((gp_status & MDIO_AN_CL73_OR_37_COMPLETE) &&
+                 (!(vars->phy_flags & PHY_SGMII_FLAG))) {
+                if (bnx2x_direct_parallel_detect_used(phy, params)) {
                         vars->flow_ctrl = params->req_fc_auto_adv;
                         return;
                 }
@@ -1684,13 +1625,11 @@ static void bnx2x_flow_ctrl_resolve(struct link_params *params,
                     (MDIO_GP_STATUS_TOP_AN_STATUS1_CL73_AUTONEG_COMPLETE |
                      MDIO_GP_STATUS_TOP_AN_STATUS1_CL73_MR_LP_NP_AN_ABLE)) {
 
-                        CL45_RD_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
+                        CL45_RD_OVER_CL22(bp, phy,
                                               MDIO_REG_BANK_CL73_IEEEB1,
                                               MDIO_CL73_IEEEB1_AN_ADV1,
                                               &ld_pause);
-                        CL45_RD_OVER_CL22(bp, params->port,
-                                             params->phy_addr,
+                        CL45_RD_OVER_CL22(bp, phy,
                                              MDIO_REG_BANK_CL73_IEEEB1,
                                              MDIO_CL73_IEEEB1_AN_LP_ADV1,
                                              &lp_pause);
@@ -1703,14 +1642,11 @@ static void bnx2x_flow_ctrl_resolve(struct link_params *params,
                         DP(NETIF_MSG_LINK, "pause_result CL73 0x%x\n",
                                  pause_result);
                 } else {
-
-                        CL45_RD_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
+                        CL45_RD_OVER_CL22(bp, phy,
                                               MDIO_REG_BANK_COMBO_IEEE0,
                                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV,
                                               &ld_pause);
-                        CL45_RD_OVER_CL22(bp, params->port,
-                               params->phy_addr,
+                        CL45_RD_OVER_CL22(bp, phy,
                                MDIO_REG_BANK_COMBO_IEEE0,
                                MDIO_COMBO_IEEE0_AUTO_NEG_LINK_PARTNER_ABILITY1,
                                &lp_pause);
@@ -1722,26 +1658,18 @@ static void bnx2x_flow_ctrl_resolve(struct link_params *params,
                                  pause_result);
                 }
                 bnx2x_pause_resolve(vars, pause_result);
-        } else if ((params->req_flow_ctrl == BNX2X_FLOW_CTRL_AUTO) &&
-                   (bnx2x_ext_phy_resolve_fc(params, vars))) {
-                return;
-        } else {
-                if (params->req_flow_ctrl == BNX2X_FLOW_CTRL_AUTO)
-                        vars->flow_ctrl = params->req_fc_auto_adv;
-                else
-                        vars->flow_ctrl = params->req_flow_ctrl;
         }
         DP(NETIF_MSG_LINK, "flow_ctrl 0x%x\n", vars->flow_ctrl);
 }
 
-static void bnx2x_check_fallback_to_cl37(struct link_params *params)
+static void bnx2x_check_fallback_to_cl37(struct bnx2x_phy *phy,
+                                         struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 rx_status, ustat_val, cl37_fsm_recieved;
         DP(NETIF_MSG_LINK, "bnx2x_check_fallback_to_cl37\n");
         /* Step 1: Make sure signal is detected */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_RX0,
                               MDIO_RX0_RX_STATUS,
                               &rx_status);
@@ -1749,16 +1677,14 @@ static void bnx2x_check_fallback_to_cl37(struct link_params *params)
             (MDIO_RX0_RX_STATUS_SIGDET)) {
                 DP(NETIF_MSG_LINK, "Signal is not detected. Restoring CL73."
                              "rx_status(0x80b0) = 0x%x\n", rx_status);
-                CL45_WR_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_WR_OVER_CL22(bp, phy,
                                       MDIO_REG_BANK_CL73_IEEEB0,
                                       MDIO_CL73_IEEEB0_CL73_AN_CONTROL,
                                       MDIO_CL73_IEEEB0_CL73_AN_CONTROL_AN_EN);
                 return;
         }
         /* Step 2: Check CL73 state machine */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_CL73_USERB0,
                               MDIO_CL73_USERB0_CL73_USTAT1,
                               &ustat_val);
@@ -1773,8 +1699,7 @@ static void bnx2x_check_fallback_to_cl37(struct link_params *params)
         }
         /* Step 3: Check CL37 Message Pages received to indicate LP
         supports only CL37 */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_REMOTE_PHY,
                               MDIO_REMOTE_PHY_MISC_RX_STATUS,
                               &cl37_fsm_recieved);
@@ -1792,25 +1717,45 @@ static void bnx2x_check_fallback_to_cl37(struct link_params *params)
         connected to a device which does not support cl73, but does support
         cl37 BAM. In this case we disable cl73 and restart cl37 auto-neg */
         /* Disable CL73 */
-        CL45_WR_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_WR_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_CL73_IEEEB0,
                               MDIO_CL73_IEEEB0_CL73_AN_CONTROL,
                               0);
         /* Restart CL37 autoneg */
-        bnx2x_restart_autoneg(params, 0);
+        bnx2x_restart_autoneg(phy, params, 0);
         DP(NETIF_MSG_LINK, "Disabling CL73, and restarting CL37 autoneg\n");
 }
-static u8 bnx2x_link_settings_status(struct link_params *params,
-                                   struct link_vars *vars,
-                                   u32 gp_status,
-                                   u8 ext_phy_link_up)
+
+static void bnx2x_xgxs_an_resolve(struct bnx2x_phy *phy,
+                                  struct link_params *params,
+                                  struct link_vars *vars,
+                                  u32 gp_status)
+{
+        if (gp_status & MDIO_AN_CL73_OR_37_COMPLETE)
+                vars->link_status |=
+                        LINK_STATUS_AUTO_NEGOTIATE_COMPLETE;
+
+        if (bnx2x_direct_parallel_detect_used(phy, params))
+                vars->link_status |=
+                        LINK_STATUS_PARALLEL_DETECTION_USED;
+}
+
+static u8 bnx2x_link_settings_status(struct bnx2x_phy *phy,
+                                     struct link_params *params,
+                                     struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
-        u16 new_line_speed;
+        u16 new_line_speed , gp_status;
         u8 rc = 0;
-        vars->link_status = 0;
 
+        /* Read gp_status */
+        CL45_RD_OVER_CL22(bp, phy,
+                                MDIO_REG_BANK_GP_STATUS,
+                                MDIO_GP_STATUS_TOP_AN_STATUS1,
+                                &gp_status);
+
+        if (phy->req_line_speed == SPEED_AUTO_NEG)
+                vars->link_status |= LINK_STATUS_AUTO_NEGOTIATE_ENABLED;
         if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) {
                 DP(NETIF_MSG_LINK, "phy link up gp_status=0x%x\n",
                          gp_status);
@@ -1823,7 +1768,12 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                 else
                         vars->duplex = DUPLEX_HALF;
 
-                bnx2x_flow_ctrl_resolve(params, vars, gp_status);
+                if (SINGLE_MEDIA_DIRECT(params)) {
+                        bnx2x_flow_ctrl_resolve(phy, params, vars, gp_status);
+                        if (phy->req_line_speed == SPEED_AUTO_NEG)
+                                bnx2x_xgxs_an_resolve(phy, params, vars,
+                                                      gp_status);
+                }
 
                 switch (gp_status & GP_STATUS_SPEED_MASK) {
                 case GP_STATUS_10M:
@@ -1905,56 +1855,7 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
                         return -EINVAL;
                 }
 
-                /* Upon link speed change set the NIG into drain mode.
-                Comes to deals with possible FIFO glitch due to clk change
-                when speed is decreased without link down indicator */
-                if (new_line_speed != vars->line_speed) {
-                        if (XGXS_EXT_PHY_TYPE(params->ext_phy_config) !=
-                             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT &&
-                            ext_phy_link_up) {
-                                DP(NETIF_MSG_LINK, "Internal link speed %d is"
-                                            " different than the external"
-                                            " link speed %d\n", new_line_speed,
-                                          vars->line_speed);
-                                vars->phy_link_up = 0;
-                                return 0;
-                        }
-                        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE
-                                    + params->port*4, 0);
-                        msleep(1);
-                }
                 vars->line_speed = new_line_speed;
-                vars->link_status |= LINK_STATUS_SERDES_LINK;
-
-                if ((params->req_line_speed == SPEED_AUTO_NEG) &&
-                    ((XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) ||
-                    (XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) ||
-                    (XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706) ||
-                    (XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726))) {
-                        vars->autoneg = AUTO_NEG_ENABLED;
-
-                        if (gp_status & MDIO_AN_CL73_OR_37_COMPLETE) {
-                                vars->autoneg |= AUTO_NEG_COMPLETE;
-                                vars->link_status |=
-                                        LINK_STATUS_AUTO_NEGOTIATE_COMPLETE;
-                        }
-
-                        vars->autoneg |= AUTO_NEG_PARALLEL_DETECTION_USED;
-                        vars->link_status |=
-                                LINK_STATUS_PARALLEL_DETECTION_USED;
-
-                }
-                if (vars->flow_ctrl & BNX2X_FLOW_CTRL_TX)
-                        vars->link_status |=
-                                LINK_STATUS_TX_FLOW_CONTROL_ENABLED;
-
-                if (vars->flow_ctrl & BNX2X_FLOW_CTRL_RX)
-                        vars->link_status |=
-                                LINK_STATUS_RX_FLOW_CONTROL_ENABLED;
 
         } else { /* link_down */
                 DP(NETIF_MSG_LINK, "phy link down\n");
@@ -1963,38 +1864,32 @@ static u8 bnx2x_link_settings_status(struct link_params *params,
 
                 vars->duplex = DUPLEX_FULL;
                 vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
-                vars->autoneg = AUTO_NEG_DISABLED;
                 vars->mac_type = MAC_TYPE_NONE;
 
-                if ((params->req_line_speed == SPEED_AUTO_NEG) &&
-                    ((XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT))) {
+                if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                    SINGLE_MEDIA_DIRECT(params)) {
                         /* Check signal is detected */
-                        bnx2x_check_fallback_to_cl37(params);
+                        bnx2x_check_fallback_to_cl37(phy, params);
                 }
         }
 
         DP(NETIF_MSG_LINK, "gp_status 0x%x  phy_link_up %x line_speed %x\n",
                  gp_status, vars->phy_link_up, vars->line_speed);
-        DP(NETIF_MSG_LINK, "duplex %x  flow_ctrl 0x%x"
-                 " autoneg 0x%x\n",
-                 vars->duplex,
-                 vars->flow_ctrl, vars->autoneg);
-        DP(NETIF_MSG_LINK, "link_status 0x%x\n", vars->link_status);
-
+        DP(NETIF_MSG_LINK, "duplex %x  flow_ctrl 0x%x link_status 0x%x\n",
+                   vars->duplex, vars->flow_ctrl, vars->link_status);
         return rc;
 }
 
 static void bnx2x_set_gmii_tx_driver(struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
+        struct bnx2x_phy *phy = &params->phy[INT_PHY];
         u16 lp_up2;
         u16 tx_driver;
         u16 bank;
 
         /* read precomp */
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
+        CL45_RD_OVER_CL22(bp, phy,
                               MDIO_REG_BANK_OVER_1G,
                               MDIO_OVER_1G_LP_UP2, &lp_up2);
 
@@ -2008,8 +1903,7 @@ static void bnx2x_set_gmii_tx_driver(struct link_params *params)
 
         for (bank = MDIO_REG_BANK_TX0; bank <= MDIO_REG_BANK_TX3;
               bank += (MDIO_REG_BANK_TX1 - MDIO_REG_BANK_TX0)) {
-                CL45_RD_OVER_CL22(bp, params->port,
-                                      params->phy_addr,
+                CL45_RD_OVER_CL22(bp, phy,
                                       bank,
                                       MDIO_TX0_TX_DRIVER, &tx_driver);
 
@@ -2018,8 +1912,7 @@ static void bnx2x_set_gmii_tx_driver(struct link_params *params)
                     (tx_driver & MDIO_TX0_TX_DRIVER_PREEMPHASIS_MASK)) {
                         tx_driver &= ~MDIO_TX0_TX_DRIVER_PREEMPHASIS_MASK;
                         tx_driver |= lp_up2;
-                        CL45_WR_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
+                        CL45_WR_OVER_CL22(bp, phy,
                                               bank,
                                               MDIO_TX0_TX_DRIVER, tx_driver);
                 }
@@ -2027,7 +1920,7 @@ static void bnx2x_set_gmii_tx_driver(struct link_params *params)
 }
 
 static u8 bnx2x_emac_program(struct link_params *params,
-                           u32 line_speed, u32 duplex)
+                             struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
         u8 port = params->port;
@@ -2039,7 +1932,7 @@ static u8 bnx2x_emac_program(struct link_params *params,
                      (EMAC_MODE_25G_MODE |
                      EMAC_MODE_PORT_MII_10M |
                      EMAC_MODE_HALF_DUPLEX));
-        switch (line_speed) {
+        switch (vars->line_speed) {
         case SPEED_10:
                 mode |= EMAC_MODE_PORT_MII_10M;
                 break;
@@ -2058,371 +1951,1369 @@ static u8 bnx2x_emac_program(struct link_params *params,
 
         default:
                 /* 10G not valid for EMAC */
-                DP(NETIF_MSG_LINK, "Invalid line_speed 0x%x\n", line_speed);
+                DP(NETIF_MSG_LINK, "Invalid line_speed 0x%x\n",
+                           vars->line_speed);
                 return -EINVAL;
         }
 
-        if (duplex == DUPLEX_HALF)
+        if (vars->duplex == DUPLEX_HALF)
                 mode |= EMAC_MODE_HALF_DUPLEX;
         bnx2x_bits_en(bp,
                     GRCBASE_EMAC0 + port*0x400 + EMAC_REG_EMAC_MODE,
                     mode);
 
-        bnx2x_set_led(params, LED_MODE_OPER, line_speed);
+        bnx2x_set_led(params, vars, LED_MODE_OPER, vars->line_speed);
         return 0;
 }
 
-/*****************************************************************************/
-/*                           External Phy section                            */
-/*****************************************************************************/
-void bnx2x_ext_phy_hw_reset(struct bnx2x *bp, u8 port)
+static void bnx2x_set_preemphasis(struct bnx2x_phy *phy,
+                                  struct link_params *params)
 {
-        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                       MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
-        msleep(1);
-        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                      MISC_REGISTERS_GPIO_OUTPUT_HIGH, port);
+
+        u16 bank, i = 0;
+        struct bnx2x *bp = params->bp;
+
+        for (bank = MDIO_REG_BANK_RX0, i = 0; bank <= MDIO_REG_BANK_RX3;
+              bank += (MDIO_REG_BANK_RX1-MDIO_REG_BANK_RX0), i++) {
+                        CL45_WR_OVER_CL22(bp, phy,
+                                          bank,
+                                          MDIO_RX0_RX_EQ_BOOST,
+                                          phy->rx_preemphasis[i]);
+        }
+
+        for (bank = MDIO_REG_BANK_TX0, i = 0; bank <= MDIO_REG_BANK_TX3;
+                      bank += (MDIO_REG_BANK_TX1 - MDIO_REG_BANK_TX0), i++) {
+                        CL45_WR_OVER_CL22(bp, phy,
+                                          bank,
+                                          MDIO_TX0_TX_DRIVER,
+                                          phy->tx_preemphasis[i]);
+        }
 }
 
-static void bnx2x_ext_phy_reset(struct link_params *params,
-                              struct link_vars   *vars)
+static void bnx2x_init_internal_phy(struct bnx2x_phy *phy,
+                                    struct link_params *params,
+                                    struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
-        u32 ext_phy_type;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
+        u8 enable_cl73 = (SINGLE_MEDIA_DIRECT(params) ||
+                          (params->loopback_mode == LOOPBACK_XGXS));
+        if (!(vars->phy_flags & PHY_SGMII_FLAG)) {
+                if (SINGLE_MEDIA_DIRECT(params) &&
+                    (params->feature_config_flags &
+                     FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED))
+                        bnx2x_set_preemphasis(phy, params);
 
-        DP(NETIF_MSG_LINK, "Port %x: bnx2x_ext_phy_reset\n", params->port);
-        ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-        /* The PHY reset is controled by GPIO 1
-         * Give it 1ms of reset pulse
-         */
-        if (vars->phy_flags & PHY_XGXS_FLAG) {
+                /* forced speed requested? */
+                if (vars->line_speed != SPEED_AUTO_NEG ||
+                    (SINGLE_MEDIA_DIRECT(params) &&
+                          params->loopback_mode == LOOPBACK_EXT)) {
+                        DP(NETIF_MSG_LINK, "not SGMII, no AN\n");
 
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                        DP(NETIF_MSG_LINK, "XGXS Direct\n");
-                        break;
+                        /* disable autoneg */
+                        bnx2x_set_autoneg(phy, params, vars, 0);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        DP(NETIF_MSG_LINK, "XGXS 8705/8706\n");
+                        /* program speed and duplex */
+                        bnx2x_program_serdes(phy, params, vars);
 
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+                } else { /* AN_mode */
+                        DP(NETIF_MSG_LINK, "not SGMII, AN\n");
 
-                        /* HW reset */
-                        bnx2x_ext_phy_hw_reset(bp, params->port);
+                        /* AN enabled */
+                        bnx2x_set_brcm_cl37_advertisment(phy, params);
 
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL, 0xa040);
-                        break;
+                        /* program duplex & pause advertisement (for aneg) */
+                        bnx2x_set_ieee_aneg_advertisment(phy, params,
+                                                       vars->ieee_fc);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                        break;
+                        /* enable autoneg */
+                        bnx2x_set_autoneg(phy, params, vars, enable_cl73);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
+                        /* enable and restart AN */
+                        bnx2x_restart_autoneg(phy, params, enable_cl73);
+                }
 
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                          MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+        } else { /* SGMII mode */
+                DP(NETIF_MSG_LINK, "SGMII\n");
 
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                                          MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+                bnx2x_initialize_sgmii_process(phy, params, vars);
+        }
+}
 
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL,
-                                       1<<15);
-                        break;
+static u8 bnx2x_init_serdes(struct bnx2x_phy *phy,
+                            struct link_params *params,
+                            struct link_vars *vars)
+{
+        u8 rc;
+        vars->phy_flags |= PHY_SGMII_FLAG;
+        bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
+        bnx2x_set_aer_mmd(params, phy);
+        rc = bnx2x_reset_unicore(params, phy, 1);
+        /* reset the SerDes and wait for reset bit return low */
+        if (rc != 0)
+                return rc;
+        bnx2x_set_aer_mmd(params, phy);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                        DP(NETIF_MSG_LINK, "XGXS 8072\n");
+        return rc;
+}
 
-                        /* Unset Low Power Mode and SW reset */
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+static u8 bnx2x_init_xgxs(struct bnx2x_phy *phy,
+                          struct link_params *params,
+                          struct link_vars *vars)
+{
+        u8 rc;
+        vars->phy_flags = PHY_XGXS_FLAG;
+        if ((phy->req_line_speed &&
+             ((phy->req_line_speed == SPEED_100) ||
+              (phy->req_line_speed == SPEED_10))) ||
+            (!phy->req_line_speed &&
+             (phy->speed_cap_mask >=
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
+             (phy->speed_cap_mask <
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
+             ))
+                vars->phy_flags |= PHY_SGMII_FLAG;
+        else
+                vars->phy_flags &= ~PHY_SGMII_FLAG;
 
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL,
-                                       1<<15);
-                        break;
+        bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
+        bnx2x_set_aer_mmd(params, phy);
+        bnx2x_set_master_ln(params, phy);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                        DP(NETIF_MSG_LINK, "XGXS 8073\n");
+        rc = bnx2x_reset_unicore(params, phy, 0);
+        /* reset the SerDes and wait for reset bit return low */
+        if (rc != 0)
+                return rc;
 
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+        bnx2x_set_aer_mmd(params, phy);
 
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+        /* setting the masterLn_def again after the reset */
+        bnx2x_set_master_ln(params, phy);
+        bnx2x_set_swap_lanes(params, phy);
+
+        return rc;
+}
+
+static u16 bnx2x_wait_reset_complete(struct bnx2x *bp,
+                                     struct bnx2x_phy *phy)
+{
+        u16 cnt, ctrl;
+        /* Wait for soft reset to get cleared upto 1 sec */
+        for (cnt = 0; cnt < 1000; cnt++) {
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, &ctrl);
+                if (!(ctrl & (1<<15)))
                         break;
+                msleep(1);
+        }
+        DP(NETIF_MSG_LINK, "control reg 0x%x (after %d ms)\n", ctrl, cnt);
+        return cnt;
+}
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                        DP(NETIF_MSG_LINK, "XGXS SFX7101\n");
+static void bnx2x_link_int_enable(struct link_params *params)
+{
+        u8 port = params->port;
+        u32 mask;
+        struct bnx2x *bp = params->bp;
 
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+        /* setting the status to report on link up
+           for either XGXS or SerDes */
 
-                        /* HW reset */
-                        bnx2x_ext_phy_hw_reset(bp, params->port);
-                        break;
+        if (params->switch_cfg == SWITCH_CFG_10G) {
+                mask = (NIG_MASK_XGXS0_LINK10G |
+                        NIG_MASK_XGXS0_LINK_STATUS);
+                DP(NETIF_MSG_LINK, "enabled XGXS interrupt\n");
+                if (!(SINGLE_MEDIA_DIRECT(params)) &&
+                        params->phy[INT_PHY].type !=
+                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) {
+                        mask |= NIG_MASK_MI_INT;
+                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
+                }
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-                        /* Restore normal power mode*/
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                      MISC_REGISTERS_GPIO_OUTPUT_HIGH,
-                                          params->port);
+        } else { /* SerDes */
+                mask = NIG_MASK_SERDES0_LINK_STATUS;
+                DP(NETIF_MSG_LINK, "enabled SerDes interrupt\n");
+                if (!(SINGLE_MEDIA_DIRECT(params)) &&
+                        params->phy[INT_PHY].type !=
+                                PORT_HW_CFG_SERDES_EXT_PHY_TYPE_NOT_CONN) {
+                        mask |= NIG_MASK_MI_INT;
+                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
+                }
+        }
+        bnx2x_bits_en(bp,
+                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
+                      mask);
 
-                        /* HW reset */
-                        bnx2x_ext_phy_hw_reset(bp, params->port);
+        DP(NETIF_MSG_LINK, "port %x, is_xgxs %x, int_status 0x%x\n", port,
+                 (params->switch_cfg == SWITCH_CFG_10G),
+                 REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4));
+        DP(NETIF_MSG_LINK, " int_mask 0x%x, MI_INT %x, SERDES_LINK %x\n",
+                 REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4),
+                 REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT + port*0x18),
+                 REG_RD(bp, NIG_REG_SERDES0_STATUS_LINK_STATUS+port*0x3c));
+        DP(NETIF_MSG_LINK, " 10G %x, XGXS_LINK %x\n",
+           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
+           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68));
+}
 
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL,
-                                       1<<15);
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
-                        DP(NETIF_MSG_LINK, "XGXS PHY Failure detected\n");
-                        break;
+static void bnx2x_rearm_latch_signal(struct bnx2x *bp, u8 port,
+                                     u8 exp_mi_int)
+{
+        u32 latch_status = 0;
 
-                default:
-                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
-                           params->ext_phy_config);
-                        break;
+        /**
+         * Disable the MI INT ( external phy int ) by writing 1 to the
+         * status register. Link down indication is high-active-signal,
+         * so in this case we need to write the status to clear the XOR
+         */
+        /* Read Latched signals */
+        latch_status = REG_RD(bp,
+                                    NIG_REG_LATCH_STATUS_0 + port*8);
+        DP(NETIF_MSG_LINK, "latch_status = 0x%x\n", latch_status);
+        /* Handle only those with latched-signal=up.*/
+        if (exp_mi_int)
+                bnx2x_bits_en(bp,
+                              NIG_REG_STATUS_INTERRUPT_PORT0
+                              + port*4,
+                              NIG_STATUS_EMAC0_MI_INT);
+        else
+                bnx2x_bits_dis(bp,
+                               NIG_REG_STATUS_INTERRUPT_PORT0
+                               + port*4,
+                               NIG_STATUS_EMAC0_MI_INT);
+
+        if (latch_status & 1) {
+
+                /* For all latched-signal=up : Re-Arm Latch signals */
+                REG_WR(bp, NIG_REG_LATCH_STATUS_0 + port*8,
+                             (latch_status & 0xfffe) | (latch_status & 1));
+        }
+        /* For all latched-signal=up,Write original_signal to status */
+}
+
+static void bnx2x_link_int_ack(struct link_params *params,
+                             struct link_vars *vars, u8 is_10g)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port;
+
+        /* first reset all status
+         * we assume only one line will be change at a time */
+        bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
+                     (NIG_STATUS_XGXS0_LINK10G |
+                      NIG_STATUS_XGXS0_LINK_STATUS |
+                      NIG_STATUS_SERDES0_LINK_STATUS));
+        if (vars->phy_link_up) {
+                if (is_10g) {
+                        /* Disable the 10G link interrupt
+                         * by writing 1 to the status register
+                         */
+                        DP(NETIF_MSG_LINK, "10G XGXS phy link up\n");
+                        bnx2x_bits_en(bp,
+                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
+                                      NIG_STATUS_XGXS0_LINK10G);
+
+                } else if (params->switch_cfg == SWITCH_CFG_10G) {
+                        /* Disable the link interrupt
+                         * by writing 1 to the relevant lane
+                         * in the status register
+                         */
+                        u32 ser_lane = ((params->lane_config &
+                                    PORT_HW_CFG_LANE_SWAP_CFG_MASTER_MASK) >>
+                                    PORT_HW_CFG_LANE_SWAP_CFG_MASTER_SHIFT);
+
+                        DP(NETIF_MSG_LINK, "%d speed XGXS phy link up\n",
+                                 vars->line_speed);
+                        bnx2x_bits_en(bp,
+                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
+                                      ((1 << ser_lane) <<
+                                       NIG_STATUS_XGXS0_LINK_STATUS_SIZE));
+
+                } else { /* SerDes */
+                        DP(NETIF_MSG_LINK, "SerDes phy link up\n");
+                        /* Disable the link interrupt
+                         * by writing 1 to the status register
+                         */
+                        bnx2x_bits_en(bp,
+                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
+                                      NIG_STATUS_SERDES0_LINK_STATUS);
                 }
 
-        } else { /* SerDes */
-                ext_phy_type = SERDES_EXT_PHY_TYPE(params->ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT:
-                        DP(NETIF_MSG_LINK, "SerDes Direct\n");
-                        break;
+        }
+}
+
+static u8 bnx2x_format_ver(u32 num, u8 *str, u16 *len)
+{
+        u8 *str_ptr = str;
+        u32 mask = 0xf0000000;
+        u8 shift = 8*4;
+        u8 digit;
+        u8 remove_leading_zeros = 1;
+        if (*len < 10) {
+                /* Need more than 10chars for this format */
+                *str_ptr = '\0';
+                (*len)--;
+                return -EINVAL;
+        }
+        while (shift > 0) {
+
+                shift -= 4;
+                digit = ((num & mask) >> shift);
+                if (digit == 0 && remove_leading_zeros) {
+                        mask = mask >> 4;
+                        continue;
+                } else if (digit < 0xa)
+                        *str_ptr = digit + '0';
+                else
+                        *str_ptr = digit - 0xa + 'a';
+                remove_leading_zeros = 0;
+                str_ptr++;
+                (*len)--;
+                mask = mask >> 4;
+                if (shift == 4*4) {
+                        *str_ptr = '.';
+                        str_ptr++;
+                        (*len)--;
+                        remove_leading_zeros = 1;
+                }
+        }
+        return 0;
+}
+
+
+static u8 bnx2x_null_format_ver(u32 spirom_ver, u8 *str, u16 *len)
+{
+        str[0] = '\0';
+        (*len)--;
+        return 0;
+}
+
+u8 bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 driver_loaded,
+                              u8 *version, u16 len)
+{
+        struct bnx2x *bp;
+        u32 spirom_ver = 0;
+        u8 status = 0;
+        u8 *ver_p = version;
+        u16 remain_len = len;
+        if (version == NULL || params == NULL)
+                return -EINVAL;
+        bp = params->bp;
+
+        /* Extract first external phy*/
+        version[0] = '\0';
+        spirom_ver = REG_RD(bp, params->phy[EXT_PHY1].ver_addr);
+
+        if (params->phy[EXT_PHY1].format_fw_ver) {
+                status |= params->phy[EXT_PHY1].format_fw_ver(spirom_ver,
+                                                              ver_p,
+                                                              &remain_len);
+                ver_p += (len - remain_len);
+        }
+        if ((params->num_phys == MAX_PHYS) &&
+            (params->phy[EXT_PHY2].ver_addr != 0)) {
+                spirom_ver = REG_RD(bp,
+                                          params->phy[EXT_PHY2].ver_addr);
+                if (params->phy[EXT_PHY2].format_fw_ver) {
+                        *ver_p = '/';
+                        ver_p++;
+                        remain_len--;
+                        status |= params->phy[EXT_PHY2].format_fw_ver(
+                                spirom_ver,
+                                ver_p,
+                                &remain_len);
+                        ver_p = version + (len - remain_len);
+                }
+        }
+        *ver_p = '\0';
+        return status;
+}
+
+static void bnx2x_set_xgxs_loopback(struct bnx2x_phy *phy,
+                                    struct link_params *params)
+{
+        u8 port = params->port;
+        struct bnx2x *bp = params->bp;
+
+        if (phy->req_line_speed != SPEED_1000) {
+                u32 md_devad;
+
+                DP(NETIF_MSG_LINK, "XGXS 10G loopback enable\n");
+
+                /* change the uni_phy_addr in the nig */
+                md_devad = REG_RD(bp, (NIG_REG_XGXS0_CTRL_MD_DEVAD +
+                                          port*0x18));
+
+                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18, 0x5);
+
+                bnx2x_cl45_write(bp, phy,
+                               5,
+                               (MDIO_REG_BANK_AER_BLOCK +
+                                (MDIO_AER_BLOCK_AER_REG & 0xf)),
+                               0x2800);
+
+                bnx2x_cl45_write(bp, phy,
+                               5,
+                               (MDIO_REG_BANK_CL73_IEEEB0 +
+                                (MDIO_CL73_IEEEB0_CL73_AN_CONTROL & 0xf)),
+                               0x6041);
+                msleep(200);
+                /* set aer mmd back */
+                bnx2x_set_aer_mmd(params, phy);
+
+                /* and md_devad */
+                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18,
+                            md_devad);
+
+        } else {
+                u16 mii_ctrl;
+                DP(NETIF_MSG_LINK, "XGXS 1G loopback enable\n");
+                bnx2x_cl45_read(bp, phy, 5,
+                                (MDIO_REG_BANK_COMBO_IEEE0 +
+                                (MDIO_COMBO_IEEE0_MII_CONTROL & 0xf)),
+                                &mii_ctrl);
+                bnx2x_cl45_write(bp, phy, 5,
+                                 (MDIO_REG_BANK_COMBO_IEEE0 +
+                                 (MDIO_COMBO_IEEE0_MII_CONTROL & 0xf)),
+                                 mii_ctrl |
+                                 MDIO_COMBO_IEEO_MII_CONTROL_LOOPBACK);
+        }
+}
+
+/*
+ *------------------------------------------------------------------------
+ * bnx2x_override_led_value -
+ *
+ * Override the led value of the requested led
+ *
+ *------------------------------------------------------------------------
+ */
+u8 bnx2x_override_led_value(struct bnx2x *bp, u8 port,
+                          u32 led_idx, u32 value)
+{
+        u32 reg_val;
 
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
-                        DP(NETIF_MSG_LINK, "SerDes 5482\n");
-                        bnx2x_ext_phy_hw_reset(bp, params->port);
+        /* If port 0 then use EMAC0, else use EMAC1*/
+        u32 emac_base = (port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+
+        DP(NETIF_MSG_LINK,
+                 "bnx2x_override_led_value() port %x led_idx %d value %d\n",
+                 port, led_idx, value);
+
+        switch (led_idx) {
+        case 0: /* 10MB led */
+                /* Read the current value of the LED register in
+                the EMAC block */
+                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
+                /* Set the OVERRIDE bit to 1 */
+                reg_val |= EMAC_LED_OVERRIDE;
+                /* If value is 1, set the 10M_OVERRIDE bit,
+                otherwise reset it.*/
+                reg_val = (value == 1) ? (reg_val | EMAC_LED_10MB_OVERRIDE) :
+                        (reg_val & ~EMAC_LED_10MB_OVERRIDE);
+                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+                break;
+        case 1: /*100MB led    */
+                /*Read the current value of the LED register in
+                the EMAC block */
+                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
+                /*  Set the OVERRIDE bit to 1 */
+                reg_val |= EMAC_LED_OVERRIDE;
+                /*  If value is 1, set the 100M_OVERRIDE bit,
+                otherwise reset it.*/
+                reg_val = (value == 1) ? (reg_val | EMAC_LED_100MB_OVERRIDE) :
+                        (reg_val & ~EMAC_LED_100MB_OVERRIDE);
+                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+                break;
+        case 2: /* 1000MB led */
+                /* Read the current value of the LED register in the
+                EMAC block */
+                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
+                /* Set the OVERRIDE bit to 1 */
+                reg_val |= EMAC_LED_OVERRIDE;
+                /* If value is 1, set the 1000M_OVERRIDE bit, otherwise
+                reset it. */
+                reg_val = (value == 1) ? (reg_val | EMAC_LED_1000MB_OVERRIDE) :
+                        (reg_val & ~EMAC_LED_1000MB_OVERRIDE);
+                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+                break;
+        case 3: /* 2500MB led */
+                /*  Read the current value of the LED register in the
+                EMAC block*/
+                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
+                /* Set the OVERRIDE bit to 1 */
+                reg_val |= EMAC_LED_OVERRIDE;
+                /*  If value is 1, set the 2500M_OVERRIDE bit, otherwise
+                reset it.*/
+                reg_val = (value == 1) ? (reg_val | EMAC_LED_2500MB_OVERRIDE) :
+                        (reg_val & ~EMAC_LED_2500MB_OVERRIDE);
+                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+                break;
+        case 4: /*10G led */
+                if (port == 0) {
+                        REG_WR(bp, NIG_REG_LED_10G_P0,
+                                    value);
+                } else {
+                        REG_WR(bp, NIG_REG_LED_10G_P1,
+                                    value);
+                }
+                break;
+        case 5: /* TRAFFIC led */
+                /* Find if the traffic control is via BMAC or EMAC */
+                if (port == 0)
+                        reg_val = REG_RD(bp, NIG_REG_NIG_EMAC0_EN);
+                else
+                        reg_val = REG_RD(bp, NIG_REG_NIG_EMAC1_EN);
+
+                /*  Override the traffic led in the EMAC:*/
+                if (reg_val == 1) {
+                        /* Read the current value of the LED register in
+                        the EMAC block */
+                        reg_val = REG_RD(bp, emac_base +
+                                             EMAC_REG_EMAC_LED);
+                        /* Set the TRAFFIC_OVERRIDE bit to 1 */
+                        reg_val |= EMAC_LED_OVERRIDE;
+                        /* If value is 1, set the TRAFFIC bit, otherwise
+                        reset it.*/
+                        reg_val = (value == 1) ? (reg_val | EMAC_LED_TRAFFIC) :
+                                (reg_val & ~EMAC_LED_TRAFFIC);
+                        REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+                } else { /* Override the traffic led in the BMAC: */
+                        REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0
+                                   + port*4, 1);
+                        REG_WR(bp, NIG_REG_LED_CONTROL_TRAFFIC_P0 + port*4,
+                                    value);
+                }
+                break;
+        default:
+                DP(NETIF_MSG_LINK,
+                         "bnx2x_override_led_value() unknown led index %d "
+                         "(should be 0-5)\n", led_idx);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+
+u8 bnx2x_set_led(struct link_params *params,
+                 struct link_vars *vars, u8 mode, u32 speed)
+{
+        u8 port = params->port;
+        u16 hw_led_mode = params->hw_led_mode;
+        u8 rc = 0, phy_idx;
+        u32 tmp;
+        u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+        struct bnx2x *bp = params->bp;
+        DP(NETIF_MSG_LINK, "bnx2x_set_led: port %x, mode %d\n", port, mode);
+        DP(NETIF_MSG_LINK, "speed 0x%x, hw_led_mode 0x%x\n",
+                 speed, hw_led_mode);
+        /* In case */
+        for (phy_idx = EXT_PHY1; phy_idx < MAX_PHYS; phy_idx++) {
+                if (params->phy[phy_idx].set_link_led) {
+                        params->phy[phy_idx].set_link_led(
+                                &params->phy[phy_idx], params, mode);
+                }
+        }
+
+        switch (mode) {
+        case LED_MODE_FRONT_PANEL_OFF:
+        case LED_MODE_OFF:
+                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 0);
+                REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4,
+                           SHARED_HW_CFG_LED_MAC1);
+
+                tmp = EMAC_RD(bp, EMAC_REG_EMAC_LED);
+                EMAC_WR(bp, EMAC_REG_EMAC_LED, (tmp | EMAC_LED_OVERRIDE));
+                break;
+
+        case LED_MODE_OPER:
+                /**
+                 * For all other phys, OPER mode is same as ON, so in case
+                 * link is down, do nothing
+                 **/
+                if (!vars->link_up)
                         break;
+        case LED_MODE_ON:
+                if (SINGLE_MEDIA_DIRECT(params)) {
+                        /**
+                        * This is a work-around for HW issue found when link
+                        * is up in CL73
+                        */
+                        REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4, 0);
+                        REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+                } else {
+                        REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4,
+                                   hw_led_mode);
+                }
 
-                default:
-                        DP(NETIF_MSG_LINK, "BAD SerDes ext_phy_config 0x%x\n",
-                                 params->ext_phy_config);
+                REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0 +
+                           port*4, 0);
+                /* Set blinking rate to ~15.9Hz */
+                REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_RATE_P0 + port*4,
+                           LED_BLINK_RATE_VAL);
+                REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_RATE_ENA_P0 +
+                           port*4, 1);
+                tmp = EMAC_RD(bp, EMAC_REG_EMAC_LED);
+                EMAC_WR(bp, EMAC_REG_EMAC_LED,
+                            (tmp & (~EMAC_LED_OVERRIDE)));
+
+                if (CHIP_IS_E1(bp) &&
+                    ((speed == SPEED_2500) ||
+                     (speed == SPEED_1000) ||
+                     (speed == SPEED_100) ||
+                     (speed == SPEED_10))) {
+                        /* On Everest 1 Ax chip versions for speeds less than
+                        10G LED scheme is different */
+                        REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0
+                                   + port*4, 1);
+                        REG_WR(bp, NIG_REG_LED_CONTROL_TRAFFIC_P0 +
+                                   port*4, 0);
+                        REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_TRAFFIC_P0 +
+                                   port*4, 1);
+                }
+                break;
+
+        default:
+                rc = -EINVAL;
+                DP(NETIF_MSG_LINK, "bnx2x_set_led: Invalid led mode %d\n",
+                         mode);
+                break;
+        }
+        return rc;
+
+}
+
+/**
+ * This function comes to reflect the actual link state read DIRECTLY from the
+ * HW
+ */
+u8 bnx2x_test_link(struct link_params *params, struct link_vars *vars,
+                   u8 is_serdes)
+{
+        struct bnx2x *bp = params->bp;
+        u16 gp_status = 0, phy_index = 0;
+        u8 ext_phy_link_up = 0, serdes_phy_type;
+        struct link_vars temp_vars;
+
+        CL45_RD_OVER_CL22(bp, &params->phy[INT_PHY],
+                              MDIO_REG_BANK_GP_STATUS,
+                              MDIO_GP_STATUS_TOP_AN_STATUS1,
+                              &gp_status);
+        /* link is up only if both local phy and external phy are up */
+        if (!(gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS))
+                return -ESRCH;
+
+        switch (params->num_phys) {
+        case 1:
+                /* No external PHY */
+                return 0;
+        case 2:
+                ext_phy_link_up = params->phy[EXT_PHY1].read_status(
+                        &params->phy[EXT_PHY1],
+                        params, &temp_vars);
+                break;
+        case 3: /* Dual Media */
+                for (phy_index = EXT_PHY1; phy_index < params->num_phys;
+                      phy_index++) {
+                        serdes_phy_type = ((params->phy[phy_index].media_type ==
+                                            ETH_PHY_SFP_FIBER) ||
+                                           (params->phy[phy_index].media_type ==
+                                            ETH_PHY_XFP_FIBER));
+
+                        if (is_serdes != serdes_phy_type)
+                                continue;
+                        if (params->phy[phy_index].read_status) {
+                                ext_phy_link_up |=
+                                        params->phy[phy_index].read_status(
+                                                &params->phy[phy_index],
+                                                params, &temp_vars);
+                        }
+                }
+                break;
+        }
+        if (ext_phy_link_up)
+                return 0;
+        return -ESRCH;
+}
+
+static u8 bnx2x_link_initialize(struct link_params *params,
+                                struct link_vars *vars)
+{
+        u8 rc = 0;
+        u8 phy_index, non_ext_phy;
+        struct bnx2x *bp = params->bp;
+        /**
+        * In case of external phy existence, the line speed would be the
+        * line speed linked up by the external phy. In case it is direct
+        * only, then the line_speed during initialization will be
+        * equal to the req_line_speed
+        */
+        vars->line_speed = params->phy[INT_PHY].req_line_speed;
+
+        /**
+         * Initialize the internal phy in case this is a direct board
+         * (no external phys), or this board has external phy which requires
+         * to first.
+         */
+
+        if (params->phy[INT_PHY].config_init)
+                params->phy[INT_PHY].config_init(
+                        &params->phy[INT_PHY],
+                        params, vars);
+
+        /* init ext phy and enable link state int */
+        non_ext_phy = (SINGLE_MEDIA_DIRECT(params) ||
+                       (params->loopback_mode == LOOPBACK_XGXS));
+
+        if (non_ext_phy ||
+            (params->phy[EXT_PHY1].flags & FLAGS_INIT_XGXS_FIRST) ||
+            (params->loopback_mode == LOOPBACK_EXT_PHY)) {
+                struct bnx2x_phy *phy = &params->phy[INT_PHY];
+                if (vars->line_speed == SPEED_AUTO_NEG)
+                        bnx2x_set_parallel_detection(phy, params);
+                bnx2x_init_internal_phy(phy, params, vars);
+        }
+
+        /* Init external phy*/
+        if (!non_ext_phy)
+                for (phy_index = EXT_PHY1; phy_index < params->num_phys;
+                      phy_index++) {
+                        /**
+                         * No need to initialize second phy in case of first
+                         * phy only selection. In case of second phy, we do
+                         * need to initialize the first phy, since they are
+                         * connected.
+                         **/
+                        if (phy_index == EXT_PHY2 &&
+                            (bnx2x_phy_selection(params) ==
+                             PORT_HW_CFG_PHY_SELECTION_FIRST_PHY)) {
+                                DP(NETIF_MSG_LINK, "Not initializing"
+                                                   "second phy\n");
+                                continue;
+                        }
+                        params->phy[phy_index].config_init(
+                                &params->phy[phy_index],
+                                params, vars);
+                }
+
+        /* Reset the interrupt indication after phy was initialized */
+        bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 +
+                       params->port*4,
+                       (NIG_STATUS_XGXS0_LINK10G |
+                        NIG_STATUS_XGXS0_LINK_STATUS |
+                        NIG_STATUS_SERDES0_LINK_STATUS |
+                        NIG_MASK_MI_INT));
+        return rc;
+}
+
+static void bnx2x_int_link_reset(struct bnx2x_phy *phy,
+                                 struct link_params *params)
+{
+        /* reset the SerDes/XGXS */
+        REG_WR(params->bp, GRCBASE_MISC +
+                     MISC_REGISTERS_RESET_REG_3_CLEAR,
+                     (0x1ff << (params->port*16)));
+}
+
+static void bnx2x_common_ext_link_reset(struct bnx2x_phy *phy,
+                                        struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        u8 gpio_port;
+        /* HW reset */
+        gpio_port = params->port;
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW,
+                            gpio_port);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW,
+                            gpio_port);
+        DP(NETIF_MSG_LINK, "reset external PHY\n");
+}
+
+static u8 bnx2x_update_link_down(struct link_params *params,
+                               struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port;
+
+        DP(NETIF_MSG_LINK, "Port %x: Link is down\n", port);
+        bnx2x_set_led(params, vars, LED_MODE_OFF, 0);
+
+        /* indicate no mac active */
+        vars->mac_type = MAC_TYPE_NONE;
+
+        /* update shared memory */
+        vars->link_status = 0;
+        vars->line_speed = 0;
+        bnx2x_update_mng(params, vars->link_status);
+
+        /* activate nig drain */
+        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
+
+        /* disable emac */
+        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
+
+        msleep(10);
+
+        /* reset BigMac */
+        bnx2x_bmac_rx_disable(bp, params->port);
+        REG_WR(bp, GRCBASE_MISC +
+                   MISC_REGISTERS_RESET_REG_2_CLEAR,
+                   (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
+        return 0;
+}
+
+static u8 bnx2x_update_link_up(struct link_params *params,
+                             struct link_vars *vars,
+                             u8 link_10g)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port;
+        u8 rc = 0;
+
+        vars->link_status |= LINK_STATUS_LINK_UP;
+
+        if (vars->flow_ctrl & BNX2X_FLOW_CTRL_TX)
+                vars->link_status |=
+                        LINK_STATUS_TX_FLOW_CONTROL_ENABLED;
+
+        if (vars->flow_ctrl & BNX2X_FLOW_CTRL_RX)
+                vars->link_status |=
+                        LINK_STATUS_RX_FLOW_CONTROL_ENABLED;
+
+        if (link_10g) {
+                bnx2x_bmac_enable(params, vars, 0);
+                bnx2x_set_led(params, vars,
+                              LED_MODE_OPER, SPEED_10000);
+        } else {
+                rc = bnx2x_emac_program(params, vars);
+
+                bnx2x_emac_enable(params, vars, 0);
+
+                /* AN complete? */
+                if ((vars->link_status & LINK_STATUS_AUTO_NEGOTIATE_COMPLETE)
+                    && (!(vars->phy_flags & PHY_SGMII_FLAG)) &&
+                    SINGLE_MEDIA_DIRECT(params))
+                        bnx2x_set_gmii_tx_driver(params);
+        }
+
+        /* PBF - link up */
+        rc |= bnx2x_pbf_update(params, vars->flow_ctrl,
+                              vars->line_speed);
+
+        /* disable drain */
+        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 0);
+
+        /* update shared memory */
+        bnx2x_update_mng(params, vars->link_status);
+        msleep(20);
+        return rc;
+}
+/**
+ * The bnx2x_link_update function should be called upon link
+ * interrupt.
+ * Link is considered up as follows:
+ * - DIRECT_SINGLE_MEDIA - Only XGXS link (internal link) needs
+ *   to be up
+ * - SINGLE_MEDIA - The link between the 577xx and the external
+ *   phy (XGXS) need to up as well as the external link of the
+ *   phy (PHY_EXT1)
+ * - DUAL_MEDIA - The link between the 577xx and the first
+ *   external phy needs to be up, and at least one of the 2
+ *   external phy link must be up.
+ */
+u8 bnx2x_link_update(struct link_params *params, struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        struct link_vars phy_vars[MAX_PHYS];
+        u8 port = params->port;
+        u8 link_10g, phy_index;
+        u8 ext_phy_link_up = 0, cur_link_up, rc = 0;
+        u8 is_mi_int = 0;
+        u16 ext_phy_line_speed = 0, prev_line_speed = vars->line_speed;
+        u8 active_external_phy = INT_PHY;
+        vars->link_status = 0;
+        for (phy_index = INT_PHY; phy_index < params->num_phys;
+              phy_index++) {
+                phy_vars[phy_index].flow_ctrl = 0;
+                phy_vars[phy_index].link_status = 0;
+                phy_vars[phy_index].line_speed = 0;
+                phy_vars[phy_index].duplex = DUPLEX_FULL;
+                phy_vars[phy_index].phy_link_up = 0;
+                phy_vars[phy_index].link_up = 0;
+        }
+
+        DP(NETIF_MSG_LINK, "port %x, XGXS?%x, int_status 0x%x\n",
+                 port, (vars->phy_flags & PHY_XGXS_FLAG),
+                 REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4));
+
+        is_mi_int = (u8)(REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT +
+                                    port*0x18) > 0);
+        DP(NETIF_MSG_LINK, "int_mask 0x%x MI_INT %x, SERDES_LINK %x\n",
+                 REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4),
+                 is_mi_int,
+                 REG_RD(bp,
+                            NIG_REG_SERDES0_STATUS_LINK_STATUS + port*0x3c));
+
+        DP(NETIF_MSG_LINK, " 10G %x, XGXS_LINK %x\n",
+          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
+          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68));
+
+        /* disable emac */
+        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
+
+        /**
+        * Step 1:
+        * Check external link change only for external phys, and apply
+        * priority selection between them in case the link on both phys
+        * is up. Note that the instead of the common vars, a temporary
+        * vars argument is used since each phy may have different link/
+        * speed/duplex result
+        */
+        for (phy_index = EXT_PHY1; phy_index < params->num_phys;
+              phy_index++) {
+                struct bnx2x_phy *phy = &params->phy[phy_index];
+                if (!phy->read_status)
+                        continue;
+                /* Read link status and params of this ext phy */
+                cur_link_up = phy->read_status(phy, params,
+                                               &phy_vars[phy_index]);
+                if (cur_link_up) {
+                        DP(NETIF_MSG_LINK, "phy in index %d link is up\n",
+                                   phy_index);
+                } else {
+                        DP(NETIF_MSG_LINK, "phy in index %d link is down\n",
+                                   phy_index);
+                        continue;
+                }
+
+                if (!ext_phy_link_up) {
+                        ext_phy_link_up = 1;
+                        active_external_phy = phy_index;
+                } else {
+                        switch (bnx2x_phy_selection(params)) {
+                        case PORT_HW_CFG_PHY_SELECTION_HARDWARE_DEFAULT:
+                        case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY:
+                        /**
+                         * In this option, the first PHY makes sure to pass the
+                         * traffic through itself only.
+                         * Its not clear how to reset the link on the second phy
+                         **/
+                                active_external_phy = EXT_PHY1;
+                                break;
+                        case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY:
+                        /**
+                         * In this option, the first PHY makes sure to pass the
+                         * traffic through the second PHY.
+                         **/
+                                active_external_phy = EXT_PHY2;
+                                break;
+                        default:
+                        /**
+                         * Link indication on both PHYs with the following cases
+                         * is invalid:
+                         * - FIRST_PHY means that second phy wasn't initialized,
+                         * hence its link is expected to be down
+                         * - SECOND_PHY means that first phy should not be able
+                         * to link up by itself (using configuration)
+                         * - DEFAULT should be overriden during initialiazation
+                         **/
+                                DP(NETIF_MSG_LINK, "Invalid link indication"
+                                           "mpc=0x%x. DISABLING LINK !!!\n",
+                                           params->multi_phy_config);
+                                ext_phy_link_up = 0;
+                                break;
+                        }
+                }
+        }
+        prev_line_speed = vars->line_speed;
+        /**
+        * Step 2:
+        * Read the status of the internal phy. In case of
+        * DIRECT_SINGLE_MEDIA board, this link is the external link,
+        * otherwise this is the link between the 577xx and the first
+        * external phy
+        */
+        if (params->phy[INT_PHY].read_status)
+                params->phy[INT_PHY].read_status(
+                        &params->phy[INT_PHY],
+                        params, vars);
+        /**
+         * The INT_PHY flow control reside in the vars. This include the
+         * case where the speed or flow control are not set to AUTO.
+         * Otherwise, the active external phy flow control result is set
+         * to the vars. The ext_phy_line_speed is needed to check if the
+         * speed is different between the internal phy and external phy.
+         * This case may be result of intermediate link speed change.
+         */
+        if (active_external_phy > INT_PHY) {
+                vars->flow_ctrl = phy_vars[active_external_phy].flow_ctrl;
+                /**
+                 * Link speed is taken from the XGXS. AN and FC result from
+                 * the external phy.
+                 */
+                vars->link_status |= phy_vars[active_external_phy].link_status;
+
+                /**
+                 * if active_external_phy is first PHY and link is up - disable
+                 * disable TX on second external PHY
+                 */
+                if (active_external_phy == EXT_PHY1) {
+                        if (params->phy[EXT_PHY2].phy_specific_func) {
+                                DP(NETIF_MSG_LINK, "Disabling TX on"
+                                                   " EXT_PHY2\n");
+                                params->phy[EXT_PHY2].phy_specific_func(
+                                        &params->phy[EXT_PHY2],
+                                        params, DISABLE_TX);
+                        }
+                }
+
+                ext_phy_line_speed = phy_vars[active_external_phy].line_speed;
+                vars->duplex = phy_vars[active_external_phy].duplex;
+                if (params->phy[active_external_phy].supported &
+                    SUPPORTED_FIBRE)
+                        vars->link_status |= LINK_STATUS_SERDES_LINK;
+                DP(NETIF_MSG_LINK, "Active external phy selected: %x\n",
+                           active_external_phy);
+        }
+
+        for (phy_index = EXT_PHY1; phy_index < params->num_phys;
+              phy_index++) {
+                if (params->phy[phy_index].flags &
+                    FLAGS_REARM_LATCH_SIGNAL) {
+                        bnx2x_rearm_latch_signal(bp, port,
+                                                 phy_index ==
+                                                 active_external_phy);
                         break;
                 }
         }
+        DP(NETIF_MSG_LINK, "vars->flow_ctrl = 0x%x, vars->link_status = 0x%x,"
+                   " ext_phy_line_speed = %d\n", vars->flow_ctrl,
+                   vars->link_status, ext_phy_line_speed);
+        /**
+         * Upon link speed change set the NIG into drain mode. Comes to
+         * deals with possible FIFO glitch due to clk change when speed
+         * is decreased without link down indicator
+         */
+
+        if (vars->phy_link_up) {
+                if (!(SINGLE_MEDIA_DIRECT(params)) && ext_phy_link_up &&
+                    (ext_phy_line_speed != vars->line_speed)) {
+                        DP(NETIF_MSG_LINK, "Internal link speed %d is"
+                                   " different than the external"
+                                   " link speed %d\n", vars->line_speed,
+                                   ext_phy_line_speed);
+                        vars->phy_link_up = 0;
+                } else if (prev_line_speed != vars->line_speed) {
+                        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE
+                                     + params->port*4, 0);
+                        msleep(1);
+                }
+        }
+
+        /* anything 10 and over uses the bmac */
+        link_10g = ((vars->line_speed == SPEED_10000) ||
+                    (vars->line_speed == SPEED_12000) ||
+                    (vars->line_speed == SPEED_12500) ||
+                    (vars->line_speed == SPEED_13000) ||
+                    (vars->line_speed == SPEED_15000) ||
+                    (vars->line_speed == SPEED_16000));
+
+        bnx2x_link_int_ack(params, vars, link_10g);
+
+        /**
+        * In case external phy link is up, and internal link is down
+        * (not initialized yet probably after link initialization, it
+        * needs to be initialized.
+        * Note that after link down-up as result of cable plug, the xgxs
+        * link would probably become up again without the need
+        * initialize it
+        */
+        if (!(SINGLE_MEDIA_DIRECT(params))) {
+                DP(NETIF_MSG_LINK, "ext_phy_link_up = %d, int_link_up = %d,"
+                           " init_preceding = %d\n", ext_phy_link_up,
+                           vars->phy_link_up,
+                           params->phy[EXT_PHY1].flags &
+                           FLAGS_INIT_XGXS_FIRST);
+                if (!(params->phy[EXT_PHY1].flags &
+                      FLAGS_INIT_XGXS_FIRST)
+                    && ext_phy_link_up && !vars->phy_link_up) {
+                        vars->line_speed = ext_phy_line_speed;
+                        if (vars->line_speed < SPEED_1000)
+                                vars->phy_flags |= PHY_SGMII_FLAG;
+                        else
+                                vars->phy_flags &= ~PHY_SGMII_FLAG;
+                        bnx2x_init_internal_phy(&params->phy[INT_PHY],
+                                                params,
+                                                vars);
+                }
+        }
+        /**
+         *  Link is up only if both local phy and external phy (in case of
+         *  non-direct board) are up
+         */
+        vars->link_up = (vars->phy_link_up &&
+                         (ext_phy_link_up ||
+                          SINGLE_MEDIA_DIRECT(params)));
+
+        if (vars->link_up)
+                rc = bnx2x_update_link_up(params, vars, link_10g);
+        else
+                rc = bnx2x_update_link_down(params, vars);
+
+        return rc;
+}
+
+
+/*****************************************************************************/
+/*                          External Phy section                             */
+/*****************************************************************************/
+void bnx2x_ext_phy_hw_reset(struct bnx2x *bp, u8 port)
+{
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
+        msleep(1);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, port);
 }
 
 static void bnx2x_save_spirom_version(struct bnx2x *bp, u8 port,
-                                    u32 shmem_base, u32 spirom_ver)
+                                      u32 spirom_ver, u32 ver_addr)
 {
         DP(NETIF_MSG_LINK, "FW version 0x%x:0x%x for port %d\n",
                  (u16)(spirom_ver>>16), (u16)spirom_ver, port);
-        REG_WR(bp, shmem_base +
-                   offsetof(struct shmem_region,
-                            port_mb[port].ext_phy_fw_version),
-                        spirom_ver);
+
+        if (ver_addr)
+                REG_WR(bp, ver_addr, spirom_ver);
 }
 
-static void bnx2x_save_bcm_spirom_ver(struct bnx2x *bp, u8 port,
-                                    u32 ext_phy_type, u8 ext_phy_addr,
-                                    u32 shmem_base)
+static void bnx2x_save_bcm_spirom_ver(struct bnx2x *bp,
+                                      struct bnx2x_phy *phy,
+                                      u8 port)
 {
         u16 fw_ver1, fw_ver2;
 
-        bnx2x_cl45_read(bp, port, ext_phy_type, ext_phy_addr, MDIO_PMA_DEVAD,
+        bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_ROM_VER1, &fw_ver1);
-        bnx2x_cl45_read(bp, port, ext_phy_type, ext_phy_addr, MDIO_PMA_DEVAD,
+        bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_ROM_VER2, &fw_ver2);
-        bnx2x_save_spirom_version(bp, port, shmem_base,
-                                (u32)(fw_ver1<<16 | fw_ver2));
+        bnx2x_save_spirom_version(bp, port, (u32)(fw_ver1<<16 | fw_ver2),
+                                  phy->ver_addr);
 }
 
-
-static void bnx2x_save_8481_spirom_version(struct bnx2x *bp, u8 port,
-                                         u8 ext_phy_addr, u32 shmem_base)
+static void bnx2x_ext_phy_set_pause(struct link_params *params,
+                                    struct bnx2x_phy *phy,
+                                    struct link_vars *vars)
 {
-        u16 val, fw_ver1, fw_ver2, cnt;
-        /* For the 32 bits registers in 8481, access via MDIO2ARM interface.*/
-        /* (1) set register 0xc200_0014(SPI_BRIDGE_CTRL_2) to 0x03000000 */
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr, MDIO_PMA_DEVAD,
-                       0xA819, 0x0014);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       0xA81A,
-                       0xc200);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       0xA81B,
-                       0x0000);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       0xA81C,
-                       0x0300);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       0xA817,
-                       0x0009);
+        u16 val;
+        struct bnx2x *bp = params->bp;
+        /* read modify write pause advertizing */
+        bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_ADV_PAUSE, &val);
 
-        for (cnt = 0; cnt < 100; cnt++) {
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                              ext_phy_addr,
-                              MDIO_PMA_DEVAD,
-                              0xA818,
-                              &val);
-                if (val & 1)
-                        break;
-                udelay(5);
+        val &= ~MDIO_AN_REG_ADV_PAUSE_BOTH;
+
+        /* Please refer to Table 28B-3 of 802.3ab-1999 spec. */
+        bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
+        if ((vars->ieee_fc &
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) ==
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) {
+                val |=  MDIO_AN_REG_ADV_PAUSE_ASYMMETRIC;
         }
-        if (cnt == 100) {
-                DP(NETIF_MSG_LINK, "Unable to read 8481 phy fw version(1)\n");
-                bnx2x_save_spirom_version(bp, port,
-                                        shmem_base, 0);
-                return;
+        if ((vars->ieee_fc &
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) ==
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) {
+                val |= MDIO_AN_REG_ADV_PAUSE_PAUSE;
         }
+        DP(NETIF_MSG_LINK, "Ext phy AN advertize 0x%x\n", val);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_ADV_PAUSE, val);
+}
 
+static u8 bnx2x_ext_phy_resolve_fc(struct bnx2x_phy *phy,
+                                   struct link_params *params,
+                                   struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u16 ld_pause;           /* local */
+        u16 lp_pause;           /* link partner */
+        u16 pause_result;
+        u8 ret = 0;
+        /* read twice */
 
-        /* 2) read register 0xc200_0000 (SPI_FW_STATUS) */
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr, MDIO_PMA_DEVAD,
-                       0xA819, 0x0000);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr, MDIO_PMA_DEVAD,
-                       0xA81A, 0xc200);
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                       ext_phy_addr, MDIO_PMA_DEVAD,
-                       0xA817, 0x000A);
-        for (cnt = 0; cnt < 100; cnt++) {
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                              ext_phy_addr,
-                              MDIO_PMA_DEVAD,
-                              0xA818,
-                              &val);
-                if (val & 1)
-                        break;
-                udelay(5);
+        vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+
+        if (phy->req_flow_ctrl != BNX2X_FLOW_CTRL_AUTO)
+                vars->flow_ctrl = phy->req_flow_ctrl;
+        else if (phy->req_line_speed != SPEED_AUTO_NEG)
+                vars->flow_ctrl = params->req_fc_auto_adv;
+        else if (vars->link_status & LINK_STATUS_AUTO_NEGOTIATE_COMPLETE) {
+                ret = 1;
+                bnx2x_cl45_read(bp, phy,
+                              MDIO_AN_DEVAD,
+                              MDIO_AN_REG_ADV_PAUSE, &ld_pause);
+                bnx2x_cl45_read(bp, phy,
+                              MDIO_AN_DEVAD,
+                              MDIO_AN_REG_LP_AUTO_NEG, &lp_pause);
+                pause_result = (ld_pause &
+                                MDIO_AN_REG_ADV_PAUSE_MASK) >> 8;
+                pause_result |= (lp_pause &
+                                 MDIO_AN_REG_ADV_PAUSE_MASK) >> 10;
+                DP(NETIF_MSG_LINK, "Ext PHY pause result 0x%x\n",
+                   pause_result);
+                bnx2x_pause_resolve(vars, pause_result);
         }
-        if (cnt == 100) {
-                DP(NETIF_MSG_LINK, "Unable to read 8481 phy fw version(2)\n");
-                bnx2x_save_spirom_version(bp, port,
-                                        shmem_base, 0);
+        return ret;
+}
+
+static void bnx2x_ext_phy_10G_an_resolve(struct bnx2x *bp,
+                                       struct bnx2x_phy *phy,
+                                       struct link_vars *vars)
+{
+        u16 val;
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD,
+                        MDIO_AN_REG_STATUS, &val);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD,
+                        MDIO_AN_REG_STATUS, &val);
+        if (val & (1<<5))
+                vars->link_status |= LINK_STATUS_AUTO_NEGOTIATE_COMPLETE;
+        if ((val & (1<<0)) == 0)
+                vars->link_status |= LINK_STATUS_PARALLEL_DETECTION_USED;
+}
+
+/******************************************************************/
+/*              common BCM8073/BCM8727 PHY SECTION                */
+/******************************************************************/
+static void bnx2x_8073_resolve_fc(struct bnx2x_phy *phy,
+                                  struct link_params *params,
+                                  struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        if (phy->req_line_speed == SPEED_10 ||
+            phy->req_line_speed == SPEED_100) {
+                vars->flow_ctrl = phy->req_flow_ctrl;
                 return;
         }
 
-        /* lower 16 bits of the register SPI_FW_STATUS */
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                      ext_phy_addr,
-                      MDIO_PMA_DEVAD,
-                      0xA81B,
-                      &fw_ver1);
-        /* upper 16 bits of register SPI_FW_STATUS */
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                      ext_phy_addr,
-                      MDIO_PMA_DEVAD,
-                      0xA81C,
-                      &fw_ver2);
+        if (bnx2x_ext_phy_resolve_fc(phy, params, vars) &&
+            (vars->flow_ctrl == BNX2X_FLOW_CTRL_NONE)) {
+                u16 pause_result;
+                u16 ld_pause;           /* local */
+                u16 lp_pause;           /* link partner */
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_AN_DEVAD,
+                                MDIO_AN_REG_CL37_FC_LD, &ld_pause);
+
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_AN_DEVAD,
+                                MDIO_AN_REG_CL37_FC_LP, &lp_pause);
+                pause_result = (ld_pause &
+                                MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) >> 5;
+                pause_result |= (lp_pause &
+                                 MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) >> 7;
 
-        bnx2x_save_spirom_version(bp, port,
-                                shmem_base, (fw_ver2<<16) | fw_ver1);
+                bnx2x_pause_resolve(vars, pause_result);
+                DP(NETIF_MSG_LINK, "Ext PHY CL37 pause result 0x%x\n",
+                           pause_result);
+        }
 }
 
-static void bnx2x_bcm8072_external_rom_boot(struct link_params *params)
+static void bnx2x_8073_8727_external_rom_boot(struct bnx2x *bp,
+                                              struct bnx2x_phy *phy,
+                                              u8 port)
 {
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
+        /* Boot port from external ROM  */
+        /* EDC grst */
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_GEN_CTRL,
+                       0x0001);
 
-        /* Need to wait 200ms after reset */
-        msleep(200);
-        /* Boot port from external ROM
-         * Set ser_boot_ctl bit in the MISC_CTRL1 register
-         */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                            MDIO_PMA_DEVAD,
-                            MDIO_PMA_REG_MISC_CTRL1, 0x0001);
+        /* ucode reboot and rst */
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_GEN_CTRL,
+                       0x008c);
+
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_MISC_CTRL1, 0x0001);
 
         /* Reset internal microprocessor */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                          MDIO_PMA_DEVAD,
-                          MDIO_PMA_REG_GEN_CTRL,
-                          MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
-        /* set micro reset = 0 */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                            MDIO_PMA_DEVAD,
-                            MDIO_PMA_REG_GEN_CTRL,
-                            MDIO_PMA_REG_GEN_CTRL_ROM_MICRO_RESET);
-        /* Reset internal microprocessor */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                          MDIO_PMA_DEVAD,
-                          MDIO_PMA_REG_GEN_CTRL,
-                          MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
-        /* wait for 100ms for code download via SPI port */
-        msleep(100);
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_GEN_CTRL,
+                       MDIO_PMA_REG_GEN_CTRL_ROM_MICRO_RESET);
+
+        /* Release srst bit */
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_GEN_CTRL,
+                       MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
+
+        /* wait for 120ms for code download via SPI port */
+        msleep(120);
 
         /* Clear ser_boot_ctl bit */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                            MDIO_PMA_DEVAD,
-                            MDIO_PMA_REG_MISC_CTRL1, 0x0000);
-        /* Wait 100ms */
-        msleep(100);
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_MISC_CTRL1, 0x0000);
+        bnx2x_save_bcm_spirom_ver(bp, phy, port);
+}
+
+static void bnx2x_8073_set_xaui_low_power_mode(struct bnx2x *bp,
+                                               struct bnx2x_phy *phy)
+{
+        u16 val;
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_8073_CHIP_REV, &val);
 
-        bnx2x_save_bcm_spirom_ver(bp, port,
-                                ext_phy_type,
-                                ext_phy_addr,
-                                params->shmem_base);
+        if (val == 0) {
+                /* Mustn't set low power mode in 8073 A0 */
+                return;
+        }
+
+        /* Disable PLL sequencer (use read-modify-write to clear bit 13) */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
+        val &= ~(1<<13);
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
+
+        /* PLL controls */
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805E, 0x1077);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805D, 0x0000);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805C, 0x030B);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805B, 0x1240);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805A, 0x2490);
+
+        /* Tx Controls */
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A7, 0x0C74);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A6, 0x9041);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A5, 0x4640);
+
+        /* Rx Controls */
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FE, 0x01C4);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FD, 0x9249);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FC, 0x2015);
+
+        /* Enable PLL sequencer  (use read-modify-write to set bit 13) */
+        bnx2x_cl45_read(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
+        val |= (1<<13);
+        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
 }
 
-static u8 bnx2x_8073_is_snr_needed(struct link_params *params)
+/******************************************************************/
+/*                      BCM8073 PHY SECTION                       */
+/******************************************************************/
+static u8 bnx2x_8073_is_snr_needed(struct bnx2x *bp, struct bnx2x_phy *phy)
 {
         /* This is only required for 8073A1, version 102 only */
-
-        struct bnx2x *bp = params->bp;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
         u16 val;
 
         /* Read 8073 HW revision*/
-        bnx2x_cl45_read(bp, params->port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_8073_CHIP_REV, &val);
 
@@ -2431,9 +3322,7 @@ static u8 bnx2x_8073_is_snr_needed(struct link_params *params)
                 return 0;
         }
 
-        bnx2x_cl45_read(bp, params->port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_ROM_VER2, &val);
 
@@ -2444,15 +3333,11 @@ static u8 bnx2x_8073_is_snr_needed(struct link_params *params)
         return 1;
 }
 
-static u8 bnx2x_bcm8073_xaui_wa(struct link_params *params)
+static u8 bnx2x_8073_xaui_wa(struct bnx2x *bp, struct bnx2x_phy *phy)
 {
-        struct bnx2x *bp = params->bp;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
         u16 val, cnt, cnt1 ;
 
-        bnx2x_cl45_read(bp, params->port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_8073_CHIP_REV, &val);
 
@@ -2466,9 +3351,7 @@ static u8 bnx2x_bcm8073_xaui_wa(struct link_params *params)
         poll Dev1, Reg $C820: */
 
         for (cnt = 0; cnt < 1000; cnt++) {
-                bnx2x_cl45_read(bp, params->port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_8073_SPEED_LINK_STATUS,
                               &val);
@@ -2485,9 +3368,7 @@ static u8 bnx2x_bcm8073_xaui_wa(struct link_params *params)
                           XAUI workaround has completed),
                           then continue on with system initialization.*/
                         for (cnt1 = 0; cnt1 < 1000; cnt1++) {
-                                bnx2x_cl45_read(bp, params->port,
-                                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                                        ext_phy_addr,
+                                bnx2x_cl45_read(bp, phy,
                                         MDIO_PMA_DEVAD,
                                         MDIO_PMA_REG_8073_XAUI_WA, &val);
                                 if (val & (1<<15)) {
@@ -2505,143 +3386,385 @@ static u8 bnx2x_bcm8073_xaui_wa(struct link_params *params)
         return -EINVAL;
 }
 
-static void bnx2x_bcm8073_bcm8727_external_rom_boot(struct bnx2x *bp, u8 port,
-                                                  u8 ext_phy_addr,
-                                                  u32 ext_phy_type,
-                                                  u32 shmem_base)
+static void bnx2x_807x_force_10G(struct bnx2x *bp, struct bnx2x_phy *phy)
 {
-        /* Boot port from external ROM  */
-        /* EDC grst */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       0x0001);
+        /* Force KR or KX */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x2040);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_10G_CTRL2, 0x000b);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_BCM_CTRL, 0x0000);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, 0x0000);
+}
 
-        /* ucode reboot and rst */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       0x008c);
+static void bnx2x_8073_set_pause_cl37(struct link_params *params,
+                                      struct bnx2x_phy *phy,
+                                      struct link_vars *vars)
+{
+        u16 cl37_val;
+        struct bnx2x *bp = params->bp;
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LD, &cl37_val);
 
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_MISC_CTRL1, 0x0001);
+        cl37_val &= ~MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+        /* Please refer to Table 28B-3 of 802.3ab-1999 spec. */
+        bnx2x_calc_ieee_aneg_adv(phy, params, &vars->ieee_fc);
+        if ((vars->ieee_fc &
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC) ==
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC) {
+                cl37_val |=  MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC;
+        }
+        if ((vars->ieee_fc &
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) ==
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) {
+                cl37_val |=  MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+        }
+        if ((vars->ieee_fc &
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) ==
+            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) {
+                cl37_val |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+        }
+        DP(NETIF_MSG_LINK,
+                 "Ext phy AN advertize cl37 0x%x\n", cl37_val);
 
-        /* Reset internal microprocessor */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       MDIO_PMA_REG_GEN_CTRL_ROM_MICRO_RESET);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LD, cl37_val);
+        msleep(500);
+}
 
-        /* Release srst bit */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
+static u8 bnx2x_8073_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u16 val = 0, tmp1;
+        u8 gpio_port;
+        DP(NETIF_MSG_LINK, "Init 8073\n");
 
-        /* wait for 100ms for code download via SPI port */
-        msleep(100);
+        gpio_port = params->port;
+        /* Restore normal power mode*/
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, gpio_port);
 
-        /* Clear ser_boot_ctl bit */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_MISC_CTRL1, 0x0000);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, gpio_port);
 
-        bnx2x_save_bcm_spirom_ver(bp, port,
-                                ext_phy_type,
-                                ext_phy_addr,
-                                shmem_base);
-}
+        /* enable LASI */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL, (1<<2));
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL,  0x0004);
 
-static void bnx2x_bcm8073_external_rom_boot(struct bnx2x *bp, u8 port,
-                                          u8 ext_phy_addr,
-                                          u32 shmem_base)
-{
-        bnx2x_bcm8073_bcm8727_external_rom_boot(bp, port, ext_phy_addr,
-                                         PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                                         shmem_base);
-}
+        bnx2x_8073_set_pause_cl37(params, phy, vars);
 
-static void bnx2x_bcm8727_external_rom_boot(struct bnx2x *bp, u8 port,
-                                          u8 ext_phy_addr,
-                                          u32 shmem_base)
-{
-        bnx2x_bcm8073_bcm8727_external_rom_boot(bp, port, ext_phy_addr,
-                                         PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                                         shmem_base);
+        bnx2x_8073_set_xaui_low_power_mode(bp, phy);
 
-}
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &tmp1);
 
-static void bnx2x_bcm8726_external_rom_boot(struct link_params *params)
-{
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM, &tmp1);
 
-        /* Need to wait 100ms after reset */
-        msleep(100);
+        DP(NETIF_MSG_LINK, "Before rom RX_ALARM(port1): 0x%x\n", tmp1);
 
-        /* Micro controller re-boot */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       0x018B);
+        /* Enable CL37 BAM */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD,
+                        MDIO_AN_REG_8073_BAM, &val);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD,
+                         MDIO_AN_REG_8073_BAM, val | 1);
 
-        /* Set soft reset */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       MDIO_PMA_REG_GEN_CTRL_ROM_MICRO_RESET);
+        if (params->loopback_mode == LOOPBACK_EXT) {
+                bnx2x_807x_force_10G(bp, phy);
+                DP(NETIF_MSG_LINK, "Forced speed 10G on 807X\n");
+                return 0;
+        } else {
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_BCM_CTRL, 0x0002);
+        }
+        if (phy->req_line_speed != SPEED_AUTO_NEG) {
+                if (phy->req_line_speed == SPEED_10000) {
+                        val = (1<<7);
+                } else if (phy->req_line_speed ==  SPEED_2500) {
+                        val = (1<<5);
+                        /* Note that 2.5G works only
+                        when used with 1G advertisment */
+                } else
+                        val = (1<<5);
+        } else {
+                val = 0;
+                if (phy->speed_cap_mask &
+                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)
+                        val |= (1<<7);
+
+                /* Note that 2.5G works only when
+                used with 1G advertisment */
+                if (phy->speed_cap_mask &
+                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_1G |
+                         PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G))
+                        val |= (1<<5);
+                DP(NETIF_MSG_LINK, "807x autoneg val = 0x%x\n", val);
+        }
 
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_MISC_CTRL1, 0x0001);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_ADV, val);
+        bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_8073_2_5G, &tmp1);
+
+        if (((phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G) &&
+             (phy->req_line_speed == SPEED_AUTO_NEG)) ||
+            (phy->req_line_speed == SPEED_2500)) {
+                u16 phy_ver;
+                /* Allow 2.5G for A1 and above */
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_8073_CHIP_REV,
+                                &phy_ver);
+                DP(NETIF_MSG_LINK, "Add 2.5G\n");
+                if (phy_ver > 0)
+                        tmp1 |= 1;
+                else
+                        tmp1 &= 0xfffe;
+        } else {
+                DP(NETIF_MSG_LINK, "Disable 2.5G\n");
+                tmp1 &= 0xfffe;
+        }
 
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL,
-                       MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_8073_2_5G, tmp1);
+        /* Add support for CL37 (passive mode) II */
 
-        /* wait for 150ms for microcode load */
-        msleep(150);
+        bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LD, &tmp1);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LD,
+                         (tmp1 | ((phy->req_duplex == DUPLEX_FULL) ?
+                                  0x20 : 0x40)));
 
-        /* Disable serial boot control, tristates pins SS_N, SCK, MOSI, MISO */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_MISC_CTRL1, 0x0000);
+        /* Add support for CL37 (passive mode) III */
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_CL37_AN, 0x1000);
 
-        msleep(200);
-        bnx2x_save_bcm_spirom_ver(bp, port,
-                                ext_phy_type,
-                                ext_phy_addr,
-                                params->shmem_base);
+        /* The SNR will improve about 2db by changing
+        BW and FEE main tap. Rest commands are executed
+        after link is up*/
+        if (bnx2x_8073_is_snr_needed(bp, phy))
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_EDC_FFE_MAIN,
+                                 0xFB0C);
+
+        /* Enable FEC (Forware Error Correction) Request in the AN */
+        bnx2x_cl45_read(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_ADV2, &tmp1);
+        tmp1 |= (1<<15);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_ADV2, tmp1);
+
+        bnx2x_ext_phy_set_pause(params, phy, vars);
+
+        /* Restart autoneg */
+        msleep(500);
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, 0x1200);
+        DP(NETIF_MSG_LINK, "807x Autoneg Restart: Advertise 1G=%x, 10G=%x\n",
+                   ((val & (1<<5)) > 0), ((val & (1<<7)) > 0));
+        return 0;
+}
+
+static u8 bnx2x_8073_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u8 link_up = 0;
+        u16 val1, val2;
+        u16 link_status = 0;
+        u16 an1000_status = 0;
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val1);
+
+        DP(NETIF_MSG_LINK, "8703 LASI status 0x%x\n", val1);
+
+        /* clear the interrupt LASI status register */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PCS_DEVAD, MDIO_PCS_REG_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PCS_DEVAD, MDIO_PCS_REG_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "807x PCS status 0x%x->0x%x\n", val2, val1);
+        /* Clear MSG-OUT */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &val1);
+
+        /* Check the LASI */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM, &val2);
+
+        DP(NETIF_MSG_LINK, "KR 0x9003 0x%x\n", val2);
+
+        /* Check the link status */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PCS_DEVAD, MDIO_PCS_REG_STATUS, &val2);
+        DP(NETIF_MSG_LINK, "KR PCS status 0x%x\n", val2);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val1);
+        link_up = ((val1 & 4) == 4);
+        DP(NETIF_MSG_LINK, "PMA_REG_STATUS=0x%x\n", val1);
+
+        if (link_up &&
+             ((phy->req_line_speed != SPEED_10000))) {
+                if (bnx2x_8073_xaui_wa(bp, phy) != 0)
+                        return 0;
+        }
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS, &an1000_status);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS, &an1000_status);
+
+        /* Check the link status on 1.1.2 */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "KR PMA status 0x%x->0x%x,"
+                   "an_link_status=0x%x\n", val2, val1, an1000_status);
+
+        link_up = (((val1 & 4) == 4) || (an1000_status & (1<<1)));
+        if (link_up && bnx2x_8073_is_snr_needed(bp, phy)) {
+                /* The SNR will improve about 2dbby
+                changing the BW and FEE main tap.*/
+                /* The 1st write to change FFE main
+                tap is set before restart AN */
+                /* Change PLL Bandwidth in EDC
+                register */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_PLL_BANDWIDTH,
+                                 0x26BC);
+
+                /* Change CDR Bandwidth in EDC register */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_CDR_BANDWIDTH,
+                                 0x0333);
+        }
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_8073_SPEED_LINK_STATUS,
+                        &link_status);
+
+        /* Bits 0..2 --> speed detected, bits 13..15--> link is down */
+        if ((link_status & (1<<2)) && (!(link_status & (1<<15)))) {
+                link_up = 1;
+                vars->line_speed = SPEED_10000;
+                DP(NETIF_MSG_LINK, "port %x: External link up in 10G\n",
+                           params->port);
+        } else if ((link_status & (1<<1)) && (!(link_status & (1<<14)))) {
+                link_up = 1;
+                vars->line_speed = SPEED_2500;
+                DP(NETIF_MSG_LINK, "port %x: External link up in 2.5G\n",
+                           params->port);
+        } else if ((link_status & (1<<0)) && (!(link_status & (1<<13)))) {
+                link_up = 1;
+                vars->line_speed = SPEED_1000;
+                DP(NETIF_MSG_LINK, "port %x: External link up in 1G\n",
+                           params->port);
+        } else {
+                link_up = 0;
+                DP(NETIF_MSG_LINK, "port %x: External link is down\n",
+                           params->port);
+        }
+
+        if (link_up) {
+                bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
+                bnx2x_8073_resolve_fc(phy, params, vars);
+        }
+        return link_up;
+}
+
+static void bnx2x_8073_link_reset(struct bnx2x_phy *phy,
+                                  struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        u8 gpio_port;
+        gpio_port = params->port;
+        DP(NETIF_MSG_LINK, "Setting 8073 port %d into low power mode\n",
+           gpio_port);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW,
+                            gpio_port);
+}
+
+/******************************************************************/
+/*                      BCM8705 PHY SECTION                       */
+/******************************************************************/
+static u8 bnx2x_8705_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        DP(NETIF_MSG_LINK, "init 8705\n");
+        /* Restore normal power mode*/
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
+        /* HW reset */
+        bnx2x_ext_phy_hw_reset(bp, params->port);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0xa040);
+        bnx2x_wait_reset_complete(bp, phy);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_MISC_CTRL, 0x8288);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_PHY_IDENTIFIER, 0x7fbf);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_CMU_PLL_BYPASS, 0x0100);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_WIS_DEVAD, MDIO_WIS_REG_LASI_CNTL, 0x1);
+        /* BCM8705 doesn't have microcode, hence the 0 */
+        bnx2x_save_spirom_version(bp, params->port, params->shmem_base, 0);
+        return 0;
+}
+
+static u8 bnx2x_8705_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        u8 link_up = 0;
+        u16 val1, rx_sd;
+        struct bnx2x *bp = params->bp;
+        DP(NETIF_MSG_LINK, "read status 8705\n");
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_WIS_DEVAD, MDIO_WIS_REG_LASI_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
+
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_WIS_DEVAD, MDIO_WIS_REG_LASI_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
+
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_SD, &rx_sd);
+
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_PMA_DEVAD, 0xc809, &val1);
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_PMA_DEVAD, 0xc809, &val1);
+
+        DP(NETIF_MSG_LINK, "8705 1.c809 val=0x%x\n", val1);
+        link_up = ((rx_sd & 0x1) && (val1 & (1<<9)) && ((val1 & (1<<8)) == 0));
+        if (link_up) {
+                vars->line_speed = SPEED_10000;
+                bnx2x_ext_phy_resolve_fc(phy, params, vars);
+        }
+        return link_up;
 }
 
-static void bnx2x_sfp_set_transmitter(struct bnx2x *bp, u8 port,
-                                    u32 ext_phy_type, u8 ext_phy_addr,
-                                    u8 tx_en)
+/******************************************************************/
+/*                      SFP+ module Section                       */
+/******************************************************************/
+static void bnx2x_sfp_set_transmitter(struct bnx2x *bp,
+                                      struct bnx2x_phy *phy,
+                                      u8 port,
+                                      u8 tx_en)
 {
         u16 val;
 
         DP(NETIF_MSG_LINK, "Setting transmitter tx_en=%x for port %x\n",
                  tx_en, port);
         /* Disable/Enable transmitter ( TX laser of the SFP+ module.)*/
-        bnx2x_cl45_read(bp, port,
-                      ext_phy_type,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_PHY_IDENTIFIER,
                       &val);
@@ -2651,58 +3774,42 @@ static void bnx2x_sfp_set_transmitter(struct bnx2x *bp, u8 port,
         else
                 val |= (1<<15);
 
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_PHY_IDENTIFIER,
                        val);
 }
 
-static u8 bnx2x_8726_read_sfp_module_eeprom(struct link_params *params,
+static u8 bnx2x_8726_read_sfp_module_eeprom(struct bnx2x_phy *phy,
+                                            struct link_params *params,
                                           u16 addr, u8 byte_cnt, u8 *o_buf)
 {
         struct bnx2x *bp = params->bp;
         u16 val = 0;
         u16 i;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
         if (byte_cnt > 16) {
                 DP(NETIF_MSG_LINK, "Reading from eeprom is"
                             " is limited to 0xf\n");
                 return -EINVAL;
         }
         /* Set the read command byte count */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_SFP_TWO_WIRE_BYTE_CNT,
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_SFP_TWO_WIRE_BYTE_CNT,
                        (byte_cnt | 0xa000));
 
         /* Set the read command address */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_SFP_TWO_WIRE_MEM_ADDR,
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_SFP_TWO_WIRE_MEM_ADDR,
                        addr);
 
         /* Activate read command */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_SFP_TWO_WIRE_CTRL,
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_SFP_TWO_WIRE_CTRL,
                        0x2c0f);
 
         /* Wait up to 500us for command complete status */
         for (i = 0; i < 100; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
@@ -2721,18 +3828,14 @@ static u8 bnx2x_8726_read_sfp_module_eeprom(struct link_params *params,
 
         /* Read the buffer */
         for (i = 0; i < byte_cnt; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_8726_TWO_WIRE_DATA_BUF + i, &val);
                 o_buf[i] = (u8)(val & MDIO_PMA_REG_8726_TWO_WIRE_DATA_MASK);
         }
 
         for (i = 0; i < 100; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
@@ -2743,14 +3846,12 @@ static u8 bnx2x_8726_read_sfp_module_eeprom(struct link_params *params,
         return -EINVAL;
 }
 
-static u8 bnx2x_8727_read_sfp_module_eeprom(struct link_params *params,
+static u8 bnx2x_8727_read_sfp_module_eeprom(struct bnx2x_phy *phy,
+                                            struct link_params *params,
                                           u16 addr, u8 byte_cnt, u8 *o_buf)
 {
         struct bnx2x *bp = params->bp;
         u16 val, i;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
 
         if (byte_cnt > 16) {
                 DP(NETIF_MSG_LINK, "Reading from eeprom is"
@@ -2759,40 +3860,30 @@ static u8 bnx2x_8727_read_sfp_module_eeprom(struct link_params *params,
         }
 
         /* Need to read from 1.8000 to clear it */
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_SFP_TWO_WIRE_CTRL,
                       &val);
 
         /* Set the read command byte count */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_SFP_TWO_WIRE_BYTE_CNT,
                        ((byte_cnt < 2) ? 2 : byte_cnt));
 
         /* Set the read command address */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_SFP_TWO_WIRE_MEM_ADDR,
                        addr);
         /* Set the destination address */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        0x8004,
                        MDIO_PMA_REG_8727_TWO_WIRE_DATA_BUF);
 
         /* Activate read command */
-        bnx2x_cl45_write(bp, port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_SFP_TWO_WIRE_CTRL,
                        0x8002);
@@ -2802,9 +3893,7 @@ static u8 bnx2x_8727_read_sfp_module_eeprom(struct link_params *params,
 
         /* Wait up to 500us for command complete status */
         for (i = 0; i < 100; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
@@ -2823,18 +3912,14 @@ static u8 bnx2x_8727_read_sfp_module_eeprom(struct link_params *params,
 
         /* Read the buffer */
         for (i = 0; i < byte_cnt; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_8727_TWO_WIRE_DATA_BUF + i, &val);
                 o_buf[i] = (u8)(val & MDIO_PMA_REG_8727_TWO_WIRE_DATA_MASK);
         }
 
         for (i = 0; i < 100; i++) {
-                bnx2x_cl45_read(bp, port,
-                              ext_phy_type,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
@@ -2846,21 +3931,21 @@ static u8 bnx2x_8727_read_sfp_module_eeprom(struct link_params *params,
         return -EINVAL;
 }
 
-u8 bnx2x_read_sfp_module_eeprom(struct link_params *params, u16 addr,
+u8 bnx2x_read_sfp_module_eeprom(struct bnx2x_phy *phy,
+                                struct link_params *params, u16 addr,
                                      u8 byte_cnt, u8 *o_buf)
 {
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726)
-                return bnx2x_8726_read_sfp_module_eeprom(params, addr,
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726)
+                return bnx2x_8726_read_sfp_module_eeprom(phy, params, addr,
                                                        byte_cnt, o_buf);
-        else if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727)
-                return bnx2x_8727_read_sfp_module_eeprom(params, addr,
+        else if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727)
+                return bnx2x_8727_read_sfp_module_eeprom(phy, params, addr,
                                                        byte_cnt, o_buf);
         return -EINVAL;
 }
 
-static u8 bnx2x_get_edc_mode(struct link_params *params,
+static u8 bnx2x_get_edc_mode(struct bnx2x_phy *phy,
+                             struct link_params *params,
                                   u16 *edc_mode)
 {
         struct bnx2x *bp = params->bp;
@@ -2868,10 +3953,11 @@ static u8 bnx2x_get_edc_mode(struct link_params *params,
         *edc_mode = EDC_MODE_LIMITING;
 
         /* First check for copper cable */
-        if (bnx2x_read_sfp_module_eeprom(params,
-                                       SFP_EEPROM_CON_TYPE_ADDR,
-                                       1,
-                                       &val) != 0) {
+        if (bnx2x_read_sfp_module_eeprom(phy,
+                                         params,
+                                         SFP_EEPROM_CON_TYPE_ADDR,
+                                         1,
+                                         &val) != 0) {
                 DP(NETIF_MSG_LINK, "Failed to read from SFP+ module EEPROM\n");
                 return -EINVAL;
         }
@@ -2883,7 +3969,8 @@ static u8 bnx2x_get_edc_mode(struct link_params *params,
 
                 /* Check if its active cable( includes SFP+ module)
                 of passive cable*/
-                if (bnx2x_read_sfp_module_eeprom(params,
+                if (bnx2x_read_sfp_module_eeprom(phy,
+                                               params,
                                                SFP_EEPROM_FC_TX_TECH_ADDR,
                                                1,
                                                &copper_module_type) !=
@@ -2923,10 +4010,11 @@ static u8 bnx2x_get_edc_mode(struct link_params *params,
 
         if (check_limiting_mode) {
                 u8 options[SFP_EEPROM_OPTIONS_SIZE];
-                if (bnx2x_read_sfp_module_eeprom(params,
-                                               SFP_EEPROM_OPTIONS_ADDR,
-                                               SFP_EEPROM_OPTIONS_SIZE,
-                                               options) != 0) {
+                if (bnx2x_read_sfp_module_eeprom(phy,
+                                                 params,
+                                                 SFP_EEPROM_OPTIONS_ADDR,
+                                                 SFP_EEPROM_OPTIONS_SIZE,
+                                                 options) != 0) {
                         DP(NETIF_MSG_LINK, "Failed to read Option"
                                 " field from module EEPROM\n");
                         return -EINVAL;
@@ -2939,17 +4027,17 @@ static u8 bnx2x_get_edc_mode(struct link_params *params,
         DP(NETIF_MSG_LINK, "EDC mode is set to 0x%x\n", *edc_mode);
         return 0;
 }
-
 /* This function read the relevant field from the module ( SFP+ ),
         and verify it is compliant with this board */
-static u8 bnx2x_verify_sfp_module(struct link_params *params)
+static u8 bnx2x_verify_sfp_module(struct bnx2x_phy *phy,
+                                  struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
-        u32 val;
-        u32 fw_resp;
+        u32 val, cmd;
+        u32 fw_resp, fw_cmd_param;
         char vendor_name[SFP_EEPROM_VENDOR_NAME_SIZE+1];
         char vendor_pn[SFP_EEPROM_PART_NO_SIZE+1];
-
+        phy->flags &= ~FLAGS_SFP_NOT_APPROVED;
         val = REG_RD(bp, params->shmem_base +
                          offsetof(struct shmem_region, dev_info.
                                   port_feature_config[params->port].config));
@@ -2959,29 +4047,43 @@ static u8 bnx2x_verify_sfp_module(struct link_params *params)
                 return 0;
         }
 
-        /* Ask the FW to validate the module */
-        if (!(params->feature_config_flags &
-              FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY)) {
+        if (params->feature_config_flags &
+            FEATURE_CONFIG_BC_SUPPORTS_DUAL_PHY_OPT_MDL_VRFY) {
+                /* Use specific phy request */
+                cmd = DRV_MSG_CODE_VRFY_SPECIFIC_PHY_OPT_MDL;
+        } else if (params->feature_config_flags &
+                   FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY) {
+                /* Use first phy request only in case of non-dual media*/
+                if (DUAL_MEDIA(params)) {
+                        DP(NETIF_MSG_LINK, "FW does not support OPT MDL "
+                           "verification\n");
+                        return -EINVAL;
+                }
+                cmd = DRV_MSG_CODE_VRFY_FIRST_PHY_OPT_MDL;
+        } else {
+                /* No support in OPT MDL detection */
                 DP(NETIF_MSG_LINK, "FW does not support OPT MDL "
-                            "verification\n");
+                          "verification\n");
                 return -EINVAL;
         }
-
-        fw_resp = bnx2x_fw_command(bp, DRV_MSG_CODE_VRFY_OPT_MDL);
+        fw_cmd_param = FW_PARAM_SET(phy->addr, phy->type, phy->mdio_ctrl);
+        fw_resp = bnx2x_fw_command(bp, cmd, fw_cmd_param);
         if (fw_resp == FW_MSG_CODE_VRFY_OPT_MDL_SUCCESS) {
                 DP(NETIF_MSG_LINK, "Approved module\n");
                 return 0;
         }
 
         /* format the warning message */
-        if (bnx2x_read_sfp_module_eeprom(params,
+        if (bnx2x_read_sfp_module_eeprom(phy,
+                                         params,
                                        SFP_EEPROM_VENDOR_NAME_ADDR,
                                        SFP_EEPROM_VENDOR_NAME_SIZE,
                                        (u8 *)vendor_name))
                 vendor_name[0] = '\0';
         else
                 vendor_name[SFP_EEPROM_VENDOR_NAME_SIZE] = '\0';
-        if (bnx2x_read_sfp_module_eeprom(params,
+        if (bnx2x_read_sfp_module_eeprom(phy,
+                                         params,
                                        SFP_EEPROM_PART_NO_ADDR,
                                        SFP_EEPROM_PART_NO_SIZE,
                                        (u8 *)vendor_pn))
@@ -2989,22 +4091,78 @@ static u8 bnx2x_verify_sfp_module(struct link_params *params)
         else
                 vendor_pn[SFP_EEPROM_PART_NO_SIZE] = '\0';
 
-        netdev_info(bp->dev, "Warning: Unqualified SFP+ module detected, Port %d from %s part number %s\n",
+        netdev_info(bp->dev, "Warning: Unqualified SFP+ module detected,"
+                             " Port %d from %s part number %s\n",
                     params->port, vendor_name, vendor_pn);
+        phy->flags |= FLAGS_SFP_NOT_APPROVED;
         return -EINVAL;
 }
 
-static u8 bnx2x_bcm8726_set_limiting_mode(struct link_params *params,
-                                        u16 edc_mode)
+static u8 bnx2x_wait_for_sfp_module_initialized(struct bnx2x_phy *phy,
+                                                struct link_params *params)
+
 {
+        u8 val;
         struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
+        u16 timeout;
+        /* Initialization time after hot-plug may take up to 300ms for some
+        phys type ( e.g. JDSU ) */
+        for (timeout = 0; timeout < 60; timeout++) {
+                if (bnx2x_read_sfp_module_eeprom(phy, params, 1, 1, &val)
+                    == 0) {
+                        DP(NETIF_MSG_LINK, "SFP+ module initialization "
+                                     "took %d ms\n", timeout * 5);
+                        return 0;
+                }
+                msleep(5);
+        }
+        return -EINVAL;
+}
+
+static void bnx2x_8727_power_module(struct bnx2x *bp,
+                                    struct bnx2x_phy *phy,
+                                    u8 is_power_up) {
+        /* Make sure GPIOs are not using for LED mode */
+        u16 val;
+        /*
+         * In the GPIO register, bit 4 is use to detemine if the GPIOs are
+         * operating as INPUT or as OUTPUT. Bit 1 is for input, and 0 for
+         * output
+         * Bits 0-1 determine the gpios value for OUTPUT in case bit 4 val is 0
+         * Bits 8-9 determine the gpios value for INPUT in case bit 4 val is 1
+         * where the 1st bit is the over-current(only input), and 2nd bit is
+         * for power( only output )
+        */
+
+        /*
+         * In case of NOC feature is disabled and power is up, set GPIO control
+         *  as input to enable listening of over-current indication
+         */
+        if (phy->flags & FLAGS_NOC)
+                return;
+        if (!(phy->flags &
+              FLAGS_NOC) && is_power_up)
+                val = (1<<4);
+        else
+                /*
+                 * Set GPIO control to OUTPUT, and set the power bit
+                 * to according to the is_power_up
+                 */
+                val = ((!(is_power_up)) << 1);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8727_GPIO_CTRL,
+                         val);
+}
+
+static u8 bnx2x_8726_set_limiting_mode(struct bnx2x *bp,
+                                       struct bnx2x_phy *phy,
+                                       u16 edc_mode)
+{
         u16 cur_limiting_mode;
 
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_ROM_VER2,
                       &cur_limiting_mode);
@@ -3014,12 +4172,10 @@ static u8 bnx2x_bcm8726_set_limiting_mode(struct link_params *params,
         if (edc_mode == EDC_MODE_LIMITING) {
                 DP(NETIF_MSG_LINK,
                          "Setting LIMITING MODE\n");
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                               ext_phy_addr,
-                               MDIO_PMA_DEVAD,
-                               MDIO_PMA_REG_ROM_VER2,
-                               EDC_MODE_LIMITING);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_ROM_VER2,
+                                 EDC_MODE_LIMITING);
         } else { /* LRM mode ( default )*/
 
                 DP(NETIF_MSG_LINK, "Setting LRM MODE\n");
@@ -3030,27 +4186,19 @@ static u8 bnx2x_bcm8726_set_limiting_mode(struct link_params *params,
                 if (cur_limiting_mode != EDC_MODE_LIMITING)
                         return 0;
 
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                               ext_phy_addr,
+                bnx2x_cl45_write(bp, phy,
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_LRM_MODE,
                                0);
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                               ext_phy_addr,
+                bnx2x_cl45_write(bp, phy,
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_ROM_VER2,
                                0x128);
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                               ext_phy_addr,
+                bnx2x_cl45_write(bp, phy,
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_MISC_CTRL0,
                                0x4008);
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
-                               ext_phy_addr,
+                bnx2x_cl45_write(bp, phy,
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_LRM_MODE,
                                0xaaaa);
@@ -3058,46 +4206,33 @@ static u8 bnx2x_bcm8726_set_limiting_mode(struct link_params *params,
         return 0;
 }
 
-static u8 bnx2x_bcm8727_set_limiting_mode(struct link_params *params,
+static u8 bnx2x_8727_set_limiting_mode(struct bnx2x *bp,
+                                       struct bnx2x_phy *phy,
                                         u16 edc_mode)
 {
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
         u16 phy_identifier;
         u16 rom_ver2_val;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-
-        bnx2x_cl45_read(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_PHY_IDENTIFIER,
                        &phy_identifier);
 
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_PHY_IDENTIFIER,
                        (phy_identifier & ~(1<<9)));
 
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_ROM_VER2,
                       &rom_ver2_val);
         /* Keep the MSB 8-bits, and set the LSB 8-bits with the edc_mode */
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_ROM_VER2,
                        (rom_ver2_val & 0xff00) | (edc_mode & 0x00ff));
 
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_PHY_IDENTIFIER,
                        (phy_identifier | (1<<9)));
@@ -3105,72 +4240,34 @@ static u8 bnx2x_bcm8727_set_limiting_mode(struct link_params *params,
         return 0;
 }
 
-
-static u8 bnx2x_wait_for_sfp_module_initialized(struct link_params *params)
+static void bnx2x_8727_specific_func(struct bnx2x_phy *phy,
+                                     struct link_params *params,
+                                     u32 action)
 {
-        u8 val;
         struct bnx2x *bp = params->bp;
-        u16 timeout;
-        /* Initialization time after hot-plug may take up to 300ms for some
-        phys type ( e.g. JDSU ) */
-        for (timeout = 0; timeout < 60; timeout++) {
-                if (bnx2x_read_sfp_module_eeprom(params, 1, 1, &val)
-                    == 0) {
-                        DP(NETIF_MSG_LINK, "SFP+ module initialization "
-                                     "took %d ms\n", timeout * 5);
-                        return 0;
-                }
-                msleep(5);
-        }
-        return -EINVAL;
-}
 
-static void bnx2x_8727_power_module(struct bnx2x *bp,
-                                  struct link_params *params,
-                                  u8 ext_phy_addr, u8 is_power_up) {
-        /* Make sure GPIOs are not using for LED mode */
-        u16 val;
-        u8 port = params->port;
-        /*
-         * In the GPIO register, bit 4 is use to detemine if the GPIOs are
-         * operating as INPUT or as OUTPUT. Bit 1 is for input, and 0 for
-         * output
-         * Bits 0-1 determine the gpios value for OUTPUT in case bit 4 val is 0
-         * Bits 8-9 determine the gpios value for INPUT in case bit 4 val is 1
-         * where the 1st bit is the over-current(only input), and 2nd bit is
-         * for power( only output )
-        */
-
-        /*
-         * In case of NOC feature is disabled and power is up, set GPIO control
-         *  as input to enable listening of over-current indication
-         */
-
-        if (!(params->feature_config_flags &
-              FEATURE_CONFIG_BCM8727_NOC) && is_power_up)
-                val = (1<<4);
-        else
-                /*
-                 * Set GPIO control to OUTPUT, and set the power bit
-                 * to according to the is_power_up
-                 */
-                val = ((!(is_power_up)) << 1);
-
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8727_GPIO_CTRL,
-                       val);
+        switch (action) {
+        case DISABLE_TX:
+                bnx2x_sfp_set_transmitter(bp, phy, params->port, 0);
+                break;
+        case ENABLE_TX:
+                if (!(phy->flags & FLAGS_SFP_NOT_APPROVED))
+                        bnx2x_sfp_set_transmitter(bp, phy, params->port, 1);
+                break;
+        default:
+                DP(NETIF_MSG_LINK, "Function 0x%x not supported by 8727\n",
+                   action);
+                return;
+        }
 }
 
-static u8 bnx2x_sfp_module_detection(struct link_params *params)
+static u8 bnx2x_sfp_module_detection(struct bnx2x_phy *phy,
+                                     struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 edc_mode;
         u8 rc = 0;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
+
         u32 val = REG_RD(bp, params->shmem_base +
                              offsetof(struct shmem_region, dev_info.
                                      port_feature_config[params->port].config));
@@ -3178,10 +4275,10 @@ static u8 bnx2x_sfp_module_detection(struct link_params *params)
         DP(NETIF_MSG_LINK, "SFP+ module plugged in/out detected on port %d\n",
                  params->port);
 
-        if (bnx2x_get_edc_mode(params, &edc_mode) != 0) {
+        if (bnx2x_get_edc_mode(phy, params, &edc_mode) != 0) {
                 DP(NETIF_MSG_LINK, "Failed to get valid module type\n");
                 return -EINVAL;
-        } else if (bnx2x_verify_sfp_module(params) !=
+        } else if (bnx2x_verify_sfp_module(phy, params) !=
                    0) {
                 /* check SFP+ module compatibility */
                 DP(NETIF_MSG_LINK, "Module verification failed!!\n");
@@ -3190,13 +4287,12 @@ static u8 bnx2x_sfp_module_detection(struct link_params *params)
                 bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_0,
                                   MISC_REGISTERS_GPIO_HIGH,
                                   params->port);
-                if ((ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727) &&
+                if ((phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727) &&
                     ((val & PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_MASK) ==
                      PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_POWER_DOWN)) {
                         /* Shutdown SFP+ module */
                         DP(NETIF_MSG_LINK, "Shutdown SFP+ module!!\n");
-                        bnx2x_8727_power_module(bp, params,
-                                              ext_phy_addr, 0);
+                        bnx2x_8727_power_module(bp, phy, 0);
                         return rc;
                 }
         } else {
@@ -3208,15 +4304,15 @@ static u8 bnx2x_sfp_module_detection(struct link_params *params)
         }
 
         /* power up the SFP module */
-        if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727)
-                bnx2x_8727_power_module(bp, params, ext_phy_addr, 1);
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727)
+                bnx2x_8727_power_module(bp, phy, 1);
 
         /* Check and set limiting mode / LRM mode on 8726.
         On 8727 it is done automatically */
-        if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726)
-                bnx2x_bcm8726_set_limiting_mode(params, edc_mode);
+        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726)
+                bnx2x_8726_set_limiting_mode(bp, phy, edc_mode);
         else
-                bnx2x_bcm8727_set_limiting_mode(params, edc_mode);
+                bnx2x_8727_set_limiting_mode(bp, phy, edc_mode);
         /*
          * Enable transmit for this module if the module is approved, or
          * if unapproved modules should also enable the Tx laser
@@ -3224,11 +4320,9 @@ static u8 bnx2x_sfp_module_detection(struct link_params *params)
         if (rc == 0 ||
             (val & PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_MASK) !=
             PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_DISABLE_TX_LASER)
-                bnx2x_sfp_set_transmitter(bp, params->port,
-                                        ext_phy_type, ext_phy_addr, 1);
+                bnx2x_sfp_set_transmitter(bp, phy, params->port, 1);
         else
-                bnx2x_sfp_set_transmitter(bp, params->port,
-                                        ext_phy_type, ext_phy_addr, 0);
+                bnx2x_sfp_set_transmitter(bp, phy, params->port, 0);
 
         return rc;
 }
@@ -3236,6 +4330,7 @@ static u8 bnx2x_sfp_module_detection(struct link_params *params)
 void bnx2x_handle_module_detect_int(struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
+        struct bnx2x_phy *phy = &params->phy[EXT_PHY1];
         u32 gpio_val;
         u8 port = params->port;
 
@@ -3245,1349 +4340,587 @@ void bnx2x_handle_module_detect_int(struct link_params *params)
                           params->port);
 
         /* Get current gpio val refelecting module plugged in / out*/
-        gpio_val = bnx2x_get_gpio(bp,  MISC_REGISTERS_GPIO_3, port);
+        gpio_val = bnx2x_get_gpio(bp, MISC_REGISTERS_GPIO_3, port);
 
         /* Call the handling function in case module is detected */
         if (gpio_val == 0) {
 
                 bnx2x_set_gpio_int(bp, MISC_REGISTERS_GPIO_3,
-                                      MISC_REGISTERS_GPIO_INT_OUTPUT_CLR,
-                                      port);
+                                   MISC_REGISTERS_GPIO_INT_OUTPUT_CLR,
+                                   port);
 
-                if (bnx2x_wait_for_sfp_module_initialized(params) ==
-                    0)
-                        bnx2x_sfp_module_detection(params);
+                if (bnx2x_wait_for_sfp_module_initialized(phy, params) == 0)
+                        bnx2x_sfp_module_detection(phy, params);
                 else
                         DP(NETIF_MSG_LINK, "SFP+ module is not initialized\n");
         } else {
-                u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-
-                u32 ext_phy_type =
-                        XGXS_EXT_PHY_TYPE(params->ext_phy_config);
                 u32 val = REG_RD(bp, params->shmem_base +
                                      offsetof(struct shmem_region, dev_info.
                                               port_feature_config[params->port].
                                               config));
 
                 bnx2x_set_gpio_int(bp, MISC_REGISTERS_GPIO_3,
-                                      MISC_REGISTERS_GPIO_INT_OUTPUT_SET,
-                                      port);
+                                   MISC_REGISTERS_GPIO_INT_OUTPUT_SET,
+                                   port);
                 /* Module was plugged out. */
                 /* Disable transmit for this module */
                 if ((val & PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_MASK) ==
                     PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_DISABLE_TX_LASER)
-                        bnx2x_sfp_set_transmitter(bp, params->port,
-                                                ext_phy_type, ext_phy_addr, 0);
+                        bnx2x_sfp_set_transmitter(bp, phy, params->port, 0);
         }
 }
 
-static void bnx2x_bcm807x_force_10G(struct link_params *params)
+/******************************************************************/
+/*              common BCM8706/BCM8726 PHY SECTION                */
+/******************************************************************/
+static u8 bnx2x_8706_8726_read_status(struct bnx2x_phy *phy,
+                                      struct link_params *params,
+                                      struct link_vars *vars)
 {
+        u8 link_up = 0;
+        u16 val1, val2, rx_sd, pcs_status;
         struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        /* Force KR or KX */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_CTRL,
-                       0x2040);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_10G_CTRL2,
-                       0x000b);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_BCM_CTRL,
-                       0x0000);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_AN_DEVAD,
-                       MDIO_AN_REG_CTRL,
-                       0x0000);
-}
-
-static void bnx2x_bcm8073_set_xaui_low_power_mode(struct link_params *params)
-{
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u16 val;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        bnx2x_cl45_read(bp, params->port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                      ext_phy_addr,
-                      MDIO_PMA_DEVAD,
-                      MDIO_PMA_REG_8073_CHIP_REV, &val);
-
-        if (val == 0) {
-                /* Mustn't set low power mode in 8073 A0 */
-                return;
+        DP(NETIF_MSG_LINK, "XGXS 8706/8726\n");
+        /* Clear RX Alarm*/
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM, &val2);
+        /* clear LASI indication*/
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val1);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val2);
+        DP(NETIF_MSG_LINK, "8706/8726 LASI status 0x%x--> 0x%x\n", val1, val2);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_SD, &rx_sd);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PCS_DEVAD, MDIO_PCS_REG_STATUS, &pcs_status);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS, &val2);
+
+        DP(NETIF_MSG_LINK, "8706/8726 rx_sd 0x%x pcs_status 0x%x 1Gbps"
+                        " link_status 0x%x\n", rx_sd, pcs_status, val2);
+        /* link is up if both bit 0 of pmd_rx_sd and
+         * bit 0 of pcs_status are set, or if the autoneg bit
+         * 1 is set
+         */
+        link_up = ((rx_sd & pcs_status & 0x1) || (val2 & (1<<1)));
+        if (link_up) {
+                if (val2 & (1<<1))
+                        vars->line_speed = SPEED_1000;
+                else
+                        vars->line_speed = SPEED_10000;
+                bnx2x_ext_phy_resolve_fc(phy, params, vars);
         }
-
-        /* Disable PLL sequencer (use read-modify-write to clear bit 13) */
-        bnx2x_cl45_read(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD,
-                       MDIO_XS_PLL_SEQUENCER, &val);
-        val &= ~(1<<13);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
-
-        /* PLL controls */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x805E, 0x1077);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x805D, 0x0000);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x805C, 0x030B);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x805B, 0x1240);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x805A, 0x2490);
-
-        /* Tx Controls */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80A7, 0x0C74);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80A6, 0x9041);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80A5, 0x4640);
-
-        /* Rx Controls */
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80FE, 0x01C4);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80FD, 0x9249);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, 0x80FC, 0x2015);
-
-        /* Enable PLL sequencer  (use read-modify-write to set bit 13) */
-        bnx2x_cl45_read(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD,
-                       MDIO_XS_PLL_SEQUENCER, &val);
-        val |= (1<<13);
-        bnx2x_cl45_write(bp, port, ext_phy_type, ext_phy_addr,
-                       MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
+        return link_up;
 }
 
-static void bnx2x_8073_set_pause_cl37(struct link_params *params,
-                                  struct link_vars *vars)
+/******************************************************************/
+/*                      BCM8706 PHY SECTION                       */
+/******************************************************************/
+static u8 bnx2x_8706_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
+        u16 cnt, val;
         struct bnx2x *bp = params->bp;
-        u16 cl37_val;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        bnx2x_cl45_read(bp, params->port,
-                      ext_phy_type,
-                      ext_phy_addr,
-                      MDIO_AN_DEVAD,
-                      MDIO_AN_REG_CL37_FC_LD, &cl37_val);
-
-        cl37_val &= ~MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
-        /* Please refer to Table 28B-3 of 802.3ab-1999 spec. */
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
+        /* HW reset */
+        bnx2x_ext_phy_hw_reset(bp, params->port);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0xa040);
+        bnx2x_wait_reset_complete(bp, phy);
 
-        if ((vars->ieee_fc &
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC) ==
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC) {
-                cl37_val |=  MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC;
+        /* Wait until fw is loaded */
+        for (cnt = 0; cnt < 100; cnt++) {
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_ROM_VER1, &val);
+                if (val)
+                        break;
+                msleep(10);
         }
-        if ((vars->ieee_fc &
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) ==
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) {
-                cl37_val |=  MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+        DP(NETIF_MSG_LINK, "XGXS 8706 is initialized after %d ms\n", cnt);
+        if ((params->feature_config_flags &
+             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
+                u8 i;
+                u16 reg;
+                for (i = 0; i < 4; i++) {
+                        reg = MDIO_XS_8706_REG_BANK_RX0 +
+                                i*(MDIO_XS_8706_REG_BANK_RX1 -
+                                   MDIO_XS_8706_REG_BANK_RX0);
+                        bnx2x_cl45_read(bp, phy, MDIO_XS_DEVAD, reg, &val);
+                        /* Clear first 3 bits of the control */
+                        val &= ~0x7;
+                        /* Set control bits according to configuration */
+                        val |= (phy->rx_preemphasis[i] & 0x7);
+                        DP(NETIF_MSG_LINK, "Setting RX Equalizer to BCM8706"
+                                   " reg 0x%x <-- val 0x%x\n", reg, val);
+                        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, reg, val);
+                }
         }
-        if ((vars->ieee_fc &
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) ==
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) {
-                cl37_val |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+        /* Force speed */
+        if (phy->req_line_speed == SPEED_10000) {
+                DP(NETIF_MSG_LINK, "XGXS 8706 force 10Gbps\n");
+
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_DIGITAL_CTRL, 0x400);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 1);
+        } else {
+                /* Force 1Gbps using autoneg with 1G advertisment */
+
+                /* Allow CL37 through CL73 */
+                DP(NETIF_MSG_LINK, "XGXS 8706 AutoNeg\n");
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_CL73, 0x040c);
+
+                /* Enable Full-Duplex advertisment on CL37 */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LP, 0x0020);
+                /* Enable CL37 AN */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_AN, 0x1000);
+                /* 1G support */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_ADV, (1<<5));
+
+                /* Enable clause 73 AN */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, 0x1200);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL,
+                                 0x0400);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL,
+                                 0x0004);
         }
-        DP(NETIF_MSG_LINK,
-                 "Ext phy AN advertize cl37 0x%x\n", cl37_val);
+        bnx2x_save_bcm_spirom_ver(bp, phy, params->port);
+        return 0;
+}
 
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_AN_DEVAD,
-                       MDIO_AN_REG_CL37_FC_LD, cl37_val);
-        msleep(500);
+static u8 bnx2x_8706_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        return bnx2x_8706_8726_read_status(phy, params, vars);
 }
 
-static void bnx2x_ext_phy_set_pause(struct link_params *params,
-                                  struct link_vars *vars)
+/******************************************************************/
+/*                      BCM8726 PHY SECTION                       */
+/******************************************************************/
+static void bnx2x_8726_config_loopback(struct bnx2x_phy *phy,
+                                       struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
-        u16 val;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        /* read modify write pause advertizing */
-        bnx2x_cl45_read(bp, params->port,
-                      ext_phy_type,
-                      ext_phy_addr,
-                      MDIO_AN_DEVAD,
-                      MDIO_AN_REG_ADV_PAUSE, &val);
-
-        val &= ~MDIO_AN_REG_ADV_PAUSE_BOTH;
-
-        /* Please refer to Table 28B-3 of 802.3ab-1999 spec. */
-
-        if ((vars->ieee_fc &
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) ==
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC) {
-                val |=  MDIO_AN_REG_ADV_PAUSE_ASYMMETRIC;
-        }
-        if ((vars->ieee_fc &
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) ==
-            MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH) {
-                val |=
-                 MDIO_AN_REG_ADV_PAUSE_PAUSE;
-        }
-        DP(NETIF_MSG_LINK,
-                 "Ext phy AN advertize 0x%x\n", val);
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_AN_DEVAD,
-                       MDIO_AN_REG_ADV_PAUSE, val);
+        DP(NETIF_MSG_LINK, "PMA/PMD ext_phy_loopback: 8726\n");
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x0001);
 }
-static void bnx2x_set_preemphasis(struct link_params *params)
+
+static void bnx2x_8726_external_rom_boot(struct bnx2x_phy *phy,
+                                         struct link_params *params)
 {
-        u16 bank, i = 0;
         struct bnx2x *bp = params->bp;
+        /* Need to wait 100ms after reset */
+        msleep(100);
 
-        for (bank = MDIO_REG_BANK_RX0, i = 0; bank <= MDIO_REG_BANK_RX3;
-              bank += (MDIO_REG_BANK_RX1-MDIO_REG_BANK_RX0), i++) {
-                        CL45_WR_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
-                                              bank,
-                                              MDIO_RX0_RX_EQ_BOOST,
-                                              params->xgxs_config_rx[i]);
-        }
-
-        for (bank = MDIO_REG_BANK_TX0, i = 0; bank <= MDIO_REG_BANK_TX3;
-                      bank += (MDIO_REG_BANK_TX1 - MDIO_REG_BANK_TX0), i++) {
-                        CL45_WR_OVER_CL22(bp, params->port,
-                                              params->phy_addr,
-                                              bank,
-                                              MDIO_TX0_TX_DRIVER,
-                                              params->xgxs_config_tx[i]);
-        }
-}
+        /* Micro controller re-boot */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_GEN_CTRL, 0x018B);
 
+        /* Set soft reset */
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_GEN_CTRL,
+                       MDIO_PMA_REG_GEN_CTRL_ROM_MICRO_RESET);
 
-static void bnx2x_8481_set_led4(struct link_params *params,
-                              u32 ext_phy_type, u8 ext_phy_addr)
-{
-        struct bnx2x *bp = params->bp;
+        bnx2x_cl45_write(bp, phy,
+                       MDIO_PMA_DEVAD,
+                       MDIO_PMA_REG_MISC_CTRL1, 0x0001);
 
-        /* PHYC_CTL_LED_CTL */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LINK_SIGNAL, 0xa482);
+                       MDIO_PMA_REG_GEN_CTRL,
+                       MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
 
-        /* Unmask LED4 for 10G link */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
+        /* wait for 150ms for microcode load */
+        msleep(150);
+
+        /* Disable serial boot control, tristates pins SS_N, SCK, MOSI, MISO */
+        bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_SIGNAL_MASK, (1<<6));
-        /* 'Interrupt Mask' */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_AN_DEVAD,
-                       0xFFFB, 0xFFFD);
-}
-static void bnx2x_8481_set_legacy_led_mode(struct link_params *params,
-                                         u32 ext_phy_type, u8 ext_phy_addr)
-{
-        struct bnx2x *bp = params->bp;
+                       MDIO_PMA_REG_MISC_CTRL1, 0x0000);
 
-        /* LED1 (10G Link): Disable LED1 when 10/100/1000 link */
-        /* LED2 (1G/100/10 Link): Enable LED2 when 10/100/1000 link) */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_AN_DEVAD,
-                       MDIO_AN_REG_8481_LEGACY_SHADOW,
-                       (1<<15) | (0xd << 10) | (0xc<<4) | 0xe);
+        msleep(200);
+        bnx2x_save_bcm_spirom_ver(bp, phy, params->port);
 }
 
-static void bnx2x_8481_set_10G_led_mode(struct link_params *params,
-                                      u32 ext_phy_type, u8 ext_phy_addr)
+static u8 bnx2x_8726_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
         u16 val1;
-
-        /* LED1 (10G Link) */
-        /* Enable continuse based on source 7(10G-link) */
-        bnx2x_cl45_read(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LINK_SIGNAL,
-                       &val1);
-        /* Set bit 2 to 0, and bits [1:0] to 10 */
-        val1 &= ~((1<<0) | (1<<2) | (1<<7)); /* Clear bits 0,2,7*/
-        val1 |= ((1<<1) | (1<<6)); /* Set bit 1, 6 */
-
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LINK_SIGNAL,
-                       val1);
-
-        /* Unmask LED1 for 10G link */
-        bnx2x_cl45_read(bp, params->port,
-                      ext_phy_type,
-                      ext_phy_addr,
-                      MDIO_PMA_DEVAD,
-                      MDIO_PMA_REG_8481_LED1_MASK,
-                      &val1);
-        /* Set bit 2 to 0, and bits [1:0] to 10 */
-        val1 |= (1<<7);
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LED1_MASK,
-                       val1);
-
-        /* LED2 (1G/100/10G Link) */
-        /* Mask LED2 for 10G link */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LED2_MASK,
-                       0);
-
-        /* Unmask LED3 for 10G link */
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                      MDIO_PMA_REG_8481_LED3_MASK,
-                       0x6);
-        bnx2x_cl45_write(bp, params->port,
-                       ext_phy_type,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_8481_LED3_BLINK,
-                       0);
+        u8 link_up = bnx2x_8706_8726_read_status(phy, params, vars);
+        if (link_up) {
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_PHY_IDENTIFIER,
+                                &val1);
+                if (val1 & (1<<15)) {
+                        DP(NETIF_MSG_LINK, "Tx is disabled\n");
+                        link_up = 0;
+                        vars->line_speed = 0;
+                }
+        }
+        return link_up;
 }
 
 
-static void bnx2x_init_internal_phy(struct link_params *params,
-                                  struct link_vars *vars,
-                                  u8 enable_cl73)
+static u8 bnx2x_8726_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
+        u32 val;
+        u32 swap_val, swap_override, aeu_gpio_mask, offset;
+        DP(NETIF_MSG_LINK, "Initializing BCM8726\n");
+        /* Restore normal power mode*/
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
 
-        if (!(vars->phy_flags & PHY_SGMII_FLAG)) {
-                if ((XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
-                    (params->feature_config_flags &
-                     FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED))
-                        bnx2x_set_preemphasis(params);
-
-                /* forced speed requested? */
-                if (vars->line_speed != SPEED_AUTO_NEG ||
-                    ((XGXS_EXT_PHY_TYPE(params->ext_phy_config) ==
-                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
-                          params->loopback_mode == LOOPBACK_EXT)) {
-                        DP(NETIF_MSG_LINK, "not SGMII, no AN\n");
-
-                        /* disable autoneg */
-                        bnx2x_set_autoneg(params, vars, 0);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
+
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 1<<15);
+        bnx2x_wait_reset_complete(bp, phy);
+
+        bnx2x_8726_external_rom_boot(phy, params);
+
+        /* Need to call module detected on initialization since
+        the module detection triggered by actual module
+        insertion might occur before driver is loaded, and when
+        driver is loaded, it reset all registers, including the
+        transmitter */
+        bnx2x_sfp_module_detection(phy, params);
+
+        if (phy->req_line_speed == SPEED_1000) {
+                DP(NETIF_MSG_LINK, "Setting 1G force\n");
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x40);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_10G_CTRL2, 0xD);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 0x5);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL,
+                                 0x400);
+        } else if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                   (phy->speed_cap_mask &
+                      PORT_HW_CFG_SPEED_CAPABILITY_D0_1G) &&
+                   ((phy->speed_cap_mask &
+                      PORT_HW_CFG_SPEED_CAPABILITY_D0_10G) !=
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)) {
+                DP(NETIF_MSG_LINK, "Setting 1G clause37\n");
+                /* Set Flow control */
+                bnx2x_ext_phy_set_pause(params, phy, vars);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_ADV, 0x20);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_CL73, 0x040c);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_FC_LD, 0x0020);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_AN, 0x1000);
+                bnx2x_cl45_write(bp, phy,
+                                MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, 0x1200);
+                /* Enable RX-ALARM control to receive
+                interrupt for 1G speed change */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 0x4);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL,
+                                 0x400);
+
+        } else { /* Default 10G. Set only LASI control */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 1);
+        }
 
-                        /* program speed and duplex */
-                        bnx2x_program_serdes(params, vars);
+        /* Set TX PreEmphasis if needed */
+        if ((params->feature_config_flags &
+             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
+                DP(NETIF_MSG_LINK, "Setting TX_CTRL1 0x%x,"
+                         "TX_CTRL2 0x%x\n",
+                         phy->tx_preemphasis[0],
+                         phy->tx_preemphasis[1]);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_8726_TX_CTRL1,
+                                 phy->tx_preemphasis[0]);
+
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_8726_TX_CTRL2,
+                                 phy->tx_preemphasis[1]);
+        }
 
-                } else { /* AN_mode */
-                        DP(NETIF_MSG_LINK, "not SGMII, AN\n");
+        /* Set GPIO3 to trigger SFP+ module insertion/removal */
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_3,
+                            MISC_REGISTERS_GPIO_INPUT_HI_Z, params->port);
 
-                        /* AN enabled */
-                        bnx2x_set_brcm_cl37_advertisment(params);
+        /* The GPIO should be swapped if the swap register is set and active */
+        swap_val = REG_RD(bp, NIG_REG_PORT_SWAP);
+        swap_override = REG_RD(bp, NIG_REG_STRAP_OVERRIDE);
 
-                        /* program duplex & pause advertisement (for aneg) */
-                        bnx2x_set_ieee_aneg_advertisment(params,
-                                                       vars->ieee_fc);
+        /* Select function upon port-swap configuration */
+        if (params->port == 0) {
+                offset = MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0;
+                aeu_gpio_mask = (swap_val && swap_override) ?
+                        AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_1 :
+                        AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_0;
+        } else {
+                offset = MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0;
+                aeu_gpio_mask = (swap_val && swap_override) ?
+                        AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_0 :
+                        AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_1;
+        }
+        val = REG_RD(bp, offset);
+        /* add GPIO3 to group */
+        val |= aeu_gpio_mask;
+        REG_WR(bp, offset, val);
+        return 0;
 
-                        /* enable autoneg */
-                        bnx2x_set_autoneg(params, vars, enable_cl73);
+}
 
-                        /* enable and restart AN */
-                        bnx2x_restart_autoneg(params, enable_cl73);
-                }
+static void bnx2x_8726_link_reset(struct bnx2x_phy *phy,
+                                  struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        DP(NETIF_MSG_LINK, "bnx2x_8726_link_reset port %d\n", params->port);
+        /* Set serial boot control for external load */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_GEN_CTRL, 0x0001);
+}
 
-        } else { /* SGMII mode */
-                DP(NETIF_MSG_LINK, "SGMII\n");
+/******************************************************************/
+/*                      BCM8727 PHY SECTION                       */
+/******************************************************************/
 
-                bnx2x_initialize_sgmii_process(params, vars);
+static void bnx2x_8727_set_link_led(struct bnx2x_phy *phy,
+                                    struct link_params *params, u8 mode)
+{
+        struct bnx2x *bp = params->bp;
+        u16 led_mode_bitmask = 0;
+        u16 gpio_pins_bitmask = 0;
+        u16 val;
+        /* Only NOC flavor requires to set the LED specifically */
+        if (!(phy->flags & FLAGS_NOC))
+                return;
+        switch (mode) {
+        case LED_MODE_FRONT_PANEL_OFF:
+        case LED_MODE_OFF:
+                led_mode_bitmask = 0;
+                gpio_pins_bitmask = 0x03;
+                break;
+        case LED_MODE_ON:
+                led_mode_bitmask = 0;
+                gpio_pins_bitmask = 0x02;
+                break;
+        case LED_MODE_OPER:
+                led_mode_bitmask = 0x60;
+                gpio_pins_bitmask = 0x11;
+                break;
         }
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_8727_PCS_OPT_CTRL,
+                        &val);
+        val &= 0xff8f;
+        val |= led_mode_bitmask;
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8727_PCS_OPT_CTRL,
+                         val);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_8727_GPIO_CTRL,
+                        &val);
+        val &= 0xffe0;
+        val |= gpio_pins_bitmask;
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8727_GPIO_CTRL,
+                         val);
+}
+static void bnx2x_8727_hw_reset(struct bnx2x_phy *phy,
+                                struct link_params *params) {
+        u32 swap_val, swap_override;
+        u8 port;
+        /**
+         * The PHY reset is controlled by GPIO 1. Fake the port number
+         * to cancel the swap done in set_gpio()
+         */
+        struct bnx2x *bp = params->bp;
+        swap_val = REG_RD(bp, NIG_REG_PORT_SWAP);
+        swap_override = REG_RD(bp, NIG_REG_STRAP_OVERRIDE);
+        port = (swap_val && swap_override) ^ 1;
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
 }
 
-static u8 bnx2x_ext_phy_init(struct link_params *params, struct link_vars *vars)
+static u8 bnx2x_8727_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
+        u16 tmp1, val, mod_abs;
+        u16 rx_alarm_ctrl_val;
+        u16 lasi_ctrl_val;
         struct bnx2x *bp = params->bp;
-        u32 ext_phy_type;
-        u8 ext_phy_addr;
-        u16 cnt;
-        u16 ctrl = 0;
-        u16 val = 0;
-        u8 rc = 0;
-
-        if (vars->phy_flags & PHY_XGXS_FLAG) {
-                ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-
-                ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-                /* Make sure that the soft reset is off (expect for the 8072:
-                 * due to the lock, it will be done inside the specific
-                 * handling)
+        /* Enable PMD link, MOD_ABS_FLT, and 1G link alarm */
+
+        bnx2x_wait_reset_complete(bp, phy);
+        rx_alarm_ctrl_val = (1<<2) | (1<<5) ;
+        lasi_ctrl_val = 0x0004;
+
+        DP(NETIF_MSG_LINK, "Initializing BCM8727\n");
+        /* enable LASI */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL,
+                         rx_alarm_ctrl_val);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, lasi_ctrl_val);
+
+        /* Initially configure  MOD_ABS to interrupt when
+        module is presence( bit 8) */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_PHY_IDENTIFIER, &mod_abs);
+        /* Set EDC off by setting OPTXLOS signal input to low
+        (bit 9).
+        When the EDC is off it locks onto a reference clock and
+        avoids becoming 'lost'.*/
+        mod_abs &= ~(1<<8);
+        if (!(phy->flags & FLAGS_NOC))
+                mod_abs &= ~(1<<9);
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_PHY_IDENTIFIER, mod_abs);
+
+
+        /* Make MOD_ABS give interrupt on change */
+        bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_PCS_OPT_CTRL,
+                        &val);
+        val |= (1<<12);
+        if (phy->flags & FLAGS_NOC)
+                val |= (3<<5);
+
+        /**
+         * Set 8727 GPIOs to input to allow reading from the 8727 GPIO0
+         * status which reflect SFP+ module over-current
+         */
+        if (!(phy->flags & FLAGS_NOC))
+                val &= 0xff8f; /* Reset bits 4-6 */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_PCS_OPT_CTRL, val);
+
+        bnx2x_8727_power_module(bp, phy, 1);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &tmp1);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM, &tmp1);
+
+        /* Set option 1G speed */
+        if (phy->req_line_speed == SPEED_1000) {
+                DP(NETIF_MSG_LINK, "Setting 1G force\n");
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x40);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_10G_CTRL2, 0xD);
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_10G_CTRL2, &tmp1);
+                DP(NETIF_MSG_LINK, "1.7 = 0x%x\n", tmp1);
+                /**
+                 * Power down the XAUI until link is up in case of dual-media
+                 * and 1G
                  */
-                if ((ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
-                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) &&
-                   (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN) &&
-                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072) &&
-                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073)) {
-                        /* Wait for soft reset to get cleared upto 1 sec */
-                        for (cnt = 0; cnt < 1000; cnt++) {
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_CTRL, &ctrl);
-                                if (!(ctrl & (1<<15)))
-                                        break;
-                                msleep(1);
-                        }
-                        DP(NETIF_MSG_LINK, "control reg 0x%x (after %d ms)\n",
-                                 ctrl, cnt);
-                }
-
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                        DP(NETIF_MSG_LINK, "XGXS 8705\n");
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_MISC_CTRL,
-                                       0x8288);
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_PHY_IDENTIFIER,
-                                       0x7fbf);
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CMU_PLL_BYPASS,
-                                       0x0100);
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_WIS_DEVAD,
-                                       MDIO_WIS_REG_LASI_CNTL, 0x1);
-
-                        /* BCM8705 doesn't have microcode, hence the 0 */
-                        bnx2x_save_spirom_version(bp, params->port,
-                                                params->shmem_base, 0);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        /* Wait until fw is loaded */
-                        for (cnt = 0; cnt < 100; cnt++) {
-                                bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                              ext_phy_addr, MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_ROM_VER1, &val);
-                                if (val)
-                                        break;
-                                msleep(10);
-                        }
-                        DP(NETIF_MSG_LINK, "XGXS 8706 is initialized "
-                                "after %d ms\n", cnt);
-                        if ((params->feature_config_flags &
-                             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
-                                u8 i;
-                                u16 reg;
-                                for (i = 0; i < 4; i++) {
-                                        reg = MDIO_XS_8706_REG_BANK_RX0 +
-                                                i*(MDIO_XS_8706_REG_BANK_RX1 -
-                                                   MDIO_XS_8706_REG_BANK_RX0);
-                                        bnx2x_cl45_read(bp, params->port,
-                                                      ext_phy_type,
-                                                      ext_phy_addr,
-                                                      MDIO_XS_DEVAD,
-                                                      reg, &val);
-                                        /* Clear first 3 bits of the control */
-                                        val &= ~0x7;
-                                        /* Set control bits according to
-                                        configuation */
-                                        val |= (params->xgxs_config_rx[i] &
-                                                0x7);
-                                        DP(NETIF_MSG_LINK, "Setting RX"
-                                                 "Equalizer to BCM8706 reg 0x%x"
-                                                 " <-- val 0x%x\n", reg, val);
-                                        bnx2x_cl45_write(bp, params->port,
-                                                       ext_phy_type,
-                                                       ext_phy_addr,
-                                                       MDIO_XS_DEVAD,
-                                                       reg, val);
-                                }
-                        }
-                        /* Force speed */
-                        if (params->req_line_speed == SPEED_10000) {
-                                DP(NETIF_MSG_LINK, "XGXS 8706 force 10Gbps\n");
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_DIGITAL_CTRL,
-                                               0x400);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_LASI_CTRL, 1);
-                        } else {
-                                /* Force 1Gbps using autoneg with 1G
-                                advertisment */
-
-                                /* Allow CL37 through CL73 */
-                                DP(NETIF_MSG_LINK, "XGXS 8706 AutoNeg\n");
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_CL73,
-                                               0x040c);
-
-                                /* Enable Full-Duplex advertisment on CL37 */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_FC_LP,
-                                               0x0020);
-                                /* Enable CL37 AN */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_AN,
-                                               0x1000);
-                                /* 1G support */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_ADV, (1<<5));
-
-                                /* Enable clause 73 AN */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CTRL,
-                                               0x1200);
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_RX_ALARM_CTRL,
-                                               0x0400);
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_LASI_CTRL, 0x0004);
-
-                        }
-                        bnx2x_save_bcm_spirom_ver(bp, params->port,
-                                                ext_phy_type,
-                                                ext_phy_addr,
-                                                params->shmem_base);
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                        DP(NETIF_MSG_LINK, "Initializing BCM8726\n");
-                        bnx2x_bcm8726_external_rom_boot(params);
-
-                        /* Need to call module detected on initialization since
-                        the module detection triggered by actual module
-                        insertion might occur before driver is loaded, and when
-                        driver is loaded, it reset all registers, including the
-                        transmitter */
-                        bnx2x_sfp_module_detection(params);
-
-                        /* Set Flow control */
-                        bnx2x_ext_phy_set_pause(params, vars);
-                        if (params->req_line_speed == SPEED_1000) {
-                                DP(NETIF_MSG_LINK, "Setting 1G force\n");
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_CTRL, 0x40);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_10G_CTRL2, 0xD);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_LASI_CTRL, 0x5);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_RX_ALARM_CTRL,
-                                               0x400);
-                        } else if ((params->req_line_speed ==
-                                    SPEED_AUTO_NEG) &&
-                                   ((params->speed_cap_mask &
-                                     PORT_HW_CFG_SPEED_CAPABILITY_D0_1G))) {
-                                DP(NETIF_MSG_LINK, "Setting 1G clause37\n");
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_ADV, 0x20);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_CL73, 0x040c);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_FC_LD, 0x0020);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_AN, 0x1000);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CTRL, 0x1200);
-
-                                /* Enable RX-ALARM control to receive
-                                interrupt for 1G speed change */
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_LASI_CTRL, 0x4);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_RX_ALARM_CTRL,
-                                               0x400);
-
-                        } else { /* Default 10G. Set only LASI control */
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_LASI_CTRL, 1);
-                        }
-
-                        /* Set TX PreEmphasis if needed */
-                        if ((params->feature_config_flags &
-                             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
-                                DP(NETIF_MSG_LINK, "Setting TX_CTRL1 0x%x,"
-                                         "TX_CTRL2 0x%x\n",
-                                         params->xgxs_config_tx[0],
-                                         params->xgxs_config_tx[1]);
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_8726_TX_CTRL1,
-                                               params->xgxs_config_tx[0]);
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_8726_TX_CTRL2,
-                                               params->xgxs_config_tx[1]);
-                        }
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                {
-                        u16 tmp1;
-                        u16 rx_alarm_ctrl_val;
-                        u16 lasi_ctrl_val;
-                        if (ext_phy_type ==
-                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072) {
-                                rx_alarm_ctrl_val = 0x400;
-                                lasi_ctrl_val = 0x0004;
-                        } else {
-                                rx_alarm_ctrl_val = (1<<2);
-                                lasi_ctrl_val = 0x0004;
-                        }
-
-                        /* enable LASI */
-                        bnx2x_cl45_write(bp, params->port,
-                                   ext_phy_type,
-                                   ext_phy_addr,
-                                   MDIO_PMA_DEVAD,
-                                   MDIO_PMA_REG_RX_ALARM_CTRL,
-                                   rx_alarm_ctrl_val);
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_LASI_CTRL,
-                                       lasi_ctrl_val);
-
-                        bnx2x_8073_set_pause_cl37(params, vars);
-
-                        if (ext_phy_type ==
-                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072)
-                                bnx2x_bcm8072_external_rom_boot(params);
-                        else
-                                /* In case of 8073 with long xaui lines,
-                                don't set the 8073 xaui low power*/
-                                bnx2x_bcm8073_set_xaui_low_power_mode(params);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_M8051_MSGOUT_REG,
-                                      &tmp1);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_RX_ALARM, &tmp1);
-
-                        DP(NETIF_MSG_LINK, "Before rom RX_ALARM(port1):"
-                                             "0x%x\n", tmp1);
-
-                        /* If this is forced speed, set to KR or KX
-                         * (all other are not supported)
-                         */
-                        if (params->loopback_mode == LOOPBACK_EXT) {
-                                bnx2x_bcm807x_force_10G(params);
-                                DP(NETIF_MSG_LINK,
-                                        "Forced speed 10G on 807X\n");
-                                break;
-                        } else {
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type, ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_BCM_CTRL,
-                                               0x0002);
-                        }
-                        if (params->req_line_speed != SPEED_AUTO_NEG) {
-                                if (params->req_line_speed == SPEED_10000) {
-                                        val = (1<<7);
-                                } else if (params->req_line_speed ==
-                                           SPEED_2500) {
-                                        val = (1<<5);
-                                        /* Note that 2.5G works only
-                                        when used with 1G advertisment */
-                                } else
-                                        val = (1<<5);
-                        } else {
-
-                                val = 0;
-                                if (params->speed_cap_mask &
-                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)
-                                        val |= (1<<7);
-
-                                /* Note that 2.5G works only when
-                                used with 1G advertisment */
-                                if (params->speed_cap_mask &
-                                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_1G |
-                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G))
-                                        val |= (1<<5);
-                                DP(NETIF_MSG_LINK,
-                                         "807x autoneg val = 0x%x\n", val);
-                        }
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_ADV, val);
-                        if (ext_phy_type ==
-                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073) {
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_8073_2_5G, &tmp1);
-
-                                if (((params->speed_cap_mask &
-                                      PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G) &&
-                                     (params->req_line_speed ==
-                                      SPEED_AUTO_NEG)) ||
-                                    (params->req_line_speed ==
-                                     SPEED_2500)) {
-                                        u16 phy_ver;
-                                        /* Allow 2.5G for A1 and above */
-                                        bnx2x_cl45_read(bp, params->port,
-                                         PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                                         ext_phy_addr,
+                if (DUAL_MEDIA(params)) {
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8727_PCS_GP, &val);
+                        val |= (3<<10);
+                        bnx2x_cl45_write(bp, phy,
                                          MDIO_PMA_DEVAD,
-                                         MDIO_PMA_REG_8073_CHIP_REV, &phy_ver);
-                                        DP(NETIF_MSG_LINK, "Add 2.5G\n");
-                                        if (phy_ver > 0)
-                                                tmp1 |= 1;
-                                        else
-                                                tmp1 &= 0xfffe;
-                                } else {
-                                        DP(NETIF_MSG_LINK, "Disable 2.5G\n");
-                                        tmp1 &= 0xfffe;
-                                }
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_8073_2_5G, tmp1);
-                        }
-
-                        /* Add support for CL37 (passive mode) II */
-
-                        bnx2x_cl45_read(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CL37_FC_LD,
-                                       &tmp1);
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CL37_FC_LD, (tmp1 |
-                                       ((params->req_duplex == DUPLEX_FULL) ?
-                                       0x20 : 0x40)));
-
-                        /* Add support for CL37 (passive mode) III */
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CL37_AN, 0x1000);
-
-                        if (ext_phy_type ==
-                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073) {
-                                /* The SNR will improve about 2db by changing
-                                BW and FEE main tap. Rest commands are executed
-                                after link is up*/
-                                /*Change FFE main cursor to 5 in EDC register*/
-                                if (bnx2x_8073_is_snr_needed(params))
-                                        bnx2x_cl45_write(bp, params->port,
-                                                    ext_phy_type,
-                                                    ext_phy_addr,
-                                                    MDIO_PMA_DEVAD,
-                                                    MDIO_PMA_REG_EDC_FFE_MAIN,
-                                                    0xFB0C);
-
-                                /* Enable FEC (Forware Error Correction)
-                                Request in the AN */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_ADV2, &tmp1);
-
-                                tmp1 |= (1<<15);
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_ADV2, tmp1);
-
-                        }
-
-                        bnx2x_ext_phy_set_pause(params, vars);
-
-                        /* Restart autoneg */
-                        msleep(500);
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CTRL, 0x1200);
-                        DP(NETIF_MSG_LINK, "807x Autoneg Restart: "
-                           "Advertise 1G=%x, 10G=%x\n",
-                           ((val & (1<<5)) > 0),
-                           ((val & (1<<7)) > 0));
-                        break;
-                }
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                {
-                        u16 tmp1;
-                        u16 rx_alarm_ctrl_val;
-                        u16 lasi_ctrl_val;
-
-                        /* Enable PMD link, MOD_ABS_FLT, and 1G link alarm */
-
-                        u16 mod_abs;
-                        rx_alarm_ctrl_val = (1<<2) | (1<<5) ;
-                        lasi_ctrl_val = 0x0004;
-
-                        DP(NETIF_MSG_LINK, "Initializing BCM8727\n");
-                        /* enable LASI */
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_RX_ALARM_CTRL,
-                                       rx_alarm_ctrl_val);
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_LASI_CTRL,
-                                       lasi_ctrl_val);
-
-                        /* Initially configure  MOD_ABS to interrupt when
-                        module is presence( bit 8) */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_PHY_IDENTIFIER, &mod_abs);
-                        /* Set EDC off by setting OPTXLOS signal input to low
-                        (bit 9).
-                        When the EDC is off it locks onto a reference clock and
-                        avoids becoming 'lost'.*/
-                        mod_abs &= ~((1<<8) | (1<<9));
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_PHY_IDENTIFIER, mod_abs);
-
-                        /* Make MOD_ABS give interrupt on change */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_8727_PCS_OPT_CTRL,
-                                      &val);
-                        val |= (1<<12);
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_8727_PCS_OPT_CTRL,
-                                       val);
-
-                        /* Set 8727 GPIOs to input to allow reading from the
-                        8727 GPIO0 status which reflect SFP+ module
-                        over-current */
-
-                        bnx2x_cl45_read(bp, params->port,
-                                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_8727_PCS_OPT_CTRL,
-                                       &val);
-                        val &= 0xff8f; /* Reset bits 4-6 */
-                        bnx2x_cl45_write(bp, params->port,
-                                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_8727_PCS_OPT_CTRL,
-                                       val);
-
-                        bnx2x_8727_power_module(bp, params, ext_phy_addr, 1);
-                        bnx2x_bcm8073_set_xaui_low_power_mode(params);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_M8051_MSGOUT_REG,
-                                      &tmp1);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_RX_ALARM, &tmp1);
-
-                        /* Set option 1G speed */
-                        if (params->req_line_speed == SPEED_1000) {
-
-                                DP(NETIF_MSG_LINK, "Setting 1G force\n");
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_CTRL, 0x40);
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_10G_CTRL2, 0xD);
-                                bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_10G_CTRL2, &tmp1);
-                                DP(NETIF_MSG_LINK, "1.7 = 0x%x\n", tmp1);
-
-                        } else if ((params->req_line_speed ==
-                                    SPEED_AUTO_NEG) &&
-                                   ((params->speed_cap_mask &
-                                     PORT_HW_CFG_SPEED_CAPABILITY_D0_1G))) {
-
-                                DP(NETIF_MSG_LINK, "Setting 1G clause37\n");
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_PMA_REG_8727_MISC_CTRL, 0);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CL37_AN, 0x1300);
-                        } else {
-                                /* Since the 8727 has only single reset pin,
-                                need to set the 10G registers although it is
-                                default */
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_CTRL, 0x0020);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_AN_DEVAD,
-                                               0x7, 0x0100);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_CTRL, 0x2040);
-                                bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                               ext_phy_addr, MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_10G_CTRL2, 0x0008);
-                        }
-
-                        /* Set 2-wire transfer rate of SFP+ module EEPROM
-                         * to 100Khz since some DACs(direct attached cables) do
-                         * not work at 400Khz.
-                         */
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_8727_TWO_WIRE_SLAVE_ADDR,
-                                       0xa001);
-
-                        /* Set TX PreEmphasis if needed */
-                        if ((params->feature_config_flags &
-                             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
-                                DP(NETIF_MSG_LINK, "Setting TX_CTRL1 0x%x,"
-                                         "TX_CTRL2 0x%x\n",
-                                         params->xgxs_config_tx[0],
-                                         params->xgxs_config_tx[1]);
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_8727_TX_CTRL1,
-                                               params->xgxs_config_tx[0]);
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_8727_TX_CTRL2,
-                                               params->xgxs_config_tx[1]);
-                        }
-
-                        break;
-                }
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                {
-                        u16 fw_ver1, fw_ver2;
-                        DP(NETIF_MSG_LINK,
-                                "Setting the SFX7101 LASI indication\n");
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_LASI_CTRL, 0x1);
-                        DP(NETIF_MSG_LINK,
-                          "Setting the SFX7101 LED to blink on traffic\n");
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_7107_LED_CNTL, (1<<3));
-
-                        bnx2x_ext_phy_set_pause(params, vars);
-                        /* Restart autoneg */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_AN_DEVAD,
-                                      MDIO_AN_REG_CTRL, &val);
-                        val |= 0x200;
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CTRL, val);
-
-                        /* Save spirom version */
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr, MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_7101_VER1, &fw_ver1);
-
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr, MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_7101_VER2, &fw_ver2);
-
-                        bnx2x_save_spirom_version(params->bp, params->port,
-                                                params->shmem_base,
-                                                (u32)(fw_ver1<<16 | fw_ver2));
-                        break;
+                                         MDIO_PMA_REG_8727_PCS_GP, val);
                 }
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                        /* This phy uses the NIG latch mechanism since link
-                                indication arrives through its LED4 and not via
-                                its LASI signal, so we get steady signal
-                                instead of clear on read */
-                        bnx2x_bits_en(bp, NIG_REG_LATCH_BC_0 + params->port*4,
-                                    1 << NIG_LATCH_BC_ENABLE_MI_INT);
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL, 0x0000);
-
-                        bnx2x_8481_set_led4(params, ext_phy_type, ext_phy_addr);
-                        if (params->req_line_speed == SPEED_AUTO_NEG) {
-
-                                u16 autoneg_val, an_1000_val, an_10_100_val;
-                                /* set 1000 speed advertisement */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_8481_1000T_CTRL,
-                                              &an_1000_val);
-
-                                if (params->speed_cap_mask &
-                                    PORT_HW_CFG_SPEED_CAPABILITY_D0_1G) {
-                                        an_1000_val |= (1<<8);
-                                        if (params->req_duplex == DUPLEX_FULL)
-                                                an_1000_val |= (1<<9);
-                                        DP(NETIF_MSG_LINK, "Advertising 1G\n");
-                                } else
-                                        an_1000_val &= ~((1<<8) | (1<<9));
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_8481_1000T_CTRL,
-                                               an_1000_val);
-
-                                /* set 100 speed advertisement */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_8481_LEGACY_AN_ADV,
-                                              &an_10_100_val);
-
-                                if (params->speed_cap_mask &
-                                 (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
-                                  PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)) {
-                                        an_10_100_val |= (1<<7);
-                                        if (params->req_duplex == DUPLEX_FULL)
-                                                an_10_100_val |= (1<<8);
-                                        DP(NETIF_MSG_LINK,
-                                                "Advertising 100M\n");
-                                } else
-                                        an_10_100_val &= ~((1<<7) | (1<<8));
-
-                                /* set 10 speed advertisement */
-                                if (params->speed_cap_mask &
-                                  (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-                                   PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)) {
-                                        an_10_100_val |= (1<<5);
-                                        if (params->req_duplex == DUPLEX_FULL)
-                                                an_10_100_val |= (1<<6);
-                                        DP(NETIF_MSG_LINK, "Advertising 10M\n");
-                                     }
-                                else
-                                        an_10_100_val &= ~((1<<5) | (1<<6));
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_8481_LEGACY_AN_ADV,
-                                               an_10_100_val);
-
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_8481_LEGACY_MII_CTRL,
-                                              &autoneg_val);
-
-                                /* Disable forced speed */
-                                autoneg_val &= ~(1<<6|1<<13);
-
-                                /* Enable autoneg and restart autoneg
-                                for legacy speeds */
-                                autoneg_val |= (1<<9|1<<12);
-
-                                if (params->req_duplex == DUPLEX_FULL)
-                                        autoneg_val |= (1<<8);
-                                else
-                                        autoneg_val &= ~(1<<8);
-
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_8481_LEGACY_MII_CTRL,
-                                               autoneg_val);
-
-                                if (params->speed_cap_mask &
-                                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10G) {
-                                        DP(NETIF_MSG_LINK, "Advertising 10G\n");
-                                        /* Restart autoneg for 10G*/
-
-                        bnx2x_cl45_write(bp, params->port,
-                                       ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CTRL, 0x3200);
-                                }
-                        } else {
-                                /* Force speed */
-                                u16 autoneg_ctrl, pma_ctrl;
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_8481_LEGACY_MII_CTRL,
-                                              &autoneg_ctrl);
-
-                                /* Disable autoneg */
-                                autoneg_ctrl &= ~(1<<12);
-
-                                /* Set 1000 force */
-                                switch (params->req_line_speed) {
-                                case SPEED_10000:
-                                        DP(NETIF_MSG_LINK,
-                                                "Unable to set 10G force !\n");
-                                        break;
-                                case SPEED_1000:
-                                        bnx2x_cl45_read(bp, params->port,
-                                                      ext_phy_type,
-                                                      ext_phy_addr,
-                                                      MDIO_PMA_DEVAD,
-                                                      MDIO_PMA_REG_CTRL,
-                                                      &pma_ctrl);
-                                        autoneg_ctrl &= ~(1<<13);
-                                        autoneg_ctrl |= (1<<6);
-                                        pma_ctrl &= ~(1<<13);
-                                        pma_ctrl |= (1<<6);
-                                        DP(NETIF_MSG_LINK,
-                                                "Setting 1000M force\n");
-                                        bnx2x_cl45_write(bp, params->port,
-                                                       ext_phy_type,
-                                                       ext_phy_addr,
-                                                       MDIO_PMA_DEVAD,
-                                                       MDIO_PMA_REG_CTRL,
-                                                       pma_ctrl);
-                                        break;
-                                case SPEED_100:
-                                        autoneg_ctrl |= (1<<13);
-                                        autoneg_ctrl &= ~(1<<6);
-                                        DP(NETIF_MSG_LINK,
-                                                "Setting 100M force\n");
-                                        break;
-                                case SPEED_10:
-                                        autoneg_ctrl &= ~(1<<13);
-                                        autoneg_ctrl &= ~(1<<6);
-                                        DP(NETIF_MSG_LINK,
-                                                "Setting 10M force\n");
-                                        break;
-                                }
-
-                                /* Duplex mode */
-                                if (params->req_duplex == DUPLEX_FULL) {
-                                        autoneg_ctrl |= (1<<8);
-                                        DP(NETIF_MSG_LINK,
-                                                "Setting full duplex\n");
-                                } else
-                                        autoneg_ctrl &= ~(1<<8);
-
-                                /* Update autoneg ctrl and pma ctrl */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_AN_DEVAD,
-                                               MDIO_AN_REG_8481_LEGACY_MII_CTRL,
-                                               autoneg_ctrl);
-                        }
-
-                        /* Save spirom version */
-                        bnx2x_save_8481_spirom_version(bp, params->port,
-                                                     ext_phy_addr,
-                                                     params->shmem_base);
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
-                        DP(NETIF_MSG_LINK,
-                                 "XGXS PHY Failure detected 0x%x\n",
-                                 params->ext_phy_config);
-                        rc = -EINVAL;
-                        break;
-                default:
-                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
-                                  params->ext_phy_config);
-                        rc = -EINVAL;
-                        break;
-                }
-
-        } else { /* SerDes */
-
-                ext_phy_type = SERDES_EXT_PHY_TYPE(params->ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT:
-                        DP(NETIF_MSG_LINK, "SerDes Direct\n");
-                        break;
-
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
-                        DP(NETIF_MSG_LINK, "SerDes 5482\n");
-                        break;
+        } else if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                   ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) &&
+                   ((phy->speed_cap_mask &
+                      PORT_HW_CFG_SPEED_CAPABILITY_D0_10G) !=
+                   PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)) {
+
+                DP(NETIF_MSG_LINK, "Setting 1G clause37\n");
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_8727_MISC_CTRL, 0);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_AN, 0x1300);
+        } else {
+                /**
+                 * Since the 8727 has only single reset pin, need to set the 10G
+                 * registers although it is default
+                 */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_8727_MISC_CTRL,
+                                 0x0020);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CL37_AN, 0x0100);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x2040);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_10G_CTRL2,
+                                 0x0008);
+        }
 
-                default:
-                        DP(NETIF_MSG_LINK, "BAD SerDes ext_phy_config 0x%x\n",
-                           params->ext_phy_config);
-                        break;
-                }
+        /* Set 2-wire transfer rate of SFP+ module EEPROM
+         * to 100Khz since some DACs(direct attached cables) do
+         * not work at 400Khz.
+         */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_TWO_WIRE_SLAVE_ADDR,
+                         0xa001);
+
+        /* Set TX PreEmphasis if needed */
+        if ((params->feature_config_flags &
+             FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED)) {
+                DP(NETIF_MSG_LINK, "Setting TX_CTRL1 0x%x, TX_CTRL2 0x%x\n",
+                           phy->tx_preemphasis[0],
+                           phy->tx_preemphasis[1]);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_TX_CTRL1,
+                                 phy->tx_preemphasis[0]);
+
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_TX_CTRL2,
+                                 phy->tx_preemphasis[1]);
         }
-        return rc;
+
+        return 0;
 }
 
-static void bnx2x_8727_handle_mod_abs(struct link_params *params)
+static void bnx2x_8727_handle_mod_abs(struct bnx2x_phy *phy,
+                                      struct link_params *params)
 {
         struct bnx2x *bp = params->bp;
         u16 mod_abs, rx_alarm_status;
-        u8 ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
         u32 val = REG_RD(bp, params->shmem_base +
                              offsetof(struct shmem_region, dev_info.
                                       port_feature_config[params->port].
                                       config));
-        bnx2x_cl45_read(bp, params->port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                      ext_phy_addr,
+        bnx2x_cl45_read(bp, phy,
                       MDIO_PMA_DEVAD,
                       MDIO_PMA_REG_PHY_IDENTIFIER, &mod_abs);
         if (mod_abs & (1<<8)) {
@@ -4602,18 +4935,16 @@ static void bnx2x_8727_handle_mod_abs(struct link_params *params)
                         (bit 9).
                         When the EDC is off it locks onto a reference clock and
                         avoids becoming 'lost'.*/
-                mod_abs &= ~((1<<8)|(1<<9));
-                bnx2x_cl45_write(bp, params->port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                               ext_phy_addr,
+                mod_abs &= ~(1<<8);
+                if (!(phy->flags & FLAGS_NOC))
+                        mod_abs &= ~(1<<9);
+                bnx2x_cl45_write(bp, phy,
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_PHY_IDENTIFIER, mod_abs);
 
                 /* Clear RX alarm since it stays up as long as
                 the mod_abs wasn't changed */
-                bnx2x_cl45_read(bp, params->port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                              ext_phy_addr,
+                bnx2x_cl45_read(bp, phy,
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_RX_ALARM, &rx_alarm_status);
 
@@ -4630,33 +4961,28 @@ static void bnx2x_8727_handle_mod_abs(struct link_params *params)
                    2. Restore the default polarity of the OPRXLOS signal and
                 this signal will then correctly indicate the presence or
                 absence of the Rx signal. (bit 9) */
-                mod_abs |= ((1<<8)|(1<<9));
-                bnx2x_cl45_write(bp, params->port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                       ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_PHY_IDENTIFIER, mod_abs);
+                mod_abs |= (1<<8);
+                if (!(phy->flags & FLAGS_NOC))
+                        mod_abs |= (1<<9);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_PHY_IDENTIFIER, mod_abs);
 
                 /* Clear RX alarm since it stays up as long as
                 the mod_abs wasn't changed. This is need to be done
                 before calling the module detection, otherwise it will clear
                 the link update alarm */
-                bnx2x_cl45_read(bp, params->port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                              ext_phy_addr,
-                              MDIO_PMA_DEVAD,
-                              MDIO_PMA_REG_RX_ALARM, &rx_alarm_status);
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_RX_ALARM, &rx_alarm_status);
 
 
                 if ((val & PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_MASK) ==
                     PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_DISABLE_TX_LASER)
-                        bnx2x_sfp_set_transmitter(bp, params->port,
-                                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                                        ext_phy_addr, 0);
+                        bnx2x_sfp_set_transmitter(bp, phy, params->port, 0);
 
-                if (bnx2x_wait_for_sfp_module_initialized(params)
-                    == 0)
-                        bnx2x_sfp_module_detection(params);
+                if (bnx2x_wait_for_sfp_module_initialized(phy, params) == 0)
+                        bnx2x_sfp_module_detection(phy, params);
                 else
                         DP(NETIF_MSG_LINK, "SFP+ module is not initialized\n");
         }
@@ -4667,1298 +4993,1711 @@ static void bnx2x_8727_handle_mod_abs(struct link_params *params)
         module plugged in/out */
 }
 
+static u8 bnx2x_8727_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 
-static u8 bnx2x_ext_phy_is_link_up(struct link_params *params,
-                                 struct link_vars *vars,
-                                 u8 is_mi_int)
 {
         struct bnx2x *bp = params->bp;
-        u32 ext_phy_type;
-        u8 ext_phy_addr;
-        u16 val1 = 0, val2;
-        u16 rx_sd, pcs_status;
-        u8 ext_phy_link_up = 0;
-        u8 port = params->port;
+        u8 link_up = 0;
+        u16 link_status = 0;
+        u16 rx_alarm_status, lasi_ctrl, val1;
+
+        /* If PHY is not initialized, do not check link status */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL,
+                        &lasi_ctrl);
+        if (!lasi_ctrl)
+                return 0;
 
-        if (vars->phy_flags & PHY_XGXS_FLAG) {
-                ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-                ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                        DP(NETIF_MSG_LINK, "XGXS Direct\n");
-                        ext_phy_link_up = 1;
-                        break;
+        /* Check the LASI */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM,
+                        &rx_alarm_status);
+        vars->line_speed = 0;
+        DP(NETIF_MSG_LINK, "8727 RX_ALARM_STATUS  0x%x\n", rx_alarm_status);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                        DP(NETIF_MSG_LINK, "XGXS 8705\n");
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_WIS_DEVAD,
-                                      MDIO_WIS_REG_LASI_STATUS, &val1);
-                        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
-
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_WIS_DEVAD,
-                                      MDIO_WIS_REG_LASI_STATUS, &val1);
-                        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
-
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_RX_SD, &rx_sd);
-
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      1,
-                                      0xc809, &val1);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      1,
-                                      0xc809, &val1);
-
-                        DP(NETIF_MSG_LINK, "8705 1.c809 val=0x%x\n", val1);
-                        ext_phy_link_up = ((rx_sd & 0x1) && (val1 & (1<<9)) &&
-                                           ((val1 & (1<<8)) == 0));
-                        if (ext_phy_link_up)
-                                vars->line_speed = SPEED_10000;
-                        break;
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val1);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                        DP(NETIF_MSG_LINK, "XGXS 8706/8726\n");
-                        /* Clear RX Alarm*/
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM,
-                                      &val2);
-                        /* clear LASI indication*/
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS,
-                                      &val1);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS,
-                                      &val2);
-                        DP(NETIF_MSG_LINK, "8706/8726 LASI status 0x%x-->"
-                                     "0x%x\n", val1, val2);
-
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_SD,
-                                      &rx_sd);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD, MDIO_PCS_REG_STATUS,
-                                      &pcs_status);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS,
-                                      &val2);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_AN_DEVAD, MDIO_AN_REG_LINK_STATUS,
-                                      &val2);
-
-                        DP(NETIF_MSG_LINK, "8706/8726 rx_sd 0x%x"
-                           "  pcs_status 0x%x 1Gbps link_status 0x%x\n",
-                           rx_sd, pcs_status, val2);
-                        /* link is up if both bit 0 of pmd_rx_sd and
-                         * bit 0 of pcs_status are set, or if the autoneg bit
-                           1 is set
-                         */
-                        ext_phy_link_up = ((rx_sd & pcs_status & 0x1) ||
-                                           (val2 & (1<<1)));
-                        if (ext_phy_link_up) {
-                                if (ext_phy_type ==
-                                     PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726) {
-                                        /* If transmitter is disabled,
-                                        ignore false link up indication */
-                                        bnx2x_cl45_read(bp, params->port,
-                                                   ext_phy_type,
-                                                   ext_phy_addr,
-                                                   MDIO_PMA_DEVAD,
-                                                   MDIO_PMA_REG_PHY_IDENTIFIER,
-                                                   &val1);
-                                        if (val1 & (1<<15)) {
-                                                DP(NETIF_MSG_LINK, "Tx is "
-                                                            "disabled\n");
-                                                ext_phy_link_up = 0;
-                                                break;
-                                        }
-                                }
-                                if (val2 & (1<<1))
-                                        vars->line_speed = SPEED_1000;
-                                else
-                                        vars->line_speed = SPEED_10000;
-                        }
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                {
-                        u16 link_status = 0;
-                        u16 rx_alarm_status;
-                        /* Check the LASI */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_RX_ALARM, &rx_alarm_status);
-
-                        DP(NETIF_MSG_LINK, "8727 RX_ALARM_STATUS 0x%x\n",
-                                 rx_alarm_status);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_LASI_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "8727 LASI status 0x%x\n", val1);
 
-                        DP(NETIF_MSG_LINK,
-                                 "8727 LASI status 0x%x\n",
-                                 val1);
+        /* Clear MSG-OUT */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &val1);
 
-                        /* Clear MSG-OUT */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_M8051_MSGOUT_REG,
-                                      &val1);
+        /**
+         * If a module is present and there is need to check
+         * for over current
+         */
+        if (!(phy->flags & FLAGS_NOC) && !(rx_alarm_status & (1<<5))) {
+                /* Check over-current using 8727 GPIO0 input*/
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD, MDIO_PMA_REG_8727_GPIO_CTRL,
+                                &val1);
+
+                if ((val1 & (1<<8)) == 0) {
+                        DP(NETIF_MSG_LINK, "8727 Power fault has been detected"
+                                       " on port %d\n", params->port);
+                        netdev_err(bp->dev, "Error:  Power fault on Port %d has"
+                                            " been detected and the power to "
+                                            "that SFP+ module has been removed"
+                                            " to prevent failure of the card."
+                                            " Please remove the SFP+ module and"
+                                            " restart the system to clear this"
+                                            " error.\n",
+                                   params->port);
 
                         /*
-                         * If a module is present and there is need to check
-                         * for over current
+                         * Disable all RX_ALARMs except for
+                         * mod_abs
                          */
-                        if (!(params->feature_config_flags &
-                              FEATURE_CONFIG_BCM8727_NOC) &&
-                            !(rx_alarm_status & (1<<5))) {
-                                /* Check over-current using 8727 GPIO0 input*/
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_8727_GPIO_CTRL,
-                                              &val1);
-
-                                if ((val1 & (1<<8)) == 0) {
-                                        DP(NETIF_MSG_LINK, "8727 Power fault"
-                                                     " has been detected on "
-                                                     "port %d\n",
-                                                 params->port);
-                                        netdev_err(bp->dev, "Error:  Power fault on Port %d has been detected and the power to that SFP+ module has been removed to prevent failure of the card. Please remove the SFP+ module and restart the system to clear this error.\n",
-                                                   params->port);
-                                        /*
-                                         * Disable all RX_ALARMs except for
-                                         * mod_abs
-                                         */
-                                        bnx2x_cl45_write(bp, params->port,
-                                                     ext_phy_type,
-                                                     ext_phy_addr,
-                                                     MDIO_PMA_DEVAD,
-                                                     MDIO_PMA_REG_RX_ALARM_CTRL,
-                                                     (1<<5));
-
-                                        bnx2x_cl45_read(bp, params->port,
-                                                    ext_phy_type,
-                                                    ext_phy_addr,
-                                                    MDIO_PMA_DEVAD,
-                                                    MDIO_PMA_REG_PHY_IDENTIFIER,
-                                                    &val1);
-                                        /* Wait for module_absent_event */
-                                        val1 |= (1<<8);
-                                        bnx2x_cl45_write(bp, params->port,
-                                                    ext_phy_type,
-                                                    ext_phy_addr,
-                                                    MDIO_PMA_DEVAD,
-                                                    MDIO_PMA_REG_PHY_IDENTIFIER,
-                                                    val1);
-                                        /* Clear RX alarm */
-                                        bnx2x_cl45_read(bp, params->port,
-                                                      ext_phy_type,
-                                                      ext_phy_addr,
-                                                      MDIO_PMA_DEVAD,
-                                                      MDIO_PMA_REG_RX_ALARM,
-                                                      &rx_alarm_status);
-                                        break;
-                                }
-                        } /* Over current check */
-
-                        /* When module absent bit is set, check module */
-                        if (rx_alarm_status & (1<<5)) {
-                                bnx2x_8727_handle_mod_abs(params);
-                                /* Enable all mod_abs and link detection bits */
-                                bnx2x_cl45_write(bp, params->port,
-                                               ext_phy_type,
-                                               ext_phy_addr,
-                                               MDIO_PMA_DEVAD,
-                                               MDIO_PMA_REG_RX_ALARM_CTRL,
-                                               ((1<<5) | (1<<2)));
-                        }
-
-                        /* If transmitter is disabled,
-                        ignore false link up indication */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_PHY_IDENTIFIER,
-                                      &val1);
-                        if (val1 & (1<<15)) {
-                                DP(NETIF_MSG_LINK, "Tx is disabled\n");
-                                ext_phy_link_up = 0;
-                                break;
-                        }
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_RX_ALARM_CTRL, (1<<5));
 
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_8073_SPEED_LINK_STATUS,
-                                      &link_status);
-
-                        /* Bits 0..2 --> speed detected,
-                           bits 13..15--> link is down */
-                        if ((link_status & (1<<2)) &&
-                            (!(link_status & (1<<15)))) {
-                                ext_phy_link_up = 1;
-                                vars->line_speed = SPEED_10000;
-                        } else if ((link_status & (1<<0)) &&
-                                   (!(link_status & (1<<13)))) {
-                                ext_phy_link_up = 1;
-                                vars->line_speed = SPEED_1000;
-                                DP(NETIF_MSG_LINK,
-                                         "port %x: External link"
-                                         " up in 1G\n", params->port);
-                        } else {
-                                ext_phy_link_up = 0;
-                                DP(NETIF_MSG_LINK,
-                                         "port %x: External link"
-                                         " is down\n", params->port);
-                        }
-                        break;
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_PHY_IDENTIFIER, &val1);
+                        /* Wait for module_absent_event */
+                        val1 |= (1<<8);
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_PHY_IDENTIFIER, val1);
+                        /* Clear RX alarm */
+                        bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_RX_ALARM, &rx_alarm_status);
+                        return 0;
                 }
+        } /* Over current check */
+
+        /* When module absent bit is set, check module */
+        if (rx_alarm_status & (1<<5)) {
+                bnx2x_8727_handle_mod_abs(phy, params);
+                /* Enable all mod_abs and link detection bits */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_RX_ALARM_CTRL,
+                                 ((1<<5) | (1<<2)));
+        }
+        DP(NETIF_MSG_LINK, "Enabling 8727 TX laser if SFP is approved\n");
+        bnx2x_8727_specific_func(phy, params, ENABLE_TX);
+        /* If transmitter is disabled, ignore false link up indication */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_PHY_IDENTIFIER, &val1);
+        if (val1 & (1<<15)) {
+                DP(NETIF_MSG_LINK, "Tx is disabled\n");
+                return 0;
+        }
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                {
-                        u16 link_status = 0;
-                        u16 an1000_status = 0;
-
-                        if (ext_phy_type ==
-                             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072) {
-                                bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD,
-                                      MDIO_PCS_REG_LASI_STATUS, &val1);
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD,
-                                      MDIO_PCS_REG_LASI_STATUS, &val2);
-                        DP(NETIF_MSG_LINK,
-                                 "870x LASI status 0x%x->0x%x\n",
-                                  val1, val2);
-                        } else {
-                                /* In 8073, port1 is directed through emac0 and
-                                 * port0 is directed through emac1
-                                 */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_LASI_STATUS, &val1);
-
-                                DP(NETIF_MSG_LINK,
-                                         "8703 LASI status 0x%x\n",
-                                          val1);
-                        }
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_8073_SPEED_LINK_STATUS, &link_status);
 
-                        /* clear the interrupt LASI status register */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD,
-                                      MDIO_PCS_REG_STATUS, &val2);
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD,
-                                      MDIO_PCS_REG_STATUS, &val1);
-                        DP(NETIF_MSG_LINK, "807x PCS status 0x%x->0x%x\n",
-                           val2, val1);
-                        /* Clear MSG-OUT */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_M8051_MSGOUT_REG,
-                                      &val1);
-
-                        /* Check the LASI */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_RX_ALARM, &val2);
-
-                        DP(NETIF_MSG_LINK, "KR 0x9003 0x%x\n", val2);
-
-                        /* Check the link status */
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PCS_DEVAD,
-                                      MDIO_PCS_REG_STATUS, &val2);
-                        DP(NETIF_MSG_LINK, "KR PCS status 0x%x\n", val2);
-
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_STATUS, &val2);
-                        bnx2x_cl45_read(bp, params->port,
-                                      ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_STATUS, &val1);
-                        ext_phy_link_up = ((val1 & 4) == 4);
-                        DP(NETIF_MSG_LINK, "PMA_REG_STATUS=0x%x\n", val1);
-                        if (ext_phy_type ==
-                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073) {
-
-                                if (ext_phy_link_up &&
-                                    ((params->req_line_speed !=
-                                        SPEED_10000))) {
-                                        if (bnx2x_bcm8073_xaui_wa(params)
-                                             != 0) {
-                                                ext_phy_link_up = 0;
-                                                break;
-                                        }
-                                }
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_LINK_STATUS,
-                                              &an1000_status);
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_LINK_STATUS,
-                                              &an1000_status);
-
-                                /* Check the link status on 1.1.2 */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_STATUS, &val2);
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_PMA_DEVAD,
-                                              MDIO_PMA_REG_STATUS, &val1);
-                                DP(NETIF_MSG_LINK, "KR PMA status 0x%x->0x%x,"
-                                             "an_link_status=0x%x\n",
-                                          val2, val1, an1000_status);
-
-                                ext_phy_link_up = (((val1 & 4) == 4) ||
-                                                (an1000_status & (1<<1)));
-                                if (ext_phy_link_up &&
-                                    bnx2x_8073_is_snr_needed(params)) {
-                                        /* The SNR will improve about 2dbby
-                                        changing the BW and FEE main tap.*/
-
-                                        /* The 1st write to change FFE main
-                                        tap is set before restart AN */
-                                        /* Change PLL Bandwidth in EDC
-                                        register */
-                                        bnx2x_cl45_write(bp, port, ext_phy_type,
-                                                    ext_phy_addr,
-                                                    MDIO_PMA_DEVAD,
-                                                    MDIO_PMA_REG_PLL_BANDWIDTH,
-                                                    0x26BC);
-
-                                        /* Change CDR Bandwidth in EDC
-                                        register */
-                                        bnx2x_cl45_write(bp, port, ext_phy_type,
-                                                    ext_phy_addr,
-                                                    MDIO_PMA_DEVAD,
-                                                    MDIO_PMA_REG_CDR_BANDWIDTH,
-                                                    0x0333);
-                                }
-                                bnx2x_cl45_read(bp, params->port,
-                                           ext_phy_type,
-                                           ext_phy_addr,
-                                           MDIO_PMA_DEVAD,
-                                           MDIO_PMA_REG_8073_SPEED_LINK_STATUS,
-                                           &link_status);
-
-                                /* Bits 0..2 --> speed detected,
-                                   bits 13..15--> link is down */
-                                if ((link_status & (1<<2)) &&
-                                    (!(link_status & (1<<15)))) {
-                                        ext_phy_link_up = 1;
-                                        vars->line_speed = SPEED_10000;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " up in 10G\n", params->port);
-                                } else if ((link_status & (1<<1)) &&
-                                           (!(link_status & (1<<14)))) {
-                                        ext_phy_link_up = 1;
-                                        vars->line_speed = SPEED_2500;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " up in 2.5G\n", params->port);
-                                } else if ((link_status & (1<<0)) &&
-                                           (!(link_status & (1<<13)))) {
-                                        ext_phy_link_up = 1;
-                                        vars->line_speed = SPEED_1000;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " up in 1G\n", params->port);
-                                } else {
-                                        ext_phy_link_up = 0;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " is down\n", params->port);
-                                }
-                        } else {
-                                /* See if 1G link is up for the 8072 */
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_LINK_STATUS,
-                                              &an1000_status);
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_LINK_STATUS,
-                                              &an1000_status);
-                                if (an1000_status & (1<<1)) {
-                                        ext_phy_link_up = 1;
-                                        vars->line_speed = SPEED_1000;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " up in 1G\n", params->port);
-                                } else if (ext_phy_link_up) {
-                                        ext_phy_link_up = 1;
-                                        vars->line_speed = SPEED_10000;
-                                        DP(NETIF_MSG_LINK,
-                                                 "port %x: External link"
-                                                 " up in 10G\n", params->port);
-                                }
-                        }
+        /* Bits 0..2 --> speed detected,
+           bits 13..15--> link is down */
+        if ((link_status & (1<<2)) && (!(link_status & (1<<15)))) {
+                link_up = 1;
+                vars->line_speed = SPEED_10000;
+        } else if ((link_status & (1<<0)) && (!(link_status & (1<<13)))) {
+                link_up = 1;
+                vars->line_speed = SPEED_1000;
+                DP(NETIF_MSG_LINK, "port %x: External link up in 1G\n",
+                           params->port);
+        } else {
+                link_up = 0;
+                DP(NETIF_MSG_LINK, "port %x: External link is down\n",
+                           params->port);
+        }
+        if (link_up)
+                bnx2x_ext_phy_resolve_fc(phy, params, vars);
+
+        if ((DUAL_MEDIA(params)) &&
+            (phy->req_line_speed == SPEED_1000)) {
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_8727_PCS_GP, &val1);
+                /**
+                 * In case of dual-media board and 1G, power up the XAUI side,
+                 * otherwise power it down. For 10G it is done automatically
+                 */
+                if (link_up)
+                        val1 &= ~(3<<10);
+                else
+                        val1 |= (3<<10);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_8727_PCS_GP, val1);
+        }
+        return link_up;
+}
 
+static void bnx2x_8727_link_reset(struct bnx2x_phy *phy,
+                                  struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        /* Disable Transmitter */
+        bnx2x_sfp_set_transmitter(bp, phy, params->port, 0);
+        /* Clear LASI */
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 0);
 
-                        break;
-                }
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_LASI_STATUS, &val2);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_LASI_STATUS, &val1);
-                        DP(NETIF_MSG_LINK,
-                                 "10G-base-T LASI status 0x%x->0x%x\n",
-                                  val2, val1);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_STATUS, &val2);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_STATUS, &val1);
-                        DP(NETIF_MSG_LINK,
-                                 "10G-base-T PMA status 0x%x->0x%x\n",
-                                 val2, val1);
-                        ext_phy_link_up = ((val1 & 4) == 4);
-                        /* if link is up
-                         * print the AN outcome of the SFX7101 PHY
-                         */
-                        if (ext_phy_link_up) {
-                                bnx2x_cl45_read(bp, params->port,
-                                              ext_phy_type,
-                                              ext_phy_addr,
-                                              MDIO_AN_DEVAD,
-                                              MDIO_AN_REG_MASTER_STATUS,
-                                              &val2);
-                                vars->line_speed = SPEED_10000;
-                                DP(NETIF_MSG_LINK,
-                                         "SFX7101 AN status 0x%x->Master=%x\n",
-                                          val2,
-                                         (val2 & (1<<14)));
-                        }
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                        /* Check 10G-BaseT link status */
-                        /* Check PMD signal ok */
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                                      ext_phy_addr,
-                                                      MDIO_AN_DEVAD,
-                                                      0xFFFA,
-                                                      &val1);
-                        bnx2x_cl45_read(bp, params->port, ext_phy_type,
-                                      ext_phy_addr,
-                                      MDIO_PMA_DEVAD,
-                                      MDIO_PMA_REG_8481_PMD_SIGNAL,
-                                      &val2);
-                        DP(NETIF_MSG_LINK, "PMD_SIGNAL 1.a811 = 0x%x\n", val2);
-
-                        /* Check link 10G */
-                        if (val2 & (1<<11)) {
-                                vars->line_speed = SPEED_10000;
-                                ext_phy_link_up = 1;
-                                bnx2x_8481_set_10G_led_mode(params,
-                                                          ext_phy_type,
-                                                          ext_phy_addr);
-                        } else { /* Check Legacy speed link */
-                                u16 legacy_status, legacy_speed;
-
-                                /* Enable expansion register 0x42
-                                (Operation mode status) */
-                                bnx2x_cl45_write(bp, params->port,
-                                         ext_phy_type,
-                                         ext_phy_addr,
-                                         MDIO_AN_DEVAD,
-                                         MDIO_AN_REG_8481_EXPANSION_REG_ACCESS,
-                                         0xf42);
-
-                                /* Get legacy speed operation status */
-                                bnx2x_cl45_read(bp, params->port,
-                                          ext_phy_type,
-                                          ext_phy_addr,
-                                          MDIO_AN_DEVAD,
-                                          MDIO_AN_REG_8481_EXPANSION_REG_RD_RW,
-                                          &legacy_status);
-
-                                DP(NETIF_MSG_LINK, "Legacy speed status"
-                                             " = 0x%x\n", legacy_status);
-                                ext_phy_link_up = ((legacy_status & (1<<11))
-                                                   == (1<<11));
-                                if (ext_phy_link_up) {
-                                        legacy_speed = (legacy_status & (3<<9));
-                                        if (legacy_speed == (0<<9))
-                                                vars->line_speed = SPEED_10;
-                                        else if (legacy_speed == (1<<9))
-                                                vars->line_speed =
-                                                        SPEED_100;
-                                        else if (legacy_speed == (2<<9))
-                                                vars->line_speed =
-                                                        SPEED_1000;
-                                        else /* Should not happen */
-                                                vars->line_speed = 0;
-
-                                        if (legacy_status & (1<<8))
-                                                vars->duplex = DUPLEX_FULL;
-                                        else
-                                                vars->duplex = DUPLEX_HALF;
-
-                                        DP(NETIF_MSG_LINK, "Link is up "
-                                                     "in %dMbps, is_duplex_full"
-                                                     "= %d\n",
-                                                vars->line_speed,
-                                                (vars->duplex == DUPLEX_FULL));
-                                        bnx2x_8481_set_legacy_led_mode(params,
-                                                                 ext_phy_type,
-                                                                 ext_phy_addr);
-                                }
-                        }
-                        break;
-                default:
-                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
-                           params->ext_phy_config);
-                        ext_phy_link_up = 0;
-                        break;
-                }
-                /* Set SGMII mode for external phy */
-                if (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) {
-                        if (vars->line_speed < SPEED_1000)
-                                vars->phy_flags |= PHY_SGMII_FLAG;
-                        else
-                                vars->phy_flags &= ~PHY_SGMII_FLAG;
-                }
+}
 
-        } else { /* SerDes */
-                ext_phy_type = SERDES_EXT_PHY_TYPE(params->ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT:
-                        DP(NETIF_MSG_LINK, "SerDes Direct\n");
-                        ext_phy_link_up = 1;
-                        break;
+/******************************************************************/
+/*              BCM8481/BCM84823/BCM84833 PHY SECTION             */
+/******************************************************************/
+static void bnx2x_save_848xx_spirom_version(struct bnx2x_phy *phy,
+                                           struct link_params *params)
+{
+        u16 val, fw_ver1, fw_ver2, cnt;
+        struct bnx2x *bp = params->bp;
 
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
-                        DP(NETIF_MSG_LINK, "SerDes 5482\n");
-                        ext_phy_link_up = 1;
+        /* For the 32 bits registers in 848xx, access via MDIO2ARM interface.*/
+        /* (1) set register 0xc200_0014(SPI_BRIDGE_CTRL_2) to 0x03000000 */
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA819, 0x0014);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA81A, 0xc200);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA81B, 0x0000);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA81C, 0x0300);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA817, 0x0009);
+
+        for (cnt = 0; cnt < 100; cnt++) {
+                bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD, 0xA818, &val);
+                if (val & 1)
                         break;
+                udelay(5);
+        }
+        if (cnt == 100) {
+                DP(NETIF_MSG_LINK, "Unable to read 848xx phy fw version(1)\n");
+                bnx2x_save_spirom_version(bp, params->port, 0,
+                                          phy->ver_addr);
+                return;
+        }
 
-                default:
-                        DP(NETIF_MSG_LINK,
-                                 "BAD SerDes ext_phy_config 0x%x\n",
-                                 params->ext_phy_config);
-                        ext_phy_link_up = 0;
+
+        /* 2) read register 0xc200_0000 (SPI_FW_STATUS) */
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA819, 0x0000);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA81A, 0xc200);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, 0xA817, 0x000A);
+        for (cnt = 0; cnt < 100; cnt++) {
+                bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD, 0xA818, &val);
+                if (val & 1)
                         break;
-                }
+                udelay(5);
         }
+        if (cnt == 100) {
+                DP(NETIF_MSG_LINK, "Unable to read 848xx phy fw version(2)\n");
+                bnx2x_save_spirom_version(bp, params->port, 0,
+                                          phy->ver_addr);
+                return;
+        }
+
+        /* lower 16 bits of the register SPI_FW_STATUS */
+        bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD, 0xA81B, &fw_ver1);
+        /* upper 16 bits of register SPI_FW_STATUS */
+        bnx2x_cl45_read(bp, phy, MDIO_PMA_DEVAD, 0xA81C, &fw_ver2);
 
-        return ext_phy_link_up;
+        bnx2x_save_spirom_version(bp, params->port, (fw_ver2<<16) | fw_ver1,
+                                  phy->ver_addr);
 }
 
-static void bnx2x_link_int_enable(struct link_params *params)
+static void bnx2x_848xx_set_led(struct bnx2x *bp,
+                                struct bnx2x_phy *phy)
 {
-        u8 port = params->port;
-        u32 ext_phy_type;
-        u32 mask;
-        struct bnx2x *bp = params->bp;
+        u16 val;
 
-        /* setting the status to report on link up
-           for either XGXS or SerDes */
+        /* PHYC_CTL_LED_CTL */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_8481_LINK_SIGNAL, &val);
+        val &= 0xFE00;
+        val |= 0x0092;
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8481_LINK_SIGNAL, val);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8481_LED1_MASK,
+                         0x80);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8481_LED2_MASK,
+                         0x18);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_8481_LED3_MASK,
+                         0x0040);
 
-        if (params->switch_cfg == SWITCH_CFG_10G) {
-                mask = (NIG_MASK_XGXS0_LINK10G |
-                        NIG_MASK_XGXS0_LINK_STATUS);
-                DP(NETIF_MSG_LINK, "enabled XGXS interrupt\n");
-                ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-                if ((ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
-                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) &&
-                    (ext_phy_type !=
-                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN)) {
-                        mask |= NIG_MASK_MI_INT;
-                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
-                }
+        /* 'Interrupt Mask' */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD,
+                         0xFFFB, 0xFFFD);
+}
 
-        } else { /* SerDes */
-                mask = NIG_MASK_SERDES0_LINK_STATUS;
-                DP(NETIF_MSG_LINK, "enabled SerDes interrupt\n");
-                ext_phy_type = SERDES_EXT_PHY_TYPE(params->ext_phy_config);
-                if ((ext_phy_type !=
-                                PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT) &&
-                    (ext_phy_type !=
-                                PORT_HW_CFG_SERDES_EXT_PHY_TYPE_NOT_CONN)) {
-                        mask |= NIG_MASK_MI_INT;
-                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
-                }
+static u8 bnx2x_848xx_cmn_config_init(struct bnx2x_phy *phy,
+                                      struct link_params *params,
+                                      struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u16 autoneg_val, an_1000_val, an_10_100_val;
+        bnx2x_wait_reset_complete(bp, phy);
+        bnx2x_bits_en(bp, NIG_REG_LATCH_BC_0 + params->port*4,
+                      1 << NIG_LATCH_BC_ENABLE_MI_INT);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 0x0000);
+
+        bnx2x_848xx_set_led(bp, phy);
+
+        /* set 1000 speed advertisement */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_8481_1000T_CTRL,
+                        &an_1000_val);
+
+        bnx2x_ext_phy_set_pause(params, phy, vars);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD,
+                        MDIO_AN_REG_8481_LEGACY_AN_ADV,
+                        &an_10_100_val);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_8481_LEGACY_MII_CTRL,
+                        &autoneg_val);
+        /* Disable forced speed */
+        autoneg_val &= ~((1<<6) | (1<<8) | (1<<9) | (1<<12) | (1<<13));
+        an_10_100_val &= ~((1<<5) | (1<<6) | (1<<7) | (1<<8));
+
+        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+             (phy->speed_cap_mask &
+             PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
+            (phy->req_line_speed == SPEED_1000)) {
+                an_1000_val |= (1<<8);
+                autoneg_val |= (1<<9 | 1<<12);
+                if (phy->req_duplex == DUPLEX_FULL)
+                        an_1000_val |= (1<<9);
+                DP(NETIF_MSG_LINK, "Advertising 1G\n");
+        } else
+                an_1000_val &= ~((1<<8) | (1<<9));
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_8481_1000T_CTRL,
+                         an_1000_val);
+
+        /* set 10 speed advertisement */
+        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+             (phy->speed_cap_mask &
+             (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)))) {
+                an_10_100_val |= (1<<7);
+                /* Enable autoneg and restart autoneg for legacy speeds */
+                autoneg_val |= (1<<9 | 1<<12);
+
+                if (phy->req_duplex == DUPLEX_FULL)
+                        an_10_100_val |= (1<<8);
+                DP(NETIF_MSG_LINK, "Advertising 100M\n");
+        }
+        /* set 10 speed advertisement */
+        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+            (phy->speed_cap_mask &
+          (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
+           PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)))) {
+                an_10_100_val |= (1<<5);
+                autoneg_val |= (1<<9 | 1<<12);
+                if (phy->req_duplex == DUPLEX_FULL)
+                        an_10_100_val |= (1<<6);
+                DP(NETIF_MSG_LINK, "Advertising 10M\n");
         }
-        bnx2x_bits_en(bp,
-                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                      mask);
 
-        DP(NETIF_MSG_LINK, "port %x, is_xgxs %x, int_status 0x%x\n", port,
-                 (params->switch_cfg == SWITCH_CFG_10G),
-                 REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4));
-        DP(NETIF_MSG_LINK, " int_mask 0x%x, MI_INT %x, SERDES_LINK %x\n",
-                 REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4),
-                 REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT + port*0x18),
-                 REG_RD(bp, NIG_REG_SERDES0_STATUS_LINK_STATUS+port*0x3c));
-        DP(NETIF_MSG_LINK, " 10G %x, XGXS_LINK %x\n",
-           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
-           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68));
-}
+        /* Only 10/100 are allowed to work in FORCE mode */
+        if (phy->req_line_speed == SPEED_100) {
+                autoneg_val |= (1<<13);
+                /* Enabled AUTO-MDIX when autoneg is disabled */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_8481_AUX_CTRL,
+                                 (1<<15 | 1<<9 | 7<<0));
+                DP(NETIF_MSG_LINK, "Setting 100M force\n");
+        }
+        if (phy->req_line_speed == SPEED_10) {
+                /* Enabled AUTO-MDIX when autoneg is disabled */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_8481_AUX_CTRL,
+                                 (1<<15 | 1<<9 | 7<<0));
+                DP(NETIF_MSG_LINK, "Setting 10M force\n");
+        }
 
-static void bnx2x_8481_rearm_latch_signal(struct bnx2x *bp, u8 port,
-                                        u8 is_mi_int)
-{
-        u32 latch_status = 0, is_mi_int_status;
-        /* Disable the MI INT ( external phy int )
-         * by writing 1 to the status register. Link down indication
-         * is high-active-signal, so in this case we need to write the
-         * status to clear the XOR
-         */
-        /* Read Latched signals */
-        latch_status = REG_RD(bp,
-                                  NIG_REG_LATCH_STATUS_0 + port*8);
-        is_mi_int_status = REG_RD(bp,
-                                  NIG_REG_STATUS_INTERRUPT_PORT0 + port*4);
-        DP(NETIF_MSG_LINK, "original_signal = 0x%x, nig_status = 0x%x,"
-                     "latch_status = 0x%x\n",
-                 is_mi_int, is_mi_int_status, latch_status);
-        /* Handle only those with latched-signal=up.*/
-        if (latch_status & 1) {
-                /* For all latched-signal=up,Write original_signal to status */
-                if (is_mi_int)
-                        bnx2x_bits_en(bp,
-                                    NIG_REG_STATUS_INTERRUPT_PORT0
-                                    + port*4,
-                                    NIG_STATUS_EMAC0_MI_INT);
-                else
-                        bnx2x_bits_dis(bp,
-                                     NIG_REG_STATUS_INTERRUPT_PORT0
-                                     + port*4,
-                                     NIG_STATUS_EMAC0_MI_INT);
-                /* For all latched-signal=up : Re-Arm Latch signals */
-                REG_WR(bp, NIG_REG_LATCH_STATUS_0 + port*8,
-                           (latch_status & 0xfffe) | (latch_status & 1));
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_8481_LEGACY_AN_ADV,
+                         an_10_100_val);
+
+        if (phy->req_duplex == DUPLEX_FULL)
+                autoneg_val |= (1<<8);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD,
+                         MDIO_AN_REG_8481_LEGACY_MII_CTRL, autoneg_val);
+
+        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+            (phy->speed_cap_mask &
+             PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)) ||
+                (phy->req_line_speed == SPEED_10000)) {
+                DP(NETIF_MSG_LINK, "Advertising 10G\n");
+                /* Restart autoneg for 10G*/
+
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD, MDIO_AN_REG_CTRL,
+                                 0x3200);
+        } else if (phy->req_line_speed != SPEED_10 &&
+                   phy->req_line_speed != SPEED_100) {
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_10GBASE_T_AN_CTRL,
+                                 1);
         }
+        /* Save spirom version */
+        bnx2x_save_848xx_spirom_version(phy, params);
+
+        return 0;
 }
-/*
- * link management
- */
-static void bnx2x_link_int_ack(struct link_params *params,
-                             struct link_vars *vars, u8 is_10g,
-                             u8 is_mi_int)
+
+static u8 bnx2x_8481_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
-        u8 port = params->port;
+        /* Restore normal power mode*/
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
 
-        /* first reset all status
-         * we assume only one line will be change at a time */
-        bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                     (NIG_STATUS_XGXS0_LINK10G |
-                      NIG_STATUS_XGXS0_LINK_STATUS |
-                      NIG_STATUS_SERDES0_LINK_STATUS));
-        if ((XGXS_EXT_PHY_TYPE(params->ext_phy_config)
-                == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481) ||
-        (XGXS_EXT_PHY_TYPE(params->ext_phy_config)
-                == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823)) {
-                bnx2x_8481_rearm_latch_signal(bp, port, is_mi_int);
-        }
-        if (vars->phy_link_up) {
-                if (is_10g) {
-                        /* Disable the 10G link interrupt
-                         * by writing 1 to the status register
-                         */
-                        DP(NETIF_MSG_LINK, "10G XGXS phy link up\n");
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                                      NIG_STATUS_XGXS0_LINK10G);
+        /* HW reset */
+        bnx2x_ext_phy_hw_reset(bp, params->port);
 
-                } else if (params->switch_cfg == SWITCH_CFG_10G) {
-                        /* Disable the link interrupt
-                         * by writing 1 to the relevant lane
-                         * in the status register
-                         */
-                        u32 ser_lane = ((params->lane_config &
-                                    PORT_HW_CFG_LANE_SWAP_CFG_MASTER_MASK) >>
-                                    PORT_HW_CFG_LANE_SWAP_CFG_MASTER_SHIFT);
+        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 1<<15);
+        return bnx2x_848xx_cmn_config_init(phy, params, vars);
+}
 
-                        DP(NETIF_MSG_LINK, "%d speed XGXS phy link up\n",
-                                 vars->line_speed);
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                                      ((1 << ser_lane) <<
-                                       NIG_STATUS_XGXS0_LINK_STATUS_SIZE));
+static u8 bnx2x_848x3_config_init(struct bnx2x_phy *phy,
+                                  struct link_params *params,
+                                  struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port, initialize = 1;
+        u16 val;
+        u16 temp;
+        u32 actual_phy_selection;
+        u8 rc = 0;
 
-                } else { /* SerDes */
-                        DP(NETIF_MSG_LINK, "SerDes phy link up\n");
-                        /* Disable the link interrupt
-                         * by writing 1 to the status register
-                         */
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                                      NIG_STATUS_SERDES0_LINK_STATUS);
-                }
+        /* This is just for MDIO_CTL_REG_84823_MEDIA register. */
 
-        } else { /* link_down */
+        msleep(1);
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_3,
+                       MISC_REGISTERS_GPIO_OUTPUT_HIGH,
+                       port);
+        msleep(200); /* 100 is not enough */
+
+        /* BCM84823 requires that XGXS links up first @ 10G for normal
+        behavior */
+        temp = vars->line_speed;
+        vars->line_speed = SPEED_10000;
+        bnx2x_set_autoneg(&params->phy[INT_PHY], params, vars, 0);
+        bnx2x_program_serdes(&params->phy[INT_PHY], params, vars);
+        vars->line_speed = temp;
+
+        /* Set dual-media configuration according to configuration */
+
+        bnx2x_cl45_read(bp, phy, MDIO_CTL_DEVAD,
+                        MDIO_CTL_REG_84823_MEDIA, &val);
+        val &= ~(MDIO_CTL_REG_84823_MEDIA_MAC_MASK |
+                 MDIO_CTL_REG_84823_MEDIA_LINE_MASK |
+                 MDIO_CTL_REG_84823_MEDIA_COPPER_CORE_DOWN |
+                 MDIO_CTL_REG_84823_MEDIA_PRIORITY_MASK |
+                 MDIO_CTL_REG_84823_MEDIA_FIBER_1G);
+        val |= MDIO_CTL_REG_84823_CTRL_MAC_XFI |
+                MDIO_CTL_REG_84823_MEDIA_LINE_XAUI_L;
+
+        actual_phy_selection = bnx2x_phy_selection(params);
+
+        switch (actual_phy_selection) {
+        case PORT_HW_CFG_PHY_SELECTION_HARDWARE_DEFAULT:
+                /* Do nothing. Essentialy this is like the priority copper */
+                break;
+        case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY:
+                val |= MDIO_CTL_REG_84823_MEDIA_PRIORITY_COPPER;
+                break;
+        case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY:
+                val |= MDIO_CTL_REG_84823_MEDIA_PRIORITY_FIBER;
+                break;
+        case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY:
+                /* Do nothing here. The first PHY won't be initialized at all */
+                break;
+        case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY:
+                val |= MDIO_CTL_REG_84823_MEDIA_COPPER_CORE_DOWN;
+                initialize = 0;
+                break;
         }
+        if (params->phy[EXT_PHY2].req_line_speed == SPEED_1000)
+                val |= MDIO_CTL_REG_84823_MEDIA_FIBER_1G;
+
+        bnx2x_cl45_write(bp, phy, MDIO_CTL_DEVAD,
+                         MDIO_CTL_REG_84823_MEDIA, val);
+        DP(NETIF_MSG_LINK, "Multi_phy config = 0x%x, Media control = 0x%x\n",
+                   params->multi_phy_config, val);
+
+        if (initialize)
+                rc = bnx2x_848xx_cmn_config_init(phy, params, vars);
+        else
+                bnx2x_save_848xx_spirom_version(phy, params);
+        return rc;
 }
 
-static u8 bnx2x_format_ver(u32 num, u8 *str, u16 len)
+static u8 bnx2x_848xx_read_status(struct bnx2x_phy *phy,
+                                       struct link_params *params,
+                                       struct link_vars *vars)
 {
-        u8 *str_ptr = str;
-        u32 mask = 0xf0000000;
-        u8 shift = 8*4;
-        u8 digit;
-        if (len < 10) {
-                /* Need more than 10chars for this format */
-                *str_ptr = '\0';
-                return -EINVAL;
-        }
-        while (shift > 0) {
+        struct bnx2x *bp = params->bp;
+        u16 val, val1, val2;
+        u8 link_up = 0;
+
+        /* Check 10G-BaseT link status */
+        /* Check PMD signal ok */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, 0xFFFA, &val1);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_8481_PMD_SIGNAL,
+                        &val2);
+        DP(NETIF_MSG_LINK, "BCM848xx: PMD_SIGNAL 1.a811 = 0x%x\n", val2);
+
+        /* Check link 10G */
+        if (val2 & (1<<11)) {
+                vars->line_speed = SPEED_10000;
+                link_up = 1;
+                bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
+        } else { /* Check Legacy speed link */
+                u16 legacy_status, legacy_speed;
+
+                /* Enable expansion register 0x42 (Operation mode status) */
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_AN_DEVAD,
+                                 MDIO_AN_REG_8481_EXPANSION_REG_ACCESS, 0xf42);
+
+                /* Get legacy speed operation status */
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_AN_DEVAD,
+                                MDIO_AN_REG_8481_EXPANSION_REG_RD_RW,
+                                &legacy_status);
+
+                DP(NETIF_MSG_LINK, "Legacy speed status"
+                             " = 0x%x\n", legacy_status);
+                link_up = ((legacy_status & (1<<11)) == (1<<11));
+                if (link_up) {
+                        legacy_speed = (legacy_status & (3<<9));
+                        if (legacy_speed == (0<<9))
+                                vars->line_speed = SPEED_10;
+                        else if (legacy_speed == (1<<9))
+                                vars->line_speed = SPEED_100;
+                        else if (legacy_speed == (2<<9))
+                                vars->line_speed = SPEED_1000;
+                        else /* Should not happen */
+                                vars->line_speed = 0;
 
-                shift -= 4;
-                digit = ((num & mask) >> shift);
-                if (digit < 0xa)
-                        *str_ptr = digit + '0';
-                else
-                        *str_ptr = digit - 0xa + 'a';
-                str_ptr++;
-                mask = mask >> 4;
-                if (shift == 4*4) {
-                        *str_ptr = ':';
-                        str_ptr++;
+                        if (legacy_status & (1<<8))
+                                vars->duplex = DUPLEX_FULL;
+                        else
+                                vars->duplex = DUPLEX_HALF;
+
+                        DP(NETIF_MSG_LINK, "Link is up in %dMbps,"
+                                   " is_duplex_full= %d\n", vars->line_speed,
+                                   (vars->duplex == DUPLEX_FULL));
+                        /* Check legacy speed AN resolution */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_AN_DEVAD,
+                                        MDIO_AN_REG_8481_LEGACY_MII_STATUS,
+                                        &val);
+                        if (val & (1<<5))
+                                vars->link_status |=
+                                        LINK_STATUS_AUTO_NEGOTIATE_COMPLETE;
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_AN_DEVAD,
+                                        MDIO_AN_REG_8481_LEGACY_AN_EXPANSION,
+                                        &val);
+                        if ((val & (1<<0)) == 0)
+                                vars->link_status |=
+                                        LINK_STATUS_PARALLEL_DETECTION_USED;
                 }
         }
-        *str_ptr = '\0';
-        return 0;
+        if (link_up) {
+                DP(NETIF_MSG_LINK, "BCM84823: link speed is %d\n",
+                           vars->line_speed);
+                bnx2x_ext_phy_resolve_fc(phy, params, vars);
+        }
+
+        return link_up;
 }
 
-u8 bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 driver_loaded,
-                              u8 *version, u16 len)
+static u8 bnx2x_848xx_format_ver(u32 raw_ver, u8 *str, u16 *len)
 {
-        struct bnx2x *bp;
-        u32 ext_phy_type = 0;
-        u32 spirom_ver = 0;
-        u8 status;
+        u8 status = 0;
+        u32 spirom_ver;
+        spirom_ver = ((raw_ver & 0xF80) >> 7) << 16 | (raw_ver & 0x7F);
+        status = bnx2x_format_ver(spirom_ver, str, len);
+        return status;
+}
 
-        if (version == NULL || params == NULL)
-                return -EINVAL;
-        bp = params->bp;
+static void bnx2x_8481_hw_reset(struct bnx2x_phy *phy,
+                                struct link_params *params)
+{
+        bnx2x_set_gpio(params->bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, 0);
+        bnx2x_set_gpio(params->bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, 1);
+}
 
-        spirom_ver = REG_RD(bp, params->shmem_base +
-                   offsetof(struct shmem_region,
-                            port_mb[params->port].ext_phy_fw_version));
+static void bnx2x_8481_link_reset(struct bnx2x_phy *phy,
+                                        struct link_params *params)
+{
+        bnx2x_cl45_write(params->bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, 0x0000);
+        bnx2x_cl45_write(params->bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_CTRL, 1);
+}
 
-        status = 0;
-        /* reset the returned value to zero */
-        ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-        switch (ext_phy_type) {
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+static void bnx2x_848x3_link_reset(struct bnx2x_phy *phy,
+                                   struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        u8 port = params->port;
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_3,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW,
+                            port);
+}
 
-                if (len < 5)
-                        return -EINVAL;
+static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
+                                     struct link_params *params, u8 mode)
+{
+        struct bnx2x *bp = params->bp;
+        u16 val;
 
-                version[0] = (spirom_ver & 0xFF);
-                version[1] = (spirom_ver & 0xFF00) >> 8;
-                version[2] = (spirom_ver & 0xFF0000) >> 16;
-                version[3] = (spirom_ver & 0xFF000000) >> 24;
-                version[4] = '\0';
+        switch (mode) {
+        case LED_MODE_OFF:
 
-                break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                status = bnx2x_format_ver(spirom_ver, version, len);
-                break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                spirom_ver = ((spirom_ver & 0xF80) >> 7) << 16 |
-                        (spirom_ver & 0x7F);
-                status = bnx2x_format_ver(spirom_ver, version, len);
-                break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                version[0] = '\0';
-                break;
+                DP(NETIF_MSG_LINK, "Port 0x%x: LED MODE OFF\n", params->port);
 
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
-                DP(NETIF_MSG_LINK, "bnx2x_get_ext_phy_fw_version:"
-                                    " type is FAILURE!\n");
-                status = -EINVAL;
+                if ((params->hw_led_mode << SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                    SHARED_HW_CFG_LED_EXTPHY1) {
+
+                        /* Set LED masks */
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED1_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED2_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED3_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED5_MASK,
+                                        0x0);
+
+                } else {
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_8481_LED1_MASK,
+                                         0x0);
+                }
                 break;
+        case LED_MODE_FRONT_PANEL_OFF:
 
-        default:
+                DP(NETIF_MSG_LINK, "Port 0x%x: LED MODE FRONT PANEL OFF\n",
+                   params->port);
+
+                if ((params->hw_led_mode << SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                    SHARED_HW_CFG_LED_EXTPHY1) {
+
+                        /* Set LED masks */
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED1_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED2_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED3_MASK,
+                                        0x0);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED5_MASK,
+                                        0x20);
+
+                } else {
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_8481_LED1_MASK,
+                                         0x0);
+                }
                 break;
-        }
-        return status;
-}
+        case LED_MODE_ON:
 
-static void bnx2x_set_xgxs_loopback(struct link_params *params,
-                                  struct link_vars *vars,
-                                  u8 is_10g)
-{
-        u8 port = params->port;
-        struct bnx2x *bp = params->bp;
+                DP(NETIF_MSG_LINK, "Port 0x%x: LED MODE ON\n", params->port);
 
-        if (is_10g) {
-                u32 md_devad;
+                if ((params->hw_led_mode << SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                    SHARED_HW_CFG_LED_EXTPHY1) {
+                        /* Set control reg */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                        &val);
+                        val &= 0x8000;
+                        val |= 0x2492;
 
-                DP(NETIF_MSG_LINK, "XGXS 10G loopback enable\n");
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                        val);
 
-                /* change the uni_phy_addr in the nig */
-                md_devad = REG_RD(bp, (NIG_REG_XGXS0_CTRL_MD_DEVAD +
-                                          port*0x18));
+                        /* Set LED masks */
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED1_MASK,
+                                        0x0);
 
-                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18, 0x5);
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED2_MASK,
+                                        0x20);
 
-                bnx2x_cl45_write(bp, port, 0,
-                               params->phy_addr,
-                               5,
-                               (MDIO_REG_BANK_AER_BLOCK +
-                                (MDIO_AER_BLOCK_AER_REG & 0xf)),
-                               0x2800);
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED3_MASK,
+                                        0x20);
 
-                bnx2x_cl45_write(bp, port, 0,
-                               params->phy_addr,
-                               5,
-                               (MDIO_REG_BANK_CL73_IEEEB0 +
-                                (MDIO_CL73_IEEEB0_CL73_AN_CONTROL & 0xf)),
-                               0x6041);
-                msleep(200);
-                /* set aer mmd back */
-                bnx2x_set_aer_mmd(params, vars);
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED5_MASK,
+                                        0x0);
+                } else {
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED1_MASK,
+                                        0x20);
+                }
+                break;
 
-                /* and md_devad */
-                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18,
-                            md_devad);
+        case LED_MODE_OPER:
 
-        } else {
-                u16 mii_control;
+                DP(NETIF_MSG_LINK, "Port 0x%x: LED MODE OPER\n", params->port);
 
-                DP(NETIF_MSG_LINK, "XGXS 1G loopback enable\n");
+                if ((params->hw_led_mode << SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                    SHARED_HW_CFG_LED_EXTPHY1) {
 
-                CL45_RD_OVER_CL22(bp, port,
-                                      params->phy_addr,
-                                      MDIO_REG_BANK_COMBO_IEEE0,
-                                      MDIO_COMBO_IEEE0_MII_CONTROL,
-                                      &mii_control);
+                        /* Set control reg */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                        &val);
+
+                        if (!((val &
+                              MDIO_PMA_REG_8481_LINK_SIGNAL_LED4_ENABLE_MASK)
+                           >> MDIO_PMA_REG_8481_LINK_SIGNAL_LED4_ENABLE_SHIFT)){
+                                DP(NETIF_MSG_LINK, "Seting LINK_SIGNAL\n");
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                                 0xa492);
+                        }
 
-                CL45_WR_OVER_CL22(bp, port,
-                                      params->phy_addr,
-                                      MDIO_REG_BANK_COMBO_IEEE0,
-                                      MDIO_COMBO_IEEE0_MII_CONTROL,
-                                      (mii_control |
-                                       MDIO_COMBO_IEEO_MII_CONTROL_LOOPBACK));
+                        /* Set LED masks */
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED1_MASK,
+                                        0x10);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED2_MASK,
+                                        0x80);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED3_MASK,
+                                        0x98);
+
+                        bnx2x_cl45_write(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LED5_MASK,
+                                        0x40);
+
+                } else {
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_8481_LED1_MASK,
+                                         0x80);
+                }
+                break;
         }
 }
+/******************************************************************/
+/*                      SFX7101 PHY SECTION                       */
+/******************************************************************/
+static void bnx2x_7101_config_loopback(struct bnx2x_phy *phy,
+                                       struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        /* SFX7101_XGXS_TEST1 */
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_XS_DEVAD, MDIO_XS_SFX7101_XGXS_TEST1, 0x100);
+}
 
-
-static void bnx2x_ext_phy_loopback(struct link_params *params)
+static u8 bnx2x_7101_config_init(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
 {
+        u16 fw_ver1, fw_ver2, val;
         struct bnx2x *bp = params->bp;
-        u8 ext_phy_addr;
-        u32 ext_phy_type;
+        DP(NETIF_MSG_LINK, "Setting the SFX7101 LASI indication\n");
 
-        if (params->switch_cfg == SWITCH_CFG_10G) {
-                ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-                ext_phy_addr = XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-                /* CL37 Autoneg Enabled */
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN:
-                        DP(NETIF_MSG_LINK,
-                                "ext_phy_loopback: We should not get here\n");
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                        DP(NETIF_MSG_LINK, "ext_phy_loopback: 8705\n");
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        DP(NETIF_MSG_LINK, "ext_phy_loopback: 8706\n");
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                        DP(NETIF_MSG_LINK, "PMA/PMD ext_phy_loopback: 8726\n");
-                        bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL,
-                                       0x0001);
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                        /* SFX7101_XGXS_TEST1 */
-                        bnx2x_cl45_write(bp, params->port, ext_phy_type,
-                                       ext_phy_addr,
-                                       MDIO_XS_DEVAD,
-                                       MDIO_XS_SFX7101_XGXS_TEST1,
-                                       0x100);
-                        DP(NETIF_MSG_LINK,
-                                "ext_phy_loopback: set ext phy loopback\n");
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+        /* Restore normal power mode*/
+        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_HIGH, params->port);
+        /* HW reset */
+        bnx2x_ext_phy_hw_reset(bp, params->port);
+        bnx2x_wait_reset_complete(bp, phy);
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_CTRL, 0x1);
+        DP(NETIF_MSG_LINK, "Setting the SFX7101 LED to blink on traffic\n");
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD, MDIO_PMA_REG_7107_LED_CNTL, (1<<3));
+
+        bnx2x_ext_phy_set_pause(params, phy, vars);
+        /* Restart autoneg */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, &val);
+        val |= 0x200;
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_AN_DEVAD, MDIO_AN_REG_CTRL, val);
+
+        /* Save spirom version */
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_7101_VER1, &fw_ver1);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_7101_VER2, &fw_ver2);
+        bnx2x_save_spirom_version(bp, params->port,
+                                  (u32)(fw_ver1<<16 | fw_ver2), phy->ver_addr);
+        return 0;
+}
 
-                        break;
-                } /* switch external PHY type */
-        } else {
-                /* serdes */
-                ext_phy_type = SERDES_EXT_PHY_TYPE(params->ext_phy_config);
-                ext_phy_addr = (params->ext_phy_config  &
-                PORT_HW_CFG_SERDES_EXT_PHY_ADDR_MASK)
-                >> PORT_HW_CFG_SERDES_EXT_PHY_ADDR_SHIFT;
+static u8 bnx2x_7101_read_status(struct bnx2x_phy *phy,
+                                 struct link_params *params,
+                                 struct link_vars *vars)
+{
+        struct bnx2x *bp = params->bp;
+        u8 link_up;
+        u16 val1, val2;
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_LASI_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "10G-base-T LASI status 0x%x->0x%x\n",
+                   val2, val1);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val2);
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD, MDIO_PMA_REG_STATUS, &val1);
+        DP(NETIF_MSG_LINK, "10G-base-T PMA status 0x%x->0x%x\n",
+                   val2, val1);
+        link_up = ((val1 & 4) == 4);
+        /* if link is up
+         * print the AN outcome of the SFX7101 PHY
+         */
+        if (link_up) {
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_AN_DEVAD, MDIO_AN_REG_MASTER_STATUS,
+                                &val2);
+                vars->line_speed = SPEED_10000;
+                DP(NETIF_MSG_LINK, "SFX7101 AN status 0x%x->Master=%x\n",
+                           val2, (val2 & (1<<14)));
+                bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
+                bnx2x_ext_phy_resolve_fc(phy, params, vars);
         }
+        return link_up;
 }
 
 
-/*
- *------------------------------------------------------------------------
- * bnx2x_override_led_value -
- *
- * Override the led value of the requsted led
- *
- *------------------------------------------------------------------------
- */
-u8 bnx2x_override_led_value(struct bnx2x *bp, u8 port,
-                          u32 led_idx, u32 value)
+static u8 bnx2x_7101_format_ver(u32 spirom_ver, u8 *str, u16 *len)
 {
-        u32 reg_val;
+        if (*len < 5)
+                return -EINVAL;
+        str[0] = (spirom_ver & 0xFF);
+        str[1] = (spirom_ver & 0xFF00) >> 8;
+        str[2] = (spirom_ver & 0xFF0000) >> 16;
+        str[3] = (spirom_ver & 0xFF000000) >> 24;
+        str[4] = '\0';
+        *len -= 5;
+        return 0;
+}
 
-        /* If port 0 then use EMAC0, else use EMAC1*/
-        u32 emac_base = (port) ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+void bnx2x_sfx7101_sp_sw_reset(struct bnx2x *bp, struct bnx2x_phy *phy)
+{
+        u16 val, cnt;
 
-        DP(NETIF_MSG_LINK,
-                 "bnx2x_override_led_value() port %x led_idx %d value %d\n",
-                 port, led_idx, value);
+        bnx2x_cl45_read(bp, phy,
+                      MDIO_PMA_DEVAD,
+                      MDIO_PMA_REG_7101_RESET, &val);
 
-        switch (led_idx) {
-        case 0: /* 10MB led */
-                /* Read the current value of the LED register in
-                the EMAC block */
-                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
-                /* Set the OVERRIDE bit to 1 */
-                reg_val |= EMAC_LED_OVERRIDE;
-                /* If value is 1, set the 10M_OVERRIDE bit,
-                otherwise reset it.*/
-                reg_val = (value == 1) ? (reg_val | EMAC_LED_10MB_OVERRIDE) :
-                        (reg_val & ~EMAC_LED_10MB_OVERRIDE);
-                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
-                break;
-        case 1: /*100MB led    */
-                /*Read the current value of the LED register in
-                the EMAC block */
-                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
-                /*  Set the OVERRIDE bit to 1 */
-                reg_val |= EMAC_LED_OVERRIDE;
-                /*  If value is 1, set the 100M_OVERRIDE bit,
-                otherwise reset it.*/
-                reg_val = (value == 1) ? (reg_val | EMAC_LED_100MB_OVERRIDE) :
-                        (reg_val & ~EMAC_LED_100MB_OVERRIDE);
-                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+        for (cnt = 0; cnt < 10; cnt++) {
+                msleep(50);
+                /* Writes a self-clearing reset */
+                bnx2x_cl45_write(bp, phy,
+                               MDIO_PMA_DEVAD,
+                               MDIO_PMA_REG_7101_RESET,
+                               (val | (1<<15)));
+                /* Wait for clear */
+                bnx2x_cl45_read(bp, phy,
+                              MDIO_PMA_DEVAD,
+                              MDIO_PMA_REG_7101_RESET, &val);
+
+                if ((val & (1<<15)) == 0)
+                        break;
+        }
+}
+
+static void bnx2x_7101_hw_reset(struct bnx2x_phy *phy,
+                                struct link_params *params) {
+        /* Low power mode is controlled by GPIO 2 */
+        bnx2x_set_gpio(params->bp, MISC_REGISTERS_GPIO_2,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, params->port);
+        /* The PHY reset is controlled by GPIO 1 */
+        bnx2x_set_gpio(params->bp, MISC_REGISTERS_GPIO_1,
+                            MISC_REGISTERS_GPIO_OUTPUT_LOW, params->port);
+}
+
+static void bnx2x_7101_set_link_led(struct bnx2x_phy *phy,
+                                    struct link_params *params, u8 mode)
+{
+        u16 val = 0;
+        struct bnx2x *bp = params->bp;
+        switch (mode) {
+        case LED_MODE_FRONT_PANEL_OFF:
+        case LED_MODE_OFF:
+                val = 2;
                 break;
-        case 2: /* 1000MB led */
-                /* Read the current value of the LED register in the
-                EMAC block */
-                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
-                /* Set the OVERRIDE bit to 1 */
-                reg_val |= EMAC_LED_OVERRIDE;
-                /* If value is 1, set the 1000M_OVERRIDE bit, otherwise
-                reset it. */
-                reg_val = (value == 1) ? (reg_val | EMAC_LED_1000MB_OVERRIDE) :
-                        (reg_val & ~EMAC_LED_1000MB_OVERRIDE);
-                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+        case LED_MODE_ON:
+                val = 1;
                 break;
-        case 3: /* 2500MB led */
-                /*  Read the current value of the LED register in the
-                EMAC block*/
-                reg_val = REG_RD(bp, emac_base + EMAC_REG_EMAC_LED);
-                /* Set the OVERRIDE bit to 1 */
-                reg_val |= EMAC_LED_OVERRIDE;
-                /*  If value is 1, set the 2500M_OVERRIDE bit, otherwise
-                reset it.*/
-                reg_val = (value == 1) ? (reg_val | EMAC_LED_2500MB_OVERRIDE) :
-                        (reg_val & ~EMAC_LED_2500MB_OVERRIDE);
-                REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
+        case LED_MODE_OPER:
+                val = 0;
                 break;
-        case 4: /*10G led */
-                if (port == 0) {
-                        REG_WR(bp, NIG_REG_LED_10G_P0,
-                                    value);
+        }
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_7107_LINK_LED_CNTL,
+                         val);
+}
+
+/******************************************************************/
+/*                      STATIC PHY DECLARATION                    */
+/******************************************************************/
+
+static struct bnx2x_phy phy_null = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN,
+        .addr           = 0,
+        .flags          = FLAGS_INIT_XGXS_FIRST,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = 0,
+        .media_type     = ETH_PHY_NOT_PRESENT,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)NULL,
+        .read_status    = (read_status_t)NULL,
+        .link_reset     = (link_reset_t)NULL,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)NULL,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_serdes = {
+        .type           = PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT,
+        .addr           = 0xff,
+        .flags          = 0,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10baseT_Half |
+                           SUPPORTED_10baseT_Full |
+                           SUPPORTED_100baseT_Half |
+                           SUPPORTED_100baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_2500baseX_Full |
+                           SUPPORTED_TP |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_UNSPECIFIED,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_init_serdes,
+        .read_status    = (read_status_t)bnx2x_link_settings_status,
+        .link_reset     = (link_reset_t)bnx2x_int_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)NULL,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_xgxs = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT,
+        .addr           = 0xff,
+        .flags          = 0,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10baseT_Half |
+                           SUPPORTED_10baseT_Full |
+                           SUPPORTED_100baseT_Half |
+                           SUPPORTED_100baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_2500baseX_Full |
+                           SUPPORTED_10000baseT_Full |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_UNSPECIFIED,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_init_xgxs,
+        .read_status    = (read_status_t)bnx2x_link_settings_status,
+        .link_reset     = (link_reset_t)bnx2x_int_link_reset,
+        .config_loopback = (config_loopback_t)bnx2x_set_xgxs_loopback,
+        .format_fw_ver  = (format_fw_ver_t)NULL,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_7101 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101,
+        .addr           = 0xff,
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_TP |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_BASE_T,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_7101_config_init,
+        .read_status    = (read_status_t)bnx2x_7101_read_status,
+        .link_reset     = (link_reset_t)bnx2x_common_ext_link_reset,
+        .config_loopback = (config_loopback_t)bnx2x_7101_config_loopback,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_7101_format_ver,
+        .hw_reset       = (hw_reset_t)bnx2x_7101_hw_reset,
+        .set_link_led   = (set_link_led_t)bnx2x_7101_set_link_led,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+static struct bnx2x_phy phy_8073 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
+        .addr           = 0xff,
+        .flags          = FLAGS_HW_LOCK_REQUIRED,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_2500baseX_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_UNSPECIFIED,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8073_config_init,
+        .read_status    = (read_status_t)bnx2x_8073_read_status,
+        .link_reset     = (link_reset_t)bnx2x_8073_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_format_ver,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+static struct bnx2x_phy phy_8705 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705,
+        .addr           = 0xff,
+        .flags          = FLAGS_INIT_XGXS_FIRST,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_XFP_FIBER,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8705_config_init,
+        .read_status    = (read_status_t)bnx2x_8705_read_status,
+        .link_reset     = (link_reset_t)bnx2x_common_ext_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_null_format_ver,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+static struct bnx2x_phy phy_8706 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706,
+        .addr           = 0xff,
+        .flags          = FLAGS_INIT_XGXS_FIRST,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_SFP_FIBER,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8706_config_init,
+        .read_status    = (read_status_t)bnx2x_8706_read_status,
+        .link_reset     = (link_reset_t)bnx2x_common_ext_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_format_ver,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_8726 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726,
+        .addr           = 0xff,
+        .flags          = (FLAGS_HW_LOCK_REQUIRED |
+                           FLAGS_INIT_XGXS_FIRST),
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_SFP_FIBER,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8726_config_init,
+        .read_status    = (read_status_t)bnx2x_8726_read_status,
+        .link_reset     = (link_reset_t)bnx2x_8726_link_reset,
+        .config_loopback = (config_loopback_t)bnx2x_8726_config_loopback,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_format_ver,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)NULL,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_8727 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
+        .addr           = 0xff,
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10000baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_FIBRE |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_SFP_FIBER,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8727_config_init,
+        .read_status    = (read_status_t)bnx2x_8727_read_status,
+        .link_reset     = (link_reset_t)bnx2x_8727_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_format_ver,
+        .hw_reset       = (hw_reset_t)bnx2x_8727_hw_reset,
+        .set_link_led   = (set_link_led_t)bnx2x_8727_set_link_led,
+        .phy_specific_func = (phy_specific_func_t)bnx2x_8727_specific_func
+};
+static struct bnx2x_phy phy_8481 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
+        .addr           = 0xff,
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ |
+                          FLAGS_REARM_LATCH_SIGNAL,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10baseT_Half |
+                           SUPPORTED_10baseT_Full |
+                           SUPPORTED_100baseT_Half |
+                           SUPPORTED_100baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_10000baseT_Full |
+                           SUPPORTED_TP |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_BASE_T,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_8481_config_init,
+        .read_status    = (read_status_t)bnx2x_848xx_read_status,
+        .link_reset     = (link_reset_t)bnx2x_8481_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_848xx_format_ver,
+        .hw_reset       = (hw_reset_t)bnx2x_8481_hw_reset,
+        .set_link_led   = (set_link_led_t)bnx2x_848xx_set_link_led,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+static struct bnx2x_phy phy_84823 = {
+        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823,
+        .addr           = 0xff,
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ |
+                          FLAGS_REARM_LATCH_SIGNAL,
+        .def_md_devad   = 0,
+        .reserved       = 0,
+        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
+        .mdio_ctrl      = 0,
+        .supported      = (SUPPORTED_10baseT_Half |
+                           SUPPORTED_10baseT_Full |
+                           SUPPORTED_100baseT_Half |
+                           SUPPORTED_100baseT_Full |
+                           SUPPORTED_1000baseT_Full |
+                           SUPPORTED_10000baseT_Full |
+                           SUPPORTED_TP |
+                           SUPPORTED_Autoneg |
+                           SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .media_type     = ETH_PHY_BASE_T,
+        .ver_addr       = 0,
+        .req_flow_ctrl  = 0,
+        .req_line_speed = 0,
+        .speed_cap_mask = 0,
+        .req_duplex     = 0,
+        .rsrv           = 0,
+        .config_init    = (config_init_t)bnx2x_848x3_config_init,
+        .read_status    = (read_status_t)bnx2x_848xx_read_status,
+        .link_reset     = (link_reset_t)bnx2x_848x3_link_reset,
+        .config_loopback = (config_loopback_t)NULL,
+        .format_fw_ver  = (format_fw_ver_t)bnx2x_848xx_format_ver,
+        .hw_reset       = (hw_reset_t)NULL,
+        .set_link_led   = (set_link_led_t)bnx2x_848xx_set_link_led,
+        .phy_specific_func = (phy_specific_func_t)NULL
+};
+
+/*****************************************************************/
+/*                                                               */
+/* Populate the phy according. Main function: bnx2x_populate_phy   */
+/*                                                               */
+/*****************************************************************/
+
+static void bnx2x_populate_preemphasis(struct bnx2x *bp, u32 shmem_base,
+                                     struct bnx2x_phy *phy, u8 port,
+                                     u8 phy_index)
+{
+        /* Get the 4 lanes xgxs config rx and tx */
+        u32 rx = 0, tx = 0, i;
+        for (i = 0; i < 2; i++) {
+                /**
+                 * INT_PHY and EXT_PHY1 share the same value location in the
+                 * shmem. When num_phys is greater than 1, than this value
+                 * applies only to EXT_PHY1
+                 */
+                if (phy_index == INT_PHY || phy_index == EXT_PHY1) {
+                        rx = REG_RD(bp, shmem_base +
+                                    offsetof(struct shmem_region,
+                           dev_info.port_hw_config[port].xgxs_config_rx[i<<1]));
+
+                        tx = REG_RD(bp, shmem_base +
+                                    offsetof(struct shmem_region,
+                           dev_info.port_hw_config[port].xgxs_config_tx[i<<1]));
                 } else {
-                        REG_WR(bp, NIG_REG_LED_10G_P1,
-                                    value);
+                        rx = REG_RD(bp, shmem_base +
+                                    offsetof(struct shmem_region,
+                          dev_info.port_hw_config[port].xgxs_config2_rx[i<<1]));
+
+                        tx = REG_RD(bp, shmem_base +
+                                    offsetof(struct shmem_region,
+                          dev_info.port_hw_config[port].xgxs_config2_rx[i<<1]));
                 }
+
+                phy->rx_preemphasis[i << 1] = ((rx>>16) & 0xffff);
+                phy->rx_preemphasis[(i << 1) + 1] = (rx & 0xffff);
+
+                phy->tx_preemphasis[i << 1] = ((tx>>16) & 0xffff);
+                phy->tx_preemphasis[(i << 1) + 1] = (tx & 0xffff);
+        }
+}
+
+static u32 bnx2x_get_ext_phy_config(struct bnx2x *bp, u32 shmem_base,
+                                    u8 phy_index, u8 port)
+{
+        u32 ext_phy_config = 0;
+        switch (phy_index) {
+        case EXT_PHY1:
+                ext_phy_config = REG_RD(bp, shmem_base +
+                                              offsetof(struct shmem_region,
+                        dev_info.port_hw_config[port].external_phy_config));
                 break;
-        case 5: /* TRAFFIC led */
-                /* Find if the traffic control is via BMAC or EMAC */
-                if (port == 0)
-                        reg_val = REG_RD(bp, NIG_REG_NIG_EMAC0_EN);
-                else
-                        reg_val = REG_RD(bp, NIG_REG_NIG_EMAC1_EN);
+        case EXT_PHY2:
+                ext_phy_config = REG_RD(bp, shmem_base +
+                                              offsetof(struct shmem_region,
+                        dev_info.port_hw_config[port].external_phy_config2));
+                break;
+        default:
+                DP(NETIF_MSG_LINK, "Invalid phy_index %d\n", phy_index);
+                return -EINVAL;
+        }
 
-                /*  Override the traffic led in the EMAC:*/
-                if (reg_val == 1) {
-                        /* Read the current value of the LED register in
-                        the EMAC block */
-                        reg_val = REG_RD(bp, emac_base +
-                                             EMAC_REG_EMAC_LED);
-                        /* Set the TRAFFIC_OVERRIDE bit to 1 */
-                        reg_val |= EMAC_LED_OVERRIDE;
-                        /* If value is 1, set the TRAFFIC bit, otherwise
-                        reset it.*/
-                        reg_val = (value == 1) ? (reg_val | EMAC_LED_TRAFFIC) :
-                                (reg_val & ~EMAC_LED_TRAFFIC);
-                        REG_WR(bp, emac_base + EMAC_REG_EMAC_LED, reg_val);
-                } else { /* Override the traffic led in the BMAC: */
-                        REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0
-                                   + port*4, 1);
-                        REG_WR(bp, NIG_REG_LED_CONTROL_TRAFFIC_P0 + port*4,
-                                    value);
-                }
+        return ext_phy_config;
+}
+static u8 bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
+                                 struct bnx2x_phy *phy)
+{
+        u32 phy_addr;
+        u32 chip_id;
+        u32 switch_cfg = (REG_RD(bp, shmem_base +
+                                       offsetof(struct shmem_region,
+                        dev_info.port_feature_config[port].link_config)) &
+                          PORT_FEATURE_CONNECTED_SWITCH_MASK);
+        chip_id = REG_RD(bp, MISC_REG_CHIP_NUM) << 16;
+        switch (switch_cfg) {
+        case SWITCH_CFG_1G:
+                phy_addr = REG_RD(bp,
+                                        NIG_REG_SERDES0_CTRL_PHY_ADDR +
+                                        port * 0x10);
+                *phy = phy_serdes;
+                break;
+        case SWITCH_CFG_10G:
+                phy_addr = REG_RD(bp,
+                                        NIG_REG_XGXS0_CTRL_PHY_ADDR +
+                                        port * 0x18);
+                *phy = phy_xgxs;
                 break;
         default:
-                DP(NETIF_MSG_LINK,
-                         "bnx2x_override_led_value() unknown led index %d "
-                         "(should be 0-5)\n", led_idx);
+                DP(NETIF_MSG_LINK, "Invalid switch_cfg\n");
                 return -EINVAL;
         }
+        phy->addr = (u8)phy_addr;
+        phy->mdio_ctrl = bnx2x_get_emac_base(bp,
+                                            SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH,
+                                            port);
+        phy->def_md_devad = DEFAULT_PHY_DEV_ADDR;
+
+        DP(NETIF_MSG_LINK, "Internal phy port=%d, addr=0x%x, mdio_ctl=0x%x\n",
+                   port, phy->addr, phy->mdio_ctrl);
 
+        bnx2x_populate_preemphasis(bp, shmem_base, phy, port, INT_PHY);
         return 0;
 }
 
-
-u8 bnx2x_set_led(struct link_params *params, u8 mode, u32 speed)
+static u8 bnx2x_populate_ext_phy(struct bnx2x *bp,
+                                 u8 phy_index,
+                                 u32 shmem_base,
+                                 u32 shmem2_base,
+                                 u8 port,
+                                 struct bnx2x_phy *phy)
 {
-        u8 port = params->port;
-        u16 hw_led_mode = params->hw_led_mode;
-        u8 rc = 0;
-        u32 tmp;
-        u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-        struct bnx2x *bp = params->bp;
-        DP(NETIF_MSG_LINK, "bnx2x_set_led: port %x, mode %d\n", port, mode);
-        DP(NETIF_MSG_LINK, "speed 0x%x, hw_led_mode 0x%x\n",
-                 speed, hw_led_mode);
-        switch (mode) {
-        case LED_MODE_OFF:
-                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 0);
-                REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4,
-                           SHARED_HW_CFG_LED_MAC1);
-
-                tmp = EMAC_RD(bp, EMAC_REG_EMAC_LED);
-                EMAC_WR(bp, EMAC_REG_EMAC_LED, (tmp | EMAC_LED_OVERRIDE));
+        u32 ext_phy_config, phy_type, config2;
+        u32 mdc_mdio_access = SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH;
+        ext_phy_config = bnx2x_get_ext_phy_config(bp, shmem_base,
+                                                  phy_index, port);
+        phy_type = XGXS_EXT_PHY_TYPE(ext_phy_config);
+        /* Select the phy type */
+        switch (phy_type) {
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
+                mdc_mdio_access = SHARED_HW_CFG_MDC_MDIO_ACCESS1_SWAPPED;
+                *phy = phy_8073;
                 break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
+                *phy = phy_8705;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
+                *phy = phy_8706;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
+                mdc_mdio_access = SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC1;
+                *phy = phy_8726;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727_NOC:
+                /* BCM8727_NOC => BCM8727 no over current */
+                mdc_mdio_access = SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC1;
+                *phy = phy_8727;
+                phy->flags |= FLAGS_NOC;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
+                mdc_mdio_access = SHARED_HW_CFG_MDC_MDIO_ACCESS1_EMAC1;
+                *phy = phy_8727;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
+                *phy = phy_8481;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
+                *phy = phy_84823;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                *phy = phy_7101;
+                break;
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
+                *phy = phy_null;
+                return -EINVAL;
+        default:
+                *phy = phy_null;
+                return 0;
+        }
 
-        case LED_MODE_OPER:
-                if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) {
-                        REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4, 0);
-                        REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
-                } else {
-                        REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4,
-                                   hw_led_mode);
-                }
+        phy->addr = XGXS_EXT_PHY_ADDR(ext_phy_config);
+        bnx2x_populate_preemphasis(bp, shmem_base, phy, port, phy_index);
 
-                REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0 +
-                           port*4, 0);
-                /* Set blinking rate to ~15.9Hz */
-                REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_RATE_P0 + port*4,
-                           LED_BLINK_RATE_VAL);
-                REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_RATE_ENA_P0 +
-                           port*4, 1);
-                tmp = EMAC_RD(bp, EMAC_REG_EMAC_LED);
-                EMAC_WR(bp, EMAC_REG_EMAC_LED,
-                            (tmp & (~EMAC_LED_OVERRIDE)));
+        /**
+        * The shmem address of the phy version is located on different
+        * structures. In case this structure is too old, do not set
+        * the address
+        */
+        config2 = REG_RD(bp, shmem_base + offsetof(struct shmem_region,
+                                        dev_info.shared_hw_config.config2));
+        if (phy_index == EXT_PHY1) {
+                phy->ver_addr = shmem_base + offsetof(struct shmem_region,
+                                port_mb[port].ext_phy_fw_version);
+
+        /* Check specific mdc mdio settings */
+        if (config2 & SHARED_HW_CFG_MDC_MDIO_ACCESS1_MASK)
+                mdc_mdio_access = config2 &
+                SHARED_HW_CFG_MDC_MDIO_ACCESS1_MASK;
+        } else {
+                u32 size = REG_RD(bp, shmem2_base);
 
-                if (CHIP_IS_E1(bp) &&
-                    ((speed == SPEED_2500) ||
-                     (speed == SPEED_1000) ||
-                     (speed == SPEED_100) ||
-                     (speed == SPEED_10))) {
-                        /* On Everest 1 Ax chip versions for speeds less than
-                        10G LED scheme is different */
-                        REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0
-                                   + port*4, 1);
-                        REG_WR(bp, NIG_REG_LED_CONTROL_TRAFFIC_P0 +
-                                   port*4, 0);
-                        REG_WR(bp, NIG_REG_LED_CONTROL_BLINK_TRAFFIC_P0 +
-                                   port*4, 1);
+                if (size >
+                    offsetof(struct shmem2_region, ext_phy_fw_version2)) {
+                        phy->ver_addr = shmem2_base +
+                            offsetof(struct shmem2_region,
+                                     ext_phy_fw_version2[port]);
                 }
-                break;
-
-        default:
-                rc = -EINVAL;
-                DP(NETIF_MSG_LINK, "bnx2x_set_led: Invalid led mode %d\n",
-                         mode);
-                break;
+                /* Check specific mdc mdio settings */
+                if (config2 & SHARED_HW_CFG_MDC_MDIO_ACCESS2_MASK)
+                        mdc_mdio_access = (config2 &
+                        SHARED_HW_CFG_MDC_MDIO_ACCESS2_MASK) >>
+                        (SHARED_HW_CFG_MDC_MDIO_ACCESS2_SHIFT -
+                         SHARED_HW_CFG_MDC_MDIO_ACCESS1_SHIFT);
         }
-        return rc;
+        phy->mdio_ctrl = bnx2x_get_emac_base(bp, mdc_mdio_access, port);
 
+        /**
+         * In case mdc/mdio_access of the external phy is different than the
+         * mdc/mdio access of the XGXS, a HW lock must be taken in each access
+         * to prevent one port interfere with another port's CL45 operations.
+         */
+        if (mdc_mdio_access != SHARED_HW_CFG_MDC_MDIO_ACCESS1_BOTH)
+                phy->flags |= FLAGS_HW_LOCK_REQUIRED;
+        DP(NETIF_MSG_LINK, "phy_type 0x%x port %d found in index %d\n",
+                   phy_type, port, phy_index);
+        DP(NETIF_MSG_LINK, "             addr=0x%x, mdio_ctl=0x%x\n",
+                   phy->addr, phy->mdio_ctrl);
+        return 0;
 }
 
-u8 bnx2x_test_link(struct link_params *params, struct link_vars *vars)
+static u8 bnx2x_populate_phy(struct bnx2x *bp, u8 phy_index, u32 shmem_base,
+                             u32 shmem2_base, u8 port, struct bnx2x_phy *phy)
 {
-        struct bnx2x *bp = params->bp;
-        u16 gp_status = 0;
-
-        CL45_RD_OVER_CL22(bp, params->port,
-                              params->phy_addr,
-                              MDIO_REG_BANK_GP_STATUS,
-                              MDIO_GP_STATUS_TOP_AN_STATUS1,
-                              &gp_status);
-        /* link is up only if both local phy and external phy are up */
-        if ((gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) &&
-            bnx2x_ext_phy_is_link_up(params, vars, 1))
-                return 0;
-
-        return -ESRCH;
+        u8 status = 0;
+        phy->type = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN;
+        if (phy_index == INT_PHY)
+                return bnx2x_populate_int_phy(bp, shmem_base, port, phy);
+        status = bnx2x_populate_ext_phy(bp, phy_index, shmem_base, shmem2_base,
+                                        port, phy);
+        return status;
 }
 
-static u8 bnx2x_link_initialize(struct link_params *params,
-                              struct link_vars *vars)
+static void bnx2x_phy_def_cfg(struct link_params *params,
+                              struct bnx2x_phy *phy,
+                              u8 phy_index)
 {
         struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 rc = 0;
-        u8 non_ext_phy;
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        /* Activate the external PHY */
-        bnx2x_ext_phy_reset(params, vars);
-
-        bnx2x_set_aer_mmd(params, vars);
+        u32 link_config;
+        /* Populate the default phy configuration for MF mode */
+        if (phy_index == EXT_PHY2) {
+                link_config = REG_RD(bp, params->shmem_base +
+                                         offsetof(struct shmem_region, dev_info.
+                        port_feature_config[params->port].link_config2));
+                phy->speed_cap_mask = REG_RD(bp, params->shmem_base +
+                                        offsetof(struct shmem_region, dev_info.
+                        port_hw_config[params->port].speed_capability_mask2));
+        } else {
+                link_config = REG_RD(bp, params->shmem_base +
+                                offsetof(struct shmem_region, dev_info.
+                                port_feature_config[params->port].link_config));
+                phy->speed_cap_mask = REG_RD(bp, params->shmem_base +
+                                offsetof(struct shmem_region, dev_info.
+                           port_hw_config[params->port].speed_capability_mask));
+        }
+        DP(NETIF_MSG_LINK, "Default config phy idx %x cfg 0x%x speed_cap_mask"
+                       " 0x%x\n", phy_index, link_config, phy->speed_cap_mask);
+
+        phy->req_duplex = DUPLEX_FULL;
+        switch (link_config  & PORT_FEATURE_LINK_SPEED_MASK) {
+        case PORT_FEATURE_LINK_SPEED_10M_HALF:
+                phy->req_duplex = DUPLEX_HALF;
+        case PORT_FEATURE_LINK_SPEED_10M_FULL:
+                phy->req_line_speed = SPEED_10;
+                break;
+        case PORT_FEATURE_LINK_SPEED_100M_HALF:
+                phy->req_duplex = DUPLEX_HALF;
+        case PORT_FEATURE_LINK_SPEED_100M_FULL:
+                phy->req_line_speed = SPEED_100;
+                break;
+        case PORT_FEATURE_LINK_SPEED_1G:
+                phy->req_line_speed = SPEED_1000;
+                break;
+        case PORT_FEATURE_LINK_SPEED_2_5G:
+                phy->req_line_speed = SPEED_2500;
+                break;
+        case PORT_FEATURE_LINK_SPEED_10G_CX4:
+                phy->req_line_speed = SPEED_10000;
+                break;
+        default:
+                phy->req_line_speed = SPEED_AUTO_NEG;
+                break;
+        }
 
-        if (vars->phy_flags & PHY_XGXS_FLAG)
-                bnx2x_set_master_ln(params);
+        switch (link_config  & PORT_FEATURE_FLOW_CONTROL_MASK) {
+        case PORT_FEATURE_FLOW_CONTROL_AUTO:
+                phy->req_flow_ctrl = BNX2X_FLOW_CTRL_AUTO;
+                break;
+        case PORT_FEATURE_FLOW_CONTROL_TX:
+                phy->req_flow_ctrl = BNX2X_FLOW_CTRL_TX;
+                break;
+        case PORT_FEATURE_FLOW_CONTROL_RX:
+                phy->req_flow_ctrl = BNX2X_FLOW_CTRL_RX;
+                break;
+        case PORT_FEATURE_FLOW_CONTROL_BOTH:
+                phy->req_flow_ctrl = BNX2X_FLOW_CTRL_BOTH;
+                break;
+        default:
+                phy->req_flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+                break;
+        }
+}
 
-        rc = bnx2x_reset_unicore(params);
-        /* reset the SerDes and wait for reset bit return low */
-        if (rc != 0)
-                return rc;
+u32 bnx2x_phy_selection(struct link_params *params)
+{
+        u32 phy_config_swapped, prio_cfg;
+        u32 return_cfg = PORT_HW_CFG_PHY_SELECTION_HARDWARE_DEFAULT;
+
+        phy_config_swapped = params->multi_phy_config &
+                PORT_HW_CFG_PHY_SWAPPED_ENABLED;
+
+        prio_cfg = params->multi_phy_config &
+                        PORT_HW_CFG_PHY_SELECTION_MASK;
+
+        if (phy_config_swapped) {
+                switch (prio_cfg) {
+                case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY:
+                     return_cfg = PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY;
+                     break;
+                case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY:
+                     return_cfg = PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY;
+                     break;
+                case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY:
+                     return_cfg = PORT_HW_CFG_PHY_SELECTION_FIRST_PHY;
+                     break;
+                case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY:
+                     return_cfg = PORT_HW_CFG_PHY_SELECTION_SECOND_PHY;
+                     break;
+                }
+        } else
+                return_cfg = prio_cfg;
 
-        bnx2x_set_aer_mmd(params, vars);
+        return return_cfg;
+}
 
-        /* setting the masterLn_def again after the reset */
-        if (vars->phy_flags & PHY_XGXS_FLAG) {
-                bnx2x_set_master_ln(params);
-                bnx2x_set_swap_lanes(params);
-        }
 
-        if (vars->phy_flags & PHY_XGXS_FLAG) {
-                if ((params->req_line_speed &&
-                    ((params->req_line_speed == SPEED_100) ||
-                     (params->req_line_speed == SPEED_10))) ||
-                    (!params->req_line_speed &&
-                     (params->speed_cap_mask >=
-                       PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
-                     (params->speed_cap_mask <
-                       PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)
-                     ))  {
-                        vars->phy_flags |= PHY_SGMII_FLAG;
-                } else {
-                        vars->phy_flags &= ~PHY_SGMII_FLAG;
+u8 bnx2x_phy_probe(struct link_params *params)
+{
+        u8 phy_index, actual_phy_idx, link_cfg_idx;
+        u32 phy_config_swapped;
+        struct bnx2x *bp = params->bp;
+        struct bnx2x_phy *phy;
+        params->num_phys = 0;
+        DP(NETIF_MSG_LINK, "Begin phy probe\n");
+        phy_config_swapped = params->multi_phy_config &
+                PORT_HW_CFG_PHY_SWAPPED_ENABLED;
+
+        for (phy_index = INT_PHY; phy_index < MAX_PHYS;
+              phy_index++) {
+                link_cfg_idx = LINK_CONFIG_IDX(phy_index);
+                actual_phy_idx = phy_index;
+                if (phy_config_swapped) {
+                        if (phy_index == EXT_PHY1)
+                                actual_phy_idx = EXT_PHY2;
+                        else if (phy_index == EXT_PHY2)
+                                actual_phy_idx = EXT_PHY1;
                 }
+                DP(NETIF_MSG_LINK, "phy_config_swapped %x, phy_index %x,"
+                               " actual_phy_idx %x\n", phy_config_swapped,
+                           phy_index, actual_phy_idx);
+                phy = &params->phy[actual_phy_idx];
+                if (bnx2x_populate_phy(bp, phy_index, params->shmem_base,
+                                       params->shmem2_base, params->port,
+                                       phy) != 0) {
+                        params->num_phys = 0;
+                        DP(NETIF_MSG_LINK, "phy probe failed in phy index %d\n",
+                                   phy_index);
+                        for (phy_index = INT_PHY;
+                              phy_index < MAX_PHYS;
+                              phy_index++)
+                                *phy = phy_null;
+                        return -EINVAL;
+                }
+                if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN)
+                        break;
+
+                bnx2x_phy_def_cfg(params, phy, phy_index);
+                params->num_phys++;
         }
-        /* In case of external phy existance, the line speed would be the
-         line speed linked up by the external phy. In case it is direct only,
-          then the line_speed during initialization will be equal to the
-           req_line_speed*/
-        vars->line_speed = params->req_line_speed;
 
-        bnx2x_calc_ieee_aneg_adv(params, &vars->ieee_fc);
+        DP(NETIF_MSG_LINK, "End phy probe. #phys found %x\n", params->num_phys);
+        return 0;
+}
 
-        /* init ext phy and enable link state int */
-        non_ext_phy = ((ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) ||
-                       (params->loopback_mode == LOOPBACK_XGXS_10));
+u32 bnx2x_supported_attr(struct link_params *params, u8 phy_idx)
+{
+        if (phy_idx < params->num_phys)
+                return params->phy[phy_idx].supported;
+        return 0;
+}
 
-        if (non_ext_phy ||
-            (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) ||
-            (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706) ||
-            (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726) ||
-            (params->loopback_mode == LOOPBACK_EXT_PHY)) {
-                if (params->req_line_speed == SPEED_AUTO_NEG)
-                        bnx2x_set_parallel_detection(params, vars->phy_flags);
-                bnx2x_init_internal_phy(params, vars, non_ext_phy);
-        }
+static void set_phy_vars(struct link_params *params)
+{
+        struct bnx2x *bp = params->bp;
+        u8 actual_phy_idx, phy_index, link_cfg_idx;
+        u8 phy_config_swapped = params->multi_phy_config &
+                        PORT_HW_CFG_PHY_SWAPPED_ENABLED;
+        for (phy_index = INT_PHY; phy_index < params->num_phys;
+              phy_index++) {
+                link_cfg_idx = LINK_CONFIG_IDX(phy_index);
+                actual_phy_idx = phy_index;
+                if (phy_config_swapped) {
+                        if (phy_index == EXT_PHY1)
+                                actual_phy_idx = EXT_PHY2;
+                        else if (phy_index == EXT_PHY2)
+                                actual_phy_idx = EXT_PHY1;
+                }
+                params->phy[actual_phy_idx].req_flow_ctrl  =
+                        params->req_flow_ctrl[link_cfg_idx];
 
-        if (!non_ext_phy)
-                rc |= bnx2x_ext_phy_init(params, vars);
+                params->phy[actual_phy_idx].req_line_speed =
+                        params->req_line_speed[link_cfg_idx];
 
-        bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                     (NIG_STATUS_XGXS0_LINK10G |
-                      NIG_STATUS_XGXS0_LINK_STATUS |
-                      NIG_STATUS_SERDES0_LINK_STATUS));
+                params->phy[actual_phy_idx].speed_cap_mask =
+                        params->speed_cap_mask[link_cfg_idx];
 
-        return rc;
+                params->phy[actual_phy_idx].req_duplex =
+                        params->req_duplex[link_cfg_idx];
 
+                DP(NETIF_MSG_LINK, "req_flow_ctrl %x, req_line_speed %x,"
+                           " speed_cap_mask %x\n",
+                           params->phy[actual_phy_idx].req_flow_ctrl,
+                           params->phy[actual_phy_idx].req_line_speed,
+                           params->phy[actual_phy_idx].speed_cap_mask);
+        }
 }
 
-
 u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
 {
         struct bnx2x *bp = params->bp;
-        u32 val;
-
         DP(NETIF_MSG_LINK, "Phy Initialization started\n");
-        DP(NETIF_MSG_LINK, "req_speed %d, req_flowctrl %d\n",
-                 params->req_line_speed, params->req_flow_ctrl);
+        DP(NETIF_MSG_LINK, "(1) req_speed %d, req_flowctrl %d\n",
+                   params->req_line_speed[0], params->req_flow_ctrl[0]);
+        DP(NETIF_MSG_LINK, "(2) req_speed %d, req_flowctrl %d\n",
+                   params->req_line_speed[1], params->req_flow_ctrl[1]);
         vars->link_status = 0;
         vars->phy_link_up = 0;
         vars->link_up = 0;
@@ -5966,11 +6705,7 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
         vars->duplex = DUPLEX_FULL;
         vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
         vars->mac_type = MAC_TYPE_NONE;
-
-        if (params->switch_cfg ==  SWITCH_CFG_1G)
-                vars->phy_flags = PHY_SERDES_FLAG;
-        else
-                vars->phy_flags = PHY_XGXS_FLAG;
+        vars->phy_flags = 0;
 
         /* disable attentions */
         bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 + params->port*4,
@@ -5981,6 +6716,13 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
 
         bnx2x_emac_init(params, vars);
 
+        if (params->num_phys == 0) {
+                DP(NETIF_MSG_LINK, "No phy found for initialization !!\n");
+                return -EINVAL;
+        }
+        set_phy_vars(params);
+
+        DP(NETIF_MSG_LINK, "Num of phys on board: %d\n", params->num_phys);
         if (CHIP_REV_IS_FPGA(bp)) {
 
                 vars->link_up = 1;
@@ -6040,7 +6782,8 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
 
                 vars->phy_flags = PHY_XGXS_FLAG;
 
-                bnx2x_phy_deassert(params, vars->phy_flags);
+                bnx2x_xgxs_deassert(params);
+
                 /* set bmac loopback */
                 bnx2x_bmac_enable(params, vars, 1);
 
@@ -6057,80 +6800,66 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
 
                 vars->phy_flags = PHY_XGXS_FLAG;
 
-                bnx2x_phy_deassert(params, vars->phy_flags);
+                bnx2x_xgxs_deassert(params);
                 /* set bmac loopback */
                 bnx2x_emac_enable(params, vars, 1);
-                bnx2x_emac_program(params, vars->line_speed,
-                                              vars->duplex);
+                bnx2x_emac_program(params, vars);
                 REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE +
                     params->port*4, 0);
 
-        } else if ((params->loopback_mode == LOOPBACK_XGXS_10) ||
+        } else if ((params->loopback_mode == LOOPBACK_XGXS) ||
                    (params->loopback_mode == LOOPBACK_EXT_PHY)) {
 
                 vars->link_up = 1;
-                vars->line_speed = SPEED_10000;
-                vars->duplex = DUPLEX_FULL;
                 vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+                vars->duplex = DUPLEX_FULL;
+                if (params->req_line_speed[0] == SPEED_1000) {
+                        vars->line_speed = SPEED_1000;
+                        vars->mac_type = MAC_TYPE_EMAC;
+                } else {
+                        vars->line_speed = SPEED_10000;
+                        vars->mac_type = MAC_TYPE_BMAC;
+                }
 
-                vars->phy_flags = PHY_XGXS_FLAG;
-
-                val = REG_RD(bp,
-                                 NIG_REG_XGXS0_CTRL_PHY_ADDR+
-                                 params->port*0x18);
-                params->phy_addr = (u8)val;
-
-                bnx2x_phy_deassert(params, vars->phy_flags);
+                bnx2x_xgxs_deassert(params);
                 bnx2x_link_initialize(params, vars);
 
-                vars->mac_type = MAC_TYPE_BMAC;
-
+                if (params->req_line_speed[0] == SPEED_1000) {
+                        bnx2x_emac_program(params, vars);
+                        bnx2x_emac_enable(params, vars, 0);
+                } else
                 bnx2x_bmac_enable(params, vars, 0);
 
-                if (params->loopback_mode == LOOPBACK_XGXS_10) {
+                if (params->loopback_mode == LOOPBACK_XGXS) {
                         /* set 10G XGXS loopback */
-                        bnx2x_set_xgxs_loopback(params, vars, 1);
+                        params->phy[INT_PHY].config_loopback(
+                                &params->phy[INT_PHY],
+                                params);
+
                 } else {
                         /* set external phy loopback */
-                        bnx2x_ext_phy_loopback(params);
+                        u8 phy_index;
+                        for (phy_index = EXT_PHY1;
+                              phy_index < params->num_phys; phy_index++) {
+                                if (params->phy[phy_index].config_loopback)
+                                        params->phy[phy_index].config_loopback(
+                                                &params->phy[phy_index],
+                                                params);
+                        }
                 }
+
                 REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE +
                             params->port*4, 0);
 
-                bnx2x_set_led(params, LED_MODE_OPER, vars->line_speed);
+                bnx2x_set_led(params, vars,
+                              LED_MODE_OPER, vars->line_speed);
         } else
         /* No loopback */
         {
-                bnx2x_phy_deassert(params, vars->phy_flags);
-                switch (params->switch_cfg) {
-                case SWITCH_CFG_1G:
-                        vars->phy_flags |= PHY_SERDES_FLAG;
-                        if ((params->ext_phy_config &
-                             PORT_HW_CFG_SERDES_EXT_PHY_TYPE_MASK) ==
-                             PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482) {
-                                vars->phy_flags |= PHY_SGMII_FLAG;
-                        }
-
-                        val = REG_RD(bp,
-                                         NIG_REG_SERDES0_CTRL_PHY_ADDR+
-                                         params->port*0x10);
-
-                        params->phy_addr = (u8)val;
-
-                        break;
-                case SWITCH_CFG_10G:
-                        vars->phy_flags |= PHY_XGXS_FLAG;
-                        val = REG_RD(bp,
-                                 NIG_REG_XGXS0_CTRL_PHY_ADDR+
-                                 params->port*0x18);
-                        params->phy_addr = (u8)val;
-
-                        break;
-                default:
-                        DP(NETIF_MSG_LINK, "Invalid switch_cfg\n");
-                        return -EINVAL;
-                }
-                DP(NETIF_MSG_LINK, "Phy address = 0x%x\n", params->phy_addr);
+                if (params->switch_cfg == SWITCH_CFG_10G)
+                        bnx2x_xgxs_deassert(params);
+                else
+                        bnx2x_serdes_deassert(bp, params->port);
 
                 bnx2x_link_initialize(params, vars);
                 msleep(30);
@@ -6138,29 +6867,11 @@ u8 bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
         }
         return 0;
 }
-
-static void bnx2x_8726_reset_phy(struct bnx2x *bp, u8 port, u8 ext_phy_addr)
-{
-        DP(NETIF_MSG_LINK, "bnx2x_8726_reset_phy port %d\n", port);
-
-        /* Set serial boot control for external load */
-        bnx2x_cl45_write(bp, port,
-                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726, ext_phy_addr,
-                       MDIO_PMA_DEVAD,
-                       MDIO_PMA_REG_GEN_CTRL, 0x0001);
-}
-
 u8 bnx2x_link_reset(struct link_params *params, struct link_vars *vars,
                   u8 reset_ext_phy)
 {
         struct bnx2x *bp = params->bp;
-        u32 ext_phy_config = params->ext_phy_config;
-        u8 port = params->port;
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(ext_phy_config);
-        u32 val = REG_RD(bp, params->shmem_base +
-                             offsetof(struct shmem_region, dev_info.
-                                      port_feature_config[params->port].
-                                      config));
+        u8 phy_index, port = params->port;
         DP(NETIF_MSG_LINK, "Resetting the link of port %d\n", port);
         /* disable attentions */
         vars->link_status = 0;
@@ -6189,73 +6900,21 @@ u8 bnx2x_link_reset(struct link_params *params, struct link_vars *vars,
          * Hold it as vars low
          */
          /* clear link led */
-        bnx2x_set_led(params, LED_MODE_OFF, 0);
-        if (reset_ext_phy) {
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                        break;
+        bnx2x_set_led(params, vars, LED_MODE_OFF, 0);
 
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                {
-
-                        /* Disable Transmitter */
-                        u8 ext_phy_addr =
-                                XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-                        if ((val & PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_MASK) ==
-                            PORT_FEAT_CFG_OPT_MDL_ENFRCMNT_DISABLE_TX_LASER)
-                                bnx2x_sfp_set_transmitter(bp, port,
-                                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                                        ext_phy_addr, 0);
-                        break;
-                }
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                        DP(NETIF_MSG_LINK, "Setting 8073 port %d into "
-                                 "low power mode\n",
-                                 port);
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                          MISC_REGISTERS_GPIO_OUTPUT_LOW,
-                                          port);
-                        break;
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                {
-                        u8 ext_phy_addr =
-                                XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-                        /* Set soft reset */
-                        bnx2x_8726_reset_phy(bp, params->port, ext_phy_addr);
-                        break;
-                }
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                {
-                        u8 ext_phy_addr =
-                                XGXS_EXT_PHY_ADDR(params->ext_phy_config);
-                        bnx2x_cl45_write(bp, port,
-                                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                                       ext_phy_addr,
-                                       MDIO_AN_DEVAD,
-                                       MDIO_AN_REG_CTRL, 0x0000);
-                        bnx2x_cl45_write(bp, port,
-                                       PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481,
-                                       ext_phy_addr,
-                                       MDIO_PMA_DEVAD,
-                                       MDIO_PMA_REG_CTRL, 1);
-                        break;
-                }
-                default:
-                        /* HW reset */
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                                          MISC_REGISTERS_GPIO_OUTPUT_LOW,
-                                          port);
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                          MISC_REGISTERS_GPIO_OUTPUT_LOW,
-                                          port);
-                        DP(NETIF_MSG_LINK, "reset external PHY\n");
+        if (reset_ext_phy) {
+                for (phy_index = EXT_PHY1; phy_index < params->num_phys;
+                      phy_index++) {
+                        if (params->phy[phy_index].link_reset)
+                                params->phy[phy_index].link_reset(
+                                        &params->phy[phy_index],
+                                        params);
                 }
         }
-        /* reset the SerDes/XGXS */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR,
-               (0x1ff << (port*16)));
 
+        if (params->phy[INT_PHY].link_reset)
+                params->phy[INT_PHY].link_reset(
+                        &params->phy[INT_PHY], params);
         /* reset BigMac */
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
                (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
@@ -6269,183 +6928,25 @@ u8 bnx2x_link_reset(struct link_params *params, struct link_vars *vars,
         return 0;
 }
 
-static u8 bnx2x_update_link_down(struct link_params *params,
-                               struct link_vars *vars)
+/****************************************************************************/
+/*                              Common function                             */
+/****************************************************************************/
+static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem2_base, u8 phy_index)
 {
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-
-        DP(NETIF_MSG_LINK, "Port %x: Link is down\n", port);
-        bnx2x_set_led(params, LED_MODE_OFF, 0);
-
-        /* indicate no mac active */
-        vars->mac_type = MAC_TYPE_NONE;
-
-        /* update shared memory */
-        vars->link_status = 0;
-        vars->line_speed = 0;
-        bnx2x_update_mng(params, vars->link_status);
-
-        /* activate nig drain */
-        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
-
-        /* disable emac */
-        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
-
-        msleep(10);
-
-        /* reset BigMac */
-        bnx2x_bmac_rx_disable(bp, params->port);
-        REG_WR(bp, GRCBASE_MISC +
-                   MISC_REGISTERS_RESET_REG_2_CLEAR,
-                   (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
-        return 0;
-}
-
-static u8 bnx2x_update_link_up(struct link_params *params,
-                             struct link_vars *vars,
-                             u8 link_10g, u32 gp_status)
-{
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u8 rc = 0;
-
-        vars->link_status |= LINK_STATUS_LINK_UP;
-        if (link_10g) {
-                bnx2x_bmac_enable(params, vars, 0);
-                bnx2x_set_led(params, LED_MODE_OPER, SPEED_10000);
-        } else {
-                rc = bnx2x_emac_program(params, vars->line_speed,
-                                      vars->duplex);
-
-                bnx2x_emac_enable(params, vars, 0);
-
-                /* AN complete? */
-                if (gp_status & MDIO_AN_CL73_OR_37_COMPLETE) {
-                        if (!(vars->phy_flags &
-                              PHY_SGMII_FLAG))
-                                bnx2x_set_gmii_tx_driver(params);
-                }
-        }
-
-        /* PBF - link up */
-        rc |= bnx2x_pbf_update(params, vars->flow_ctrl,
-                              vars->line_speed);
-
-        /* disable drain */
-        REG_WR(bp, NIG_REG_EGRESS_DRAIN0_MODE + port*4, 0);
-
-        /* update shared memory */
-        bnx2x_update_mng(params, vars->link_status);
-        msleep(20);
-        return rc;
-}
-/* This function should called upon link interrupt */
-/* In case vars->link_up, driver needs to
-        1. Update the pbf
-        2. Disable drain
-        3. Update the shared memory
-        4. Indicate link up
-        5. Set LEDs
-   Otherwise,
-        1. Update shared memory
-        2. Reset BigMac
-        3. Report link down
-        4. Unset LEDs
-*/
-u8 bnx2x_link_update(struct link_params *params, struct link_vars *vars)
-{
-        struct bnx2x *bp = params->bp;
-        u8 port = params->port;
-        u16 gp_status;
-        u8 link_10g;
-        u8 ext_phy_link_up, rc = 0;
-        u32 ext_phy_type;
-        u8 is_mi_int = 0;
-
-        DP(NETIF_MSG_LINK, "port %x, XGXS?%x, int_status 0x%x\n",
-                 port, (vars->phy_flags & PHY_XGXS_FLAG),
-                 REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4));
-
-        is_mi_int = (u8)(REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT +
-                                    port*0x18) > 0);
-        DP(NETIF_MSG_LINK, "int_mask 0x%x MI_INT %x, SERDES_LINK %x\n",
-                 REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4),
-                 is_mi_int,
-                 REG_RD(bp,
-                            NIG_REG_SERDES0_STATUS_LINK_STATUS + port*0x3c));
-
-        DP(NETIF_MSG_LINK, " 10G %x, XGXS_LINK %x\n",
-          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
-          REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68));
-
-        /* disable emac */
-        REG_WR(bp, NIG_REG_NIG_EMAC0_EN + port*4, 0);
-
-        ext_phy_type = XGXS_EXT_PHY_TYPE(params->ext_phy_config);
-
-        /* Check external link change only for non-direct */
-        ext_phy_link_up = bnx2x_ext_phy_is_link_up(params, vars, is_mi_int);
-
-        /* Read gp_status */
-        CL45_RD_OVER_CL22(bp, port, params->phy_addr,
-                              MDIO_REG_BANK_GP_STATUS,
-                              MDIO_GP_STATUS_TOP_AN_STATUS1,
-                              &gp_status);
-
-        rc = bnx2x_link_settings_status(params, vars, gp_status,
-                                      ext_phy_link_up);
-        if (rc != 0)
-                return rc;
-
-        /* anything 10 and over uses the bmac */
-        link_10g = ((vars->line_speed == SPEED_10000) ||
-                    (vars->line_speed == SPEED_12000) ||
-                    (vars->line_speed == SPEED_12500) ||
-                    (vars->line_speed == SPEED_13000) ||
-                    (vars->line_speed == SPEED_15000) ||
-                    (vars->line_speed == SPEED_16000));
-
-        bnx2x_link_int_ack(params, vars, link_10g, is_mi_int);
-
-        /* In case external phy link is up, and internal link is down
-        ( not initialized yet probably after link initialization, it needs
-        to be initialized.
-        Note that after link down-up as result of cable plug,
-        the xgxs link would probably become up again without the need to
-        initialize it*/
-
-        if ((ext_phy_type != PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT) &&
-            (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) &&
-            (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706) &&
-            (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726) &&
-            (ext_phy_link_up && !vars->phy_link_up))
-                bnx2x_init_internal_phy(params, vars, 0);
-
-        /* link is up only if both local phy and external phy are up */
-        vars->link_up = (ext_phy_link_up && vars->phy_link_up);
-
-        if (vars->link_up)
-                rc = bnx2x_update_link_up(params, vars, link_10g, gp_status);
-        else
-                rc = bnx2x_update_link_down(params, vars);
-
-        return rc;
-}
-
-static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
-{
-        u8 ext_phy_addr[PORT_MAX];
+        struct bnx2x_phy phy[PORT_MAX];
+        struct bnx2x_phy *phy_blk[PORT_MAX];
         u16 val;
         s8 port;
 
         /* PART1 - Reset both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 /* Extract the ext phy address for the port */
-                u32 ext_phy_config = REG_RD(bp, shmem_base +
-                                        offsetof(struct shmem_region,
-                   dev_info.port_hw_config[port].external_phy_config));
-
+                if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
+                                       port, &phy[port]) !=
+                    0) {
+                        DP(NETIF_MSG_LINK, "populate_phy failed\n");
+                        return -EINVAL;
+                }
                 /* disable attentions */
                 bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
                              (NIG_MASK_XGXS0_LINK_STATUS |
@@ -6453,17 +6954,13 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
                               NIG_MASK_SERDES0_LINK_STATUS |
                               NIG_MASK_MI_INT));
 
-                ext_phy_addr[port] = XGXS_EXT_PHY_ADDR(ext_phy_config);
-
                 /* Need to take the phy out of low power mode in order
                         to write to access its registers */
                 bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
                                   MISC_REGISTERS_GPIO_OUTPUT_HIGH, port);
 
                 /* Reset the phy */
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                               ext_phy_addr[port],
+                bnx2x_cl45_write(bp, &phy[port],
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_CTRL,
                                1<<15);
@@ -6472,15 +6969,22 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
         /* Add delay of 150ms after reset */
         msleep(150);
 
+        if (phy[PORT_0].addr & 0x1) {
+                phy_blk[PORT_0] = &(phy[PORT_1]);
+                phy_blk[PORT_1] = &(phy[PORT_0]);
+        } else {
+                phy_blk[PORT_0] = &(phy[PORT_0]);
+                phy_blk[PORT_1] = &(phy[PORT_1]);
+        }
+
         /* PART2 - Download firmware to both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u16 fw_ver1;
 
-                bnx2x_bcm8073_external_rom_boot(bp, port,
-                                              ext_phy_addr[port], shmem_base);
+                bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
+                                                  port);
 
-                bnx2x_cl45_read(bp, port, PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr[port],
+                bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_ROM_VER1, &fw_ver1);
                 if (fw_ver1 == 0 || fw_ver1 == 0x4321) {
@@ -6492,16 +6996,12 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
                 }
 
                 /* Only set bit 10 = 1 (Tx power down) */
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr[port],
+                bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_TX_POWER_DOWN, &val);
 
                 /* Phase1 of TX_POWER_DOWN reset */
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                               ext_phy_addr[port],
+                bnx2x_cl45_write(bp, phy_blk[port],
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_TX_POWER_DOWN,
                                (val | 1<<10));
@@ -6515,28 +7015,20 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 /* Phase2 of POWER_DOWN_RESET */
                 /* Release bit 10 (Release Tx power down) */
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr[port],
+                bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_TX_POWER_DOWN, &val);
 
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                               ext_phy_addr[port],
+                bnx2x_cl45_write(bp, phy_blk[port],
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_TX_POWER_DOWN, (val & (~(1<<10))));
                 msleep(15);
 
                 /* Read modify write the SPI-ROM version select register */
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr[port],
+                bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_EDC_FFE_MAIN, &val);
-                bnx2x_cl45_write(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073,
-                              ext_phy_addr[port],
+                bnx2x_cl45_write(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_EDC_FFE_MAIN, (val | (1<<12)));
 
@@ -6545,33 +7037,74 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp, u32 shmem_base)
                                   MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
         }
         return 0;
-
 }
 
-static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base)
+static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp, u32 shmem_base,
+                                     u32 shmem2_base, u8 phy_index)
+{
+        u32 val;
+        s8 port;
+        struct bnx2x_phy phy;
+        /* Use port1 because of the static port-swap */
+        /* Enable the module detection interrupt */
+        val = REG_RD(bp, MISC_REG_GPIO_EVENT_EN);
+        val |= ((1<<MISC_REGISTERS_GPIO_3)|
+                (1<<(MISC_REGISTERS_GPIO_3 + MISC_REGISTERS_GPIO_PORT_SHIFT)));
+        REG_WR(bp, MISC_REG_GPIO_EVENT_EN, val);
+
+        bnx2x_ext_phy_hw_reset(bp, 1);
+        msleep(5);
+        for (port = 0; port < PORT_MAX; port++) {
+                /* Extract the ext phy address for the port */
+                if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
+                                       port, &phy) !=
+                    0) {
+                        DP(NETIF_MSG_LINK, "populate phy failed\n");
+                        return -EINVAL;
+                }
+
+                /* Reset phy*/
+                bnx2x_cl45_write(bp, &phy,
+                                 MDIO_PMA_DEVAD, MDIO_PMA_REG_GEN_CTRL, 0x0001);
+
+
+                /* Set fault module detected LED on */
+                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_0,
+                                  MISC_REGISTERS_GPIO_HIGH,
+                                  port);
+        }
+
+        return 0;
+}
+static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base,
+                                     u32 shmem2_base, u8 phy_index)
 {
-        u8 ext_phy_addr[PORT_MAX];
-        s8 port, first_port, i;
+        s8 port;
         u32 swap_val, swap_override;
+        struct bnx2x_phy phy[PORT_MAX];
+        struct bnx2x_phy *phy_blk[PORT_MAX];
         DP(NETIF_MSG_LINK, "Executing BCM8727 common init\n");
         swap_val = REG_RD(bp,  NIG_REG_PORT_SWAP);
         swap_override = REG_RD(bp,  NIG_REG_STRAP_OVERRIDE);
 
-        bnx2x_ext_phy_hw_reset(bp, 1 ^ (swap_val && swap_override));
-        msleep(5);
+        port = 1;
 
-        if (swap_val && swap_override)
-                first_port = PORT_0;
-        else
-                first_port = PORT_1;
+        bnx2x_ext_phy_hw_reset(bp, port ^ (swap_val && swap_override));
+
+        /* Calculate the port based on port swap */
+        port ^= (swap_val && swap_override);
+
+        msleep(5);
 
         /* PART1 - Reset both phys */
-        for (i = 0, port = first_port; i < PORT_MAX; i++, port = !port) {
+        for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 /* Extract the ext phy address for the port */
-                u32 ext_phy_config = REG_RD(bp, shmem_base +
-                                        offsetof(struct shmem_region,
-                   dev_info.port_hw_config[port].external_phy_config));
-
+                if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
+                                       port, &phy[port]) !=
+                                       0) {
+                        DP(NETIF_MSG_LINK, "populate phy failed\n");
+                        return -EINVAL;
+                }
                 /* disable attentions */
                 bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
                              (NIG_MASK_XGXS0_LINK_STATUS |
@@ -6579,12 +7112,9 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base)
                               NIG_MASK_SERDES0_LINK_STATUS |
                               NIG_MASK_MI_INT));
 
-                ext_phy_addr[port] = XGXS_EXT_PHY_ADDR(ext_phy_config);
 
                 /* Reset the phy */
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                               ext_phy_addr[port],
+                bnx2x_cl45_write(bp, &phy[port],
                                MDIO_PMA_DEVAD,
                                MDIO_PMA_REG_CTRL,
                                1<<15);
@@ -6592,16 +7122,20 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base)
 
         /* Add delay of 150ms after reset */
         msleep(150);
-
+        if (phy[PORT_0].addr & 0x1) {
+                phy_blk[PORT_0] = &(phy[PORT_1]);
+                phy_blk[PORT_1] = &(phy[PORT_0]);
+        } else {
+                phy_blk[PORT_0] = &(phy[PORT_0]);
+                phy_blk[PORT_1] = &(phy[PORT_1]);
+        }
         /* PART2 - Download firmware to both phys */
-        for (i = 0, port = first_port; i < PORT_MAX; i++, port = !port) {
+        for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u16 fw_ver1;
 
-                bnx2x_bcm8727_external_rom_boot(bp, port,
-                                              ext_phy_addr[port], shmem_base);
-
-                bnx2x_cl45_read(bp, port, PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
-                              ext_phy_addr[port],
+                bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
+                                                  port);
+                bnx2x_cl45_read(bp, phy_blk[port],
                               MDIO_PMA_DEVAD,
                               MDIO_PMA_REG_ROM_VER1, &fw_ver1);
                 if (fw_ver1 == 0 || fw_ver1 == 0x4321) {
@@ -6616,82 +7150,32 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp, u32 shmem_base)
         return 0;
 }
 
-
-static u8 bnx2x_8726_common_init_phy(struct bnx2x *bp, u32 shmem_base)
-{
-        u8 ext_phy_addr;
-        u32 val;
-        s8 port;
-
-        /* Use port1 because of the static port-swap */
-        /* Enable the module detection interrupt */
-        val = REG_RD(bp, MISC_REG_GPIO_EVENT_EN);
-        val |= ((1<<MISC_REGISTERS_GPIO_3)|
-                (1<<(MISC_REGISTERS_GPIO_3 + MISC_REGISTERS_GPIO_PORT_SHIFT)));
-        REG_WR(bp, MISC_REG_GPIO_EVENT_EN, val);
-
-        bnx2x_ext_phy_hw_reset(bp, 1);
-        msleep(5);
-        for (port = 0; port < PORT_MAX; port++) {
-                /* Extract the ext phy address for the port */
-                u32 ext_phy_config = REG_RD(bp, shmem_base +
-                                        offsetof(struct shmem_region,
-                        dev_info.port_hw_config[port].external_phy_config));
-
-                ext_phy_addr = XGXS_EXT_PHY_ADDR(ext_phy_config);
-                DP(NETIF_MSG_LINK, "8726_common_init : ext_phy_addr = 0x%x\n",
-                         ext_phy_addr);
-
-                bnx2x_8726_reset_phy(bp, port, ext_phy_addr);
-
-                /* Set fault module detected LED on */
-                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_0,
-                                  MISC_REGISTERS_GPIO_HIGH,
-                                  port);
-        }
-
-        return 0;
-}
-
-
-static u8 bnx2x_84823_common_init_phy(struct bnx2x *bp, u32 shmem_base)
-{
-        /* HW reset */
-        bnx2x_ext_phy_hw_reset(bp, 1);
-        return 0;
-}
-u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base)
+static u8 bnx2x_ext_phy_common_init(struct bnx2x *bp, u32 shmem_base,
+                                    u32 shmem2_base, u8 phy_index,
+                                    u32 ext_phy_type)
 {
         u8 rc = 0;
-        u32 ext_phy_type;
-
-        DP(NETIF_MSG_LINK, "Begin common phy init\n");
-
-        /* Read the ext_phy_type for arbitrary port(0) */
-        ext_phy_type = XGXS_EXT_PHY_TYPE(
-                        REG_RD(bp, shmem_base +
-                           offsetof(struct shmem_region,
-                             dev_info.port_hw_config[0].external_phy_config)));
 
         switch (ext_phy_type) {
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-        {
-                rc = bnx2x_8073_common_init_phy(bp, shmem_base);
+                rc = bnx2x_8073_common_init_phy(bp, shmem_base,
+                                                shmem2_base, phy_index);
                 break;
-        }
 
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727_NOC:
-                rc = bnx2x_8727_common_init_phy(bp, shmem_base);
+                rc = bnx2x_8727_common_init_phy(bp, shmem_base,
+                                                shmem2_base, phy_index);
                 break;
 
         case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
                 /* GPIO1 affects both ports, so there's need to pull
                 it for single port alone */
-                rc = bnx2x_8726_common_init_phy(bp, shmem_base);
+                rc = bnx2x_8726_common_init_phy(bp, shmem_base,
+                                                shmem2_base, phy_index);
                 break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84823:
-                rc = bnx2x_84823_common_init_phy(bp, shmem_base);
+        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
+                rc = -EINVAL;
                 break;
         default:
                 DP(NETIF_MSG_LINK,
@@ -6703,33 +7187,80 @@ u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base)
         return rc;
 }
 
-void bnx2x_sfx7101_sp_sw_reset(struct bnx2x *bp, u8 port, u8 phy_addr)
+u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base,
+                         u32 shmem2_base)
 {
-        u16 val, cnt;
+        u8 rc = 0;
+        u8 phy_index;
+        u32 ext_phy_type, ext_phy_config;
+        DP(NETIF_MSG_LINK, "Begin common phy init\n");
 
-        bnx2x_cl45_read(bp, port,
-                      PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101,
-                      phy_addr,
-                      MDIO_PMA_DEVAD,
-                      MDIO_PMA_REG_7101_RESET, &val);
+        if (CHIP_REV_IS_EMUL(bp))
+                return 0;
 
-        for (cnt = 0; cnt < 10; cnt++) {
-                msleep(50);
-                /* Writes a self-clearing reset */
-                bnx2x_cl45_write(bp, port,
-                               PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101,
-                               phy_addr,
-                               MDIO_PMA_DEVAD,
-                               MDIO_PMA_REG_7101_RESET,
-                               (val | (1<<15)));
-                /* Wait for clear */
-                bnx2x_cl45_read(bp, port,
-                              PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101,
-                              phy_addr,
-                              MDIO_PMA_DEVAD,
-                              MDIO_PMA_REG_7101_RESET, &val);
+        /* Read the ext_phy_type for arbitrary port(0) */
+        for (phy_index = EXT_PHY1; phy_index < MAX_PHYS;
+              phy_index++) {
+                ext_phy_config = bnx2x_get_ext_phy_config(bp,
+                                                          shmem_base,
+                                                          phy_index, 0);
+                ext_phy_type = XGXS_EXT_PHY_TYPE(ext_phy_config);
+                rc |= bnx2x_ext_phy_common_init(bp, shmem_base,
+                                                shmem2_base,
+                                                phy_index, ext_phy_type);
+        }
+        return rc;
+}
 
-                if ((val & (1<<15)) == 0)
-                        break;
+u8 bnx2x_hw_lock_required(struct bnx2x *bp, u32 shmem_base, u32 shmem2_base)
+{
+        u8 phy_index;
+        struct bnx2x_phy phy;
+        for (phy_index = INT_PHY; phy_index < MAX_PHYS;
+              phy_index++) {
+                if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
+                                       0, &phy) != 0) {
+                        DP(NETIF_MSG_LINK, "populate phy failed\n");
+                        return 0;
+                }
+
+                if (phy.flags & FLAGS_HW_LOCK_REQUIRED)
+                        return 1;
+        }
+        return 0;
+}
+
+u8 bnx2x_fan_failure_det_req(struct bnx2x *bp,
+                             u32 shmem_base,
+                             u32 shmem2_base,
+                             u8 port)
+{
+        u8 phy_index, fan_failure_det_req = 0;
+        struct bnx2x_phy phy;
+        for (phy_index = EXT_PHY1; phy_index < MAX_PHYS;
+              phy_index++) {
+                if (bnx2x_populate_phy(bp, phy_index, shmem_base, shmem2_base,
+                                       port, &phy)
+                    != 0) {
+                        DP(NETIF_MSG_LINK, "populate phy failed\n");
+                        return 0;
+                }
+                fan_failure_det_req |= (phy.flags &
+                                        FLAGS_FAN_FAILURE_DET_REQ);
+        }
+        return fan_failure_det_req;
+}
+
+void bnx2x_hw_reset_phy(struct link_params *params)
+{
+        u8 phy_index;
+        for (phy_index = EXT_PHY1; phy_index < MAX_PHYS;
+              phy_index++) {
+                if (params->phy[phy_index].hw_reset) {
+                        params->phy[phy_index].hw_reset(
+                                &params->phy[phy_index],
+                                params);
+                        params->phy[phy_index] = phy_null;
+                }
         }
 }
diff --git a/drivers/net/bnx2x/bnx2x_link.h b/drivers/net/bnx2x/bnx2x_link.h
index 40c2981de8ed..e98ea3d19471 100644
--- a/drivers/net/bnx2x/bnx2x_link.h
+++ b/drivers/net/bnx2x/bnx2x_link.h
@@ -1,4 +1,4 @@
-/* Copyright 2008-2009 Broadcom Corporation
+/* Copyright 2008-2010 Broadcom Corporation
  *
  * Unless you and Broadcom execute a separate written software license
  * agreement governing use of this software, this software is licensed to you
@@ -46,9 +46,137 @@
 #define SFP_EEPROM_PART_NO_ADDR                 0x28
 #define SFP_EEPROM_PART_NO_SIZE         16
 #define PWR_FLT_ERR_MSG_LEN                     250
+
+#define XGXS_EXT_PHY_TYPE(ext_phy_config) \
+                ((ext_phy_config) & PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK)
+#define XGXS_EXT_PHY_ADDR(ext_phy_config) \
+                (((ext_phy_config) & PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >> \
+                 PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT)
+#define SERDES_EXT_PHY_TYPE(ext_phy_config) \
+                ((ext_phy_config) & PORT_HW_CFG_SERDES_EXT_PHY_TYPE_MASK)
+
+/* Single Media Direct board is the plain 577xx board with CX4/RJ45 jacks */
+#define SINGLE_MEDIA_DIRECT(params)     (params->num_phys == 1)
+/* Single Media board contains single external phy */
+#define SINGLE_MEDIA(params)            (params->num_phys == 2)
+/* Dual Media board contains two external phy with different media */
+#define DUAL_MEDIA(params)              (params->num_phys == 3)
+#define FW_PARAM_MDIO_CTRL_OFFSET 16
+#define FW_PARAM_SET(phy_addr, phy_type, mdio_access) \
+        (phy_addr | phy_type | mdio_access << FW_PARAM_MDIO_CTRL_OFFSET)
 /***********************************************************/
 /*                         Structs                         */
 /***********************************************************/
+#define INT_PHY         0
+#define EXT_PHY1        1
+#define EXT_PHY2        2
+#define MAX_PHYS        3
+
+/* Same configuration is shared between the XGXS and the first external phy */
+#define LINK_CONFIG_SIZE (MAX_PHYS - 1)
+#define LINK_CONFIG_IDX(_phy_idx) ((_phy_idx == INT_PHY) ? \
+                                         0 : (_phy_idx - 1))
+/***********************************************************/
+/*                      bnx2x_phy struct                     */
+/*  Defines the required arguments and function per phy    */
+/***********************************************************/
+struct link_vars;
+struct link_params;
+struct bnx2x_phy;
+
+typedef u8 (*config_init_t)(struct bnx2x_phy *phy, struct link_params *params,
+                            struct link_vars *vars);
+typedef u8 (*read_status_t)(struct bnx2x_phy *phy, struct link_params *params,
+                            struct link_vars *vars);
+typedef void (*link_reset_t)(struct bnx2x_phy *phy,
+                             struct link_params *params);
+typedef void (*config_loopback_t)(struct bnx2x_phy *phy,
+                                  struct link_params *params);
+typedef u8 (*format_fw_ver_t)(u32 raw, u8 *str, u16 *len);
+typedef void (*hw_reset_t)(struct bnx2x_phy *phy, struct link_params *params);
+typedef void (*set_link_led_t)(struct bnx2x_phy *phy,
+                               struct link_params *params, u8 mode);
+typedef void (*phy_specific_func_t)(struct bnx2x_phy *phy,
+                                    struct link_params *params, u32 action);
+
+struct bnx2x_phy {
+        u32 type;
+
+        /* Loaded during init */
+        u8 addr;
+
+        u8 flags;
+        /* Require HW lock */
+#define FLAGS_HW_LOCK_REQUIRED          (1<<0)
+        /* No Over-Current detection */
+#define FLAGS_NOC                       (1<<1)
+        /* Fan failure detection required */
+#define FLAGS_FAN_FAILURE_DET_REQ       (1<<2)
+        /* Initialize first the XGXS and only then the phy itself */
+#define FLAGS_INIT_XGXS_FIRST           (1<<3)
+#define FLAGS_REARM_LATCH_SIGNAL        (1<<6)
+#define FLAGS_SFP_NOT_APPROVED          (1<<7)
+
+        u8 def_md_devad;
+        u8 reserved;
+        /* preemphasis values for the rx side */
+        u16 rx_preemphasis[4];
+
+        /* preemphasis values for the tx side */
+        u16 tx_preemphasis[4];
+
+        /* EMAC address for access MDIO */
+        u32 mdio_ctrl;
+
+        u32 supported;
+
+        u32 media_type;
+#define ETH_PHY_UNSPECIFIED 0x0
+#define ETH_PHY_SFP_FIBER   0x1
+#define ETH_PHY_XFP_FIBER   0x2
+#define ETH_PHY_DA_TWINAX   0x3
+#define ETH_PHY_BASE_T      0x4
+#define ETH_PHY_NOT_PRESENT 0xff
+
+        /* The address in which version is located*/
+        u32 ver_addr;
+
+        u16 req_flow_ctrl;
+
+        u16 req_line_speed;
+
+        u32 speed_cap_mask;
+
+        u16 req_duplex;
+        u16 rsrv;
+        /* Called per phy/port init, and it configures LASI, speed, autoneg,
+         duplex, flow control negotiation, etc. */
+        config_init_t config_init;
+
+        /* Called due to interrupt. It determines the link, speed */
+        read_status_t read_status;
+
+        /* Called when driver is unloading. Should reset the phy */
+        link_reset_t link_reset;
+
+        /* Set the loopback configuration for the phy */
+        config_loopback_t config_loopback;
+
+        /* Format the given raw number into str up to len */
+        format_fw_ver_t format_fw_ver;
+
+        /* Reset the phy (both ports) */
+        hw_reset_t hw_reset;
+
+        /* Set link led mode (on/off/oper)*/
+        set_link_led_t set_link_led;
+
+        /* PHY Specific tasks */
+        phy_specific_func_t phy_specific_func;
+#define DISABLE_TX      1
+#define ENABLE_TX       2
+};
+
 /* Inputs parameters to the CLC */
 struct link_params {
 
@@ -59,56 +187,50 @@ struct link_params {
 #define LOOPBACK_NONE   0
 #define LOOPBACK_EMAC   1
 #define LOOPBACK_BMAC   2
-#define LOOPBACK_XGXS_10        3
+#define LOOPBACK_XGXS           3
 #define LOOPBACK_EXT_PHY        4
 #define LOOPBACK_EXT    5
 
-        u16 req_duplex;
-        u16 req_flow_ctrl;
-        u16 req_fc_auto_adv; /* Should be set to TX / BOTH when
-        req_flow_ctrl is set to AUTO */
-        u16 req_line_speed; /* Also determine AutoNeg */
-
         /* Device parameters */
         u8 mac_addr[6];
 
+        u16 req_duplex[LINK_CONFIG_SIZE];
+        u16 req_flow_ctrl[LINK_CONFIG_SIZE];
+
+        u16 req_line_speed[LINK_CONFIG_SIZE]; /* Also determine AutoNeg */
+
         /* shmem parameters */
         u32 shmem_base;
-        u32 speed_cap_mask;
+        u32 shmem2_base;
+        u32 speed_cap_mask[LINK_CONFIG_SIZE];
         u32 switch_cfg;
 #define SWITCH_CFG_1G           PORT_FEATURE_CON_SWITCH_1G_SWITCH
 #define SWITCH_CFG_10G          PORT_FEATURE_CON_SWITCH_10G_SWITCH
 #define SWITCH_CFG_AUTO_DETECT  PORT_FEATURE_CON_SWITCH_AUTO_DETECT
 
-        u16 hw_led_mode; /* part of the hw_config read from the shmem */
-
-        /* phy_addr populated by the phy_init function */
-        u8 phy_addr;
-        /*u8 reserved1;*/
-
         u32 lane_config;
-        u32 ext_phy_config;
-#define XGXS_EXT_PHY_TYPE(ext_phy_config) \
-                ((ext_phy_config) & PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK)
-#define XGXS_EXT_PHY_ADDR(ext_phy_config) \
-                (((ext_phy_config) & PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >> \
-                 PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT)
-#define SERDES_EXT_PHY_TYPE(ext_phy_config) \
-                ((ext_phy_config) & PORT_HW_CFG_SERDES_EXT_PHY_TYPE_MASK)
 
         /* Phy register parameter */
         u32 chip_id;
 
-        u16 xgxs_config_rx[4]; /* preemphasis values for the rx side */
-        u16 xgxs_config_tx[4]; /* preemphasis values for the tx side */
-
         u32 feature_config_flags;
 #define FEATURE_CONFIG_OVERRIDE_PREEMPHASIS_ENABLED (1<<0)
 #define FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY (1<<2)
-#define FEATURE_CONFIG_BCM8727_NOC                      (1<<3)
+#define FEATURE_CONFIG_BC_SUPPORTS_DUAL_PHY_OPT_MDL_VRFY        (1<<3)
+        /* Will be populated during common init */
+        struct bnx2x_phy phy[MAX_PHYS];
+
+        /* Will be populated during common init */
+        u8 num_phys;
+
+        u8 rsrv;
+        u16 hw_led_mode; /* part of the hw_config read from the shmem */
+        u32 multi_phy_config;
 
         /* Device pointer passed to all callback functions */
         struct bnx2x *bp;
+        u16 req_fc_auto_adv; /* Should be set to TX / BOTH when
+                                req_flow_ctrl is set to AUTO */
 };
 
 /* Output parameters */
@@ -129,12 +251,6 @@ struct link_vars {
         u16 flow_ctrl;
         u16 ieee_fc;
 
-        u32 autoneg;
-#define AUTO_NEG_DISABLED                       0x0
-#define AUTO_NEG_ENABLED                        0x1
-#define AUTO_NEG_COMPLETE                       0x2
-#define AUTO_NEG_PARALLEL_DETECTION_USED        0x3
-
         /* The same definitions as the shmem parameter */
         u32 link_status;
 };
@@ -142,8 +258,6 @@ struct link_vars {
 /***********************************************************/
 /*                         Functions                       */
 /***********************************************************/
-
-/* Initialize the phy */
 u8 bnx2x_phy_init(struct link_params *input, struct link_vars *output);
 
 /* Reset the link. Should be called when driver or interface goes down
@@ -155,17 +269,21 @@ u8 bnx2x_link_reset(struct link_params *params, struct link_vars *vars,
 /* bnx2x_link_update should be called upon link interrupt */
 u8 bnx2x_link_update(struct link_params *input, struct link_vars *output);
 
-/* use the following cl45 functions to read/write from external_phy
+/* use the following phy functions to read/write from external_phy
   In order to use it to read/write internal phy registers, use
   DEFAULT_PHY_DEV_ADDR as devad, and (_bank + (_addr & 0xf)) as
-  Use ext_phy_type of 0 in case of cl22 over cl45
   the register */
-u8 bnx2x_cl45_read(struct bnx2x *bp, u8 port, u32 ext_phy_type,
-                 u8 phy_addr, u8 devad, u16 reg, u16 *ret_val);
+u8 bnx2x_phy_read(struct link_params *params, u8 phy_addr,
+                  u8 devad, u16 reg, u16 *ret_val);
+
+u8 bnx2x_phy_write(struct link_params *params, u8 phy_addr,
+                   u8 devad, u16 reg, u16 val);
 
-u8 bnx2x_cl45_write(struct bnx2x *bp, u8 port, u32 ext_phy_type,
-                  u8 phy_addr, u8 devad, u16 reg, u16 val);
+u8 bnx2x_cl45_read(struct bnx2x *bp, struct bnx2x_phy *phy,
+                   u8 devad, u16 reg, u16 *ret_val);
 
+u8 bnx2x_cl45_write(struct bnx2x *bp, struct bnx2x_phy *phy,
+                    u8 devad, u16 reg, u16 val);
 /* Reads the link_status from the shmem,
    and update the link vars accordingly */
 void bnx2x_link_status_update(struct link_params *input,
@@ -178,9 +296,12 @@ u8 bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 driver_loaded,
    Basically, the CLC takes care of the led for the link, but in case one needs
    to set/unset the led unnaturally, set the "mode" to LED_MODE_OPER to
    blink the led, and LED_MODE_OFF to set the led off.*/
-u8 bnx2x_set_led(struct link_params *params, u8 mode, u32 speed);
-#define LED_MODE_OFF    0
-#define LED_MODE_OPER   2
+u8 bnx2x_set_led(struct link_params *params, struct link_vars *vars,
+                 u8 mode, u32 speed);
+#define LED_MODE_OFF                    0
+#define LED_MODE_ON                     1
+#define LED_MODE_OPER                   2
+#define LED_MODE_FRONT_PANEL_OFF        3
 
 u8 bnx2x_override_led_value(struct bnx2x *bp, u8 port, u32 led_idx, u32 value);
 
@@ -190,17 +311,38 @@ void bnx2x_handle_module_detect_int(struct link_params *params);
 
 /* Get the actual link status. In case it returns 0, link is up,
         otherwise link is down*/
-u8 bnx2x_test_link(struct link_params *input, struct link_vars *vars);
+u8 bnx2x_test_link(struct link_params *input, struct link_vars *vars,
+                   u8 is_serdes);
 
 /* One-time initialization for external phy after power up */
-u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base);
+u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base, u32 shmem2_base);
 
 /* Reset the external PHY using GPIO */
 void bnx2x_ext_phy_hw_reset(struct bnx2x *bp, u8 port);
 
-void bnx2x_sfx7101_sp_sw_reset(struct bnx2x *bp, u8 port, u8 phy_addr);
+/* Reset the external of SFX7101 */
+void bnx2x_sfx7101_sp_sw_reset(struct bnx2x *bp, struct bnx2x_phy *phy);
 
-u8 bnx2x_read_sfp_module_eeprom(struct link_params *params, u16 addr,
+u8 bnx2x_read_sfp_module_eeprom(struct bnx2x_phy *phy,
+                                struct link_params *params, u16 addr,
                               u8 byte_cnt, u8 *o_buf);
 
+void bnx2x_hw_reset_phy(struct link_params *params);
+
+/* Checks if HW lock is required for this phy/board type */
+u8 bnx2x_hw_lock_required(struct bnx2x *bp, u32 shmem_base,
+                          u32 shmem2_base);
+
+/* Returns the aggregative supported attributes of the phys on board */
+u32 bnx2x_supported_attr(struct link_params *params, u8 phy_idx);
+
+/* Check swap bit and adjust PHY order */
+u32 bnx2x_phy_selection(struct link_params *params);
+
+/* Probe the phys on board, and populate them in "params" */
+u8 bnx2x_phy_probe(struct link_params *params);
+/* Checks if fan failure detection is required on one of the phys on board */
+u8 bnx2x_fan_failure_det_req(struct bnx2x *bp, u32 shmem_base,
+                             u32 shmem2_base, u8 port);
+
 #endif /* BNX2X_LINK_H */
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index f8c3f08e4ce7..67587fe9e358 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -781,7 +781,7 @@ static bool bnx2x_trylock_hw_lock(struct bnx2x *bp, u32 resource)
                 DP(NETIF_MSG_HW,
                    "resource(0x%x) > HW_LOCK_MAX_RESOURCE_VALUE(0x%x)\n",
                    resource, HW_LOCK_MAX_RESOURCE_VALUE);
-                return -EINVAL;
+                return false;
         }
 
         if (func <= 5)
@@ -1227,26 +1227,66 @@ static int bnx2x_set_spio(struct bnx2x *bp, int spio_num, u32 mode)
         return 0;
 }
 
+int bnx2x_get_link_cfg_idx(struct bnx2x *bp)
+{
+        u32 sel_phy_idx = 0;
+        if (bp->link_vars.link_up) {
+                sel_phy_idx = EXT_PHY1;
+                /* In case link is SERDES, check if the EXT_PHY2 is the one */
+                if ((bp->link_vars.link_status & LINK_STATUS_SERDES_LINK) &&
+                    (bp->link_params.phy[EXT_PHY2].supported & SUPPORTED_FIBRE))
+                        sel_phy_idx = EXT_PHY2;
+        } else {
+
+                switch (bnx2x_phy_selection(&bp->link_params)) {
+                case PORT_HW_CFG_PHY_SELECTION_HARDWARE_DEFAULT:
+                case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY:
+                case PORT_HW_CFG_PHY_SELECTION_FIRST_PHY_PRIORITY:
+                       sel_phy_idx = EXT_PHY1;
+                       break;
+                case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY:
+                case PORT_HW_CFG_PHY_SELECTION_SECOND_PHY_PRIORITY:
+                       sel_phy_idx = EXT_PHY2;
+                       break;
+                }
+        }
+        /*
+        * The selected actived PHY is always after swapping (in case PHY
+        * swapping is enabled). So when swapping is enabled, we need to reverse
+        * the configuration
+        */
+
+        if (bp->link_params.multi_phy_config &
+            PORT_HW_CFG_PHY_SWAPPED_ENABLED) {
+                if (sel_phy_idx == EXT_PHY1)
+                        sel_phy_idx = EXT_PHY2;
+                else if (sel_phy_idx == EXT_PHY2)
+                        sel_phy_idx = EXT_PHY1;
+        }
+        return LINK_CONFIG_IDX(sel_phy_idx);
+}
+
 void bnx2x_calc_fc_adv(struct bnx2x *bp)
 {
+        u8 cfg_idx = bnx2x_get_link_cfg_idx(bp);
         switch (bp->link_vars.ieee_fc &
                 MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_MASK) {
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE:
-                bp->port.advertising &= ~(ADVERTISED_Asym_Pause |
+                bp->port.advertising[cfg_idx] &= ~(ADVERTISED_Asym_Pause |
                                           ADVERTISED_Pause);
                 break;
 
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH:
-                bp->port.advertising |= (ADVERTISED_Asym_Pause |
+                bp->port.advertising[cfg_idx] |= (ADVERTISED_Asym_Pause |
                                          ADVERTISED_Pause);
                 break;
 
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC:
-                bp->port.advertising |= ADVERTISED_Asym_Pause;
+                bp->port.advertising[cfg_idx] |= ADVERTISED_Asym_Pause;
                 break;
 
         default:
-                bp->port.advertising &= ~(ADVERTISED_Asym_Pause |
+                bp->port.advertising[cfg_idx] &= ~(ADVERTISED_Asym_Pause |
                                           ADVERTISED_Pause);
                 break;
         }
@@ -1257,7 +1297,8 @@ u8 bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 {
         if (!BP_NOMCP(bp)) {
                 u8 rc;
-
+                int cfx_idx = bnx2x_get_link_cfg_idx(bp);
+                u16 req_line_speed = bp->link_params.req_line_speed[cfx_idx];
                 /* Initialize link parameters structure variables */
                 /* It is recommended to turn off RX FC for jumbo frames
                    for better performance */
@@ -1268,8 +1309,10 @@ u8 bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 
                 bnx2x_acquire_phy_lock(bp);
 
-                if (load_mode == LOAD_DIAG)
-                        bp->link_params.loopback_mode = LOOPBACK_XGXS_10;
+                if (load_mode == LOAD_DIAG) {
+                        bp->link_params.loopback_mode = LOOPBACK_XGXS;
+                        bp->link_params.req_line_speed[cfx_idx] = SPEED_10000;
+                }
 
                 rc = bnx2x_phy_init(&bp->link_params, &bp->link_vars);
 
@@ -1281,7 +1324,7 @@ u8 bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
                         bnx2x_stats_handle(bp, STATS_EVENT_LINK_UP);
                         bnx2x_link_report(bp);
                 }
-
+                bp->link_params.req_line_speed[cfx_idx] = req_line_speed;
                 return rc;
         }
         BNX2X_ERR("Bootcode is missing - can not initialize link\n");
@@ -1292,6 +1335,7 @@ void bnx2x_link_set(struct bnx2x *bp)
 {
         if (!BP_NOMCP(bp)) {
                 bnx2x_acquire_phy_lock(bp);
+                bnx2x_link_reset(&bp->link_params, &bp->link_vars, 1);
                 bnx2x_phy_init(&bp->link_params, &bp->link_vars);
                 bnx2x_release_phy_lock(bp);
 
@@ -1310,13 +1354,14 @@ static void bnx2x__link_reset(struct bnx2x *bp)
                 BNX2X_ERR("Bootcode is missing - can not reset link\n");
 }
 
-u8 bnx2x_link_test(struct bnx2x *bp)
+u8 bnx2x_link_test(struct bnx2x *bp, u8 is_serdes)
 {
         u8 rc = 0;
 
         if (!BP_NOMCP(bp)) {
                 bnx2x_acquire_phy_lock(bp);
-                rc = bnx2x_test_link(&bp->link_params, &bp->link_vars);
+                rc = bnx2x_test_link(&bp->link_params, &bp->link_vars,
+                                     is_serdes);
                 bnx2x_release_phy_lock(bp);
         } else
                 BNX2X_ERR("Bootcode is missing - can not test link\n");
@@ -1585,7 +1630,7 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
  */
 
 /* send the MCP a request, block until there is a reply */
-u32 bnx2x_fw_command(struct bnx2x *bp, u32 command)
+u32 bnx2x_fw_command(struct bnx2x *bp, u32 command, u32 param)
 {
         int func = BP_FUNC(bp);
         u32 seq = ++bp->fw_seq;
@@ -1594,6 +1639,7 @@ u32 bnx2x_fw_command(struct bnx2x *bp, u32 command)
         u8 delay = CHIP_REV_IS_SLOW(bp) ? 100 : 10;
 
         mutex_lock(&bp->fw_mb_mutex);
+        SHMEM_WR(bp, func_mb[func].drv_mb_param, param);
         SHMEM_WR(bp, func_mb[func].drv_mb_header, (command | seq));
         DP(BNX2X_MSG_MCP, "wrote command (%x) to FW MB\n", (command | seq));
 
@@ -1715,9 +1761,9 @@ static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
 
         /* Report results to MCP */
         if (dcc_event)
-                bnx2x_fw_command(bp, DRV_MSG_CODE_DCC_FAILURE);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_DCC_FAILURE, 0);
         else
-                bnx2x_fw_command(bp, DRV_MSG_CODE_DCC_OK);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_DCC_OK, 0);
 }
 
 /* must be called under the spq lock */
@@ -1959,12 +2005,16 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
 static inline void bnx2x_fan_failure(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
-
+        u32 ext_phy_config;
         /* mark the failure */
-        bp->link_params.ext_phy_config &= ~PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK;
-        bp->link_params.ext_phy_config |= PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE;
+        ext_phy_config =
+                SHMEM_RD(bp,
+                         dev_info.port_hw_config[port].external_phy_config);
+
+        ext_phy_config &= ~PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK;
+        ext_phy_config |= PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE;
         SHMEM_WR(bp, dev_info.port_hw_config[port].external_phy_config,
-                 bp->link_params.ext_phy_config);
+                 ext_phy_config);
 
         /* log the failure */
         netdev_err(bp->dev, "Fan Failure on Network Controller has caused"
@@ -1976,7 +2026,7 @@ static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
 {
         int port = BP_PORT(bp);
         int reg_offset;
-        u32 val, swap_val, swap_override;
+        u32 val;
 
         reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                              MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
@@ -1990,30 +2040,7 @@ static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
                 BNX2X_ERR("SPIO5 hw attention\n");
 
                 /* Fan failure attention */
-                switch (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config)) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                        /* Low power mode is controlled by GPIO 2 */
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
-                                       MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
-                        /* The PHY reset is controlled by GPIO 1 */
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                                       MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                        /* The PHY reset is controlled by GPIO 1 */
-                        /* fake the port number to cancel the swap done in
-                           set_gpio() */
-                        swap_val = REG_RD(bp, NIG_REG_PORT_SWAP);
-                        swap_override = REG_RD(bp, NIG_REG_STRAP_OVERRIDE);
-                        port = (swap_val && swap_override) ^ 1;
-                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
-                                       MISC_REGISTERS_GPIO_OUTPUT_LOW, port);
-                        break;
-
-                default:
-                        break;
-                }
+                bnx2x_hw_reset_phy(&bp->link_params);
                 bnx2x_fan_failure(bp);
         }
 
@@ -3803,10 +3830,9 @@ static const struct {
 
 static void enable_blocks_parity(struct bnx2x *bp)
 {
-        int i, mask_arr_len =
-                sizeof(bnx2x_parity_mask)/(sizeof(bnx2x_parity_mask[0]));
+        int i;
 
-        for (i = 0; i < mask_arr_len; i++)
+        for (i = 0; i < ARRAY_SIZE(bnx2x_parity_mask); i++)
                 REG_WR(bp, bnx2x_parity_mask[i].addr,
                         bnx2x_parity_mask[i].mask);
 }
@@ -3862,17 +3888,12 @@ static void bnx2x_setup_fan_failure_detection(struct bnx2x *bp)
          */
         else if (val == SHARED_HW_CFG_FAN_FAILURE_PHY_TYPE)
                 for (port = PORT_0; port < PORT_MAX; port++) {
-                        u32 phy_type =
-                                SHMEM_RD(bp, dev_info.port_hw_config[port].
-                                         external_phy_config) &
-                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK;
                         is_required |=
-                                ((phy_type ==
-                                  PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101) ||
-                                 (phy_type ==
-                                  PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727) ||
-                                 (phy_type ==
-                                  PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481));
+                                bnx2x_fan_failure_det_req(
+                                        bp,
+                                        bp->common.shmem_base,
+                                        bp->common.shmem2_base,
+                                        port);
                 }
 
         DP(NETIF_MSG_HW, "fan detection setting: %d\n", is_required);
@@ -4139,17 +4160,9 @@ static int bnx2x_init_common(struct bnx2x *bp)
                 return -EBUSY;
         }
 
-        switch (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config)) {
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                bp->port.need_hw_lock = 1;
-                break;
-
-        default:
-                break;
-        }
+        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
+                                                       bp->common.shmem_base,
+                                                       bp->common.shmem2_base);
 
         bnx2x_setup_fan_failure_detection(bp);
 
@@ -4162,7 +4175,8 @@ static int bnx2x_init_common(struct bnx2x *bp)
 
         if (!BP_NOMCP(bp)) {
                 bnx2x_acquire_phy_lock(bp);
-                bnx2x_common_init_phy(bp, bp->common.shmem_base);
+                bnx2x_common_init_phy(bp, bp->common.shmem_base,
+                                      bp->common.shmem2_base);
                 bnx2x_release_phy_lock(bp);
         } else
                 BNX2X_ERR("Bootcode is missing - can not initialize link\n");
@@ -4297,60 +4311,17 @@ static int bnx2x_init_port(struct bnx2x *bp)
 
         bnx2x_init_block(bp, MCP_BLOCK, init_stage);
         bnx2x_init_block(bp, DMAE_BLOCK, init_stage);
-
-        switch (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config)) {
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                {
-                u32 swap_val, swap_override, aeu_gpio_mask, offset;
-
-                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_3,
-                               MISC_REGISTERS_GPIO_INPUT_HI_Z, port);
-
-                /* The GPIO should be swapped if the swap register is
-                   set and active */
-                swap_val = REG_RD(bp, NIG_REG_PORT_SWAP);
-                swap_override = REG_RD(bp, NIG_REG_STRAP_OVERRIDE);
-
-                /* Select function upon port-swap configuration */
-                if (port == 0) {
-                        offset = MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0;
-                        aeu_gpio_mask = (swap_val && swap_override) ?
-                                AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_1 :
-                                AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_0;
-                } else {
-                        offset = MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0;
-                        aeu_gpio_mask = (swap_val && swap_override) ?
-                                AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_0 :
-                                AEU_INPUTS_ATTN_BITS_GPIO3_FUNCTION_1;
-                }
-                val = REG_RD(bp, offset);
-                /* add GPIO3 to group */
-                val |= aeu_gpio_mask;
-                REG_WR(bp, offset, val);
-                }
-                bp->port.need_hw_lock = 1;
-                break;
-
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                bp->port.need_hw_lock = 1;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                /* add SPIO 5 to group 0 */
-                {
+        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
+                                                       bp->common.shmem_base,
+                                                       bp->common.shmem2_base);
+        if (bnx2x_fan_failure_det_req(bp, bp->common.shmem_base,
+                                      bp->common.shmem2_base, port)) {
                 u32 reg_addr = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                                        MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
                 val = REG_RD(bp, reg_addr);
                 val |= AEU_INPUTS_ATTN_BITS_SPIO5;
                 REG_WR(bp, reg_addr, val);
-                }
-                break;
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                bp->port.need_hw_lock = 1;
-                break;
-        default:
-                break;
         }
-
         bnx2x__link_reset(bp);
 
         return 0;
@@ -4480,7 +4451,7 @@ static int bnx2x_init_func(struct bnx2x *bp)
         /* Reset PCIE errors for debug */
         REG_WR(bp, 0x2114, 0xffffffff);
         REG_WR(bp, 0x2120, 0xffffffff);
-
+        bnx2x_phy_probe(&bp->link_params);
         return 0;
 }
 
@@ -5302,7 +5273,7 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode)
 
 unload_error:
         if (!BP_NOMCP(bp))
-                reset_code = bnx2x_fw_command(bp, reset_code);
+                reset_code = bnx2x_fw_command(bp, reset_code, 0);
         else {
                 DP(NETIF_MSG_IFDOWN, "NO MCP - load counts      %d, %d, %d\n",
                    load_count[0], load_count[1], load_count[2]);
@@ -5327,7 +5298,7 @@ unload_error:
 
         /* Report UNLOAD_DONE to MCP */
         if (!BP_NOMCP(bp))
-                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
 
 }
 
@@ -5892,13 +5863,14 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         bp->fw_seq =
                                (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
                                 DRV_MSG_SEQ_NUMBER_MASK);
-                        reset_code = bnx2x_fw_command(bp, reset_code);
+                        reset_code = bnx2x_fw_command(bp, reset_code, 0);
 
                         /* if UNDI is loaded on the other port */
                         if (reset_code != FW_MSG_CODE_DRV_UNLOAD_COMMON) {
 
                                 /* send "DONE" for previous unload */
-                                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+                                bnx2x_fw_command(bp,
+                                                 DRV_MSG_CODE_UNLOAD_DONE, 0);
 
                                 /* unload UNDI on port 1 */
                                 bp->func = 1;
@@ -5907,7 +5879,7 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                         DRV_MSG_SEQ_NUMBER_MASK);
                                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
 
-                                bnx2x_fw_command(bp, reset_code);
+                                bnx2x_fw_command(bp, reset_code, 0);
                         }
 
                         /* now it's safe to release the lock */
@@ -5949,7 +5921,7 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         REG_WR(bp, NIG_REG_STRAP_OVERRIDE, swap_en);
 
                         /* send unload done to the MCP */
-                        bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+                        bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE, 0);
 
                         /* restore our func and fw_seq */
                         bp->func = func;
@@ -5997,6 +5969,7 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
         bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
         bp->common.shmem2_base = REG_RD(bp, MISC_REG_GENERIC_CR_0);
         bp->link_params.shmem_base = bp->common.shmem_base;
+        bp->link_params.shmem2_base = bp->common.shmem2_base;
         BNX2X_DEV_INFO("shmem offset 0x%x  shmem2 offset 0x%x\n",
                        bp->common.shmem_base, bp->common.shmem2_base);
 
@@ -6039,8 +6012,11 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
                             "please upgrade BC\n", BNX2X_BC_VER, val);
         }
         bp->link_params.feature_config_flags |=
-                (val >= REQ_BC_VER_4_VRFY_OPT_MDL) ?
+                                (val >= REQ_BC_VER_4_VRFY_FIRST_PHY_OPT_MDL) ?
                 FEATURE_CONFIG_BC_SUPPORTS_OPT_MDL_VRFY : 0;
+        bp->link_params.feature_config_flags |=
+                (val >= REQ_BC_VER_4_VRFY_SPECIFIC_PHY_OPT_MDL) ?
+                FEATURE_CONFIG_BC_SUPPORTS_DUAL_PHY_OPT_MDL_VRFY : 0;
 
         if (BP_E1HVN(bp) == 0) {
                 pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_PMC, &pmc);
@@ -6064,194 +6040,55 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
 static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
                                                     u32 switch_cfg)
 {
-        int port = BP_PORT(bp);
-        u32 ext_phy_type;
-
-        switch (switch_cfg) {
-        case SWITCH_CFG_1G:
-                BNX2X_DEV_INFO("switch_cfg 0x%x (1G)\n", switch_cfg);
-
-                ext_phy_type =
-                        SERDES_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (Direct)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10baseT_Half |
-                                               SUPPORTED_10baseT_Full |
-                                               SUPPORTED_100baseT_Half |
-                                               SUPPORTED_100baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_2500baseX_Full |
-                                               SUPPORTED_TP |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
+        int cfg_size = 0, idx, port = BP_PORT(bp);
 
-                case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (5482)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10baseT_Half |
-                                               SUPPORTED_10baseT_Full |
-                                               SUPPORTED_100baseT_Half |
-                                               SUPPORTED_100baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_TP |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
+        /* Aggregation of supported attributes of all external phys */
+        bp->port.supported[0] = 0;
+        bp->port.supported[1] = 0;
+        switch (bp->link_params.num_phys) {
+        case 1:
+                bp->port.supported[0] = bp->link_params.phy[INT_PHY].supported;
+                cfg_size = 1;
+                break;
+        case 2:
+                bp->port.supported[0] = bp->link_params.phy[EXT_PHY1].supported;
+                cfg_size = 1;
+                break;
+        case 3:
+                if (bp->link_params.multi_phy_config &
+                    PORT_HW_CFG_PHY_SWAPPED_ENABLED) {
+                        bp->port.supported[1] =
+                                bp->link_params.phy[EXT_PHY1].supported;
+                        bp->port.supported[0] =
+                                bp->link_params.phy[EXT_PHY2].supported;
+                } else {
+                        bp->port.supported[0] =
+                                bp->link_params.phy[EXT_PHY1].supported;
+                        bp->port.supported[1] =
+                                bp->link_params.phy[EXT_PHY2].supported;
+                }
+                cfg_size = 2;
+                break;
+        }
 
-                default:
-                        BNX2X_ERR("NVRAM config error. "
-                                  "BAD SerDes ext_phy_config 0x%x\n",
-                                  bp->link_params.ext_phy_config);
+        if (!(bp->port.supported[0] || bp->port.supported[1])) {
+                BNX2X_ERR("NVRAM config error. BAD phy config."
+                          "PHY1 config 0x%x, PHY2 config 0x%x\n",
+                           SHMEM_RD(bp,
+                           dev_info.port_hw_config[port].external_phy_config),
+                           SHMEM_RD(bp,
+                           dev_info.port_hw_config[port].external_phy_config2));
                         return;
                 }
 
+        switch (switch_cfg) {
+        case SWITCH_CFG_1G:
                 bp->port.phy_addr = REG_RD(bp, NIG_REG_SERDES0_CTRL_PHY_ADDR +
                                            port*0x10);
                 BNX2X_DEV_INFO("phy_addr 0x%x\n", bp->port.phy_addr);
                 break;
 
         case SWITCH_CFG_10G:
-                BNX2X_DEV_INFO("switch_cfg 0x%x (10G)\n", switch_cfg);
-
-                ext_phy_type =
-                        XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
-                switch (ext_phy_type) {
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (Direct)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10baseT_Half |
-                                               SUPPORTED_10baseT_Full |
-                                               SUPPORTED_100baseT_Half |
-                                               SUPPORTED_100baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_2500baseX_Full |
-                                               SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_TP |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8072)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8073)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_2500baseX_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8705)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8706)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8726:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8726)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8727)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_FIBRE |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (SFX7101)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_TP |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (BCM8481)\n",
-                                       ext_phy_type);
-
-                        bp->port.supported |= (SUPPORTED_10baseT_Half |
-                                               SUPPORTED_10baseT_Full |
-                                               SUPPORTED_100baseT_Half |
-                                               SUPPORTED_100baseT_Full |
-                                               SUPPORTED_1000baseT_Full |
-                                               SUPPORTED_10000baseT_Full |
-                                               SUPPORTED_TP |
-                                               SUPPORTED_Autoneg |
-                                               SUPPORTED_Pause |
-                                               SUPPORTED_Asym_Pause);
-                        break;
-
-                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE:
-                        BNX2X_ERR("XGXS PHY Failure detected 0x%x\n",
-                                  bp->link_params.ext_phy_config);
-                        break;
-
-                default:
-                        BNX2X_ERR("NVRAM config error. "
-                                  "BAD XGXS ext_phy_config 0x%x\n",
-                                  bp->link_params.ext_phy_config);
-                        return;
-                }
-
                 bp->port.phy_addr = REG_RD(bp, NIG_REG_XGXS0_CTRL_PHY_ADDR +
                                            port*0x18);
                 BNX2X_DEV_INFO("phy_addr 0x%x\n", bp->port.phy_addr);
@@ -6260,164 +6097,183 @@ static void __devinit bnx2x_link_settings_supported(struct bnx2x *bp,
 
         default:
                 BNX2X_ERR("BAD switch_cfg link_config 0x%x\n",
-                          bp->port.link_config);
+                          bp->port.link_config[0]);
                 return;
         }
-        bp->link_params.phy_addr = bp->port.phy_addr;
-
-        /* mask what we support according to speed_cap_mask */
-        if (!(bp->link_params.speed_cap_mask &
+        /* mask what we support according to speed_cap_mask per configuration */
+        for (idx = 0; idx < cfg_size; idx++) {
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                 PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF))
-                bp->port.supported &= ~SUPPORTED_10baseT_Half;
+                        bp->port.supported[idx] &= ~SUPPORTED_10baseT_Half;
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                 PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL))
-                bp->port.supported &= ~SUPPORTED_10baseT_Full;
+                        bp->port.supported[idx] &= ~SUPPORTED_10baseT_Full;
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                 PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF))
-                bp->port.supported &= ~SUPPORTED_100baseT_Half;
+                        bp->port.supported[idx] &= ~SUPPORTED_100baseT_Half;
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                 PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL))
-                bp->port.supported &= ~SUPPORTED_100baseT_Full;
+                        bp->port.supported[idx] &= ~SUPPORTED_100baseT_Full;
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_1G))
-                bp->port.supported &= ~(SUPPORTED_1000baseT_Half |
+                        bp->port.supported[idx] &= ~(SUPPORTED_1000baseT_Half |
                                         SUPPORTED_1000baseT_Full);
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G))
-                bp->port.supported &= ~SUPPORTED_2500baseX_Full;
+                        bp->port.supported[idx] &= ~SUPPORTED_2500baseX_Full;
 
-        if (!(bp->link_params.speed_cap_mask &
+                if (!(bp->link_params.speed_cap_mask[idx] &
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_10G))
-                bp->port.supported &= ~SUPPORTED_10000baseT_Full;
+                        bp->port.supported[idx] &= ~SUPPORTED_10000baseT_Full;
+
+        }
 
-        BNX2X_DEV_INFO("supported 0x%x\n", bp->port.supported);
+        BNX2X_DEV_INFO("supported 0x%x 0x%x\n", bp->port.supported[0],
+                       bp->port.supported[1]);
 }
 
 static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
 {
-        bp->link_params.req_duplex = DUPLEX_FULL;
-
-        switch (bp->port.link_config & PORT_FEATURE_LINK_SPEED_MASK) {
+        u32 link_config, idx, cfg_size = 0;
+        bp->port.advertising[0] = 0;
+        bp->port.advertising[1] = 0;
+        switch (bp->link_params.num_phys) {
+        case 1:
+        case 2:
+                cfg_size = 1;
+                break;
+        case 3:
+                cfg_size = 2;
+                break;
+        }
+        for (idx = 0; idx < cfg_size; idx++) {
+                bp->link_params.req_duplex[idx] = DUPLEX_FULL;
+                link_config = bp->port.link_config[idx];
+                switch (link_config & PORT_FEATURE_LINK_SPEED_MASK) {
         case PORT_FEATURE_LINK_SPEED_AUTO:
-                if (bp->port.supported & SUPPORTED_Autoneg) {
-                        bp->link_params.req_line_speed = SPEED_AUTO_NEG;
-                        bp->port.advertising = bp->port.supported;
+                        if (bp->port.supported[idx] & SUPPORTED_Autoneg) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_AUTO_NEG;
+                                bp->port.advertising[idx] |=
+                                        bp->port.supported[idx];
                 } else {
-                        u32 ext_phy_type =
-                            XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
-
-                        if ((ext_phy_type ==
-                             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) ||
-                            (ext_phy_type ==
-                             PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706)) {
-                                /* force 10G, no AN */
-                                bp->link_params.req_line_speed = SPEED_10000;
-                                bp->port.advertising =
-                                                (ADVERTISED_10000baseT_Full |
+                        /* force 10G, no AN */
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_10000;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_10000baseT_Full |
                                                  ADVERTISED_FIBRE);
-                                break;
-                        }
-                        BNX2X_ERR("NVRAM config error. "
-                                  "Invalid link_config 0x%x"
-                                  "  Autoneg not supported\n",
-                                  bp->port.link_config);
-                        return;
+                                continue;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_10M_FULL:
-                if (bp->port.supported & SUPPORTED_10baseT_Full) {
-                        bp->link_params.req_line_speed = SPEED_10;
-                        bp->port.advertising = (ADVERTISED_10baseT_Full |
+                        if (bp->port.supported[idx] & SUPPORTED_10baseT_Full) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_10;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_10baseT_Full |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                    bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_10M_HALF:
-                if (bp->port.supported & SUPPORTED_10baseT_Half) {
-                        bp->link_params.req_line_speed = SPEED_10;
-                        bp->link_params.req_duplex = DUPLEX_HALF;
-                        bp->port.advertising = (ADVERTISED_10baseT_Half |
+                        if (bp->port.supported[idx] & SUPPORTED_10baseT_Half) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_10;
+                                bp->link_params.req_duplex[idx] =
+                                        DUPLEX_HALF;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_10baseT_Half |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                    bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_100M_FULL:
-                if (bp->port.supported & SUPPORTED_100baseT_Full) {
-                        bp->link_params.req_line_speed = SPEED_100;
-                        bp->port.advertising = (ADVERTISED_100baseT_Full |
+                        if (bp->port.supported[idx] & SUPPORTED_100baseT_Full) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_100;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_100baseT_Full |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                    bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_100M_HALF:
-                if (bp->port.supported & SUPPORTED_100baseT_Half) {
-                        bp->link_params.req_line_speed = SPEED_100;
-                        bp->link_params.req_duplex = DUPLEX_HALF;
-                        bp->port.advertising = (ADVERTISED_100baseT_Half |
+                        if (bp->port.supported[idx] & SUPPORTED_100baseT_Half) {
+                                bp->link_params.req_line_speed[idx] = SPEED_100;
+                                bp->link_params.req_duplex[idx] = DUPLEX_HALF;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_100baseT_Half |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                    bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_1G:
-                if (bp->port.supported & SUPPORTED_1000baseT_Full) {
-                        bp->link_params.req_line_speed = SPEED_1000;
-                        bp->port.advertising = (ADVERTISED_1000baseT_Full |
+                        if (bp->port.supported[idx] &
+                            SUPPORTED_1000baseT_Full) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_1000;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_1000baseT_Full |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                    bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
 
         case PORT_FEATURE_LINK_SPEED_2_5G:
-                if (bp->port.supported & SUPPORTED_2500baseX_Full) {
-                        bp->link_params.req_line_speed = SPEED_2500;
-                        bp->port.advertising = (ADVERTISED_2500baseX_Full |
+                        if (bp->port.supported[idx] &
+                            SUPPORTED_2500baseX_Full) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_2500;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_2500baseX_Full |
                                                 ADVERTISED_TP);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                     bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
@@ -6425,16 +6281,19 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
         case PORT_FEATURE_LINK_SPEED_10G_CX4:
         case PORT_FEATURE_LINK_SPEED_10G_KX4:
         case PORT_FEATURE_LINK_SPEED_10G_KR:
-                if (bp->port.supported & SUPPORTED_10000baseT_Full) {
-                        bp->link_params.req_line_speed = SPEED_10000;
-                        bp->port.advertising = (ADVERTISED_10000baseT_Full |
+                        if (bp->port.supported[idx] &
+                            SUPPORTED_10000baseT_Full) {
+                                bp->link_params.req_line_speed[idx] =
+                                        SPEED_10000;
+                                bp->port.advertising[idx] |=
+                                        (ADVERTISED_10000baseT_Full |
                                                 ADVERTISED_FIBRE);
                 } else {
                         BNX2X_ERROR("NVRAM config error. "
                                     "Invalid link_config 0x%x"
                                     "  speed_cap_mask 0x%x\n",
-                                    bp->port.link_config,
-                                    bp->link_params.speed_cap_mask);
+                                    link_config,
+                                     bp->link_params.speed_cap_mask[idx]);
                         return;
                 }
                 break;
@@ -6442,23 +6301,28 @@ static void __devinit bnx2x_link_settings_requested(struct bnx2x *bp)
         default:
                 BNX2X_ERROR("NVRAM config error. "
                             "BAD link speed link_config 0x%x\n",
-                            bp->port.link_config);
-                bp->link_params.req_line_speed = SPEED_AUTO_NEG;
-                bp->port.advertising = bp->port.supported;
+                                  link_config);
+                        bp->link_params.req_line_speed[idx] = SPEED_AUTO_NEG;
+                        bp->port.advertising[idx] = bp->port.supported[idx];
                 break;
         }
 
-        bp->link_params.req_flow_ctrl = (bp->port.link_config &
+                bp->link_params.req_flow_ctrl[idx] = (link_config &
                                          PORT_FEATURE_FLOW_CONTROL_MASK);
-        if ((bp->link_params.req_flow_ctrl == BNX2X_FLOW_CTRL_AUTO) &&
-            !(bp->port.supported & SUPPORTED_Autoneg))
-                bp->link_params.req_flow_ctrl = BNX2X_FLOW_CTRL_NONE;
+                if ((bp->link_params.req_flow_ctrl[idx] ==
+                     BNX2X_FLOW_CTRL_AUTO) &&
+                    !(bp->port.supported[idx] & SUPPORTED_Autoneg)) {
+                        bp->link_params.req_flow_ctrl[idx] =
+                                BNX2X_FLOW_CTRL_NONE;
+                }
 
-        BNX2X_DEV_INFO("req_line_speed %d  req_duplex %d  req_flow_ctrl 0x%x"
-                       "  advertising 0x%x\n",
-                       bp->link_params.req_line_speed,
-                       bp->link_params.req_duplex,
-                       bp->link_params.req_flow_ctrl, bp->port.advertising);
+                BNX2X_DEV_INFO("req_line_speed %d  req_duplex %d req_flow_ctrl"
+                               " 0x%x advertising 0x%x\n",
+                               bp->link_params.req_line_speed[idx],
+                               bp->link_params.req_duplex[idx],
+                               bp->link_params.req_flow_ctrl[idx],
+                               bp->port.advertising[idx]);
+        }
 }
 
 static void __devinit bnx2x_set_mac_buf(u8 *mac_buf, u32 mac_lo, u16 mac_hi)
@@ -6474,48 +6338,28 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
         int port = BP_PORT(bp);
         u32 val, val2;
         u32 config;
-        u16 i;
-        u32 ext_phy_type;
+        u32 ext_phy_type, ext_phy_config;;
 
         bp->link_params.bp = bp;
         bp->link_params.port = port;
 
         bp->link_params.lane_config =
                 SHMEM_RD(bp, dev_info.port_hw_config[port].lane_config);
-        bp->link_params.ext_phy_config =
-                SHMEM_RD(bp,
-                         dev_info.port_hw_config[port].external_phy_config);
-        /* BCM8727_NOC => BCM8727 no over current */
-        if (XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config) ==
-            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727_NOC) {
-                bp->link_params.ext_phy_config &=
-                        ~PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK;
-                bp->link_params.ext_phy_config |=
-                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727;
-                bp->link_params.feature_config_flags |=
-                        FEATURE_CONFIG_BCM8727_NOC;
-        }
 
-        bp->link_params.speed_cap_mask =
+        bp->link_params.speed_cap_mask[0] =
                 SHMEM_RD(bp,
                          dev_info.port_hw_config[port].speed_capability_mask);
-
-        bp->port.link_config =
+        bp->link_params.speed_cap_mask[1] =
+                SHMEM_RD(bp,
+                         dev_info.port_hw_config[port].speed_capability_mask2);
+        bp->port.link_config[0] =
                 SHMEM_RD(bp, dev_info.port_feature_config[port].link_config);
 
-        /* Get the 4 lanes xgxs config rx and tx */
-        for (i = 0; i < 2; i++) {
-                val = SHMEM_RD(bp,
-                           dev_info.port_hw_config[port].xgxs_config_rx[i<<1]);
-                bp->link_params.xgxs_config_rx[i << 1] = ((val>>16) & 0xffff);
-                bp->link_params.xgxs_config_rx[(i << 1) + 1] = (val & 0xffff);
-
-                val = SHMEM_RD(bp,
-                           dev_info.port_hw_config[port].xgxs_config_tx[i<<1]);
-                bp->link_params.xgxs_config_tx[i << 1] = ((val>>16) & 0xffff);
-                bp->link_params.xgxs_config_tx[(i << 1) + 1] = (val & 0xffff);
-        }
+        bp->port.link_config[1] =
+                SHMEM_RD(bp, dev_info.port_feature_config[port].link_config2);
 
+        bp->link_params.multi_phy_config =
+                SHMEM_RD(bp, dev_info.port_hw_config[port].multi_phy_config);
         /* If the device is capable of WoL, set the default state according
          * to the HW
          */
@@ -6523,14 +6367,15 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
         bp->wol = (!(bp->flags & NO_WOL_FLAG) &&
                    (config & PORT_FEATURE_WOL_ENABLED));
 
-        BNX2X_DEV_INFO("lane_config 0x%08x  ext_phy_config 0x%08x"
-                       "  speed_cap_mask 0x%08x  link_config 0x%08x\n",
+        BNX2X_DEV_INFO("lane_config 0x%08x"
+                       "speed_cap_mask0 0x%08x  link_config0 0x%08x\n",
                        bp->link_params.lane_config,
-                       bp->link_params.ext_phy_config,
-                       bp->link_params.speed_cap_mask, bp->port.link_config);
+                       bp->link_params.speed_cap_mask[0],
+                       bp->port.link_config[0]);
 
-        bp->link_params.switch_cfg |= (bp->port.link_config &
+        bp->link_params.switch_cfg = (bp->port.link_config[0] &
                                        PORT_FEATURE_CONNECTED_SWITCH_MASK);
+        bnx2x_phy_probe(&bp->link_params);
         bnx2x_link_settings_supported(bp, bp->link_params.switch_cfg);
 
         bnx2x_link_settings_requested(bp);
@@ -6539,14 +6384,17 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
          * If connected directly, work with the internal PHY, otherwise, work
          * with the external PHY
          */
-        ext_phy_type = XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
+        ext_phy_config =
+                SHMEM_RD(bp,
+                         dev_info.port_hw_config[port].external_phy_config);
+        ext_phy_type = XGXS_EXT_PHY_TYPE(ext_phy_config);
         if (ext_phy_type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)
-                bp->mdio.prtad = bp->link_params.phy_addr;
+                bp->mdio.prtad = bp->port.phy_addr;
 
         else if ((ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) &&
                  (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN))
                 bp->mdio.prtad =
-                        XGXS_EXT_PHY_ADDR(bp->link_params.ext_phy_config);
+                        XGXS_EXT_PHY_ADDR(ext_phy_config);
 
         val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_upper);
         val = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_lower);
@@ -6771,7 +6619,6 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
         bp->mrrs = mrrs;
 
         bp->tx_ring_size = MAX_TX_AVAIL;
-        bp->rx_ring_size = MAX_RX_AVAIL;
 
         bp->rx_csum = 1;
 
@@ -6982,23 +6829,15 @@ static int bnx2x_mdio_read(struct net_device *netdev, int prtad,
         struct bnx2x *bp = netdev_priv(netdev);
         u16 value;
         int rc;
-        u32 phy_type = XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
 
         DP(NETIF_MSG_LINK, "mdio_read: prtad 0x%x, devad 0x%x, addr 0x%x\n",
            prtad, devad, addr);
 
-        if (prtad != bp->mdio.prtad) {
-                DP(NETIF_MSG_LINK, "prtad missmatch (cmd:0x%x != bp:0x%x)\n",
-                   prtad, bp->mdio.prtad);
-                return -EINVAL;
-        }
-
         /* The HW expects different devad if CL22 is used */
         devad = (devad == MDIO_DEVAD_NONE) ? DEFAULT_PHY_DEV_ADDR : devad;
 
         bnx2x_acquire_phy_lock(bp);
-        rc = bnx2x_cl45_read(bp, BP_PORT(bp), phy_type, prtad,
-                             devad, addr, &value);
+        rc = bnx2x_phy_read(&bp->link_params, prtad, devad, addr, &value);
         bnx2x_release_phy_lock(bp);
         DP(NETIF_MSG_LINK, "mdio_read_val 0x%x rc = 0x%x\n", value, rc);
 
@@ -7012,24 +6851,16 @@ static int bnx2x_mdio_write(struct net_device *netdev, int prtad, int devad,
                             u16 addr, u16 value)
 {
         struct bnx2x *bp = netdev_priv(netdev);
-        u32 ext_phy_type = XGXS_EXT_PHY_TYPE(bp->link_params.ext_phy_config);
         int rc;
 
         DP(NETIF_MSG_LINK, "mdio_write: prtad 0x%x, devad 0x%x, addr 0x%x,"
                            " value 0x%x\n", prtad, devad, addr, value);
 
-        if (prtad != bp->mdio.prtad) {
-                DP(NETIF_MSG_LINK, "prtad missmatch (cmd:0x%x != bp:0x%x)\n",
-                   prtad, bp->mdio.prtad);
-                return -EINVAL;
-        }
-
         /* The HW expects different devad if CL22 is used */
         devad = (devad == MDIO_DEVAD_NONE) ? DEFAULT_PHY_DEV_ADDR : devad;
 
         bnx2x_acquire_phy_lock(bp);
-        rc = bnx2x_cl45_write(bp, BP_PORT(bp), ext_phy_type, prtad,
-                              devad, addr, value);
+        rc = bnx2x_phy_write(&bp->link_params, prtad, devad, addr, value);
         bnx2x_release_phy_lock(bp);
         return rc;
 }
@@ -7259,7 +7090,7 @@ static void __devinit bnx2x_get_pcie_width_speed(struct bnx2x *bp,
         *speed = (val & PCICFG_LINK_SPEED) >> PCICFG_LINK_SPEED_SHIFT;
 }
 
-static int __devinit bnx2x_check_firmware(struct bnx2x *bp)
+static int bnx2x_check_firmware(struct bnx2x *bp)
 {
         const struct firmware *firmware = bp->firmware;
         struct bnx2x_fw_file_hdr *fw_hdr;
@@ -7370,7 +7201,7 @@ do {									\
              (u8 *)bp->arr, len);                                       \
 } while (0)
 
-static int __devinit bnx2x_init_firmware(struct bnx2x *bp, struct device *dev)
+int bnx2x_init_firmware(struct bnx2x *bp)
 {
         const char *fw_file_name;
         struct bnx2x_fw_file_hdr *fw_hdr;
@@ -7381,21 +7212,21 @@ static int __devinit bnx2x_init_firmware(struct bnx2x *bp, struct device *dev)
         else if (CHIP_IS_E1H(bp))
                 fw_file_name = FW_FILE_NAME_E1H;
         else {
-                dev_err(dev, "Unsupported chip revision\n");
+                BNX2X_ERR("Unsupported chip revision\n");
                 return -EINVAL;
         }
 
-        dev_info(dev, "Loading %s\n", fw_file_name);
+        BNX2X_DEV_INFO("Loading %s\n", fw_file_name);
 
-        rc = request_firmware(&bp->firmware, fw_file_name, dev);
+        rc = request_firmware(&bp->firmware, fw_file_name, &bp->pdev->dev);
         if (rc) {
-                dev_err(dev, "Can't load firmware file %s\n", fw_file_name);
+                BNX2X_ERR("Can't load firmware file %s\n", fw_file_name);
                 goto request_firmware_exit;
         }
 
         rc = bnx2x_check_firmware(bp);
         if (rc) {
-                dev_err(dev, "Corrupt firmware file %s\n", fw_file_name);
+                BNX2X_ERR("Corrupt firmware file %s\n", fw_file_name);
                 goto request_firmware_exit;
         }
 
@@ -7473,13 +7304,6 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         if (rc)
                 goto init_one_exit;
 
-        /* Set init arrays */
-        rc = bnx2x_init_firmware(bp, &pdev->dev);
-        if (rc) {
-                dev_err(&pdev->dev, "Error loading firmware\n");
-                goto init_one_exit;
-        }
-
         rc = register_netdev(dev);
         if (rc) {
                 dev_err(&pdev->dev, "Cannot register net device\n");
@@ -7530,11 +7354,6 @@ static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
         /* Make sure RESET task is not scheduled before continuing */
         cancel_delayed_work_sync(&bp->reset_task);
 
-        kfree(bp->init_ops_offsets);
-        kfree(bp->init_ops);
-        kfree(bp->init_data);
-        release_firmware(bp->firmware);
-
         if (bp->regview)
                 iounmap(bp->regview);
 
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index a1f3bf0cd630..6be0d09ad3fd 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -4964,6 +4964,8 @@
 #define MDIO_SERDES_DIGITAL_A_1000X_CONTROL2_PRL_DT_EN                  0x0001
 #define MDIO_SERDES_DIGITAL_A_1000X_CONTROL2_AN_FST_TMR                 0x0040
 #define MDIO_SERDES_DIGITAL_A_1000X_STATUS1                     0x14
+#define MDIO_SERDES_DIGITAL_A_1000X_STATUS1_SGMII                       0x0001
+#define MDIO_SERDES_DIGITAL_A_1000X_STATUS1_LINK                        0x0002
 #define MDIO_SERDES_DIGITAL_A_1000X_STATUS1_DUPLEX                      0x0004
 #define MDIO_SERDES_DIGITAL_A_1000X_STATUS1_SPEED_MASK                  0x0018
 #define MDIO_SERDES_DIGITAL_A_1000X_STATUS1_SPEED_SHIFT                 3
@@ -5135,28 +5137,35 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_PMA_REG_8727_TWO_WIRE_SLAVE_ADDR   0x8005
 #define MDIO_PMA_REG_8727_TWO_WIRE_DATA_BUF     0x8007
 #define MDIO_PMA_REG_8727_TWO_WIRE_DATA_MASK 0xff
-#define MDIO_PMA_REG_8727_MISC_CTRL             0x8309
 #define MDIO_PMA_REG_8727_TX_CTRL1              0xca02
 #define MDIO_PMA_REG_8727_TX_CTRL2              0xca05
 #define MDIO_PMA_REG_8727_PCS_OPT_CTRL          0xc808
 #define MDIO_PMA_REG_8727_GPIO_CTRL             0xc80e
+#define MDIO_PMA_REG_8727_PCS_GP                0xc842
+
+#define MDIO_AN_REG_8727_MISC_CTRL              0x8309
 
 #define MDIO_PMA_REG_8073_CHIP_REV                      0xc801
 #define MDIO_PMA_REG_8073_SPEED_LINK_STATUS             0xc820
 #define MDIO_PMA_REG_8073_XAUI_WA                       0xc841
+#define MDIO_PMA_REG_8073_OPT_DIGITAL_CTRL              0xcd08
 
 #define MDIO_PMA_REG_7101_RESET         0xc000
 #define MDIO_PMA_REG_7107_LED_CNTL      0xc007
+#define MDIO_PMA_REG_7107_LINK_LED_CNTL 0xc009
 #define MDIO_PMA_REG_7101_VER1          0xc026
 #define MDIO_PMA_REG_7101_VER2          0xc027
 
-#define MDIO_PMA_REG_8481_PMD_SIGNAL    0xa811
-#define MDIO_PMA_REG_8481_LED1_MASK     0xa82c
-#define MDIO_PMA_REG_8481_LED2_MASK     0xa82f
-#define MDIO_PMA_REG_8481_LED3_MASK     0xa832
-#define MDIO_PMA_REG_8481_LED3_BLINK    0xa834
-#define MDIO_PMA_REG_8481_SIGNAL_MASK   0xa835
-#define MDIO_PMA_REG_8481_LINK_SIGNAL   0xa83b
+#define MDIO_PMA_REG_8481_PMD_SIGNAL                    0xa811
+#define MDIO_PMA_REG_8481_LED1_MASK                     0xa82c
+#define MDIO_PMA_REG_8481_LED2_MASK                     0xa82f
+#define MDIO_PMA_REG_8481_LED3_MASK                     0xa832
+#define MDIO_PMA_REG_8481_LED3_BLINK                    0xa834
+#define MDIO_PMA_REG_8481_LED5_MASK                     0xa838
+#define MDIO_PMA_REG_8481_SIGNAL_MASK                   0xa835
+#define MDIO_PMA_REG_8481_LINK_SIGNAL                   0xa83b
+#define MDIO_PMA_REG_8481_LINK_SIGNAL_LED4_ENABLE_MASK  0x800
+#define MDIO_PMA_REG_8481_LINK_SIGNAL_LED4_ENABLE_SHIFT 11
 
 
 #define MDIO_WIS_DEVAD                  0x2
@@ -5188,6 +5197,8 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_XS_8706_REG_BANK_RX3       0x80ec
 #define MDIO_XS_8706_REG_BANK_RXA       0x80fc
 
+#define MDIO_XS_REG_8073_RX_CTRL_PCIE   0x80FA
+
 #define MDIO_AN_DEVAD                   0x7
 /*ieee*/
 #define MDIO_AN_REG_CTRL                0x0000
@@ -5210,14 +5221,40 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_AN_REG_CL37_FC_LP          0xffe5
 
 #define MDIO_AN_REG_8073_2_5G           0x8329
+#define MDIO_AN_REG_8073_BAM            0x8350
 
+#define MDIO_AN_REG_8481_10GBASE_T_AN_CTRL      0x0020
 #define MDIO_AN_REG_8481_LEGACY_MII_CTRL        0xffe0
+#define MDIO_AN_REG_8481_LEGACY_MII_STATUS      0xffe1
 #define MDIO_AN_REG_8481_LEGACY_AN_ADV          0xffe4
+#define MDIO_AN_REG_8481_LEGACY_AN_EXPANSION    0xffe6
 #define MDIO_AN_REG_8481_1000T_CTRL             0xffe9
 #define MDIO_AN_REG_8481_EXPANSION_REG_RD_RW    0xfff5
 #define MDIO_AN_REG_8481_EXPANSION_REG_ACCESS   0xfff7
+#define MDIO_AN_REG_8481_AUX_CTRL               0xfff8
 #define MDIO_AN_REG_8481_LEGACY_SHADOW          0xfffc
 
+/* BCM84823 only */
+#define MDIO_CTL_DEVAD                  0x1e
+#define MDIO_CTL_REG_84823_MEDIA                0x401a
+#define MDIO_CTL_REG_84823_MEDIA_MAC_MASK               0x0018
+        /* These pins configure the BCM84823 interface to MAC after reset. */
+#define MDIO_CTL_REG_84823_CTRL_MAC_XFI                 0x0008
+#define MDIO_CTL_REG_84823_MEDIA_MAC_XAUI_M             0x0010
+        /* These pins configure the BCM84823 interface to Line after reset. */
+#define MDIO_CTL_REG_84823_MEDIA_LINE_MASK              0x0060
+#define MDIO_CTL_REG_84823_MEDIA_LINE_XAUI_L            0x0020
+#define MDIO_CTL_REG_84823_MEDIA_LINE_XFI               0x0040
+        /* When this pin is active high during reset, 10GBASE-T core is power
+         * down, When it is active low the 10GBASE-T is power up
+         */
+#define MDIO_CTL_REG_84823_MEDIA_COPPER_CORE_DOWN       0x0080
+#define MDIO_CTL_REG_84823_MEDIA_PRIORITY_MASK          0x0100
+#define MDIO_CTL_REG_84823_MEDIA_PRIORITY_COPPER        0x0000
+#define MDIO_CTL_REG_84823_MEDIA_PRIORITY_FIBER         0x0100
+#define MDIO_CTL_REG_84823_MEDIA_FIBER_1G                       0x1000
+
+
 #define IGU_FUNC_BASE                   0x0400
 
 #define IGU_ADDR_MSIX                   0x0000
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index c74724461020..efa1403ebf82 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -969,6 +969,7 @@ static void bnx2x_net_stats_update(struct bnx2x *bp)
 {
         struct bnx2x_eth_stats *estats = &bp->eth_stats;
         struct net_device_stats *nstats = &bp->dev->stats;
+        unsigned long tmp;
         int i;
 
         nstats->rx_packets =
@@ -985,10 +986,10 @@ static void bnx2x_net_stats_update(struct bnx2x *bp)
 
         nstats->tx_bytes = bnx2x_hilo(&estats->total_bytes_transmitted_hi);
 
-        nstats->rx_dropped = estats->mac_discard;
+        tmp = estats->mac_discard;
         for_each_queue(bp, i)
-                nstats->rx_dropped +=
-                        le32_to_cpu(bp->fp[i].old_tclient.checksum_discard);
+                tmp += le32_to_cpu(bp->fp[i].old_tclient.checksum_discard);
+        nstats->rx_dropped = tmp;
 
         nstats->tx_dropped = 0;
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 0ddf4c66afe2..079b9d1eead5 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -252,7 +252,7 @@ static inline void __enable_port(struct port *port)
  */
 static inline int __port_is_enabled(struct port *port)
 {
-        return(port->slave->state == BOND_STATE_ACTIVE);
+        return port->slave->state == BOND_STATE_ACTIVE;
 }
 
 /**
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..fb70c3e12927 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4678,6 +4678,10 @@ static void bond_setup(struct net_device *bond_dev)
                                NETIF_F_HW_VLAN_RX |
                                NETIF_F_HW_VLAN_FILTER);
 
+        /* By default, we enable GRO on bonding devices.
+         * Actual support requires lowlevel drivers are GRO ready.
+         */
+        bond_dev->features |= NETIF_F_GRO;
 }
 
 static void bond_work_cancel_all(struct bonding *bond)
diff --git a/drivers/net/bsd_comp.c b/drivers/net/bsd_comp.c
index 88edb986691a..6e99d80ec409 100644
--- a/drivers/net/bsd_comp.c
+++ b/drivers/net/bsd_comp.c
@@ -429,7 +429,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
         if (!db->lens)
           {
             bsd_free (db);
-            return (NULL);
+            return NULL;
           }
       }
 /*
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index b1bdc909090f..312b9c8f4f3b 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -143,12 +143,12 @@ static u32 __devinit mpc512x_can_get_clock(struct platform_device *ofdev,
         np_clock = of_find_matching_node(NULL, mpc512x_clock_ids);
         if (!np_clock) {
                 dev_err(&ofdev->dev, "couldn't find clock node\n");
-                return -ENODEV;
+                return 0;
         }
         clockctl = of_iomap(np_clock, 0);
         if (!clockctl) {
                 dev_err(&ofdev->dev, "couldn't map clock registers\n");
-                return 0;
+                goto exit_put;
         }
 
         /* Determine the MSCAN device index from the physical address */
@@ -233,9 +233,9 @@ static u32 __devinit mpc512x_can_get_clock(struct platform_device *ofdev,
                 clocksrc == 1 ? "ref_clk" : "sys_clk", clockdiv);
 
 exit_unmap:
-        of_node_put(np_clock);
         iounmap(clockctl);
-
+exit_put:
+        of_node_put(np_clock);
         return freq;
 }
 #else /* !CONFIG_PPC_MPC512x */
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 28c88eeec757..d6b6d6aa565a 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -419,7 +419,7 @@ static u16 cas_phy_read(struct cas *cp, int reg)
                 udelay(10);
                 cmd = readl(cp->regs + REG_MIF_FRAME);
                 if (cmd & MIF_FRAME_TURN_AROUND_LSB)
-                        return (cmd & MIF_FRAME_DATA_MASK);
+                        return cmd & MIF_FRAME_DATA_MASK;
         }
         return 0xFFFF; /* -1 */
 }
@@ -804,7 +804,7 @@ static int cas_reset_mii_phy(struct cas *cp)
                         break;
                 udelay(10);
         }
-        return (limit <= 0);
+        return limit <= 0;
 }
 
 static int cas_saturn_firmware_init(struct cas *cp)
@@ -2149,7 +2149,7 @@ end_copy_pkt:
                 skb->csum = csum_unfold(~csum);
                 skb->ip_summed = CHECKSUM_COMPLETE;
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
         return len;
 }
 
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index f01cfdb995de..340b537dc97e 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1388,7 +1388,7 @@ static void sge_rx(struct sge *sge, struct freelQ *fl, unsigned int len)
                 ++st->rx_cso_good;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         if (unlikely(adapter->vlan_grp && p->vlan_valid)) {
                 st->vlan_xtract++;
@@ -1551,7 +1551,7 @@ static inline int responses_pending(const struct adapter *adapter)
         const struct respQ *Q = &adapter->sge->respQ;
         const struct respQ_e *e = &Q->entries[Q->cidx];
 
-        return (e->GenerationBit == Q->genbit);
+        return e->GenerationBit == Q->genbit;
 }
 
 /*
diff --git a/drivers/net/chelsio/subr.c b/drivers/net/chelsio/subr.c
index 599d178df62d..63ebf76d2390 100644
--- a/drivers/net/chelsio/subr.c
+++ b/drivers/net/chelsio/subr.c
@@ -314,14 +314,12 @@ static int mi1_mdio_write(struct net_device *dev, int phy_addr, int mmd_addr,
         return 0;
 }
 
-#if defined(CONFIG_CHELSIO_T1_1G)
 static const struct mdio_ops mi1_mdio_ops = {
         .init = mi1_mdio_init,
         .read = mi1_mdio_read,
         .write = mi1_mdio_write,
         .mode_support = MDIO_SUPPORTS_C22
 };
-#endif
 
 #endif
 
diff --git a/drivers/net/chelsio/vsc7326.c b/drivers/net/chelsio/vsc7326.c
index c844111cffeb..106a590f0d9a 100644
--- a/drivers/net/chelsio/vsc7326.c
+++ b/drivers/net/chelsio/vsc7326.c
@@ -255,7 +255,7 @@ static int bist_rd(adapter_t *adapter, int moduleid, int address)
         else if ((result & (1 << 8)) != 0x0)
                 pr_err("bist read error: 0x%x\n", result);
 
-        return (result & 0xff);
+        return result & 0xff;
 }
 
 static int bist_wr(adapter_t *adapter, int moduleid, int address, int value)
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 09610323a948..2ab6a7c4ffc1 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -1022,7 +1022,7 @@ static int cnic_alloc_bnx2x_context(struct cnic_dev *dev)
         if (blks > cp->ethdev->ctx_tbl_len)
                 return -ENOMEM;
 
-        cp->ctx_arr = kzalloc(blks * sizeof(struct cnic_ctx), GFP_KERNEL);
+        cp->ctx_arr = kcalloc(blks, sizeof(struct cnic_ctx), GFP_KERNEL);
         if (cp->ctx_arr == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index e1f6156b3710..fec939f8f65f 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -38,7 +38,7 @@
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <linux/clk.h>
-#include <asm/gpio.h>
+#include <linux/gpio.h>
 #include <asm/atomic.h>
 
 MODULE_AUTHOR("Eugene Konev <ejka@imfi.kspu.ru>");
@@ -108,7 +108,7 @@ MODULE_PARM_DESC(dumb_switch, "Assume switch is not connected to MDIO bus");
 #define CPMAC_RX_INT_CLEAR              0x019c
 #define CPMAC_MAC_INT_ENABLE            0x01a8
 #define CPMAC_MAC_INT_CLEAR             0x01ac
-#define CPMAC_MAC_ADDR_LO(channel)      (0x01b0 + (channel) * 4)
+#define CPMAC_MAC_ADDR_LO(channel)      (0x01b0 + (channel) * 4)
 #define CPMAC_MAC_ADDR_MID              0x01d0
 #define CPMAC_MAC_ADDR_HI               0x01d4
 #define CPMAC_MAC_HASH_LO               0x01d8
@@ -227,7 +227,7 @@ static void cpmac_dump_regs(struct net_device *dev)
         for (i = 0; i < CPMAC_REG_END; i += 4) {
                 if (i % 16 == 0) {
                         if (i)
-                                printk("\n");
+                                pr_cont("\n");
                         printk(KERN_DEBUG "%s: reg[%p]:", dev->name,
                                priv->regs + i);
                 }
@@ -262,7 +262,7 @@ static void cpmac_dump_skb(struct net_device *dev, struct sk_buff *skb)
         for (i = 0; i < skb->len; i++) {
                 if (i % 16 == 0) {
                         if (i)
-                                printk("\n");
+                                pr_cont("\n");
                         printk(KERN_DEBUG "%s: data[%p]:", dev->name,
                                skb->data + i);
                 }
@@ -391,7 +391,7 @@ static struct sk_buff *cpmac_rx_one(struct cpmac_priv *priv,
         if (likely(skb)) {
                 skb_put(desc->skb, desc->datalen);
                 desc->skb->protocol = eth_type_trans(desc->skb, priv->dev);
-                desc->skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(desc->skb);
                 priv->dev->stats.rx_packets++;
                 priv->dev->stats.rx_bytes += desc->datalen;
                 result = desc->skb;
@@ -506,7 +506,7 @@ static int cpmac_poll(struct napi_struct *napi, int budget)
                                         "restart rx from a descriptor that's "
                                         "not free: %p\n",
                                         priv->dev->name, restart);
-                                goto fatal_error;
+                        goto fatal_error;
                 }
 
                 cpmac_write(priv->regs, CPMAC_RX_PTR(0), restart->mapping);
@@ -873,7 +873,8 @@ static int cpmac_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         return -EINVAL;
 }
 
-static void cpmac_get_ringparam(struct net_device *dev, struct ethtool_ringparam* ring)
+static void cpmac_get_ringparam(struct net_device *dev,
+                                                struct ethtool_ringparam *ring)
 {
         struct cpmac_priv *priv = netdev_priv(dev);
 
@@ -888,7 +889,8 @@ static void cpmac_get_ringparam(struct net_device *dev, struct ethtool_ringparam
         ring->tx_pending = 1;
 }
 
-static int cpmac_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ring)
+static int cpmac_set_ringparam(struct net_device *dev,
+                                                struct ethtool_ringparam *ring)
 {
         struct cpmac_priv *priv = netdev_priv(dev);
 
@@ -1012,8 +1014,8 @@ static int cpmac_open(struct net_device *dev)
 
         priv->rx_head->prev->hw_next = (u32)0;
 
-        if ((res = request_irq(dev->irq, cpmac_irq, IRQF_SHARED,
-                               dev->name, dev))) {
+        res = request_irq(dev->irq, cpmac_irq, IRQF_SHARED, dev->name, dev);
+        if (res) {
                 if (netif_msg_drv(priv))
                         printk(KERN_ERR "%s: failed to obtain irq\n",
                                dev->name);
@@ -1133,7 +1135,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
         }
 
         if (phy_id == PHY_MAX_ADDR) {
-                dev_err(&pdev->dev, "no PHY present, falling back to switch on MDIO bus 0\n");
+                dev_err(&pdev->dev, "no PHY present, falling back "
+                                        "to switch on MDIO bus 0\n");
                 strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE); /* fixed phys bus */
                 phy_id = pdev->id;
         }
@@ -1169,9 +1172,10 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
         priv->msg_enable = netif_msg_init(debug_level, 0xff);
         memcpy(dev->dev_addr, pdata->dev_addr, sizeof(pdata->dev_addr));
 
-        snprintf(priv->phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        snprintf(priv->phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT,
+                                                mdio_bus_id, phy_id);
 
-        priv->phy = phy_connect(dev, priv->phy_name, &cpmac_adjust_link, 0,
+        priv->phy = phy_connect(dev, priv->phy_name, cpmac_adjust_link, 0,
                                                 PHY_INTERFACE_MODE_MII);
 
         if (IS_ERR(priv->phy)) {
@@ -1182,7 +1186,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
                 goto fail;
         }
 
-        if ((rc = register_netdev(dev))) {
+        rc = register_netdev(dev);
+        if (rc) {
                 printk(KERN_ERR "cpmac: error %i registering device %s\n", rc,
                        dev->name);
                 goto fail;
@@ -1248,11 +1253,13 @@ int __devinit cpmac_init(void)
 
         cpmac_mii->reset(cpmac_mii);
 
-        for (i = 0; i < 300; i++)
-                if ((mask = cpmac_read(cpmac_mii->priv, CPMAC_MDIO_ALIVE)))
+        for (i = 0; i < 300; i++) {
+                mask = cpmac_read(cpmac_mii->priv, CPMAC_MDIO_ALIVE);
+                if (mask)
                         break;
                 else
                         msleep(10);
+        }
 
         mask &= 0x7fffffff;
         if (mask & (mask - 1)) {
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index f208712c0b90..f9eede0a4b86 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1286,7 +1286,7 @@ irq_err:
 /*
  * Release resources when all the ports and offloading have been stopped.
  */
-static void cxgb_down(struct adapter *adapter)
+static void cxgb_down(struct adapter *adapter, int on_wq)
 {
         t3_sge_stop(adapter);
         spin_lock_irq(&adapter->work_lock);     /* sync with PHY intr task */
@@ -1296,7 +1296,8 @@ static void cxgb_down(struct adapter *adapter)
         free_irq_resources(adapter);
         quiesce_rx(adapter);
         t3_sge_stop(adapter);
-        flush_workqueue(cxgb3_wq);      /* wait for external IRQ handler */
+        if (!on_wq)
+                flush_workqueue(cxgb3_wq);/* wait for external IRQ handler */
 }
 
 static void schedule_chk_task(struct adapter *adap)
@@ -1374,7 +1375,7 @@ static int offload_close(struct t3cdev *tdev)
         clear_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map);
 
         if (!adapter->open_device_map)
-                cxgb_down(adapter);
+                cxgb_down(adapter, 0);
 
         cxgb3_offload_deactivate(adapter);
         return 0;
@@ -1409,7 +1410,7 @@ static int cxgb_open(struct net_device *dev)
         return 0;
 }
 
-static int cxgb_close(struct net_device *dev)
+static int __cxgb_close(struct net_device *dev, int on_wq)
 {
         struct port_info *pi = netdev_priv(dev);
         struct adapter *adapter = pi->adapter;
@@ -1436,12 +1437,17 @@ static int cxgb_close(struct net_device *dev)
                 cancel_delayed_work_sync(&adapter->adap_check_task);
 
         if (!adapter->open_device_map)
-                cxgb_down(adapter);
+                cxgb_down(adapter, on_wq);
 
         cxgb3_event_notify(&adapter->tdev, OFFLOAD_PORT_DOWN, pi->port_id);
         return 0;
 }
 
+static int cxgb_close(struct net_device *dev)
+{
+        return __cxgb_close(dev, 0);
+}
+
 static struct net_device_stats *cxgb_get_stats(struct net_device *dev)
 {
         struct port_info *pi = netdev_priv(dev);
@@ -2864,7 +2870,7 @@ void t3_os_link_fault_handler(struct adapter *adapter, int port_id)
         spin_unlock(&adapter->work_lock);
 }
 
-static int t3_adapter_error(struct adapter *adapter, int reset)
+static int t3_adapter_error(struct adapter *adapter, int reset, int on_wq)
 {
         int i, ret = 0;
 
@@ -2879,7 +2885,7 @@ static int t3_adapter_error(struct adapter *adapter, int reset)
                 struct net_device *netdev = adapter->port[i];
 
                 if (netif_running(netdev))
-                        cxgb_close(netdev);
+                        __cxgb_close(netdev, on_wq);
         }
 
         /* Stop SGE timers */
@@ -2950,7 +2956,7 @@ static void fatal_error_task(struct work_struct *work)
         int err = 0;
 
         rtnl_lock();
-        err = t3_adapter_error(adapter, 1);
+        err = t3_adapter_error(adapter, 1, 1);
         if (!err)
                 err = t3_reenable_adapter(adapter);
         if (!err)
@@ -3000,7 +3006,7 @@ static pci_ers_result_t t3_io_error_detected(struct pci_dev *pdev,
         if (state == pci_channel_io_perm_failure)
                 return PCI_ERS_RESULT_DISCONNECT;
 
-        ret = t3_adapter_error(adapter, 0);
+        ret = t3_adapter_error(adapter, 0, 0);
 
         /* Request a slot reset. */
         return PCI_ERS_RESULT_NEED_RESET;
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index c6485b39eb0e..21db7491f613 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -64,7 +64,7 @@ static inline int offload_activated(struct t3cdev *tdev)
 {
         const struct adapter *adapter = tdev2adap(tdev);
 
-        return (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map));
+        return test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map);
 }
 
 /**
diff --git a/drivers/net/cxgb3/regs.h b/drivers/net/cxgb3/regs.h
index cb42353c9fdd..6990f6c65221 100644
--- a/drivers/net/cxgb3/regs.h
+++ b/drivers/net/cxgb3/regs.h
@@ -1997,6 +1997,10 @@
 
 #define A_PL_RST 0x6f0
 
+#define S_FATALPERREN    4
+#define V_FATALPERREN(x) ((x) << S_FATALPERREN)
+#define F_FATALPERREN    V_FATALPERREN(1U)
+
 #define S_CRSTWRM    1
 #define V_CRSTWRM(x) ((x) << S_CRSTWRM)
 #define F_CRSTWRM    V_CRSTWRM(1U)
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 8ff96c6f6de5..c5a142bea5e9 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2022,7 +2022,7 @@ static void rx_eth(struct adapter *adap, struct sge_rspq *rq,
                 qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
         skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
 
         if (unlikely(p->vlan_valid)) {
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index 427c451be1a7..421d5589cecd 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -1408,6 +1408,7 @@ static int t3_handle_intr_status(struct adapter *adapter, unsigned int reg,
                         fatal++;
                         CH_ALERT(adapter, "%s (0x%x)\n",
                                  acts->msg, status & acts->mask);
+                        status &= ~acts->mask;
                 } else if (acts->msg)
                         CH_WARN(adapter, "%s (0x%x)\n",
                                 acts->msg, status & acts->mask);
@@ -1843,11 +1844,10 @@ static int mac_intr_handler(struct adapter *adap, unsigned int idx)
                 t3_os_link_fault_handler(adap, idx);
         }
 
-        t3_write_reg(adap, A_XGM_INT_CAUSE + mac->offset, cause);
-
         if (cause & XGM_INTR_FATAL)
                 t3_fatal_err(adap);
 
+        t3_write_reg(adap, A_XGM_INT_CAUSE + mac->offset, cause);
         return cause != 0;
 }
 
@@ -3569,6 +3569,7 @@ int t3_init_hw(struct adapter *adapter, u32 fw_params)
         t3_write_reg(adapter, A_PM1_TX_MODE, 0);
         chan_init_hw(adapter, adapter->params.chan_map);
         t3_sge_init(adapter, &adapter->params.sge);
+        t3_set_reg_field(adapter, A_PL_RST, 0, F_FATALPERREN);
 
         t3_write_reg(adapter, A_T3DBG_GPIO_ACT_LOW, calc_gpio_intr(adapter));
 
@@ -3682,7 +3683,7 @@ static void mc7_prep(struct adapter *adapter, struct mc7 *mc7,
         mc7->name = name;
         mc7->offset = base_addr - MC7_PMRX_BASE_ADDR;
         cfg = t3_read_reg(adapter, mc7->offset + A_MC7_CFG);
-        mc7->size = mc7->size = G_DEN(cfg) == M_DEN ? 0 : mc7_calc_size(cfg);
+        mc7->size = G_DEN(cfg) == M_DEN ? 0 : mc7_calc_size(cfg);
         mc7->width = G_WIDTH(cfg);
 }
 
diff --git a/drivers/net/cxgb4/cxgb4.h b/drivers/net/cxgb4/cxgb4.h
index 6e562c0dad7d..3ece9f5069fa 100644
--- a/drivers/net/cxgb4/cxgb4.h
+++ b/drivers/net/cxgb4/cxgb4.h
@@ -463,6 +463,8 @@ struct sge {
         u8 counter_val[SGE_NCOUNTERS];
         unsigned int starve_thres;
         u8 idma_state[2];
+        unsigned int egr_start;
+        unsigned int ingr_start;
         void *egr_map[MAX_EGRQ];    /* qid->queue egress queue map */
         struct sge_rspq *ingr_map[MAX_INGQ]; /* qid->queue ingress queue map */
         DECLARE_BITMAP(starving_fl, MAX_EGRQ);
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index c327527fbbc8..75b9401fd484 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -175,16 +175,26 @@ enum {
 
 static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         CH_DEVICE(0xa000, 0),  /* PE10K */
-        CH_DEVICE(0x4001, 0),
-        CH_DEVICE(0x4002, 0),
-        CH_DEVICE(0x4003, 0),
-        CH_DEVICE(0x4004, 0),
-        CH_DEVICE(0x4005, 0),
-        CH_DEVICE(0x4006, 0),
-        CH_DEVICE(0x4007, 0),
-        CH_DEVICE(0x4008, 0),
-        CH_DEVICE(0x4009, 0),
-        CH_DEVICE(0x400a, 0),
+        CH_DEVICE(0x4001, -1),
+        CH_DEVICE(0x4002, -1),
+        CH_DEVICE(0x4003, -1),
+        CH_DEVICE(0x4004, -1),
+        CH_DEVICE(0x4005, -1),
+        CH_DEVICE(0x4006, -1),
+        CH_DEVICE(0x4007, -1),
+        CH_DEVICE(0x4008, -1),
+        CH_DEVICE(0x4009, -1),
+        CH_DEVICE(0x400a, -1),
+        CH_DEVICE(0x4401, 4),
+        CH_DEVICE(0x4402, 4),
+        CH_DEVICE(0x4403, 4),
+        CH_DEVICE(0x4404, 4),
+        CH_DEVICE(0x4405, 4),
+        CH_DEVICE(0x4406, 4),
+        CH_DEVICE(0x4407, 4),
+        CH_DEVICE(0x4408, 4),
+        CH_DEVICE(0x4409, 4),
+        CH_DEVICE(0x440a, 4),
         { 0, }
 };
 
@@ -423,10 +433,11 @@ static int fwevtq_handler(struct sge_rspq *q, const __be64 *rsp,
         if (likely(opcode == CPL_SGE_EGR_UPDATE)) {
                 const struct cpl_sge_egr_update *p = (void *)rsp;
                 unsigned int qid = EGR_QID(ntohl(p->opcode_qid));
-                struct sge_txq *txq = q->adap->sge.egr_map[qid];
+                struct sge_txq *txq;
 
+                txq = q->adap->sge.egr_map[qid - q->adap->sge.egr_start];
                 txq->restarts++;
-                if ((u8 *)txq < (u8 *)q->adap->sge.ethrxq) {
+                if ((u8 *)txq < (u8 *)q->adap->sge.ofldtxq) {
                         struct sge_eth_txq *eq;
 
                         eq = container_of(txq, struct sge_eth_txq, q);
@@ -658,6 +669,15 @@ static int setup_rss(struct adapter *adap)
 }
 
 /*
+ * Return the channel of the ingress queue with the given qid.
+ */
+static unsigned int rxq_to_chan(const struct sge *p, unsigned int qid)
+{
+        qid -= p->ingr_start;
+        return netdev2pinfo(p->ingr_map[qid]->netdev)->tx_chan;
+}
+
+/*
  * Wait until all NAPI handlers are descheduled.
  */
 static void quiesce_rx(struct adapter *adap)
@@ -1671,27 +1691,41 @@ static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
         return 0;
 }
 
-/*
- * Translate a physical EEPROM address to virtual.  The first 1K is accessed
- * through virtual addresses starting at 31K, the rest is accessed through
- * virtual addresses starting at 0.  This mapping is correct only for PF0.
+/**
+ *      eeprom_ptov - translate a physical EEPROM address to virtual
+ *      @phys_addr: the physical EEPROM address
+ *      @fn: the PCI function number
+ *      @sz: size of function-specific area
+ *
+ *      Translate a physical EEPROM address to virtual.  The first 1K is
+ *      accessed through virtual addresses starting at 31K, the rest is
+ *      accessed through virtual addresses starting at 0.
+ *
+ *      The mapping is as follows:
+ *      [0..1K) -> [31K..32K)
+ *      [1K..1K+A) -> [31K-A..31K)
+ *      [1K+A..ES) -> [0..ES-A-1K)
+ *
+ *      where A = @fn * @sz, and ES = EEPROM size.
  */
-static int eeprom_ptov(unsigned int phys_addr)
+static int eeprom_ptov(unsigned int phys_addr, unsigned int fn, unsigned int sz)
 {
+        fn *= sz;
         if (phys_addr < 1024)
                 return phys_addr + (31 << 10);
+        if (phys_addr < 1024 + fn)
+                return 31744 - fn + phys_addr - 1024;
         if (phys_addr < EEPROMSIZE)
-                return phys_addr - 1024;
+                return phys_addr - 1024 - fn;
         return -EINVAL;
 }
 
 /*
  * The next two routines implement eeprom read/write from physical addresses.
- * The physical->virtual translation is correct only for PF0.
  */
 static int eeprom_rd_phys(struct adapter *adap, unsigned int phys_addr, u32 *v)
 {
-        int vaddr = eeprom_ptov(phys_addr);
+        int vaddr = eeprom_ptov(phys_addr, adap->fn, EEPROMPFSIZE);
 
         if (vaddr >= 0)
                 vaddr = pci_read_vpd(adap->pdev, vaddr, sizeof(u32), v);
@@ -1700,7 +1734,7 @@ static int eeprom_rd_phys(struct adapter *adap, unsigned int phys_addr, u32 *v)
 
 static int eeprom_wr_phys(struct adapter *adap, unsigned int phys_addr, u32 v)
 {
-        int vaddr = eeprom_ptov(phys_addr);
+        int vaddr = eeprom_ptov(phys_addr, adap->fn, EEPROMPFSIZE);
 
         if (vaddr >= 0)
                 vaddr = pci_write_vpd(adap->pdev, vaddr, sizeof(u32), &v);
@@ -1743,6 +1777,14 @@ static int set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
         aligned_offset = eeprom->offset & ~3;
         aligned_len = (eeprom->len + (eeprom->offset & 3) + 3) & ~3;
 
+        if (adapter->fn > 0) {
+                u32 start = 1024 + adapter->fn * EEPROMPFSIZE;
+
+                if (aligned_offset < start ||
+                    aligned_offset + aligned_len > start + EEPROMPFSIZE)
+                        return -EPERM;
+        }
+
         if (aligned_offset != eeprom->offset || aligned_len != eeprom->len) {
                 /*
                  * RMW possibly needed for first or last words.
@@ -2304,7 +2346,7 @@ int cxgb4_create_server(const struct net_device *dev, unsigned int stid,
         req->peer_port = htons(0);
         req->local_ip = sip;
         req->peer_ip = htonl(0);
-        chan = netdev2pinfo(adap->sge.ingr_map[queue]->netdev)->tx_chan;
+        chan = rxq_to_chan(&adap->sge, queue);
         req->opt0 = cpu_to_be64(TX_CHAN(chan));
         req->opt1 = cpu_to_be64(CONN_POLICY_ASK |
                                 SYN_RSS_ENABLE | SYN_RSS_QUEUE(queue));
@@ -2346,7 +2388,7 @@ int cxgb4_create_server6(const struct net_device *dev, unsigned int stid,
         req->local_ip_lo = *(__be64 *)(sip->s6_addr + 8);
         req->peer_ip_hi = cpu_to_be64(0);
         req->peer_ip_lo = cpu_to_be64(0);
-        chan = netdev2pinfo(adap->sge.ingr_map[queue]->netdev)->tx_chan;
+        chan = rxq_to_chan(&adap->sge, queue);
         req->opt0 = cpu_to_be64(TX_CHAN(chan));
         req->opt1 = cpu_to_be64(CONN_POLICY_ASK |
                                 SYN_RSS_ENABLE | SYN_RSS_QUEUE(queue));
@@ -3061,12 +3103,16 @@ static int adap_init0(struct adapter *adap)
         params[2] = FW_PARAM_PFVF(L2T_END);
         params[3] = FW_PARAM_PFVF(FILTER_START);
         params[4] = FW_PARAM_PFVF(FILTER_END);
-        ret = t4_query_params(adap, adap->fn, adap->fn, 0, 5, params, val);
+        params[5] = FW_PARAM_PFVF(IQFLINT_START);
+        params[6] = FW_PARAM_PFVF(EQ_START);
+        ret = t4_query_params(adap, adap->fn, adap->fn, 0, 7, params, val);
         if (ret < 0)
                 goto bye;
         port_vec = val[0];
         adap->tids.ftid_base = val[3];
         adap->tids.nftids = val[4] - val[3] + 1;
+        adap->sge.ingr_start = val[5];
+        adap->sge.egr_start = val[6];
 
         if (c.ofldcaps) {
                 /* query offload-related parameters */
diff --git a/drivers/net/cxgb4/sge.c b/drivers/net/cxgb4/sge.c
index bf38cfc57565..9967f3debce7 100644
--- a/drivers/net/cxgb4/sge.c
+++ b/drivers/net/cxgb4/sge.c
@@ -557,7 +557,8 @@ out:	cred = q->avail - cred;
 
         if (unlikely(fl_starving(q))) {
                 smp_wmb();
-                set_bit(q->cntxt_id, adap->sge.starving_fl);
+                set_bit(q->cntxt_id - adap->sge.egr_start,
+                        adap->sge.starving_fl);
         }
 
         return cred;
@@ -974,7 +975,7 @@ out_free:	dev_kfree_skb(skb);
         }
 
         cpl->ctrl0 = htonl(TXPKT_OPCODE(CPL_TX_PKT_XT) |
-                           TXPKT_INTF(pi->tx_chan) | TXPKT_PF(0));
+                           TXPKT_INTF(pi->tx_chan) | TXPKT_PF(adap->fn));
         cpl->pack = htons(0);
         cpl->len = htons(skb->len);
         cpl->ctrl1 = cpu_to_be64(cntrl);
@@ -1213,7 +1214,8 @@ static void txq_stop_maperr(struct sge_ofld_txq *q)
 {
         q->mapping_err++;
         q->q.stops++;
-        set_bit(q->q.cntxt_id, q->adap->sge.txq_maperr);
+        set_bit(q->q.cntxt_id - q->adap->sge.egr_start,
+                q->adap->sge.txq_maperr);
 }
 
 /**
@@ -1603,7 +1605,7 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
                         rxq->stats.rx_cso++;
                 }
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         if (unlikely(pkt->vlan_ex)) {
                 struct vlan_group *grp = pi->vlan_grp;
@@ -1835,6 +1837,7 @@ static unsigned int process_intrq(struct adapter *adap)
                 if (RSPD_TYPE(rc->type_gen) == RSP_TYPE_INTR) {
                         unsigned int qid = ntohl(rc->pldbuflen_qid);
 
+                        qid -= adap->sge.ingr_start;
                         napi_schedule(&adap->sge.ingr_map[qid]->napi);
                 }
 
@@ -2050,14 +2053,14 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
         /* set offset to -1 to distinguish ingress queues without FL */
         iq->offset = fl ? 0 : -1;
 
-        adap->sge.ingr_map[iq->cntxt_id] = iq;
+        adap->sge.ingr_map[iq->cntxt_id - adap->sge.ingr_start] = iq;
 
         if (fl) {
                 fl->cntxt_id = ntohs(c.fl0id);
                 fl->avail = fl->pend_cred = 0;
                 fl->pidx = fl->cidx = 0;
                 fl->alloc_failed = fl->large_alloc_failed = fl->starving = 0;
-                adap->sge.egr_map[fl->cntxt_id] = fl;
+                adap->sge.egr_map[fl->cntxt_id - adap->sge.egr_start] = fl;
                 refill_fl(adap, fl, fl_cap(fl), GFP_KERNEL);
         }
         return 0;
@@ -2087,7 +2090,7 @@ static void init_txq(struct adapter *adap, struct sge_txq *q, unsigned int id)
         q->stops = q->restarts = 0;
         q->stat = (void *)&q->desc[q->size];
         q->cntxt_id = id;
-        adap->sge.egr_map[id] = q;
+        adap->sge.egr_map[id - adap->sge.egr_start] = q;
 }
 
 int t4_sge_alloc_eth_txq(struct adapter *adap, struct sge_eth_txq *txq,
@@ -2259,7 +2262,7 @@ static void free_rspq_fl(struct adapter *adap, struct sge_rspq *rq,
 {
         unsigned int fl_id = fl ? fl->cntxt_id : 0xffff;
 
-        adap->sge.ingr_map[rq->cntxt_id] = NULL;
+        adap->sge.ingr_map[rq->cntxt_id - adap->sge.ingr_start] = NULL;
         t4_iq_free(adap, adap->fn, adap->fn, 0, FW_IQ_TYPE_FL_INT_CAP,
                    rq->cntxt_id, fl_id, 0xffff);
         dma_free_coherent(adap->pdev_dev, (rq->size + 1) * rq->iqe_len,
diff --git a/drivers/net/cxgb4/t4_hw.h b/drivers/net/cxgb4/t4_hw.h
index 10a055565776..c26b455f37de 100644
--- a/drivers/net/cxgb4/t4_hw.h
+++ b/drivers/net/cxgb4/t4_hw.h
@@ -42,6 +42,7 @@ enum {
         MAX_MTU        = 9600,  /* max MAC MTU, excluding header + FCS */
         EEPROMSIZE     = 17408, /* Serial EEPROM physical size */
         EEPROMVSIZE    = 32768, /* Serial EEPROM virtual address space size */
+        EEPROMPFSIZE   = 1024,  /* EEPROM writable area size for PFn, n>0 */
         RSS_NENTRIES   = 2048,  /* # of entries in RSS mapping table */
         TCB_SIZE       = 128,   /* TCB size */
         NMTUS          = 16,    /* size of MTU table */
diff --git a/drivers/net/cxgb4/t4fw_api.h b/drivers/net/cxgb4/t4fw_api.h
index 0969f2fbc1b0..940584a8a640 100644
--- a/drivers/net/cxgb4/t4fw_api.h
+++ b/drivers/net/cxgb4/t4fw_api.h
@@ -487,6 +487,11 @@ enum fw_params_param_pfvf {
         FW_PARAMS_PARAM_PFVF_CPMASK     = 0x25,
         FW_PARAMS_PARAM_PFVF_OCQ_START  = 0x26,
         FW_PARAMS_PARAM_PFVF_OCQ_END    = 0x27,
+        FW_PARAMS_PARAM_PFVF_CONM_MAP   = 0x28,
+        FW_PARAMS_PARAM_PFVF_IQFLINT_START = 0x29,
+        FW_PARAMS_PARAM_PFVF_IQFLINT_END = 0x2A,
+        FW_PARAMS_PARAM_PFVF_EQ_START   = 0x2B,
+        FW_PARAMS_PARAM_PFVF_EQ_END     = 0x2C,
 };
 
 /*
diff --git a/drivers/net/cxgb4vf/sge.c b/drivers/net/cxgb4vf/sge.c
index eb5a1c9cb2d3..f10864ddafbe 100644
--- a/drivers/net/cxgb4vf/sge.c
+++ b/drivers/net/cxgb4vf/sge.c
@@ -1520,7 +1520,6 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
         __skb_pull(skb, PKTSHIFT);
         skb->protocol = eth_type_trans(skb, rspq->netdev);
         skb_record_rx_queue(skb, rspq->idx);
-        skb->dev->last_rx = jiffies;                  /* XXX removed 2.6.29 */
         pi = netdev_priv(skb->dev);
         rxq->stats.pkts++;
 
@@ -1535,7 +1534,7 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
                 }
                 rxq->stats.rx_cso++;
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         if (unlikely(pkt->vlan_ex)) {
                 struct vlan_group *grp = pi->vlan_grp;
diff --git a/drivers/net/de620.c b/drivers/net/de620.c
index f3650fd096f4..1c51a7576119 100644
--- a/drivers/net/de620.c
+++ b/drivers/net/de620.c
@@ -676,7 +676,7 @@ static int de620_rx_intr(struct net_device *dev)
         de620_set_register(dev, W_NPRF, next_rx_page);
         pr_debug("next_rx_page=%d CPR=%d\n", next_rx_page, curr_page);
 
-        return (next_rx_page != curr_page); /* That was slightly tricky... */
+        return next_rx_page != curr_page; /* That was slightly tricky... */
 }
 
 /*********************************************
diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index d7de376d7178..219eb5ad5c12 100644
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -1255,7 +1255,7 @@ static int __devinit dec_lance_probe(struct device *bdev, const int type)
          */
         init_timer(&lp->multicast_timer);
         lp->multicast_timer.data = (unsigned long) dev;
-        lp->multicast_timer.function = &lance_set_multicast_retry;
+        lp->multicast_timer.function = lance_set_multicast_retry;
 
         ret = register_netdev(dev);
         if (ret) {
diff --git a/drivers/net/defxx.c b/drivers/net/defxx.c
index e5667c55844e..417e14385623 100644
--- a/drivers/net/defxx.c
+++ b/drivers/net/defxx.c
@@ -1024,7 +1024,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
                                  &data) != DFX_K_SUCCESS) {
                 printk("%s: Could not read adapter factory MAC address!\n",
                        print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         le32 = cpu_to_le32(data);
         memcpy(&bp->factory_mac_addr[0], &le32, sizeof(u32));
@@ -1033,7 +1033,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
                                  &data) != DFX_K_SUCCESS) {
                 printk("%s: Could not read adapter factory MAC address!\n",
                        print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         le32 = cpu_to_le32(data);
         memcpy(&bp->factory_mac_addr[4], &le32, sizeof(u16));
@@ -1075,7 +1075,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
         if (top_v == NULL) {
                 printk("%s: Could not allocate memory for host buffers "
                        "and structures!\n", print_name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
         }
         memset(top_v, 0, alloc_size);   /* zero out memory before continuing */
         top_p = bp->kmalloced_dma;      /* get physical address of buffer */
@@ -1145,7 +1145,7 @@ static int __devinit dfx_driver_init(struct net_device *dev,
         DBG_printk("%s: Consumer block virt = %0lX, phys = %0X\n",
                    print_name, (long)bp->cons_block_virt, bp->cons_block_phys);
 
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
 }
 
 
@@ -1195,7 +1195,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_uninit(bp, bp->reset_type) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not uninitialize/reset adapter!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1229,7 +1229,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                                                         NULL) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not set adapter burst size!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1246,7 +1246,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                                                         NULL) != DFX_K_SUCCESS)
                 {
                 printk("%s: Could not set consumer block address!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1278,7 +1278,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: DMA command request failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Set the initial values for eFDXEnable and MACTReq MIB objects */
@@ -1294,7 +1294,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: DMA command request failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialize adapter CAM */
@@ -1302,7 +1302,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_ctl_update_cam(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: Adapter CAM update failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialize adapter filters */
@@ -1310,7 +1310,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
         if (dfx_ctl_update_filters(bp) != DFX_K_SUCCESS)
                 {
                 printk("%s: Adapter filters update failed!\n", bp->dev->name);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /*
@@ -1328,7 +1328,7 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                 printk("%s: Receive buffer allocation failed\n", bp->dev->name);
                 if (get_buffers)
                         dfx_rcv_flush(bp);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Issue START command and bring adapter to LINK_(UN)AVAILABLE state */
@@ -1339,13 +1339,13 @@ static int dfx_adap_init(DFX_board_t *bp, int get_buffers)
                 printk("%s: Start command failed\n", bp->dev->name);
                 if (get_buffers)
                         dfx_rcv_flush(bp);
-                return(DFX_K_FAILURE);
+                return DFX_K_FAILURE;
                 }
 
         /* Initialization succeeded, reenable PDQ interrupts */
 
         dfx_port_write_long(bp, PI_PDQ_K_REG_HOST_INT_ENB, PI_HOST_INT_K_ENABLE_DEF_INTS);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -1434,7 +1434,7 @@ static int dfx_open(struct net_device *dev)
 
         /* Set device structure info */
         netif_start_queue(dev);
-        return(0);
+        return 0;
 }
 
 
@@ -1526,7 +1526,7 @@ static int dfx_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        return(0);
+        return 0;
 }
 
 
@@ -2027,7 +2027,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
 
         bp->cmd_req_virt->cmd_type = PI_CMD_K_SMT_MIB_GET;
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return((struct net_device_stats *) &bp->stats);
+                return (struct net_device_stats *)&bp->stats;
 
         /* Fill the bp->stats structure with the SMT MIB object values */
 
@@ -2128,7 +2128,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
 
         bp->cmd_req_virt->cmd_type = PI_CMD_K_CNTRS_GET;
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return((struct net_device_stats *) &bp->stats);
+                return (struct net_device_stats *)&bp->stats;
 
         /* Fill the bp->stats structure with the FDDI counter values */
 
@@ -2144,7 +2144,7 @@ static struct net_device_stats *dfx_ctl_get_stats(struct net_device *dev)
         bp->stats.port_lem_cts[0]                       = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[0].ls;
         bp->stats.port_lem_cts[1]                       = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[1].ls;
 
-        return((struct net_device_stats *) &bp->stats);
+        return (struct net_device_stats *)&bp->stats;
         }
 
 
@@ -2354,7 +2354,7 @@ static int dfx_ctl_set_mac_address(struct net_device *dev, void *addr)
                 {
                 DBG_printk("%s: Adapter CAM updated with new MAC address\n", dev->name);
                 }
-        return(0);                      /* always return zero */
+        return 0;                       /* always return zero */
         }
 
 
@@ -2438,8 +2438,8 @@ static int dfx_ctl_update_cam(DFX_board_t *bp)
         /* Issue command to update adapter CAM, then return */
 
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return(DFX_K_FAILURE);
-        return(DFX_K_SUCCESS);
+                return DFX_K_FAILURE;
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2504,8 +2504,8 @@ static int dfx_ctl_update_filters(DFX_board_t *bp)
         /* Issue command to update adapter filters, then return */
 
         if (dfx_hw_dma_cmd_req(bp) != DFX_K_SUCCESS)
-                return(DFX_K_FAILURE);
-        return(DFX_K_SUCCESS);
+                return DFX_K_FAILURE;
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2561,7 +2561,7 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 (status == PI_STATE_K_HALTED)           ||
                 (status == PI_STATE_K_DMA_UNAVAIL)      ||
                 (status == PI_STATE_K_UPGRADE))
-                return(DFX_K_OUTSTATE);
+                return DFX_K_OUTSTATE;
 
         /* Put response buffer on the command response queue */
 
@@ -2599,7 +2599,7 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /* Bump (and wrap) the completion index and write out to register */
 
@@ -2619,14 +2619,14 @@ static int dfx_hw_dma_cmd_req(DFX_board_t *bp)
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /* Bump (and wrap) the completion index and write out to register */
 
         bp->cmd_rsp_reg.index.comp += 1;
         bp->cmd_rsp_reg.index.comp &= PI_CMD_RSP_K_NUM_ENTRIES-1;
         dfx_port_write_long(bp, PI_PDQ_K_REG_CMD_RSP_PROD, bp->cmd_rsp_reg.lword);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2700,7 +2700,7 @@ static int dfx_hw_port_ctrl_req(
                 udelay(100);                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
+                return DFX_K_HW_TIMEOUT;
 
         /*
          * If the address of host_data is non-zero, assume caller has supplied a
@@ -2710,7 +2710,7 @@ static int dfx_hw_port_ctrl_req(
 
         if (host_data != NULL)
                 dfx_port_read_long(bp, PI_PDQ_K_REG_HOST_DATA, host_data);
-        return(DFX_K_SUCCESS);
+        return DFX_K_SUCCESS;
         }
 
 
@@ -2800,7 +2800,7 @@ static int dfx_hw_adap_state_rd(DFX_board_t *bp)
         PI_UINT32 port_status;          /* Port Status register value */
 
         dfx_port_read_long(bp, PI_PDQ_K_REG_PORT_STATUS, &port_status);
-        return((port_status & PI_PSTATUS_M_STATE) >> PI_PSTATUS_V_STATE);
+        return (port_status & PI_PSTATUS_M_STATE) >> PI_PSTATUS_V_STATE;
         }
 
 
@@ -2852,8 +2852,8 @@ static int dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type)
                 udelay(100);                                    /* wait for 100 microseconds */
                 }
         if (timeout_cnt == 0)
-                return(DFX_K_HW_TIMEOUT);
-        return(DFX_K_SUCCESS);
+                return DFX_K_HW_TIMEOUT;
+        return DFX_K_SUCCESS;
         }
 
 /*
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index a2f238d20caa..e1a8216ff692 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -465,7 +465,7 @@ rio_open (struct net_device *dev)
         init_timer (&np->timer);
         np->timer.expires = jiffies + 1*HZ;
         np->timer.data = (unsigned long) dev;
-        np->timer.function = &rio_timer;
+        np->timer.function = rio_timer;
         add_timer (&np->timer);
 
         /* Start Tx/Rx */
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 4fd6b2b4554b..9f6aeefa06bf 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -1056,7 +1056,7 @@ dm9000_rx(struct net_device *dev)
                                 if ((((rxbyte & 0x1c) << 3) & rxbyte) == 0)
                                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                                 else
-                                        skb->ip_summed = CHECKSUM_NONE;
+                                        skb_checksum_none_assert(skb);
                         }
                         netif_rx(skb);
                         dev->stats.rx_packets++;
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 8e2eab4e7c75..b0aa9e68990a 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2215,10 +2215,10 @@ static int e100_change_mtu(struct net_device *netdev, int new_mtu)
 static int e100_asf(struct nic *nic)
 {
         /* ASF can be enabled from eeprom */
-        return((nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
+        return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
            (nic->eeprom[eeprom_config_asf] & eeprom_asf) &&
            !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
-           ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE));
+           ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE);
 }
 
 static int e100_up(struct nic *nic)
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 99288b95aead..a881dd0093bd 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -310,6 +310,9 @@ struct e1000_adapter {
         int need_ioport;
 
         bool discarding;
+
+        struct work_struct fifo_stall_task;
+        struct work_struct phy_info_task;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5cc39ed289c6..cb3f84b81793 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -123,8 +123,10 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter,
                                 struct e1000_rx_ring *rx_ring);
 static void e1000_set_rx_mode(struct net_device *netdev);
 static void e1000_update_phy_info(unsigned long data);
+static void e1000_update_phy_info_task(struct work_struct *work);
 static void e1000_watchdog(unsigned long data);
 static void e1000_82547_tx_fifo_stall(unsigned long data);
+static void e1000_82547_tx_fifo_stall_task(struct work_struct *work);
 static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                                     struct net_device *netdev);
 static struct net_device_stats * e1000_get_stats(struct net_device *netdev);
@@ -519,8 +521,21 @@ void e1000_down(struct e1000_adapter *adapter)
         e1000_clean_all_rx_rings(adapter);
 }
 
+void e1000_reinit_safe(struct e1000_adapter *adapter)
+{
+        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+                msleep(1);
+        rtnl_lock();
+        e1000_down(adapter);
+        e1000_up(adapter);
+        rtnl_unlock();
+        clear_bit(__E1000_RESETTING, &adapter->flags);
+}
+
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
+        /* if rtnl_lock is not held the call path is bogus */
+        ASSERT_RTNL();
         WARN_ON(in_interrupt());
         while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                 msleep(1);
@@ -790,6 +805,70 @@ static const struct net_device_ops e1000_netdev_ops = {
 };
 
 /**
+ * e1000_init_hw_struct - initialize members of hw struct
+ * @adapter: board private struct
+ * @hw: structure used by e1000_hw.c
+ *
+ * Factors out initialization of the e1000_hw struct to its own function
+ * that can be called very early at init (just after struct allocation).
+ * Fields are initialized based on PCI device information and
+ * OS network device settings (MTU size).
+ * Returns negative error codes if MAC type setup fails.
+ */
+static int e1000_init_hw_struct(struct e1000_adapter *adapter,
+                                struct e1000_hw *hw)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        /* PCI config space info */
+        hw->vendor_id = pdev->vendor;
+        hw->device_id = pdev->device;
+        hw->subsystem_vendor_id = pdev->subsystem_vendor;
+        hw->subsystem_id = pdev->subsystem_device;
+        hw->revision_id = pdev->revision;
+
+        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
+
+        hw->max_frame_size = adapter->netdev->mtu +
+                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
+        hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
+
+        /* identify the MAC */
+        if (e1000_set_mac_type(hw)) {
+                e_err(probe, "Unknown MAC Type\n");
+                return -EIO;
+        }
+
+        switch (hw->mac_type) {
+        default:
+                break;
+        case e1000_82541:
+        case e1000_82547:
+        case e1000_82541_rev_2:
+        case e1000_82547_rev_2:
+                hw->phy_init_script = 1;
+                break;
+        }
+
+        e1000_set_media_type(hw);
+        e1000_get_bus_info(hw);
+
+        hw->wait_autoneg_complete = false;
+        hw->tbi_compatibility_en = true;
+        hw->adaptive_ifs = true;
+
+        /* Copper options */
+
+        if (hw->media_type == e1000_media_type_copper) {
+                hw->mdix = AUTO_ALL_MODES;
+                hw->disable_polarity_correction = false;
+                hw->master_slave = E1000_MASTER_SLAVE;
+        }
+
+        return 0;
+}
+
+/**
  * e1000_probe - Device Initialization Routine
  * @pdev: PCI device information struct
  * @ent: entry in e1000_pci_tbl
@@ -826,22 +905,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         if (err)
                 return err;
 
-        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
-            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
-                pci_using_dac = 1;
-        } else {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
-                if (err) {
-                        err = dma_set_coherent_mask(&pdev->dev,
-                                                    DMA_BIT_MASK(32));
-                        if (err) {
-                                pr_err("No usable DMA config, aborting\n");
-                                goto err_dma;
-                        }
-                }
-                pci_using_dac = 0;
-        }
-
         err = pci_request_selected_regions(pdev, bars, e1000_driver_name);
         if (err)
                 goto err_pci_reg;
@@ -885,6 +948,32 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 }
         }
 
+        /* make ready for any if (hw->...) below */
+        err = e1000_init_hw_struct(adapter, hw);
+        if (err)
+                goto err_sw_init;
+
+        /*
+         * there is a workaround being applied below that limits
+         * 64-bit DMA addresses to 64-bit hardware.  There are some
+         * 32-bit adapters that Tx hang when given 64-bit DMA addresses
+         */
+        pci_using_dac = 0;
+        if ((hw->bus_type == e1000_bus_type_pcix) &&
+            !dma_set_mask(&pdev->dev, DMA_BIT_MASK(64))) {
+                /*
+                 * according to DMA-API-HOWTO, coherent calls will always
+                 * succeed if the set call did
+                 */
+                dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+                pci_using_dac = 1;
+        } else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) {
+                dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+        } else {
+                pr_err("No usable DMA config, aborting\n");
+                goto err_dma;
+        }
+
         netdev->netdev_ops = &e1000_netdev_ops;
         e1000_set_ethtool_ops(netdev);
         netdev->watchdog_timeo = 5 * HZ;
@@ -914,8 +1003,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
            (hw->mac_type != e1000_82547))
                 netdev->features |= NETIF_F_TSO;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         netdev->vlan_features |= NETIF_F_TSO;
         netdev->vlan_features |= NETIF_F_HW_CSUM;
@@ -959,21 +1050,21 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         if (!is_valid_ether_addr(netdev->perm_addr))
                 e_err(probe, "Invalid MAC Address\n");
 
-        e1000_get_bus_info(hw);
-
         init_timer(&adapter->tx_fifo_stall_timer);
-        adapter->tx_fifo_stall_timer.function = &e1000_82547_tx_fifo_stall;
+        adapter->tx_fifo_stall_timer.function = e1000_82547_tx_fifo_stall;
         adapter->tx_fifo_stall_timer.data = (unsigned long)adapter;
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &e1000_watchdog;
+        adapter->watchdog_timer.function = e1000_watchdog;
         adapter->watchdog_timer.data = (unsigned long) adapter;
 
         init_timer(&adapter->phy_info_timer);
-        adapter->phy_info_timer.function = &e1000_update_phy_info;
+        adapter->phy_info_timer.function = e1000_update_phy_info;
         adapter->phy_info_timer.data = (unsigned long)adapter;
 
+        INIT_WORK(&adapter->fifo_stall_task, e1000_82547_tx_fifo_stall_task);
         INIT_WORK(&adapter->reset_task, e1000_reset_task);
+        INIT_WORK(&adapter->phy_info_task, e1000_update_phy_info_task);
 
         e1000_check_options(adapter);
 
@@ -1072,6 +1163,7 @@ err_eeprom:
                 iounmap(hw->flash_address);
         kfree(adapter->tx_ring);
         kfree(adapter->rx_ring);
+err_dma:
 err_sw_init:
         iounmap(hw->hw_addr);
 err_ioremap:
@@ -1079,7 +1171,6 @@ err_ioremap:
 err_alloc_etherdev:
         pci_release_selected_regions(pdev, bars);
 err_pci_reg:
-err_dma:
         pci_disable_device(pdev);
         return err;
 }
@@ -1131,62 +1222,12 @@ static void __devexit e1000_remove(struct pci_dev *pdev)
  * @adapter: board private structure to initialize
  *
  * e1000_sw_init initializes the Adapter private data structure.
- * Fields are initialized based on PCI device information and
- * OS network device settings (MTU size).
+ * e1000_init_hw_struct MUST be called before this function
  **/
 
 static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
 {
-        struct e1000_hw *hw = &adapter->hw;
-        struct net_device *netdev = adapter->netdev;
-        struct pci_dev *pdev = adapter->pdev;
-
-        /* PCI config space info */
-
-        hw->vendor_id = pdev->vendor;
-        hw->device_id = pdev->device;
-        hw->subsystem_vendor_id = pdev->subsystem_vendor;
-        hw->subsystem_id = pdev->subsystem_device;
-        hw->revision_id = pdev->revision;
-
-        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
-
         adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
-        hw->max_frame_size = netdev->mtu +
-                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
-        hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
-
-        /* identify the MAC */
-
-        if (e1000_set_mac_type(hw)) {
-                e_err(probe, "Unknown MAC Type\n");
-                return -EIO;
-        }
-
-        switch (hw->mac_type) {
-        default:
-                break;
-        case e1000_82541:
-        case e1000_82547:
-        case e1000_82541_rev_2:
-        case e1000_82547_rev_2:
-                hw->phy_init_script = 1;
-                break;
-        }
-
-        e1000_set_media_type(hw);
-
-        hw->wait_autoneg_complete = false;
-        hw->tbi_compatibility_en = true;
-        hw->adaptive_ifs = true;
-
-        /* Copper options */
-
-        if (hw->media_type == e1000_media_type_copper) {
-                hw->mdix = AUTO_ALL_MODES;
-                hw->disable_polarity_correction = false;
-                hw->master_slave = E1000_MASTER_SLAVE;
-        }
 
         adapter->num_tx_queues = 1;
         adapter->num_rx_queues = 1;
@@ -2210,22 +2251,45 @@ static void e1000_set_rx_mode(struct net_device *netdev)
 static void e1000_update_phy_info(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+        schedule_work(&adapter->phy_info_task);
+}
+
+static void e1000_update_phy_info_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                                     struct e1000_adapter,
+                                                     phy_info_task);
         struct e1000_hw *hw = &adapter->hw;
+
+        rtnl_lock();
         e1000_phy_get_info(hw, &adapter->phy_info);
+        rtnl_unlock();
 }
 
 /**
  * e1000_82547_tx_fifo_stall - Timer Call-back
  * @data: pointer to adapter cast into an unsigned long
  **/
-
 static void e1000_82547_tx_fifo_stall(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+        schedule_work(&adapter->fifo_stall_task);
+}
+
+/**
+ * e1000_82547_tx_fifo_stall_task - task to complete work
+ * @work: work struct contained inside adapter struct
+ **/
+static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                                     struct e1000_adapter,
+                                                     fifo_stall_task);
         struct e1000_hw *hw = &adapter->hw;
         struct net_device *netdev = adapter->netdev;
         u32 tctl;
 
+        rtnl_lock();
         if (atomic_read(&adapter->tx_fifo_stall)) {
                 if ((er32(TDT) == er32(TDH)) &&
                    (er32(TDFT) == er32(TDFH)) &&
@@ -2246,6 +2310,7 @@ static void e1000_82547_tx_fifo_stall(unsigned long data)
                         mod_timer(&adapter->tx_fifo_stall_timer, jiffies + 1);
                 }
         }
+        rtnl_unlock();
 }
 
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -3113,7 +3178,7 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter =
                 container_of(work, struct e1000_adapter, reset_task);
 
-        e1000_reinit_locked(adapter);
+        e1000_reinit_safe(adapter);
 }
 
 /**
@@ -3535,7 +3600,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
         adapter->total_tx_packets += total_tx_packets;
         netdev->stats.tx_bytes += total_tx_bytes;
         netdev->stats.tx_packets += total_tx_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 /**
@@ -3552,7 +3617,8 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
         struct e1000_hw *hw = &adapter->hw;
         u16 status = (u16)status_err;
         u8 errors = (u8)(status_err >> 24);
-        skb->ip_summed = CHECKSUM_NONE;
+
+        skb_checksum_none_assert(skb);
 
         /* 82543 or newer only */
         if (unlikely(hw->mac_type < e1000_82543)) return;
@@ -3598,13 +3664,14 @@ static void e1000_consume_page(struct e1000_buffer *bi, struct sk_buff *skb,
 static void e1000_receive_skb(struct e1000_adapter *adapter, u8 status,
                               __le16 vlan, struct sk_buff *skb)
 {
-        if (unlikely(adapter->vlgrp && (status & E1000_RXD_STAT_VP))) {
-                vlan_hwaccel_receive_skb(skb, adapter->vlgrp,
-                                         le16_to_cpu(vlan) &
-                                         E1000_RXD_SPC_VLAN_MASK);
-        } else {
-                netif_receive_skb(skb);
-        }
+        skb->protocol = eth_type_trans(skb, adapter->netdev);
+
+        if ((unlikely(adapter->vlgrp && (status & E1000_RXD_STAT_VP))))
+                vlan_gro_receive(&adapter->napi, adapter->vlgrp,
+                                 le16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK,
+                                 skb);
+        else
+                napi_gro_receive(&adapter->napi, skb);
 }
 
 /**
@@ -3762,8 +3829,6 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
                         goto next_desc;
                 }
 
-                skb->protocol = eth_type_trans(skb, netdev);
-
                 e1000_receive_skb(adapter, status, rx_desc->special, skb);
 
 next_desc:
@@ -3926,8 +3991,6 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                   ((u32)(rx_desc->errors) << 24),
                                   le16_to_cpu(rx_desc->csum), skb);
 
-                skb->protocol = eth_type_trans(skb, netdev);
-
                 e1000_receive_skb(adapter, status, rx_desc->special, skb);
 
 next_desc:
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 6355a1b779d3..b7f15b3f0e03 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -368,7 +368,7 @@ out:
 static u32 e1000_get_rx_csum(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
-        return (adapter->flags & FLAG_RX_CSUM_ENABLED);
+        return adapter->flags & FLAG_RX_CSUM_ENABLED;
 }
 
 static int e1000_set_rx_csum(struct net_device *netdev, u32 data)
@@ -389,7 +389,7 @@ static int e1000_set_rx_csum(struct net_device *netdev, u32 data)
 
 static u32 e1000_get_tx_csum(struct net_device *netdev)
 {
-        return ((netdev->features & NETIF_F_HW_CSUM) != 0);
+        return (netdev->features & NETIF_F_HW_CSUM) != 0;
 }
 
 static int e1000_set_tx_csum(struct net_device *netdev, u32 data)
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index e561d15c3eb1..c69563c3ce96 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -475,7 +475,8 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
 {
         u16 status = (u16)status_err;
         u8 errors = (u8)(status_err >> 24);
-        skb->ip_summed = CHECKSUM_NONE;
+
+        skb_checksum_none_assert(skb);
 
         /* Ignore Checksum bit is set */
         if (status & E1000_RXD_STAT_IXSM)
@@ -1052,7 +1053,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
         adapter->total_tx_packets += total_tx_packets;
         netdev->stats.tx_bytes += total_tx_bytes;
         netdev->stats.tx_packets += total_tx_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 /**
@@ -3411,22 +3412,16 @@ static int e1000_test_msi_interrupt(struct e1000_adapter *adapter)
 
         if (adapter->flags & FLAG_MSI_TEST_FAILED) {
                 adapter->int_mode = E1000E_INT_MODE_LEGACY;
-                err = -EIO;
-                e_info("MSI interrupt test failed!\n");
-        }
+                e_info("MSI interrupt test failed, using legacy interrupt.\n");
+        } else
+                e_dbg("MSI interrupt test succeeded!\n");
 
         free_irq(adapter->pdev->irq, netdev);
         pci_disable_msi(adapter->pdev);
 
-        if (err == -EIO)
-                goto msi_test_failed;
-
-        /* okay so the test worked, restore settings */
-        e_dbg("MSI interrupt test succeeded!\n");
 msi_test_failed:
         e1000e_set_interrupt_capability(adapter);
-        e1000_request_irq(adapter);
-        return err;
+        return e1000_request_irq(adapter);
 }
 
 /**
@@ -3458,21 +3453,6 @@ static int e1000_test_msi(struct e1000_adapter *adapter)
                 pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd);
         }
 
-        /* success ! */
-        if (!err)
-                return 0;
-
-        /* EIO means MSI test failed */
-        if (err != -EIO)
-                return err;
-
-        /* back to INTx mode */
-        e_warn("MSI interrupt test failed, using legacy interrupt.\n");
-
-        e1000_free_irq(adapter);
-
-        err = e1000_request_irq(adapter);
-
         return err;
 }
 
@@ -5712,8 +5692,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         netdev->vlan_features |= NETIF_F_HW_CSUM;
         netdev->vlan_features |= NETIF_F_SG;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (e1000e_enable_mng_pass_thru(&adapter->hw))
                 adapter->flags |= FLAG_MNG_PT_ENABLED;
@@ -5754,11 +5736,11 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         }
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &e1000_watchdog;
+        adapter->watchdog_timer.function = e1000_watchdog;
         adapter->watchdog_timer.data = (unsigned long) adapter;
 
         init_timer(&adapter->phy_info_timer);
-        adapter->phy_info_timer.function = &e1000_update_phy_info;
+        adapter->phy_info_timer.function = e1000_update_phy_info;
         adapter->phy_info_timer.data = (unsigned long) adapter;
 
         INIT_WORK(&adapter->reset_task, e1000_reset_task);
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index 8d97f168f018..7c826319ee5a 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1457,11 +1457,11 @@ hardware_send_packet(struct net_device *dev, void *buf, short length)
         if (net_debug > 5)
                 printk(KERN_DEBUG "%s: entering hardware_send_packet routine.\n", dev->name);
 
-                /* determine how much of the transmit buffer space is available */
-                if (lp->tx_end > lp->tx_start)
+        /* determine how much of the transmit buffer space is available */
+        if (lp->tx_end > lp->tx_start)
                 tx_available = lp->xmt_ram - (lp->tx_end - lp->tx_start);
-                else if (lp->tx_end < lp->tx_start)
-                        tx_available = lp->tx_start - lp->tx_end;
+        else if (lp->tx_end < lp->tx_start)
+                tx_available = lp->tx_start - lp->tx_end;
         else tx_available = lp->xmt_ram;
 
         if (((((length + 3) >> 1) << 1) + 2*XMT_HEADER) >= tx_available) {
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a333b42111b8..190fb691d20b 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -180,7 +180,7 @@ static void ehea_update_firmware_handles(void)
                          num_portres * EHEA_NUM_PORTRES_FW_HANDLES;
 
         if (num_fw_handles) {
-                arr = kzalloc(num_fw_handles * sizeof(*arr), GFP_KERNEL);
+                arr = kcalloc(num_fw_handles, sizeof(*arr), GFP_KERNEL);
                 if (!arr)
                         goto out;  /* Keep the existing array */
         } else
@@ -265,7 +265,7 @@ static void ehea_update_bcmc_registrations(void)
                 }
 
         if (num_registrations) {
-                arr = kzalloc(num_registrations * sizeof(*arr), GFP_ATOMIC);
+                arr = kcalloc(num_registrations, sizeof(*arr), GFP_ATOMIC);
                 if (!arr)
                         goto out;  /* Keep the existing array */
         } else
@@ -818,8 +818,6 @@ static void check_sqs(struct ehea_port *port)
                         }
                 }
         }
-
-        return;
 }
 
 
@@ -3721,7 +3719,7 @@ int __init ehea_module_init(void)
         if (ret)
                 ehea_info("failed registering memory remove notifier");
 
-        ret = crash_shutdown_register(&ehea_crash_handler);
+        ret = crash_shutdown_register(ehea_crash_handler);
         if (ret)
                 ehea_info("failed registering crash handler");
 
@@ -3746,7 +3744,7 @@ out3:
 out2:
         unregister_memory_notifier(&ehea_mem_nb);
         unregister_reboot_notifier(&ehea_reboot_nb);
-        crash_shutdown_unregister(&ehea_crash_handler);
+        crash_shutdown_unregister(ehea_crash_handler);
 out:
         return ret;
 }
@@ -3759,7 +3757,7 @@ static void __exit ehea_module_exit(void)
         driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
         ibmebus_unregister_driver(&ehea_driver);
         unregister_reboot_notifier(&ehea_reboot_nb);
-        ret = crash_shutdown_unregister(&ehea_crash_handler);
+        ret = crash_shutdown_unregister(ehea_crash_handler);
         if (ret)
                 ehea_info("failed unregistering crash handler");
         unregister_memory_notifier(&ehea_mem_nb);
diff --git a/drivers/net/enic/enic.h b/drivers/net/enic/enic.h
index f239aa8c6f4c..75869ed7226f 100644
--- a/drivers/net/enic/enic.h
+++ b/drivers/net/enic/enic.h
@@ -32,7 +32,7 @@
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "1.4.1.1"
+#define DRV_VERSION             "1.4.1.2"
 #define DRV_COPYRIGHT           "Copyright 2008-2010 Cisco Systems, Inc"
 
 #define ENIC_BARS_MAX           6
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 9aab85366d21..711077a2e345 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -911,7 +911,9 @@ static int enic_set_mac_address_dynamic(struct net_device *netdev, void *p)
 
 static int enic_set_mac_address(struct net_device *netdev, void *p)
 {
-        return -EOPNOTSUPP;
+        struct sockaddr *saddr = p;
+
+        return enic_set_mac_addr(netdev, (char *)saddr->sa_data);
 }
 
 static int enic_dev_packet_filter(struct enic *enic, int directed,
@@ -2152,17 +2154,6 @@ void enic_dev_deinit(struct enic *enic)
         enic_clear_intr_mode(enic);
 }
 
-static int enic_dev_stats_clear(struct enic *enic)
-{
-        int err;
-
-        spin_lock(&enic->devcmd_lock);
-        err = vnic_dev_stats_clear(enic->vdev);
-        spin_unlock(&enic->devcmd_lock);
-
-        return err;
-}
-
 int enic_dev_init(struct enic *enic)
 {
         struct device *dev = enic_get_dev(enic);
@@ -2205,10 +2196,6 @@ int enic_dev_init(struct enic *enic)
 
         enic_init_vnic_resources(enic);
 
-        /* Clear LIF stats
-         */
-        enic_dev_stats_clear(enic);
-
         err = enic_set_rq_alloc_buf(enic);
         if (err) {
                 dev_err(dev, "Failed to set RQ buffer allocator, aborting\n");
diff --git a/drivers/net/enic/vnic_dev.c b/drivers/net/enic/vnic_dev.c
index 6a5b578a69e1..08d5d42da260 100644
--- a/drivers/net/enic/vnic_dev.c
+++ b/drivers/net/enic/vnic_dev.c
@@ -74,6 +74,7 @@ static int vnic_dev_discover_res(struct vnic_dev *vdev,
         struct vnic_dev_bar *bar, unsigned int num_bars)
 {
         struct vnic_resource_header __iomem *rh;
+        struct mgmt_barmap_hdr __iomem *mrh;
         struct vnic_resource __iomem *r;
         u8 type;
 
@@ -85,22 +86,32 @@ static int vnic_dev_discover_res(struct vnic_dev *vdev,
                 return -EINVAL;
         }
 
-        rh = bar->vaddr;
+        rh  = bar->vaddr;
+        mrh = bar->vaddr;
         if (!rh) {
                 pr_err("vNIC BAR0 res hdr not mem-mapped\n");
                 return -EINVAL;
         }
 
-        if (ioread32(&rh->magic) != VNIC_RES_MAGIC ||
-            ioread32(&rh->version) != VNIC_RES_VERSION) {
-                pr_err("vNIC BAR0 res magic/version error "
-                        "exp (%lx/%lx) curr (%x/%x)\n",
+        /* Check for mgmt vnic in addition to normal vnic */
+        if ((ioread32(&rh->magic) != VNIC_RES_MAGIC) ||
+                (ioread32(&rh->version) != VNIC_RES_VERSION)) {
+                if ((ioread32(&mrh->magic) != MGMTVNIC_MAGIC) ||
+                        (ioread32(&mrh->version) != MGMTVNIC_VERSION)) {
+                        pr_err("vNIC BAR0 res magic/version error "
+                        "exp (%lx/%lx) or (%lx/%lx), curr (%x/%x)\n",
                         VNIC_RES_MAGIC, VNIC_RES_VERSION,
+                        MGMTVNIC_MAGIC, MGMTVNIC_VERSION,
                         ioread32(&rh->magic), ioread32(&rh->version));
-                return -EINVAL;
+                        return -EINVAL;
+                }
         }
 
-        r = (struct vnic_resource __iomem *)(rh + 1);
+        if (ioread32(&mrh->magic) == MGMTVNIC_MAGIC)
+                r = (struct vnic_resource __iomem *)(mrh + 1);
+        else
+                r = (struct vnic_resource __iomem *)(rh + 1);
+
 
         while ((type = ioread8(&r->type)) != RES_TYPE_EOL) {
 
diff --git a/drivers/net/enic/vnic_devcmd.h b/drivers/net/enic/vnic_devcmd.h
index 20661755df6b..9abb3d51dea1 100644
--- a/drivers/net/enic/vnic_devcmd.h
+++ b/drivers/net/enic/vnic_devcmd.h
@@ -238,6 +238,18 @@ enum vnic_devcmd_cmd {
          * out: (u32)a0=status of proxied cmd
          *      a1-a15=out args of proxied cmd */
         CMD_PROXY_BY_BDF =      _CMDC(_CMD_DIR_RW, _CMD_VTYPE_ALL, 42),
+
+        /*
+         * As for BY_BDF except a0 is index of hvnlink subordinate vnic
+         * or SR-IOV virtual vnic */
+        CMD_PROXY_BY_INDEX =    _CMDC(_CMD_DIR_RW, _CMD_VTYPE_ALL, 43),
+
+        /*
+         * in:  (u64)a0=paddr of buffer to put latest VIC VIF-CONFIG-INFO TLV in
+         *      (u32)a1=length of buffer in a0
+         * out: (u64)a0=paddr of buffer with latest VIC VIF-CONFIG-INFO TLV
+         *      (u32)a1=actual length of latest VIC VIF-CONFIG-INFO TLV */
+        CMD_CONFIG_INFO_GET     = _CMDC(_CMD_DIR_RW, _CMD_VTYPE_ALL, 44),
 };
 
 /* flags for CMD_OPEN */
diff --git a/drivers/net/enic/vnic_enet.h b/drivers/net/enic/vnic_enet.h
index 3b3291248956..e8740e3704e4 100644
--- a/drivers/net/enic/vnic_enet.h
+++ b/drivers/net/enic/vnic_enet.h
@@ -30,7 +30,7 @@ struct vnic_enet_config {
         u32 wq_desc_count;
         u32 rq_desc_count;
         u16 mtu;
-        u16 intr_timer;
+        u16 intr_timer_deprecated;
         u8 intr_timer_type;
         u8 intr_mode;
         char devname[16];
diff --git a/drivers/net/enic/vnic_resource.h b/drivers/net/enic/vnic_resource.h
index 810287beff14..e0a73f1ca6f4 100644
--- a/drivers/net/enic/vnic_resource.h
+++ b/drivers/net/enic/vnic_resource.h
@@ -22,6 +22,11 @@
 
 #define VNIC_RES_MAGIC          0x766E6963L     /* 'vnic' */
 #define VNIC_RES_VERSION        0x00000000L
+#define MGMTVNIC_MAGIC          0x544d474dL     /* 'MGMT' */
+#define MGMTVNIC_VERSION        0x00000000L
+
+/* The MAC address assigned to the CFG vNIC is fixed. */
+#define MGMTVNIC_MAC            { 0x02, 0x00, 0x54, 0x4d, 0x47, 0x4d }
 
 /* vNIC resource types */
 enum vnic_res_type {
@@ -52,6 +57,14 @@ struct vnic_resource_header {
         u32 version;
 };
 
+struct mgmt_barmap_hdr {
+        u32 magic;                      /* magic number */
+        u32 version;                    /* header format version */
+        u16 lif;                        /* loopback lif for mgmt frames */
+        u16 pci_slot;                   /* installed pci slot */
+        char serial[16];                /* card serial number */
+};
+
 struct vnic_resource {
         u8 type;
         u8 bar;
diff --git a/drivers/net/enic/vnic_rq.c b/drivers/net/enic/vnic_rq.c
index dbb2aca258b9..b236d7cbc137 100644
--- a/drivers/net/enic/vnic_rq.c
+++ b/drivers/net/enic/vnic_rq.c
@@ -77,8 +77,10 @@ void vnic_rq_free(struct vnic_rq *rq)
         vnic_dev_free_desc_ring(vdev, &rq->ring);
 
         for (i = 0; i < VNIC_RQ_BUF_BLKS_MAX; i++) {
-                kfree(rq->bufs[i]);
-                rq->bufs[i] = NULL;
+                if (rq->bufs[i]) {
+                        kfree(rq->bufs[i]);
+                        rq->bufs[i] = NULL;
+                }
         }
 
         rq->ctrl = NULL;
diff --git a/drivers/net/enic/vnic_rq.h b/drivers/net/enic/vnic_rq.h
index 2dc48f91abf7..4b6f0212c8a2 100644
--- a/drivers/net/enic/vnic_rq.h
+++ b/drivers/net/enic/vnic_rq.h
@@ -143,7 +143,7 @@ static inline void vnic_rq_post(struct vnic_rq *rq,
 
 static inline int vnic_rq_posting_soon(struct vnic_rq *rq)
 {
-        return ((rq->to_use->index & VNIC_RQ_RETURN_RATE) == 0);
+        return (rq->to_use->index & VNIC_RQ_RETURN_RATE) == 0;
 }
 
 static inline void vnic_rq_return_descs(struct vnic_rq *rq, unsigned int count)
diff --git a/drivers/net/enic/vnic_vic.c b/drivers/net/enic/vnic_vic.c
index 197c9d24af82..4725b79de0ef 100644
--- a/drivers/net/enic/vnic_vic.c
+++ b/drivers/net/enic/vnic_vic.c
@@ -54,8 +54,8 @@ int vic_provinfo_add_tlv(struct vic_provinfo *vp, u16 type, u16 length,
         if (!vp || !value)
                 return -EINVAL;
 
-        if (ntohl(vp->length) + sizeof(*tlv) + length >
-                VIC_PROVINFO_MAX_TLV_DATA)
+        if (ntohl(vp->length) + offsetof(struct vic_provinfo_tlv, value) +
+                length > VIC_PROVINFO_MAX_TLV_DATA)
                 return -ENOMEM;
 
         tlv = (struct vic_provinfo_tlv *)((u8 *)vp->tlv +
@@ -66,7 +66,8 @@ int vic_provinfo_add_tlv(struct vic_provinfo *vp, u16 type, u16 length,
         memcpy(tlv->value, value, length);
 
         vp->num_tlvs = htonl(ntohl(vp->num_tlvs) + 1);
-        vp->length = htonl(ntohl(vp->length) + sizeof(*tlv) + length);
+        vp->length = htonl(ntohl(vp->length) +
+                offsetof(struct vic_provinfo_tlv, value) + length);
 
         return 0;
 }
diff --git a/drivers/net/enic/vnic_wq.c b/drivers/net/enic/vnic_wq.c
index 122e33bcc578..4b2a6c6a569b 100644
--- a/drivers/net/enic/vnic_wq.c
+++ b/drivers/net/enic/vnic_wq.c
@@ -77,8 +77,10 @@ void vnic_wq_free(struct vnic_wq *wq)
         vnic_dev_free_desc_ring(vdev, &wq->ring);
 
         for (i = 0; i < VNIC_WQ_BUF_BLKS_MAX; i++) {
-                kfree(wq->bufs[i]);
-                wq->bufs[i] = NULL;
+                if (wq->bufs[i]) {
+                        kfree(wq->bufs[i]);
+                        wq->bufs[i] = NULL;
+                }
         }
 
         wq->ctrl = NULL;
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 57c8ac0ef3f1..32543a300b81 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -758,7 +758,7 @@ static int epic_open(struct net_device *dev)
         init_timer(&ep->timer);
         ep->timer.expires = jiffies + 3*HZ;
         ep->timer.data = (unsigned long)dev;
-        ep->timer.function = &epic_timer;                               /* timer handler */
+        ep->timer.function = epic_timer;                                /* timer handler */
         add_timer(&ep->timer);
 
         return 0;
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 10e39f2b31c3..fb717be511f6 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -637,7 +637,9 @@ static void eth16i_initialize(struct net_device *dev, int boot)
 
         /* Set interface port type */
         if(boot) {
-                char *porttype[] = {"BNC", "DIX", "TP", "AUTO", "FROM_EPROM" };
+                static const char * const porttype[] = {
+                        "BNC", "DIX", "TP", "AUTO", "FROM_EPROM"
+                };
 
                 switch(dev->if_port)
                 {
@@ -794,7 +796,7 @@ static int eth16i_receive_probe_packet(int ioaddr)
 
                         if(eth16i_debug > 1)
                                 printk(KERN_DEBUG "RECEIVE_PACKET\n");
-                        return(0); /* Found receive packet */
+                        return 0; /* Found receive packet */
                 }
         }
 
@@ -803,7 +805,7 @@ static int eth16i_receive_probe_packet(int ioaddr)
                 printk(KERN_DEBUG "RX_STATUS_REG = %x\n", inb(ioaddr + RX_STATUS_REG));
         }
 
-        return(0); /* Return success */
+        return 0; /* Return success */
 }
 
 #if 0
@@ -839,7 +841,7 @@ static int __init eth16i_get_irq(int ioaddr)
 
         if( ioaddr < 0x1000) {
                 cbyte = inb(ioaddr + JUMPERLESS_CONFIG);
-                return( eth16i_irqmap[ ((cbyte & 0xC0) >> 6) ] );
+                return eth16i_irqmap[((cbyte & 0xC0) >> 6)];
         } else {  /* Oh..the card is EISA so method getting IRQ different */
                 unsigned short index = 0;
                 cbyte = inb(ioaddr + EISA_IRQ_REG);
@@ -847,7 +849,7 @@ static int __init eth16i_get_irq(int ioaddr)
                         cbyte = cbyte >> 1;
                         index++;
                 }
-                return( eth32i_irqmap[ index ] );
+                return eth32i_irqmap[index];
         }
 }
 
@@ -907,7 +909,7 @@ static int eth16i_read_eeprom(int ioaddr, int offset)
         data = eth16i_read_eeprom_word(ioaddr);
         outb(CS_0 | SK_0, ioaddr + EEPROM_CTRL_REG);
 
-        return(data);
+        return data;
 }
 
 static int eth16i_read_eeprom_word(int ioaddr)
@@ -926,7 +928,7 @@ static int eth16i_read_eeprom_word(int ioaddr)
                 eeprom_slow_io();
         }
 
-        return(data);
+        return data;
 }
 
 static void eth16i_eeprom_cmd(int ioaddr, unsigned char command)
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index 6d653c459c1f..c5a2fe099a8d 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -806,11 +806,6 @@ static void ethoc_tx_timeout(struct net_device *dev)
                 ethoc_interrupt(dev->irq, dev);
 }
 
-static struct net_device_stats *ethoc_stats(struct net_device *dev)
-{
-        return &dev->stats;
-}
-
 static netdev_tx_t ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ethoc *priv = netdev_priv(dev);
@@ -863,7 +858,6 @@ static const struct net_device_ops ethoc_netdev_ops = {
         .ndo_set_multicast_list = ethoc_set_multicast_list,
         .ndo_change_mtu = ethoc_change_mtu,
         .ndo_tx_timeout = ethoc_tx_timeout,
-        .ndo_get_stats = ethoc_stats,
         .ndo_start_xmit = ethoc_start_xmit,
 };
 
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index d7e8f6b8f4cf..dd54abe2f710 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -915,14 +915,14 @@ static int netdev_open(struct net_device *dev)
         init_timer(&np->timer);
         np->timer.expires = RUN_AT(3 * HZ);
         np->timer.data = (unsigned long) dev;
-        np->timer.function = &netdev_timer;
+        np->timer.function = netdev_timer;
 
         /* timer handler */
         add_timer(&np->timer);
 
         init_timer(&np->reset_timer);
         np->reset_timer.data = (unsigned long) dev;
-        np->reset_timer.function = &reset_timer;
+        np->reset_timer.function = reset_timer;
         np->reset_timer_armed = 0;
 
         return 0;
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index e3e10b4add9c..e9f5d030bc26 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -771,11 +771,6 @@ static void mpc52xx_fec_reset(struct net_device *dev)
 
 
 /* ethtool interface */
-static void mpc52xx_fec_get_drvinfo(struct net_device *dev,
-                struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, DRIVER_NAME);
-}
 
 static int mpc52xx_fec_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
@@ -810,7 +805,6 @@ static void mpc52xx_fec_set_msglevel(struct net_device *dev, u32 level)
 }
 
 static const struct ethtool_ops mpc52xx_fec_ethtool_ops = {
-        .get_drvinfo = mpc52xx_fec_get_drvinfo,
         .get_settings = mpc52xx_fec_get_settings,
         .set_settings = mpc52xx_fec_set_settings,
         .get_link = ethtool_op_get_link,
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 4da05b1b445c..ddac63cefbaa 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -4620,7 +4620,7 @@ static int nv_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam*
 static u32 nv_get_rx_csum(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
-        return (np->rx_csum) != 0;
+        return np->rx_csum != 0;
 }
 
 static int nv_set_rx_csum(struct net_device *dev, u32 data)
@@ -5440,13 +5440,13 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         init_timer(&np->oom_kick);
         np->oom_kick.data = (unsigned long) dev;
-        np->oom_kick.function = &nv_do_rx_refill;       /* timer handler */
+        np->oom_kick.function = nv_do_rx_refill;        /* timer handler */
         init_timer(&np->nic_poll);
         np->nic_poll.data = (unsigned long) dev;
-        np->nic_poll.function = &nv_do_nic_poll;        /* timer handler */
+        np->nic_poll.function = nv_do_nic_poll; /* timer handler */
         init_timer(&np->stats_poll);
         np->stats_poll.data = (unsigned long) dev;
-        np->stats_poll.function = &nv_do_stats_poll;    /* timer handler */
+        np->stats_poll.function = nv_do_stats_poll;     /* timer handler */
 
         err = pci_enable_device(pci_dev);
         if (err)
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index d6e3111959ab..d684f187de57 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -1036,7 +1036,7 @@ static int __devinit fs_enet_probe(struct platform_device *ofdev,
         ndev = alloc_etherdev(privsize);
         if (!ndev) {
                 ret = -ENOMEM;
-                goto out_free_fpi;
+                goto out_put;
         }
 
         SET_NETDEV_DEV(ndev, &ofdev->dev);
@@ -1099,6 +1099,7 @@ out_cleanup_data:
 out_free_dev:
         free_netdev(ndev);
         dev_set_drvdata(&ofdev->dev, NULL);
+out_put:
         of_node_put(fpi->phy_node);
 out_free_fpi:
         kfree(fpi);
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d4bf91aac25f..8d3a2ccbc953 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -125,7 +125,7 @@ int fsl_pq_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value)
         struct fsl_pq_mdio __iomem *regs = fsl_pq_mdio_get_regs(bus);
 
         /* Write to the local MII regs */
-        return(fsl_pq_local_mdio_write(regs, mii_id, regnum, value));
+        return fsl_pq_local_mdio_write(regs, mii_id, regnum, value);
 }
 
 /*
@@ -137,7 +137,7 @@ int fsl_pq_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         struct fsl_pq_mdio __iomem *regs = fsl_pq_mdio_get_regs(bus);
 
         /* Read the local MII regs */
-        return(fsl_pq_local_mdio_read(regs, mii_id, regnum));
+        return fsl_pq_local_mdio_read(regs, mii_id, regnum);
 }
 
 /* Reset the MIIM registers, and wait for the bus to free */
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4f7c3f3ca234..f30adbf86bb2 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1859,7 +1859,7 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
                                 printk(KERN_ERR "%s: Can't get IRQ %d\n",
                                         dev->name, grp->interruptError);
 
-                                goto err_irq_fail;
+                        goto err_irq_fail;
                 }
 
                 if ((err = request_irq(grp->interruptTransmit, gfar_transmit,
@@ -2048,7 +2048,6 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         u32 bufaddr;
         unsigned long flags;
         unsigned int nr_frags, nr_txbds, length;
-        union skb_shared_tx *shtx;
 
         /*
          * TOE=1 frames larger than 2500 bytes may see excess delays
@@ -2069,10 +2068,10 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         txq = netdev_get_tx_queue(dev, rq);
         base = tx_queue->tx_bd_base;
         regs = tx_queue->grp->regs;
-        shtx = skb_tx(skb);
 
         /* check if time stamp should be generated */
-        if (unlikely(shtx->hardware && priv->hwts_tx_en))
+        if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP &&
+                     priv->hwts_tx_en))
                 do_tstamp = 1;
 
         /* make space for additional header when fcb is needed */
@@ -2174,7 +2173,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Setup tx hardware time stamping if requested */
         if (unlikely(do_tstamp)) {
-                shtx->in_progress = 1;
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
                 if (fcb == NULL)
                         fcb = gfar_add_fcb(skb);
                 fcb->ptp = 1;
@@ -2446,7 +2445,6 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
         int howmany = 0;
         u32 lstatus;
         size_t buflen;
-        union skb_shared_tx *shtx;
 
         rx_queue = priv->rx_queue[tx_queue->qindex];
         bdp = tx_queue->dirty_tx;
@@ -2461,8 +2459,7 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
                  * When time stamping, one additional TxBD must be freed.
                  * Also, we need to dma_unmap_single() the TxPAL.
                  */
-                shtx = skb_tx(skb);
-                if (unlikely(shtx->in_progress))
+                if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
                         nr_txbds = frags + 2;
                 else
                         nr_txbds = frags + 1;
@@ -2476,7 +2473,7 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
                                 (lstatus & BD_LENGTH_MASK))
                         break;
 
-                if (unlikely(shtx->in_progress)) {
+                if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
                         next = next_txbd(bdp, base, tx_ring_size);
                         buflen = next->length + GMAC_FCB_LEN;
                 } else
@@ -2485,7 +2482,7 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
                 dma_unmap_single(&priv->ofdev->dev, bdp->bufPtr,
                                 buflen, DMA_TO_DEVICE);
 
-                if (unlikely(shtx->in_progress)) {
+                if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
                         struct skb_shared_hwtstamps shhwtstamps;
                         u64 *ns = (u64*) (((u32)skb->data + 0x10) & ~0x7);
                         memset(&shhwtstamps, 0, sizeof(shhwtstamps));
@@ -2657,7 +2654,7 @@ static inline void gfar_rx_checksum(struct sk_buff *skb, struct rxfcb *fcb)
         if ((fcb->flags & RXFCB_CSUM_MASK) == (RXFCB_CIP | RXFCB_CTU))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 }
 
 
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 9bda023c0235..ae8e5d3c6c1f 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -254,7 +254,7 @@ static unsigned int gfar_usecs2ticks(struct gfar_private *priv, unsigned int use
 
         /* Make sure we return a number greater than 0
          * if usecs > 0 */
-        return ((usecs * 1000 + count - 1) / count);
+        return (usecs * 1000 + count - 1) / count;
 }
 
 /* Convert ethernet clock ticks to microseconds */
@@ -278,7 +278,7 @@ static unsigned int gfar_ticks2usecs(struct gfar_private *priv, unsigned int tic
 
         /* Make sure we return a number greater than 0 */
         /* if ticks is > 0 */
-        return ((ticks * count) / 1000);
+        return (ticks * count) / 1000;
 }
 
 /* Get the coalescing parameters, and put them in the cvals
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index f15c64f1cd38..27d6960ce09e 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -893,7 +893,7 @@ static int greth_rx_gbit(struct net_device *dev, int limit)
                                 if (greth->flags & GRETH_FLAG_RX_CSUM && hw_checksummed(status))
                                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                                 else
-                                        skb->ip_summed = CHECKSUM_NONE;
+                                        skb_checksum_none_assert(skb);
 
                                 skb->protocol = eth_type_trans(skb, dev);
                                 dev->stats.rx_packets++;
@@ -1547,10 +1547,10 @@ static int __devinit greth_of_probe(struct platform_device *ofdev, const struct
         dev->netdev_ops = &greth_netdev_ops;
         dev->ethtool_ops = &greth_ethtool_ops;
 
-        if (register_netdev(dev)) {
+        err = register_netdev(dev);
+        if (err) {
                 if (netif_msg_probe(greth))
                         dev_err(greth->dev, "netdevice registration failed.\n");
-                err = -ENOMEM;
                 goto error5;
         }
 
diff --git a/drivers/net/hamachi.c b/drivers/net/hamachi.c
index 49aac7027fbb..9a6485892b3d 100644
--- a/drivers/net/hamachi.c
+++ b/drivers/net/hamachi.c
@@ -1004,7 +1004,7 @@ static int hamachi_open(struct net_device *dev)
         init_timer(&hmp->timer);
         hmp->timer.expires = RUN_AT((24*HZ)/10);                        /* 2.4 sec. */
         hmp->timer.data = (unsigned long)dev;
-        hmp->timer.function = &hamachi_timer;                           /* timer handler */
+        hmp->timer.function = hamachi_timer;                            /* timer handler */
         add_timer(&hmp->timer);
 
         return 0;
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 14f01d156db9..ac1d323c5eb5 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -168,7 +168,7 @@ static inline struct net_device *bpq_get_ax25_dev(struct net_device *dev)
 
 static inline int dev_is_ethdev(struct net_device *dev)
 {
-        return (dev->type == ARPHRD_ETHER && strncmp(dev->name, "dummy", 5));
+        return dev->type == ARPHRD_ETHER && strncmp(dev->name, "dummy", 5);
 }
 
 /* ------------------------------------------------------------------------ */
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index b8bdf9d51cd4..5b37579e84b7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -110,7 +110,7 @@ static int calc_crc_ccitt(const unsigned char *buf, int cnt)
         for (; cnt > 0; cnt--)
                 crc = (crc >> 8) ^ crc_ccitt_table[(crc ^ *buf++) & 0xff];
         crc ^= 0xffff;
-        return (crc & 0xffff);
+        return crc & 0xffff;
 }
 #endif
 
diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index 9f64c8637208..33655814448e 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -1069,7 +1069,8 @@ static void scc_tx_done(struct scc_channel *scc)
                 case KISS_DUPLEX_LINK:
                         scc->stat.tx_state = TXS_IDLE2;
                         if (scc->kiss.idletime != TIMER_OFF)
-                        scc_start_tx_timer(scc, t_idle, scc->kiss.idletime*100);
+                                scc_start_tx_timer(scc, t_idle,
+                                                   scc->kiss.idletime*100);
                         break;
                 case KISS_DUPLEX_OPTIMA:
                         scc_notify(scc, HWEV_ALL_SENT);
diff --git a/drivers/net/hp.c b/drivers/net/hp.c
index 86ececd3c658..d15d2f2ba78e 100644
--- a/drivers/net/hp.c
+++ b/drivers/net/hp.c
@@ -204,10 +204,10 @@ static int __init hp_probe1(struct net_device *dev, int ioaddr)
         ei_status.rx_start_page = HP_START_PG + TX_PAGES;
         ei_status.stop_page = wordmode ? HP_16BSTOP_PG : HP_8BSTOP_PG;
 
-        ei_status.reset_8390 = &hp_reset_8390;
-        ei_status.get_8390_hdr = &hp_get_8390_hdr;
-        ei_status.block_input = &hp_block_input;
-        ei_status.block_output = &hp_block_output;
+        ei_status.reset_8390 = hp_reset_8390;
+        ei_status.get_8390_hdr = hp_get_8390_hdr;
+        ei_status.block_input = hp_block_input;
+        ei_status.block_output = hp_block_output;
         hp_init_card(dev);
 
         retval = register_netdev(dev);
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 095b17ecf609..8e2c4601b5f5 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1312,7 +1312,7 @@ static int hp100_build_rx_pdl(hp100_ring_t * ringptr,
                 for (p = (ringptr->pdl); p < (ringptr->pdl + 5); p++)
                         printk("hp100: %s: Adr 0x%.8x = 0x%.8x\n", dev->name, (u_int) p, (u_int) * p);
 #endif
-                return (1);
+                return 1;
         }
         /* else: */
         /* alloc_skb failed (no memory) -> still can receive the header
@@ -1325,7 +1325,7 @@ static int hp100_build_rx_pdl(hp100_ring_t * ringptr,
 
         ringptr->pdl[0] = 0x00010000;   /* PDH: Count=1 Fragment */
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -2752,7 +2752,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
                 hp100_outw(HP100_MISC_ERROR, IRQ_STATUS);
 
                 if (val & HP100_LINK_UP_ST)
-                        return (0);     /* login was ok */
+                        return 0;       /* login was ok */
                 else {
                         printk("hp100: %s: Training failed.\n", dev->name);
                         hp100_down_vg_link(dev);
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index 07d8e5b634f3..c5ef62ceb840 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -155,10 +155,10 @@ static int __devinit hydra_init(struct zorro_dev *z)
 
     ei_status.rx_start_page = start_page + TX_PAGES;
 
-    ei_status.reset_8390 = &hydra_reset_8390;
-    ei_status.block_input = &hydra_block_input;
-    ei_status.block_output = &hydra_block_output;
-    ei_status.get_8390_hdr = &hydra_get_8390_hdr;
+    ei_status.reset_8390 = hydra_reset_8390;
+    ei_status.block_input = hydra_block_input;
+    ei_status.block_output = hydra_block_output;
+    ei_status.get_8390_hdr = hydra_get_8390_hdr;
     ei_status.reg_offset = hydra_offsets;
 
     dev->netdev_ops = &hydra_netdev_ops;
@@ -173,9 +173,8 @@ static int __devinit hydra_init(struct zorro_dev *z)
 
     zorro_set_drvdata(z, dev);
 
-    printk(KERN_INFO "%s: Hydra at 0x%08llx, address "
-           "%pM (hydra.c " HYDRA_VERSION ")\n",
-           dev->name, (unsigned long long)z->resource.start, dev->dev_addr);
+    pr_info("%s: Hydra at %pR, address %pM (hydra.c " HYDRA_VERSION ")\n",
+            dev->name, &z->resource, dev->dev_addr);
 
     return 0;
 }
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index 519e19e23955..385dc3204cb7 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -2095,11 +2095,11 @@ static void *emac_dump_regs(struct emac_instance *dev, void *buf)
         if (emac_has_feature(dev, EMAC_FTR_EMAC4)) {
                 hdr->version = EMAC4_ETHTOOL_REGS_VER;
                 memcpy_fromio(hdr + 1, dev->emacp, EMAC4_ETHTOOL_REGS_SIZE(dev));
-                return ((void *)(hdr + 1) + EMAC4_ETHTOOL_REGS_SIZE(dev));
+                return (void *)(hdr + 1) + EMAC4_ETHTOOL_REGS_SIZE(dev);
         } else {
                 hdr->version = EMAC_ETHTOOL_REGS_VER;
                 memcpy_fromio(hdr + 1, dev->emacp, EMAC_ETHTOOL_REGS_SIZE(dev));
-                return ((void *)(hdr + 1) + EMAC_ETHTOOL_REGS_SIZE(dev));
+                return (void *)(hdr + 1) + EMAC_ETHTOOL_REGS_SIZE(dev);
         }
 }
 
@@ -2293,7 +2293,7 @@ static int __devinit emac_check_deps(struct emac_instance *dev,
                 if (deps[i].drvdata != NULL)
                         there++;
         }
-        return (there == EMAC_DEP_COUNT);
+        return there == EMAC_DEP_COUNT;
 }
 
 static void emac_put_deps(struct emac_instance *dev)
diff --git a/drivers/net/ibm_newemac/core.h b/drivers/net/ibm_newemac/core.h
index 9e37e3d9c51d..4fec0844d59d 100644
--- a/drivers/net/ibm_newemac/core.h
+++ b/drivers/net/ibm_newemac/core.h
@@ -410,7 +410,7 @@ static inline u32 *emac_xaht_base(struct emac_instance *dev)
         else
                 offset = offsetof(struct emac_regs, u0.emac4.iaht1);
 
-        return ((u32 *)((ptrdiff_t)p + offset));
+        return (u32 *)((ptrdiff_t)p + offset);
 }
 
 static inline u32 *emac_gaht_base(struct emac_instance *dev)
@@ -418,7 +418,7 @@ static inline u32 *emac_gaht_base(struct emac_instance *dev)
         /* GAHT registers always come after an identical number of
          * IAHT registers.
          */
-        return (emac_xaht_base(dev) + EMAC_XAHT_REGS(dev));
+        return emac_xaht_base(dev) + EMAC_XAHT_REGS(dev);
 }
 
 static inline u32 *emac_iaht_base(struct emac_instance *dev)
@@ -426,7 +426,7 @@ static inline u32 *emac_iaht_base(struct emac_instance *dev)
         /* IAHT registers always come before an identical number of
          * GAHT registers.
          */
-        return (emac_xaht_base(dev));
+        return emac_xaht_base(dev);
 }
 
 /* Ethtool get_regs complex data.
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 294ccfb427cf..0037a696cd0a 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -602,7 +602,7 @@ static void irqrx_handler(struct net_device *dev)
                                 /* set up skb fields */
 
                                 skb->protocol = eth_type_trans(skb, dev);
-                                skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(skb);
 
                                 /* bookkeeping */
                                 dev->stats.rx_packets++;
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 4734c939ad03..b3e157ed6776 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -1,122 +1,84 @@
-/**************************************************************************/
-/*                                                                        */
-/* IBM eServer i/pSeries Virtual Ethernet Device Driver                   */
-/* Copyright (C) 2003 IBM Corp.                                           */
-/*  Originally written by Dave Larson (larson1@us.ibm.com)                */
-/*  Maintained by Santiago Leon (santil@us.ibm.com)                       */
-/*                                                                        */
-/*  This program is free software; you can redistribute it and/or modify  */
-/*  it under the terms of the GNU General Public License as published by  */
-/*  the Free Software Foundation; either version 2 of the License, or     */
-/*  (at your option) any later version.                                   */
-/*                                                                        */
-/*  This program is distributed in the hope that it will be useful,       */
-/*  but WITHOUT ANY WARRANTY; without even the implied warranty of        */
-/*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         */
-/*  GNU General Public License for more details.                          */
-/*                                                                        */
-/*  You should have received a copy of the GNU General Public License     */
-/*  along with this program; if not, write to the Free Software           */
-/*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  */
-/*                                                                   USA  */
-/*                                                                        */
-/* This module contains the implementation of a virtual ethernet device   */
-/* for use with IBM i/pSeries LPAR Linux.  It utilizes the logical LAN    */
-/* option of the RS/6000 Platform Architechture to interface with virtual */
-/* ethernet NICs that are presented to the partition by the hypervisor.   */
-/*                                                                        */
-/**************************************************************************/
 /*
-  TODO:
-  - add support for sysfs
-  - possibly remove procfs support
-*/
+ * IBM Power Virtual Ethernet Device Driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright (C) IBM Corporation, 2003, 2010
+ *
+ * Authors: Dave Larson <larson1@us.ibm.com>
+ *          Santiago Leon <santil@linux.vnet.ibm.com>
+ *          Brian King <brking@linux.vnet.ibm.com>
+ *          Robert Jennings <rcj@linux.vnet.ibm.com>
+ *          Anton Blanchard <anton@au.ibm.com>
+ */
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/ioport.h>
 #include <linux/dma-mapping.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
-#include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/pm.h>
 #include <linux/ethtool.h>
-#include <linux/proc_fs.h>
 #include <linux/in.h>
 #include <linux/ip.h>
+#include <linux/ipv6.h>
 #include <linux/slab.h>
-#include <net/net_namespace.h>
 #include <asm/hvcall.h>
 #include <asm/atomic.h>
 #include <asm/vio.h>
 #include <asm/iommu.h>
-#include <asm/uaccess.h>
 #include <asm/firmware.h>
-#include <linux/seq_file.h>
 
 #include "ibmveth.h"
 
-#undef DEBUG
-
-#define ibmveth_printk(fmt, args...) \
-  printk(KERN_DEBUG "%s: " fmt, __FILE__, ## args)
-
-#define ibmveth_error_printk(fmt, args...) \
-  printk(KERN_ERR "(%s:%3.3d ua:%x) ERROR: " fmt, __FILE__, __LINE__ , adapter->vdev->unit_address, ## args)
-
-#ifdef DEBUG
-#define ibmveth_debug_printk_no_adapter(fmt, args...) \
-  printk(KERN_DEBUG "(%s:%3.3d): " fmt, __FILE__, __LINE__ , ## args)
-#define ibmveth_debug_printk(fmt, args...) \
-  printk(KERN_DEBUG "(%s:%3.3d ua:%x): " fmt, __FILE__, __LINE__ , adapter->vdev->unit_address, ## args)
-#define ibmveth_assert(expr) \
-  if(!(expr)) {                                   \
-    printk(KERN_DEBUG "assertion failed (%s:%3.3d ua:%x): %s\n", __FILE__, __LINE__, adapter->vdev->unit_address, #expr); \
-    BUG(); \
-  }
-#else
-#define ibmveth_debug_printk_no_adapter(fmt, args...)
-#define ibmveth_debug_printk(fmt, args...)
-#define ibmveth_assert(expr)
-#endif
-
-static int ibmveth_open(struct net_device *dev);
-static int ibmveth_close(struct net_device *dev);
-static int ibmveth_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
-static int ibmveth_poll(struct napi_struct *napi, int budget);
-static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *dev);
-static void ibmveth_set_multicast_list(struct net_device *dev);
-static int ibmveth_change_mtu(struct net_device *dev, int new_mtu);
-static void ibmveth_proc_register_driver(void);
-static void ibmveth_proc_unregister_driver(void);
-static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter);
-static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter);
 static irqreturn_t ibmveth_interrupt(int irq, void *dev_instance);
 static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter);
 static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev);
-static struct kobj_type ktype_veth_pool;
 
+static struct kobj_type ktype_veth_pool;
 
-#ifdef CONFIG_PROC_FS
-#define IBMVETH_PROC_DIR "ibmveth"
-static struct proc_dir_entry *ibmveth_proc_dir;
-#endif
 
 static const char ibmveth_driver_name[] = "ibmveth";
-static const char ibmveth_driver_string[] = "IBM i/pSeries Virtual Ethernet Driver";
-#define ibmveth_driver_version "1.03"
+static const char ibmveth_driver_string[] = "IBM Power Virtual Ethernet Driver";
+#define ibmveth_driver_version "1.04"
 
-MODULE_AUTHOR("Santiago Leon <santil@us.ibm.com>");
-MODULE_DESCRIPTION("IBM i/pSeries Virtual Ethernet Driver");
+MODULE_AUTHOR("Santiago Leon <santil@linux.vnet.ibm.com>");
+MODULE_DESCRIPTION("IBM Power Virtual Ethernet Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(ibmveth_driver_version);
 
+static unsigned int tx_copybreak __read_mostly = 128;
+module_param(tx_copybreak, uint, 0644);
+MODULE_PARM_DESC(tx_copybreak,
+        "Maximum size of packet that is copied to a new buffer on transmit");
+
+static unsigned int rx_copybreak __read_mostly = 128;
+module_param(rx_copybreak, uint, 0644);
+MODULE_PARM_DESC(rx_copybreak,
+        "Maximum size of packet that is copied to a new buffer on receive");
+
+static unsigned int rx_flush __read_mostly = 0;
+module_param(rx_flush, uint, 0644);
+MODULE_PARM_DESC(rx_flush, "Flush receive buffers before use");
+
 struct ibmveth_stat {
         char name[ETH_GSTRING_LEN];
         int offset;
@@ -128,12 +90,16 @@ struct ibmveth_stat {
 struct ibmveth_stat ibmveth_stats[] = {
         { "replenish_task_cycles", IBMVETH_STAT_OFF(replenish_task_cycles) },
         { "replenish_no_mem", IBMVETH_STAT_OFF(replenish_no_mem) },
-        { "replenish_add_buff_failure", IBMVETH_STAT_OFF(replenish_add_buff_failure) },
-        { "replenish_add_buff_success", IBMVETH_STAT_OFF(replenish_add_buff_success) },
+        { "replenish_add_buff_failure",
+                        IBMVETH_STAT_OFF(replenish_add_buff_failure) },
+        { "replenish_add_buff_success",
+                        IBMVETH_STAT_OFF(replenish_add_buff_success) },
         { "rx_invalid_buffer", IBMVETH_STAT_OFF(rx_invalid_buffer) },
         { "rx_no_buffer", IBMVETH_STAT_OFF(rx_no_buffer) },
         { "tx_map_failed", IBMVETH_STAT_OFF(tx_map_failed) },
         { "tx_send_failed", IBMVETH_STAT_OFF(tx_send_failed) },
+        { "fw_enabled_ipv4_csum", IBMVETH_STAT_OFF(fw_ipv4_csum_support) },
+        { "fw_enabled_ipv6_csum", IBMVETH_STAT_OFF(fw_ipv6_csum_support) },
 };
 
 /* simple methods of getting data from the current rxq entry */
@@ -144,41 +110,44 @@ static inline u32 ibmveth_rxq_flags(struct ibmveth_adapter *adapter)
 
 static inline int ibmveth_rxq_toggle(struct ibmveth_adapter *adapter)
 {
-        return (ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_TOGGLE) >> IBMVETH_RXQ_TOGGLE_SHIFT;
+        return (ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_TOGGLE) >>
+                        IBMVETH_RXQ_TOGGLE_SHIFT;
 }
 
 static inline int ibmveth_rxq_pending_buffer(struct ibmveth_adapter *adapter)
 {
-        return (ibmveth_rxq_toggle(adapter) == adapter->rx_queue.toggle);
+        return ibmveth_rxq_toggle(adapter) == adapter->rx_queue.toggle;
 }
 
 static inline int ibmveth_rxq_buffer_valid(struct ibmveth_adapter *adapter)
 {
-        return (ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_VALID);
+        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_VALID;
 }
 
 static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter)
 {
-        return (ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_OFF_MASK);
+        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_OFF_MASK;
 }
 
 static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)
 {
-        return (adapter->rx_queue.queue_addr[adapter->rx_queue.index].length);
+        return adapter->rx_queue.queue_addr[adapter->rx_queue.index].length;
 }
 
 static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter *adapter)
 {
-        return (ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_CSUM_GOOD);
+        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_CSUM_GOOD;
 }
 
 /* setup the initial settings for a buffer pool */
-static void ibmveth_init_buffer_pool(struct ibmveth_buff_pool *pool, u32 pool_index, u32 pool_size, u32 buff_size, u32 pool_active)
+static void ibmveth_init_buffer_pool(struct ibmveth_buff_pool *pool,
+                                     u32 pool_index, u32 pool_size,
+                                     u32 buff_size, u32 pool_active)
 {
         pool->size = pool_size;
         pool->index = pool_index;
         pool->buff_size = buff_size;
-        pool->threshold = pool_size / 2;
+        pool->threshold = pool_size * 7 / 8;
         pool->active = pool_active;
 }
 
@@ -189,12 +158,11 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
 
         pool->free_map = kmalloc(sizeof(u16) * pool->size, GFP_KERNEL);
 
-        if(!pool->free_map) {
+        if (!pool->free_map)
                 return -1;
-        }
 
         pool->dma_addr = kmalloc(sizeof(dma_addr_t) * pool->size, GFP_KERNEL);
-        if(!pool->dma_addr) {
+        if (!pool->dma_addr) {
                 kfree(pool->free_map);
                 pool->free_map = NULL;
                 return -1;
@@ -202,7 +170,7 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
 
         pool->skbuff = kcalloc(pool->size, sizeof(void *), GFP_KERNEL);
 
-        if(!pool->skbuff) {
+        if (!pool->skbuff) {
                 kfree(pool->dma_addr);
                 pool->dma_addr = NULL;
 
@@ -213,9 +181,8 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
 
         memset(pool->dma_addr, 0, sizeof(dma_addr_t) * pool->size);
 
-        for(i = 0; i < pool->size; ++i) {
+        for (i = 0; i < pool->size; ++i)
                 pool->free_map[i] = i;
-        }
 
         atomic_set(&pool->available, 0);
         pool->producer_index = 0;
@@ -224,10 +191,19 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
         return 0;
 }
 
+static inline void ibmveth_flush_buffer(void *addr, unsigned long length)
+{
+        unsigned long offset;
+
+        for (offset = 0; offset < length; offset += SMP_CACHE_BYTES)
+                asm("dcbfl %0,%1" :: "b" (addr), "r" (offset));
+}
+
 /* replenish the buffers for a pool.  note that we don't need to
  * skb_reserve these since they are used for incoming...
  */
-static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struct ibmveth_buff_pool *pool)
+static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter,
+                                          struct ibmveth_buff_pool *pool)
 {
         u32 i;
         u32 count = pool->size - atomic_read(&pool->available);
@@ -240,23 +216,26 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
 
         mb();
 
-        for(i = 0; i < count; ++i) {
+        for (i = 0; i < count; ++i) {
                 union ibmveth_buf_desc desc;
 
-                skb = alloc_skb(pool->buff_size, GFP_ATOMIC);
+                skb = netdev_alloc_skb(adapter->netdev, pool->buff_size);
 
-                if(!skb) {
-                        ibmveth_debug_printk("replenish: unable to allocate skb\n");
+                if (!skb) {
+                        netdev_dbg(adapter->netdev,
+                                   "replenish: unable to allocate skb\n");
                         adapter->replenish_no_mem++;
                         break;
                 }
 
                 free_index = pool->consumer_index;
-                pool->consumer_index = (pool->consumer_index + 1) % pool->size;
+                pool->consumer_index++;
+                if (pool->consumer_index >= pool->size)
+                        pool->consumer_index = 0;
                 index = pool->free_map[free_index];
 
-                ibmveth_assert(index != IBM_VETH_INVALID_MAP);
-                ibmveth_assert(pool->skbuff[index] == NULL);
+                BUG_ON(index == IBM_VETH_INVALID_MAP);
+                BUG_ON(pool->skbuff[index] != NULL);
 
                 dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
                                 pool->buff_size, DMA_FROM_DEVICE);
@@ -269,16 +248,23 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                 pool->skbuff[index] = skb;
 
                 correlator = ((u64)pool->index << 32) | index;
-                *(u64*)skb->data = correlator;
+                *(u64 *)skb->data = correlator;
 
                 desc.fields.flags_len = IBMVETH_BUF_VALID | pool->buff_size;
                 desc.fields.address = dma_addr;
 
-                lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc);
+                if (rx_flush) {
+                        unsigned int len = min(pool->buff_size,
+                                                adapter->netdev->mtu +
+                                                IBMVETH_BUFF_OH);
+                        ibmveth_flush_buffer(skb->data, len);
+                }
+                lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address,
+                                                   desc.desc);
 
-                if (lpar_rc != H_SUCCESS)
+                if (lpar_rc != H_SUCCESS) {
                         goto failure;
-                else {
+                } else {
                         buffers_added++;
                         adapter->replenish_add_buff_success++;
                 }
@@ -313,26 +299,31 @@ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
 
         adapter->replenish_task_cycles++;
 
-        for (i = (IbmVethNumBufferPools - 1); i >= 0; i--)
-                if(adapter->rx_buff_pool[i].active)
-                        ibmveth_replenish_buffer_pool(adapter,
-                                                     &adapter->rx_buff_pool[i]);
+        for (i = (IBMVETH_NUM_BUFF_POOLS - 1); i >= 0; i--) {
+                struct ibmveth_buff_pool *pool = &adapter->rx_buff_pool[i];
 
-        adapter->rx_no_buffer = *(u64*)(((char*)adapter->buffer_list_addr) + 4096 - 8);
+                if (pool->active &&
+                    (atomic_read(&pool->available) < pool->threshold))
+                        ibmveth_replenish_buffer_pool(adapter, pool);
+        }
+
+        adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) +
+                                                4096 - 8);
 }
 
 /* empty and free ana buffer pool - also used to do cleanup in error paths */
-static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter, struct ibmveth_buff_pool *pool)
+static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter,
+                                     struct ibmveth_buff_pool *pool)
 {
         int i;
 
         kfree(pool->free_map);
         pool->free_map = NULL;
 
-        if(pool->skbuff && pool->dma_addr) {
-                for(i = 0; i < pool->size; ++i) {
+        if (pool->skbuff && pool->dma_addr) {
+                for (i = 0; i < pool->size; ++i) {
                         struct sk_buff *skb = pool->skbuff[i];
-                        if(skb) {
+                        if (skb) {
                                 dma_unmap_single(&adapter->vdev->dev,
                                                  pool->dma_addr[i],
                                                  pool->buff_size,
@@ -343,31 +334,32 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter, struct ibm
                 }
         }
 
-        if(pool->dma_addr) {
+        if (pool->dma_addr) {
                 kfree(pool->dma_addr);
                 pool->dma_addr = NULL;
         }
 
-        if(pool->skbuff) {
+        if (pool->skbuff) {
                 kfree(pool->skbuff);
                 pool->skbuff = NULL;
         }
 }
 
 /* remove a buffer from a pool */
-static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64 correlator)
+static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,
+                                            u64 correlator)
 {
         unsigned int pool  = correlator >> 32;
         unsigned int index = correlator & 0xffffffffUL;
         unsigned int free_index;
         struct sk_buff *skb;
 
-        ibmveth_assert(pool < IbmVethNumBufferPools);
-        ibmveth_assert(index < adapter->rx_buff_pool[pool].size);
+        BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
+        BUG_ON(index >= adapter->rx_buff_pool[pool].size);
 
         skb = adapter->rx_buff_pool[pool].skbuff[index];
 
-        ibmveth_assert(skb != NULL);
+        BUG_ON(skb == NULL);
 
         adapter->rx_buff_pool[pool].skbuff[index] = NULL;
 
@@ -377,9 +369,10 @@ static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64
                          DMA_FROM_DEVICE);
 
         free_index = adapter->rx_buff_pool[pool].producer_index;
-        adapter->rx_buff_pool[pool].producer_index
-                = (adapter->rx_buff_pool[pool].producer_index + 1)
-                % adapter->rx_buff_pool[pool].size;
+        adapter->rx_buff_pool[pool].producer_index++;
+        if (adapter->rx_buff_pool[pool].producer_index >=
+            adapter->rx_buff_pool[pool].size)
+                adapter->rx_buff_pool[pool].producer_index = 0;
         adapter->rx_buff_pool[pool].free_map[free_index] = index;
 
         mb();
@@ -394,8 +387,8 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada
         unsigned int pool = correlator >> 32;
         unsigned int index = correlator & 0xffffffffUL;
 
-        ibmveth_assert(pool < IbmVethNumBufferPools);
-        ibmveth_assert(index < adapter->rx_buff_pool[pool].size);
+        BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
+        BUG_ON(index >= adapter->rx_buff_pool[pool].size);
 
         return adapter->rx_buff_pool[pool].skbuff[index];
 }
@@ -410,10 +403,10 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
         union ibmveth_buf_desc desc;
         unsigned long lpar_rc;
 
-        ibmveth_assert(pool < IbmVethNumBufferPools);
-        ibmveth_assert(index < adapter->rx_buff_pool[pool].size);
+        BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
+        BUG_ON(index >= adapter->rx_buff_pool[pool].size);
 
-        if(!adapter->rx_buff_pool[pool].active) {
+        if (!adapter->rx_buff_pool[pool].active) {
                 ibmveth_rxq_harvest_buffer(adapter);
                 ibmveth_free_buffer_pool(adapter, &adapter->rx_buff_pool[pool]);
                 return;
@@ -425,12 +418,13 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
 
         lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc);
 
-        if(lpar_rc != H_SUCCESS) {
-                ibmveth_debug_printk("h_add_logical_lan_buffer failed during recycle rc=%ld", lpar_rc);
+        if (lpar_rc != H_SUCCESS) {
+                netdev_dbg(adapter->netdev, "h_add_logical_lan_buffer failed "
+                           "during recycle rc=%ld", lpar_rc);
                 ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
         }
 
-        if(++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
+        if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
                 adapter->rx_queue.index = 0;
                 adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
         }
@@ -440,7 +434,7 @@ static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter)
 {
         ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
 
-        if(++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
+        if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
                 adapter->rx_queue.index = 0;
                 adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
         }
@@ -451,7 +445,7 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
         int i;
         struct device *dev = &adapter->vdev->dev;
 
-        if(adapter->buffer_list_addr != NULL) {
+        if (adapter->buffer_list_addr != NULL) {
                 if (!dma_mapping_error(dev, adapter->buffer_list_dma)) {
                         dma_unmap_single(dev, adapter->buffer_list_dma, 4096,
                                         DMA_BIDIRECTIONAL);
@@ -461,7 +455,7 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                 adapter->buffer_list_addr = NULL;
         }
 
-        if(adapter->filter_list_addr != NULL) {
+        if (adapter->filter_list_addr != NULL) {
                 if (!dma_mapping_error(dev, adapter->filter_list_dma)) {
                         dma_unmap_single(dev, adapter->filter_list_dma, 4096,
                                         DMA_BIDIRECTIONAL);
@@ -471,7 +465,7 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                 adapter->filter_list_addr = NULL;
         }
 
-        if(adapter->rx_queue.queue_addr != NULL) {
+        if (adapter->rx_queue.queue_addr != NULL) {
                 if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
                         dma_unmap_single(dev,
                                         adapter->rx_queue.queue_dma,
@@ -483,7 +477,7 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                 adapter->rx_queue.queue_addr = NULL;
         }
 
-        for(i = 0; i<IbmVethNumBufferPools; i++)
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
                 if (adapter->rx_buff_pool[i].active)
                         ibmveth_free_buffer_pool(adapter,
                                                  &adapter->rx_buff_pool[i]);
@@ -506,9 +500,11 @@ static int ibmveth_register_logical_lan(struct ibmveth_adapter *adapter,
 {
         int rc, try_again = 1;
 
-        /* After a kexec the adapter will still be open, so our attempt to
-        * open it will fail. So if we get a failure we free the adapter and
-        * try again, but only once. */
+        /*
+         * After a kexec the adapter will still be open, so our attempt to
+         * open it will fail. So if we get a failure we free the adapter and
+         * try again, but only once.
+         */
 retry:
         rc = h_register_logical_lan(adapter->vdev->unit_address,
                                     adapter->buffer_list_dma, rxq_desc.desc,
@@ -537,28 +533,31 @@ static int ibmveth_open(struct net_device *netdev)
         int i;
         struct device *dev;
 
-        ibmveth_debug_printk("open starting\n");
+        netdev_dbg(netdev, "open starting\n");
 
         napi_enable(&adapter->napi);
 
-        for(i = 0; i<IbmVethNumBufferPools; i++)
+        for(i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
                 rxq_entries += adapter->rx_buff_pool[i].size;
 
         adapter->buffer_list_addr = (void*) get_zeroed_page(GFP_KERNEL);
         adapter->filter_list_addr = (void*) get_zeroed_page(GFP_KERNEL);
 
-        if(!adapter->buffer_list_addr || !adapter->filter_list_addr) {
-                ibmveth_error_printk("unable to allocate filter or buffer list pages\n");
+        if (!adapter->buffer_list_addr || !adapter->filter_list_addr) {
+                netdev_err(netdev, "unable to allocate filter or buffer list "
+                           "pages\n");
                 ibmveth_cleanup(adapter);
                 napi_disable(&adapter->napi);
                 return -ENOMEM;
         }
 
-        adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) * rxq_entries;
-        adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len, GFP_KERNEL);
+        adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
+                                                rxq_entries;
+        adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
+                                                GFP_KERNEL);
 
-        if(!adapter->rx_queue.queue_addr) {
-                ibmveth_error_printk("unable to allocate rx queue pages\n");
+        if (!adapter->rx_queue.queue_addr) {
+                netdev_err(netdev, "unable to allocate rx queue pages\n");
                 ibmveth_cleanup(adapter);
                 napi_disable(&adapter->napi);
                 return -ENOMEM;
@@ -577,7 +576,8 @@ static int ibmveth_open(struct net_device *netdev)
         if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
             (dma_mapping_error(dev, adapter->filter_list_dma)) ||
             (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
-                ibmveth_error_printk("unable to map filter or buffer list pages\n");
+                netdev_err(netdev, "unable to map filter or buffer list "
+                           "pages\n");
                 ibmveth_cleanup(adapter);
                 napi_disable(&adapter->napi);
                 return -ENOMEM;
@@ -590,20 +590,23 @@ static int ibmveth_open(struct net_device *netdev)
         memcpy(&mac_address, netdev->dev_addr, netdev->addr_len);
         mac_address = mac_address >> 16;
 
-        rxq_desc.fields.flags_len = IBMVETH_BUF_VALID | adapter->rx_queue.queue_len;
+        rxq_desc.fields.flags_len = IBMVETH_BUF_VALID |
+                                        adapter->rx_queue.queue_len;
         rxq_desc.fields.address = adapter->rx_queue.queue_dma;
 
-        ibmveth_debug_printk("buffer list @ 0x%p\n", adapter->buffer_list_addr);
-        ibmveth_debug_printk("filter list @ 0x%p\n", adapter->filter_list_addr);
-        ibmveth_debug_printk("receive q   @ 0x%p\n", adapter->rx_queue.queue_addr);
+        netdev_dbg(netdev, "buffer list @ 0x%p\n", adapter->buffer_list_addr);
+        netdev_dbg(netdev, "filter list @ 0x%p\n", adapter->filter_list_addr);
+        netdev_dbg(netdev, "receive q   @ 0x%p\n", adapter->rx_queue.queue_addr);
 
         h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
 
         lpar_rc = ibmveth_register_logical_lan(adapter, rxq_desc, mac_address);
 
-        if(lpar_rc != H_SUCCESS) {
-                ibmveth_error_printk("h_register_logical_lan failed with %ld\n", lpar_rc);
-                ibmveth_error_printk("buffer TCE:0x%llx filter TCE:0x%llx rxq desc:0x%llx MAC:0x%llx\n",
+        if (lpar_rc != H_SUCCESS) {
+                netdev_err(netdev, "h_register_logical_lan failed with %ld\n",
+                           lpar_rc);
+                netdev_err(netdev, "buffer TCE:0x%llx filter TCE:0x%llx rxq "
+                           "desc:0x%llx MAC:0x%llx\n",
                                      adapter->buffer_list_dma,
                                      adapter->filter_list_dma,
                                      rxq_desc.desc,
@@ -613,11 +616,11 @@ static int ibmveth_open(struct net_device *netdev)
                 return -ENONET;
         }
 
-        for(i = 0; i<IbmVethNumBufferPools; i++) {
-                if(!adapter->rx_buff_pool[i].active)
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
+                if (!adapter->rx_buff_pool[i].active)
                         continue;
                 if (ibmveth_alloc_buffer_pool(&adapter->rx_buff_pool[i])) {
-                        ibmveth_error_printk("unable to alloc pool\n");
+                        netdev_err(netdev, "unable to alloc pool\n");
                         adapter->rx_buff_pool[i].active = 0;
                         ibmveth_cleanup(adapter);
                         napi_disable(&adapter->napi);
@@ -625,9 +628,12 @@ static int ibmveth_open(struct net_device *netdev)
                 }
         }
 
-        ibmveth_debug_printk("registering irq 0x%x\n", netdev->irq);
-        if((rc = request_irq(netdev->irq, ibmveth_interrupt, 0, netdev->name, netdev)) != 0) {
-                ibmveth_error_printk("unable to request irq 0x%x, rc %d\n", netdev->irq, rc);
+        netdev_dbg(netdev, "registering irq 0x%x\n", netdev->irq);
+        rc = request_irq(netdev->irq, ibmveth_interrupt, 0, netdev->name,
+                         netdev);
+        if (rc != 0) {
+                netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
+                           netdev->irq, rc);
                 do {
                         rc = h_free_logical_lan(adapter->vdev->unit_address);
                 } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
@@ -640,7 +646,7 @@ static int ibmveth_open(struct net_device *netdev)
         adapter->bounce_buffer =
             kmalloc(netdev->mtu + IBMVETH_BUFF_OH, GFP_KERNEL);
         if (!adapter->bounce_buffer) {
-                ibmveth_error_printk("unable to allocate bounce buffer\n");
+                netdev_err(netdev, "unable to allocate bounce buffer\n");
                 ibmveth_cleanup(adapter);
                 napi_disable(&adapter->napi);
                 return -ENOMEM;
@@ -649,18 +655,18 @@ static int ibmveth_open(struct net_device *netdev)
             dma_map_single(&adapter->vdev->dev, adapter->bounce_buffer,
                            netdev->mtu + IBMVETH_BUFF_OH, DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, adapter->bounce_buffer_dma)) {
-                ibmveth_error_printk("unable to map bounce buffer\n");
+                netdev_err(netdev, "unable to map bounce buffer\n");
                 ibmveth_cleanup(adapter);
                 napi_disable(&adapter->napi);
                 return -ENOMEM;
         }
 
-        ibmveth_debug_printk("initial replenish cycle\n");
+        netdev_dbg(netdev, "initial replenish cycle\n");
         ibmveth_interrupt(netdev->irq, netdev);
 
         netif_start_queue(netdev);
 
-        ibmveth_debug_printk("open complete\n");
+        netdev_dbg(netdev, "open complete\n");
 
         return 0;
 }
@@ -670,7 +676,7 @@ static int ibmveth_close(struct net_device *netdev)
         struct ibmveth_adapter *adapter = netdev_priv(netdev);
         long lpar_rc;
 
-        ibmveth_debug_printk("close starting\n");
+        netdev_dbg(netdev, "close starting\n");
 
         napi_disable(&adapter->napi);
 
@@ -683,26 +689,29 @@ static int ibmveth_close(struct net_device *netdev)
                 lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
         } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
 
-        if(lpar_rc != H_SUCCESS)
-        {
-                ibmveth_error_printk("h_free_logical_lan failed with %lx, continuing with close\n",
-                                     lpar_rc);
+        if (lpar_rc != H_SUCCESS) {
+                netdev_err(netdev, "h_free_logical_lan failed with %lx, "
+                           "continuing with close\n", lpar_rc);
         }
 
         free_irq(netdev->irq, netdev);
 
-        adapter->rx_no_buffer = *(u64*)(((char*)adapter->buffer_list_addr) + 4096 - 8);
+        adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) +
+                                                4096 - 8);
 
         ibmveth_cleanup(adapter);
 
-        ibmveth_debug_printk("close complete\n");
+        netdev_dbg(netdev, "close complete\n");
 
         return 0;
 }
 
-static int netdev_get_settings(struct net_device *dev, struct ethtool_cmd *cmd) {
-        cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_Autoneg | SUPPORTED_FIBRE);
-        cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg | ADVERTISED_FIBRE);
+static int netdev_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_Autoneg |
+                                SUPPORTED_FIBRE);
+        cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg |
+                                ADVERTISED_FIBRE);
         cmd->speed = SPEED_1000;
         cmd->duplex = DUPLEX_FULL;
         cmd->port = PORT_FIBRE;
@@ -714,12 +723,16 @@ static int netdev_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         return 0;
 }
 
-static void netdev_get_drvinfo (struct net_device *dev, struct ethtool_drvinfo *info) {
+static void netdev_get_drvinfo(struct net_device *dev,
+                               struct ethtool_drvinfo *info)
+{
         strncpy(info->driver, ibmveth_driver_name, sizeof(info->driver) - 1);
-        strncpy(info->version, ibmveth_driver_version, sizeof(info->version) - 1);
+        strncpy(info->version, ibmveth_driver_version,
+                sizeof(info->version) - 1);
 }
 
-static u32 netdev_get_link(struct net_device *dev) {
+static u32 netdev_get_link(struct net_device *dev)
+{
         return 1;
 }
 
@@ -727,18 +740,20 @@ static void ibmveth_set_rx_csum_flags(struct net_device *dev, u32 data)
 {
         struct ibmveth_adapter *adapter = netdev_priv(dev);
 
-        if (data)
+        if (data) {
                 adapter->rx_csum = 1;
-        else {
+        } else {
                 /*
-                 * Since the ibmveth firmware interface does not have the concept of
-                 * separate tx/rx checksum offload enable, if rx checksum is disabled
-                 * we also have to disable tx checksum offload. Once we disable rx
-                 * checksum offload, we are no longer allowed to send tx buffers that
-                 * are not properly checksummed.
+                 * Since the ibmveth firmware interface does not have the
+                 * concept of separate tx/rx checksum offload enable, if rx
+                 * checksum is disabled we also have to disable tx checksum
+                 * offload. Once we disable rx checksum offload, we are no
+                 * longer allowed to send tx buffers that are not properly
+                 * checksummed.
                  */
                 adapter->rx_csum = 0;
                 dev->features &= ~NETIF_F_IP_CSUM;
+                dev->features &= ~NETIF_F_IPV6_CSUM;
         }
 }
 
@@ -747,10 +762,15 @@ static void ibmveth_set_tx_csum_flags(struct net_device *dev, u32 data)
         struct ibmveth_adapter *adapter = netdev_priv(dev);
 
         if (data) {
-                dev->features |= NETIF_F_IP_CSUM;
+                if (adapter->fw_ipv4_csum_support)
+                        dev->features |= NETIF_F_IP_CSUM;
+                if (adapter->fw_ipv6_csum_support)
+                        dev->features |= NETIF_F_IPV6_CSUM;
                 adapter->rx_csum = 1;
-        } else
+        } else {
                 dev->features &= ~NETIF_F_IP_CSUM;
+                dev->features &= ~NETIF_F_IPV6_CSUM;
+        }
 }
 
 static int ibmveth_set_csum_offload(struct net_device *dev, u32 data,
@@ -758,7 +778,8 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data,
 {
         struct ibmveth_adapter *adapter = netdev_priv(dev);
         unsigned long set_attr, clr_attr, ret_attr;
-        long ret;
+        unsigned long set_attr6, clr_attr6;
+        long ret, ret6;
         int rc1 = 0, rc2 = 0;
         int restart = 0;
 
@@ -772,10 +793,13 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data,
         set_attr = 0;
         clr_attr = 0;
 
-        if (data)
+        if (data) {
                 set_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
-        else
+                set_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;
+        } else {
                 clr_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
+                clr_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;
+        }
 
         ret = h_illan_attributes(adapter->vdev->unit_address, 0, 0, &ret_attr);
 
@@ -786,18 +810,39 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data,
                                          set_attr, &ret_attr);
 
                 if (ret != H_SUCCESS) {
-                        rc1 = -EIO;
-                        ibmveth_error_printk("unable to change checksum offload settings."
-                                             " %d rc=%ld\n", data, ret);
+                        netdev_err(dev, "unable to change IPv4 checksum "
+                                        "offload settings. %d rc=%ld\n",
+                                        data, ret);
 
                         ret = h_illan_attributes(adapter->vdev->unit_address,
                                                  set_attr, clr_attr, &ret_attr);
+                } else {
+                        adapter->fw_ipv4_csum_support = data;
+                }
+
+                ret6 = h_illan_attributes(adapter->vdev->unit_address,
+                                         clr_attr6, set_attr6, &ret_attr);
+
+                if (ret6 != H_SUCCESS) {
+                        netdev_err(dev, "unable to change IPv6 checksum "
+                                        "offload settings. %d rc=%ld\n",
+                                        data, ret);
+
+                        ret = h_illan_attributes(adapter->vdev->unit_address,
+                                                 set_attr6, clr_attr6,
+                                                 &ret_attr);
                 } else
+                        adapter->fw_ipv6_csum_support = data;
+
+                if (ret == H_SUCCESS || ret6 == H_SUCCESS)
                         done(dev, data);
+                else
+                        rc1 = -EIO;
         } else {
                 rc1 = -EIO;
-                ibmveth_error_printk("unable to change checksum offload settings."
-                                     " %d rc=%ld ret_attr=%lx\n", data, ret, ret_attr);
+                netdev_err(dev, "unable to change checksum offload settings."
+                                     " %d rc=%ld ret_attr=%lx\n", data, ret,
+                                     ret_attr);
         }
 
         if (restart)
@@ -821,13 +866,14 @@ static int ibmveth_set_tx_csum(struct net_device *dev, u32 data)
         struct ibmveth_adapter *adapter = netdev_priv(dev);
         int rc = 0;
 
-        if (data && (dev->features & NETIF_F_IP_CSUM))
+        if (data && (dev->features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)))
                 return 0;
-        if (!data && !(dev->features & NETIF_F_IP_CSUM))
+        if (!data && !(dev->features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)))
                 return 0;
 
         if (data && !adapter->rx_csum)
-                rc = ibmveth_set_csum_offload(dev, data, ibmveth_set_tx_csum_flags);
+                rc = ibmveth_set_csum_offload(dev, data,
+                                              ibmveth_set_tx_csum_flags);
         else
                 ibmveth_set_tx_csum_flags(dev, data);
 
@@ -881,6 +927,7 @@ static const struct ethtool_ops netdev_ethtool_ops = {
         .get_strings            = ibmveth_get_strings,
         .get_sset_count         = ibmveth_get_sset_count,
         .get_ethtool_stats      = ibmveth_get_ethtool_stats,
+        .set_sg                 = ethtool_op_set_sg,
 };
 
 static int ibmveth_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -890,129 +937,216 @@ static int ibmveth_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
 #define page_offset(v) ((unsigned long)(v) & ((1 << 12) - 1))
 
-static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
-                                      struct net_device *netdev)
+static int ibmveth_send(struct ibmveth_adapter *adapter,
+                        union ibmveth_buf_desc *descs)
 {
-        struct ibmveth_adapter *adapter = netdev_priv(netdev);
-        union ibmveth_buf_desc desc;
-        unsigned long lpar_rc;
         unsigned long correlator;
-        unsigned long flags;
         unsigned int retry_count;
-        unsigned int tx_dropped = 0;
-        unsigned int tx_bytes = 0;
-        unsigned int tx_packets = 0;
-        unsigned int tx_send_failed = 0;
-        unsigned int tx_map_failed = 0;
-        int used_bounce = 0;
-        unsigned long data_dma_addr;
+        unsigned long ret;
+
+        /*
+         * The retry count sets a maximum for the number of broadcast and
+         * multicast destinations within the system.
+         */
+        retry_count = 1024;
+        correlator = 0;
+        do {
+                ret = h_send_logical_lan(adapter->vdev->unit_address,
+                                             descs[0].desc, descs[1].desc,
+                                             descs[2].desc, descs[3].desc,
+                                             descs[4].desc, descs[5].desc,
+                                             correlator, &correlator);
+        } while ((ret == H_BUSY) && (retry_count--));
+
+        if (ret != H_SUCCESS && ret != H_DROPPED) {
+                netdev_err(adapter->netdev, "tx: h_send_logical_lan failed "
+                           "with rc=%ld\n", ret);
+                return 1;
+        }
+
+        return 0;
+}
 
-        desc.fields.flags_len = IBMVETH_BUF_VALID | skb->len;
+static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
+                                      struct net_device *netdev)
+{
+        struct ibmveth_adapter *adapter = netdev_priv(netdev);
+        unsigned int desc_flags;
+        union ibmveth_buf_desc descs[6];
+        int last, i;
+        int force_bounce = 0;
+
+        /*
+         * veth handles a maximum of 6 segments including the header, so
+         * we have to linearize the skb if there are more than this.
+         */
+        if (skb_shinfo(skb)->nr_frags > 5 && __skb_linearize(skb)) {
+                netdev->stats.tx_dropped++;
+                goto out;
+        }
 
+        /* veth can't checksum offload UDP */
         if (skb->ip_summed == CHECKSUM_PARTIAL &&
-            ip_hdr(skb)->protocol != IPPROTO_TCP && skb_checksum_help(skb)) {
-                ibmveth_error_printk("tx: failed to checksum packet\n");
-                tx_dropped++;
+            ((skb->protocol == htons(ETH_P_IP) &&
+              ip_hdr(skb)->protocol != IPPROTO_TCP) ||
+             (skb->protocol == htons(ETH_P_IPV6) &&
+              ipv6_hdr(skb)->nexthdr != IPPROTO_TCP)) &&
+            skb_checksum_help(skb)) {
+
+                netdev_err(netdev, "tx: failed to checksum packet\n");
+                netdev->stats.tx_dropped++;
                 goto out;
         }
 
+        desc_flags = IBMVETH_BUF_VALID;
+
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                unsigned char *buf = skb_transport_header(skb) + skb->csum_offset;
+                unsigned char *buf = skb_transport_header(skb) +
+                                                skb->csum_offset;
 
-                desc.fields.flags_len |= (IBMVETH_BUF_NO_CSUM | IBMVETH_BUF_CSUM_GOOD);
+                desc_flags |= (IBMVETH_BUF_NO_CSUM | IBMVETH_BUF_CSUM_GOOD);
 
                 /* Need to zero out the checksum */
                 buf[0] = 0;
                 buf[1] = 0;
         }
 
-        data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
-                                       skb->len, DMA_TO_DEVICE);
-        if (dma_mapping_error(&adapter->vdev->dev, data_dma_addr)) {
-                if (!firmware_has_feature(FW_FEATURE_CMO))
-                        ibmveth_error_printk("tx: unable to map xmit buffer\n");
+retry_bounce:
+        memset(descs, 0, sizeof(descs));
+
+        /*
+         * If a linear packet is below the rx threshold then
+         * copy it into the static bounce buffer. This avoids the
+         * cost of a TCE insert and remove.
+         */
+        if (force_bounce || (!skb_is_nonlinear(skb) &&
+                                (skb->len < tx_copybreak))) {
                 skb_copy_from_linear_data(skb, adapter->bounce_buffer,
                                           skb->len);
-                desc.fields.address = adapter->bounce_buffer_dma;
-                tx_map_failed++;
-                used_bounce = 1;
-                wmb();
-        } else
-                desc.fields.address = data_dma_addr;
-
-        /* send the frame. Arbitrarily set retrycount to 1024 */
-        correlator = 0;
-        retry_count = 1024;
-        do {
-                lpar_rc = h_send_logical_lan(adapter->vdev->unit_address,
-                                             desc.desc, 0, 0, 0, 0, 0,
-                                             correlator, &correlator);
-        } while ((lpar_rc == H_BUSY) && (retry_count--));
-
-        if(lpar_rc != H_SUCCESS && lpar_rc != H_DROPPED) {
-                ibmveth_error_printk("tx: h_send_logical_lan failed with rc=%ld\n", lpar_rc);
-                ibmveth_error_printk("tx: valid=%d, len=%d, address=0x%08x\n",
-                                     (desc.fields.flags_len & IBMVETH_BUF_VALID) ? 1 : 0,
-                                     skb->len, desc.fields.address);
-                tx_send_failed++;
-                tx_dropped++;
-        } else {
-                tx_packets++;
-                tx_bytes += skb->len;
-                netdev->trans_start = jiffies; /* NETIF_F_LLTX driver :( */
+
+                descs[0].fields.flags_len = desc_flags | skb->len;
+                descs[0].fields.address = adapter->bounce_buffer_dma;
+
+                if (ibmveth_send(adapter, descs)) {
+                        adapter->tx_send_failed++;
+                        netdev->stats.tx_dropped++;
+                } else {
+                        netdev->stats.tx_packets++;
+                        netdev->stats.tx_bytes += skb->len;
+                }
+
+                goto out;
+        }
+
+        /* Map the header */
+        descs[0].fields.address = dma_map_single(&adapter->vdev->dev, skb->data,
+                                                 skb_headlen(skb),
+                                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->vdev->dev, descs[0].fields.address))
+                goto map_failed;
+
+        descs[0].fields.flags_len = desc_flags | skb_headlen(skb);
+
+        /* Map the frags */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                unsigned long dma_addr;
+                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+                dma_addr = dma_map_page(&adapter->vdev->dev, frag->page,
+                                        frag->page_offset, frag->size,
+                                        DMA_TO_DEVICE);
+
+                if (dma_mapping_error(&adapter->vdev->dev, dma_addr))
+                        goto map_failed_frags;
+
+                descs[i+1].fields.flags_len = desc_flags | frag->size;
+                descs[i+1].fields.address = dma_addr;
         }
 
-        if (!used_bounce)
-                dma_unmap_single(&adapter->vdev->dev, data_dma_addr,
-                                 skb->len, DMA_TO_DEVICE);
+        if (ibmveth_send(adapter, descs)) {
+                adapter->tx_send_failed++;
+                netdev->stats.tx_dropped++;
+        } else {
+                netdev->stats.tx_packets++;
+                netdev->stats.tx_bytes += skb->len;
+        }
 
-out:    spin_lock_irqsave(&adapter->stats_lock, flags);
-        netdev->stats.tx_dropped += tx_dropped;
-        netdev->stats.tx_bytes += tx_bytes;
-        netdev->stats.tx_packets += tx_packets;
-        adapter->tx_send_failed += tx_send_failed;
-        adapter->tx_map_failed += tx_map_failed;
-        spin_unlock_irqrestore(&adapter->stats_lock, flags);
+        for (i = 0; i < skb_shinfo(skb)->nr_frags + 1; i++)
+                dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
+                               descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+                               DMA_TO_DEVICE);
 
+out:
         dev_kfree_skb(skb);
         return NETDEV_TX_OK;
+
+map_failed_frags:
+        last = i+1;
+        for (i = 0; i < last; i++)
+                dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
+                               descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+                               DMA_TO_DEVICE);
+
+map_failed:
+        if (!firmware_has_feature(FW_FEATURE_CMO))
+                netdev_err(netdev, "tx: unable to map xmit buffer\n");
+        adapter->tx_map_failed++;
+        skb_linearize(skb);
+        force_bounce = 1;
+        goto retry_bounce;
 }
 
 static int ibmveth_poll(struct napi_struct *napi, int budget)
 {
-        struct ibmveth_adapter *adapter = container_of(napi, struct ibmveth_adapter, napi);
+        struct ibmveth_adapter *adapter =
+                        container_of(napi, struct ibmveth_adapter, napi);
         struct net_device *netdev = adapter->netdev;
         int frames_processed = 0;
         unsigned long lpar_rc;
 
- restart_poll:
+restart_poll:
         do {
-                struct sk_buff *skb;
-
                 if (!ibmveth_rxq_pending_buffer(adapter))
                         break;
 
-                rmb();
+                smp_rmb();
                 if (!ibmveth_rxq_buffer_valid(adapter)) {
                         wmb(); /* suggested by larson1 */
                         adapter->rx_invalid_buffer++;
-                        ibmveth_debug_printk("recycling invalid buffer\n");
+                        netdev_dbg(netdev, "recycling invalid buffer\n");
                         ibmveth_rxq_recycle_buffer(adapter);
                 } else {
+                        struct sk_buff *skb, *new_skb;
                         int length = ibmveth_rxq_frame_length(adapter);
                         int offset = ibmveth_rxq_frame_offset(adapter);
                         int csum_good = ibmveth_rxq_csum_good(adapter);
 
                         skb = ibmveth_rxq_get_buffer(adapter);
-                        if (csum_good)
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-                        ibmveth_rxq_harvest_buffer(adapter);
+                        new_skb = NULL;
+                        if (length < rx_copybreak)
+                                new_skb = netdev_alloc_skb(netdev, length);
+
+                        if (new_skb) {
+                                skb_copy_to_linear_data(new_skb,
+                                                        skb->data + offset,
+                                                        length);
+                                if (rx_flush)
+                                        ibmveth_flush_buffer(skb->data,
+                                                length + offset);
+                                skb = new_skb;
+                                ibmveth_rxq_recycle_buffer(adapter);
+                        } else {
+                                ibmveth_rxq_harvest_buffer(adapter);
+                                skb_reserve(skb, offset);
+                        }
 
-                        skb_reserve(skb, offset);
                         skb_put(skb, length);
                         skb->protocol = eth_type_trans(skb, netdev);
 
+                        if (csum_good)
+                                skb->ip_summed = CHECKSUM_UNNECESSARY;
+
                         netif_receive_skb(skb); /* send it up */
 
                         netdev->stats.rx_packets++;
@@ -1030,7 +1164,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
                 lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                        VIO_IRQ_ENABLE);
 
-                ibmveth_assert(lpar_rc == H_SUCCESS);
+                BUG_ON(lpar_rc != H_SUCCESS);
 
                 napi_complete(napi);
 
@@ -1054,7 +1188,7 @@ static irqreturn_t ibmveth_interrupt(int irq, void *dev_instance)
         if (napi_schedule_prep(&adapter->napi)) {
                 lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                        VIO_IRQ_DISABLE);
-                ibmveth_assert(lpar_rc == H_SUCCESS);
+                BUG_ON(lpar_rc != H_SUCCESS);
                 __napi_schedule(&adapter->napi);
         }
         return IRQ_HANDLED;
@@ -1071,8 +1205,9 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                                            IbmVethMcastEnableRecv |
                                            IbmVethMcastDisableFiltering,
                                            0);
-                if(lpar_rc != H_SUCCESS) {
-                        ibmveth_error_printk("h_multicast_ctrl rc=%ld when entering promisc mode\n", lpar_rc);
+                if (lpar_rc != H_SUCCESS) {
+                        netdev_err(netdev, "h_multicast_ctrl rc=%ld when "
+                                   "entering promisc mode\n", lpar_rc);
                 }
         } else {
                 struct netdev_hw_addr *ha;
@@ -1082,19 +1217,23 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                                            IbmVethMcastDisableFiltering |
                                            IbmVethMcastClearFilterTable,
                                            0);
-                if(lpar_rc != H_SUCCESS) {
-                        ibmveth_error_printk("h_multicast_ctrl rc=%ld when attempting to clear filter table\n", lpar_rc);
+                if (lpar_rc != H_SUCCESS) {
+                        netdev_err(netdev, "h_multicast_ctrl rc=%ld when "
+                                   "attempting to clear filter table\n",
+                                   lpar_rc);
                 }
                 /* add the addresses to the filter table */
                 netdev_for_each_mc_addr(ha, netdev) {
-                        // add the multicast address to the filter table
+                        /* add the multicast address to the filter table */
                         unsigned long mcast_addr = 0;
                         memcpy(((char *)&mcast_addr)+2, ha->addr, 6);
                         lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                    IbmVethMcastAddFilter,
                                                    mcast_addr);
-                        if(lpar_rc != H_SUCCESS) {
-                                ibmveth_error_printk("h_multicast_ctrl rc=%ld when adding an entry to the filter table\n", lpar_rc);
+                        if (lpar_rc != H_SUCCESS) {
+                                netdev_err(netdev, "h_multicast_ctrl rc=%ld "
+                                           "when adding an entry to the filter "
+                                           "table\n", lpar_rc);
                         }
                 }
 
@@ -1102,8 +1241,9 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                 lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                            IbmVethMcastEnableFiltering,
                                            0);
-                if(lpar_rc != H_SUCCESS) {
-                        ibmveth_error_printk("h_multicast_ctrl rc=%ld when enabling filtering\n", lpar_rc);
+                if (lpar_rc != H_SUCCESS) {
+                        netdev_err(netdev, "h_multicast_ctrl rc=%ld when "
+                                   "enabling filtering\n", lpar_rc);
                 }
         }
 }
@@ -1116,14 +1256,14 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
         int i, rc;
         int need_restart = 0;
 
-        if (new_mtu < IBMVETH_MAX_MTU)
+        if (new_mtu < IBMVETH_MIN_MTU)
                 return -EINVAL;
 
-        for (i = 0; i < IbmVethNumBufferPools; i++)
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
                 if (new_mtu_oh < adapter->rx_buff_pool[i].buff_size)
                         break;
 
-        if (i == IbmVethNumBufferPools)
+        if (i == IBMVETH_NUM_BUFF_POOLS)
                 return -EINVAL;
 
         /* Deactivate all the buffer pools so that the next loop can activate
@@ -1136,7 +1276,7 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
         }
 
         /* Look for an active buffer pool that can hold the new MTU */
-        for(i = 0; i<IbmVethNumBufferPools; i++) {
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                 adapter->rx_buff_pool[i].active = 1;
 
                 if (new_mtu_oh < adapter->rx_buff_pool[i].buff_size) {
@@ -1190,7 +1330,7 @@ static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev)
         ret = IBMVETH_BUFF_LIST_SIZE + IBMVETH_FILT_LIST_SIZE;
         ret += IOMMU_PAGE_ALIGN(netdev->mtu);
 
-        for (i = 0; i < IbmVethNumBufferPools; i++) {
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                 /* add the size of the active receive buffers */
                 if (adapter->rx_buff_pool[i].active)
                         ret +=
@@ -1219,41 +1359,36 @@ static const struct net_device_ops ibmveth_netdev_ops = {
 #endif
 };
 
-static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+static int __devinit ibmveth_probe(struct vio_dev *dev,
+                                   const struct vio_device_id *id)
 {
         int rc, i;
-        long ret;
         struct net_device *netdev;
         struct ibmveth_adapter *adapter;
-        unsigned long set_attr, ret_attr;
-
         unsigned char *mac_addr_p;
         unsigned int *mcastFilterSize_p;
 
+        dev_dbg(&dev->dev, "entering ibmveth_probe for UA 0x%x\n",
+                dev->unit_address);
 
-        ibmveth_debug_printk_no_adapter("entering ibmveth_probe for UA 0x%x\n",
-                                        dev->unit_address);
-
-        mac_addr_p = (unsigned char *) vio_get_attribute(dev,
-                                                VETH_MAC_ADDR, NULL);
-        if(!mac_addr_p) {
-                printk(KERN_ERR "(%s:%3.3d) ERROR: Can't find VETH_MAC_ADDR "
-                                "attribute\n", __FILE__, __LINE__);
-                return 0;
+        mac_addr_p = (unsigned char *)vio_get_attribute(dev, VETH_MAC_ADDR,
+                                                        NULL);
+        if (!mac_addr_p) {
+                dev_err(&dev->dev, "Can't find VETH_MAC_ADDR attribute\n");
+                return -EINVAL;
         }
 
-        mcastFilterSize_p = (unsigned int *) vio_get_attribute(dev,
+        mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
                                                 VETH_MCAST_FILTER_SIZE, NULL);
-        if(!mcastFilterSize_p) {
-                printk(KERN_ERR "(%s:%3.3d) ERROR: Can't find "
-                                "VETH_MCAST_FILTER_SIZE attribute\n",
-                                __FILE__, __LINE__);
-                return 0;
+        if (!mcastFilterSize_p) {
+                dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE "
+                        "attribute\n");
+                return -EINVAL;
         }
 
         netdev = alloc_etherdev(sizeof(struct ibmveth_adapter));
 
-        if(!netdev)
+        if (!netdev)
                 return -ENOMEM;
 
         adapter = netdev_priv(netdev);
@@ -1261,19 +1396,19 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
 
         adapter->vdev = dev;
         adapter->netdev = netdev;
-        adapter->mcastFilterSize= *mcastFilterSize_p;
+        adapter->mcastFilterSize = *mcastFilterSize_p;
         adapter->pool_config = 0;
 
         netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
 
-        /*      Some older boxes running PHYP non-natively have an OF that
-                returns a 8-byte local-mac-address field (and the first
-                2 bytes have to be ignored) while newer boxes' OF return
-                a 6-byte field. Note that IEEE 1275 specifies that
-                local-mac-address must be a 6-byte field.
-                The RPA doc specifies that the first byte must be 10b, so
-                we'll just look for it to solve this 8 vs. 6 byte field issue */
-
+        /*
+         * Some older boxes running PHYP non-natively have an OF that returns
+         * a 8-byte local-mac-address field (and the first 2 bytes have to be
+         * ignored) while newer boxes' OF return a 6-byte field. Note that
+         * IEEE 1275 specifies that local-mac-address must be a 6-byte field.
+         * The RPA doc specifies that the first byte must be 10b, so we'll
+         * just look for it to solve this 8 vs. 6 byte field issue
+         */
         if ((*mac_addr_p & 0x3) != 0x02)
                 mac_addr_p += 2;
 
@@ -1284,12 +1419,11 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
         netdev->netdev_ops = &ibmveth_netdev_ops;
         netdev->ethtool_ops = &netdev_ethtool_ops;
         SET_NETDEV_DEV(netdev, &dev->dev);
-        netdev->features |= NETIF_F_LLTX;
-        spin_lock_init(&adapter->stats_lock);
+        netdev->features |= NETIF_F_SG;
 
         memcpy(netdev->dev_addr, &adapter->mac_addr, netdev->addr_len);
 
-        for(i = 0; i<IbmVethNumBufferPools; i++) {
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                 struct kobject *kobj = &adapter->rx_buff_pool[i].kobj;
                 int error;
 
@@ -1302,41 +1436,25 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
                         kobject_uevent(kobj, KOBJ_ADD);
         }
 
-        ibmveth_debug_printk("adapter @ 0x%p\n", adapter);
+        netdev_dbg(netdev, "adapter @ 0x%p\n", adapter);
 
         adapter->buffer_list_dma = DMA_ERROR_CODE;
         adapter->filter_list_dma = DMA_ERROR_CODE;
         adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
 
-        ibmveth_debug_printk("registering netdev...\n");
-
-        ret = h_illan_attributes(dev->unit_address, 0, 0, &ret_attr);
-
-        if (ret == H_SUCCESS && !(ret_attr & IBMVETH_ILLAN_ACTIVE_TRUNK) &&
-            !(ret_attr & IBMVETH_ILLAN_TRUNK_PRI_MASK) &&
-            (ret_attr & IBMVETH_ILLAN_PADDED_PKT_CSUM)) {
-                set_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
-
-                ret = h_illan_attributes(dev->unit_address, 0, set_attr, &ret_attr);
+        netdev_dbg(netdev, "registering netdev...\n");
 
-                if (ret == H_SUCCESS) {
-                        adapter->rx_csum = 1;
-                        netdev->features |= NETIF_F_IP_CSUM;
-                } else
-                        ret = h_illan_attributes(dev->unit_address, set_attr, 0, &ret_attr);
-        }
+        ibmveth_set_csum_offload(netdev, 1, ibmveth_set_tx_csum_flags);
 
         rc = register_netdev(netdev);
 
-        if(rc) {
-                ibmveth_debug_printk("failed to register netdev rc=%d\n", rc);
+        if (rc) {
+                netdev_dbg(netdev, "failed to register netdev rc=%d\n", rc);
                 free_netdev(netdev);
                 return rc;
         }
 
-        ibmveth_debug_printk("registered\n");
-
-        ibmveth_proc_register_adapter(adapter);
+        netdev_dbg(netdev, "registered\n");
 
         return 0;
 }
@@ -1347,114 +1465,23 @@ static int __devexit ibmveth_remove(struct vio_dev *dev)
         struct ibmveth_adapter *adapter = netdev_priv(netdev);
         int i;
 
-        for(i = 0; i<IbmVethNumBufferPools; i++)
+        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
                 kobject_put(&adapter->rx_buff_pool[i].kobj);
 
         unregister_netdev(netdev);
 
-        ibmveth_proc_unregister_adapter(adapter);
-
         free_netdev(netdev);
         dev_set_drvdata(&dev->dev, NULL);
 
         return 0;
 }
 
-#ifdef CONFIG_PROC_FS
-static void ibmveth_proc_register_driver(void)
-{
-        ibmveth_proc_dir = proc_mkdir(IBMVETH_PROC_DIR, init_net.proc_net);
-        if (ibmveth_proc_dir) {
-        }
-}
-
-static void ibmveth_proc_unregister_driver(void)
-{
-        remove_proc_entry(IBMVETH_PROC_DIR, init_net.proc_net);
-}
-
-static int ibmveth_show(struct seq_file *seq, void *v)
-{
-        struct ibmveth_adapter *adapter = seq->private;
-        char *current_mac = (char *) adapter->netdev->dev_addr;
-        char *firmware_mac = (char *) &adapter->mac_addr;
-
-        seq_printf(seq, "%s %s\n\n", ibmveth_driver_string, ibmveth_driver_version);
-
-        seq_printf(seq, "Unit Address:    0x%x\n", adapter->vdev->unit_address);
-        seq_printf(seq, "Current MAC:     %pM\n", current_mac);
-        seq_printf(seq, "Firmware MAC:    %pM\n", firmware_mac);
-
-        seq_printf(seq, "\nAdapter Statistics:\n");
-        seq_printf(seq, "  TX:  vio_map_single failres:      %lld\n", adapter->tx_map_failed);
-        seq_printf(seq, "       send failures:               %lld\n", adapter->tx_send_failed);
-        seq_printf(seq, "  RX:  replenish task cycles:       %lld\n", adapter->replenish_task_cycles);
-        seq_printf(seq, "       alloc_skb_failures:          %lld\n", adapter->replenish_no_mem);
-        seq_printf(seq, "       add buffer failures:         %lld\n", adapter->replenish_add_buff_failure);
-        seq_printf(seq, "       invalid buffers:             %lld\n", adapter->rx_invalid_buffer);
-        seq_printf(seq, "       no buffers:                  %lld\n", adapter->rx_no_buffer);
-
-        return 0;
-}
-
-static int ibmveth_proc_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, ibmveth_show, PDE(inode)->data);
-}
-
-static const struct file_operations ibmveth_proc_fops = {
-        .owner   = THIS_MODULE,
-        .open    = ibmveth_proc_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release,
-};
-
-static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
-{
-        struct proc_dir_entry *entry;
-        if (ibmveth_proc_dir) {
-                char u_addr[10];
-                sprintf(u_addr, "%x", adapter->vdev->unit_address);
-                entry = proc_create_data(u_addr, S_IFREG, ibmveth_proc_dir,
-                                         &ibmveth_proc_fops, adapter);
-                if (!entry)
-                        ibmveth_error_printk("Cannot create adapter proc entry");
-        }
-}
-
-static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter)
-{
-        if (ibmveth_proc_dir) {
-                char u_addr[10];
-                sprintf(u_addr, "%x", adapter->vdev->unit_address);
-                remove_proc_entry(u_addr, ibmveth_proc_dir);
-        }
-}
-
-#else /* CONFIG_PROC_FS */
-static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
-{
-}
-
-static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter)
-{
-}
-static void ibmveth_proc_register_driver(void)
-{
-}
-
-static void ibmveth_proc_unregister_driver(void)
-{
-}
-#endif /* CONFIG_PROC_FS */
-
 static struct attribute veth_active_attr;
 static struct attribute veth_num_attr;
 static struct attribute veth_size_attr;
 
-static ssize_t veth_pool_show(struct kobject * kobj,
-                              struct attribute * attr, char * buf)
+static ssize_t veth_pool_show(struct kobject *kobj,
+                              struct attribute *attr, char *buf)
 {
         struct ibmveth_buff_pool *pool = container_of(kobj,
                                                       struct ibmveth_buff_pool,
@@ -1469,8 +1496,8 @@ static ssize_t veth_pool_show(struct kobject * kobj,
         return 0;
 }
 
-static ssize_t veth_pool_store(struct kobject * kobj, struct attribute * attr,
-const char * buf, size_t count)
+static ssize_t veth_pool_store(struct kobject *kobj, struct attribute *attr,
+                               const char *buf, size_t count)
 {
         struct ibmveth_buff_pool *pool = container_of(kobj,
                                                       struct ibmveth_buff_pool,
@@ -1484,8 +1511,9 @@ const char * buf, size_t count)
         if (attr == &veth_active_attr) {
                 if (value && !pool->active) {
                         if (netif_running(netdev)) {
-                                if(ibmveth_alloc_buffer_pool(pool)) {
-                                        ibmveth_error_printk("unable to alloc pool\n");
+                                if (ibmveth_alloc_buffer_pool(pool)) {
+                                        netdev_err(netdev,
+                                                   "unable to alloc pool\n");
                                         return -ENOMEM;
                                 }
                                 pool->active = 1;
@@ -1494,14 +1522,15 @@ const char * buf, size_t count)
                                 adapter->pool_config = 0;
                                 if ((rc = ibmveth_open(netdev)))
                                         return rc;
-                        } else
+                        } else {
                                 pool->active = 1;
+                        }
                 } else if (!value && pool->active) {
                         int mtu = netdev->mtu + IBMVETH_BUFF_OH;
                         int i;
                         /* Make sure there is a buffer pool with buffers that
                            can hold a packet of the size of the MTU */
-                        for (i = 0; i < IbmVethNumBufferPools; i++) {
+                        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                                 if (pool == &adapter->rx_buff_pool[i])
                                         continue;
                                 if (!adapter->rx_buff_pool[i].active)
@@ -1510,8 +1539,8 @@ const char * buf, size_t count)
                                         break;
                         }
 
-                        if (i == IbmVethNumBufferPools) {
-                                ibmveth_error_printk("no active pool >= MTU\n");
+                        if (i == IBMVETH_NUM_BUFF_POOLS) {
+                                netdev_err(netdev, "no active pool >= MTU\n");
                                 return -EPERM;
                         }
 
@@ -1526,9 +1555,9 @@ const char * buf, size_t count)
                         pool->active = 0;
                 }
         } else if (attr == &veth_num_attr) {
-                if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT)
+                if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT) {
                         return -EINVAL;
-                else {
+                } else {
                         if (netif_running(netdev)) {
                                 adapter->pool_config = 1;
                                 ibmveth_close(netdev);
@@ -1536,13 +1565,14 @@ const char * buf, size_t count)
                                 pool->size = value;
                                 if ((rc = ibmveth_open(netdev)))
                                         return rc;
-                        } else
+                        } else {
                                 pool->size = value;
+                        }
                 }
         } else if (attr == &veth_size_attr) {
-                if (value <= IBMVETH_BUFF_OH || value > IBMVETH_MAX_BUF_SIZE)
+                if (value <= IBMVETH_BUFF_OH || value > IBMVETH_MAX_BUF_SIZE) {
                         return -EINVAL;
-                else {
+                } else {
                         if (netif_running(netdev)) {
                                 adapter->pool_config = 1;
                                 ibmveth_close(netdev);
@@ -1550,8 +1580,9 @@ const char * buf, size_t count)
                                 pool->buff_size = value;
                                 if ((rc = ibmveth_open(netdev)))
                                         return rc;
-                        } else
+                        } else {
                                 pool->buff_size = value;
+                        }
                 }
         }
 
@@ -1561,16 +1592,16 @@ const char * buf, size_t count)
 }
 
 
-#define ATTR(_name, _mode)      \
-        struct attribute veth_##_name##_attr = {               \
-        .name = __stringify(_name), .mode = _mode, \
-        };
+#define ATTR(_name, _mode)                              \
+        struct attribute veth_##_name##_attr = {        \
+        .name = __stringify(_name), .mode = _mode,      \
+        };
 
 static ATTR(active, 0644);
 static ATTR(num, 0644);
 static ATTR(size, 0644);
 
-static struct attribute * veth_pool_attrs[] = {
+static struct attribute *veth_pool_attrs[] = {
         &veth_active_attr,
         &veth_num_attr,
         &veth_size_attr,
@@ -1595,7 +1626,7 @@ static int ibmveth_resume(struct device *dev)
         return 0;
 }
 
-static struct vio_device_id ibmveth_device_table[] __devinitdata= {
+static struct vio_device_id ibmveth_device_table[] __devinitdata = {
         { "network", "IBM,l-lan"},
         { "", "" }
 };
@@ -1619,9 +1650,8 @@ static struct vio_driver ibmveth_driver = {
 
 static int __init ibmveth_module_init(void)
 {
-        ibmveth_printk("%s: %s %s\n", ibmveth_driver_name, ibmveth_driver_string, ibmveth_driver_version);
-
-        ibmveth_proc_register_driver();
+        printk(KERN_DEBUG "%s: %s %s\n", ibmveth_driver_name,
+               ibmveth_driver_string, ibmveth_driver_version);
 
         return vio_register_driver(&ibmveth_driver);
 }
@@ -1629,7 +1659,6 @@ static int __init ibmveth_module_init(void)
 static void __exit ibmveth_module_exit(void)
 {
         vio_unregister_driver(&ibmveth_driver);
-        ibmveth_proc_unregister_driver();
 }
 
 module_init(ibmveth_module_init);
diff --git a/drivers/net/ibmveth.h b/drivers/net/ibmveth.h
index ec76ace66c6b..43a794fab9ff 100644
--- a/drivers/net/ibmveth.h
+++ b/drivers/net/ibmveth.h
@@ -1,26 +1,28 @@
-/**************************************************************************/
-/*                                                                        */
-/* IBM eServer i/[Series Virtual Ethernet Device Driver                   */
-/* Copyright (C) 2003 IBM Corp.                                           */
-/*  Dave Larson (larson1@us.ibm.com)                                      */
-/*  Santiago Leon (santil@us.ibm.com)                                     */
-/*                                                                        */
-/*  This program is free software; you can redistribute it and/or modify  */
-/*  it under the terms of the GNU General Public License as published by  */
-/*  the Free Software Foundation; either version 2 of the License, or     */
-/*  (at your option) any later version.                                   */
-/*                                                                        */
-/*  This program is distributed in the hope that it will be useful,       */
-/*  but WITHOUT ANY WARRANTY; without even the implied warranty of        */
-/*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         */
-/*  GNU General Public License for more details.                          */
-/*                                                                        */
-/*  You should have received a copy of the GNU General Public License     */
-/*  along with this program; if not, write to the Free Software           */
-/*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  */
-/*                                                                   USA  */
-/*                                                                        */
-/**************************************************************************/
+/*
+ * IBM Power Virtual Ethernet Device Driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright (C) IBM Corporation, 2003, 2010
+ *
+ * Authors: Dave Larson <larson1@us.ibm.com>
+ *          Santiago Leon <santil@linux.vnet.ibm.com>
+ *          Brian King <brking@linux.vnet.ibm.com>
+ *          Robert Jennings <rcj@linux.vnet.ibm.com>
+ *          Anton Blanchard <anton@au.ibm.com>
+ */
 
 #ifndef _IBMVETH_H
 #define _IBMVETH_H
@@ -92,17 +94,17 @@ static inline long h_illan_attributes(unsigned long unit_address,
 #define h_change_logical_lan_mac(ua, mac) \
   plpar_hcall_norets(H_CHANGE_LOGICAL_LAN_MAC, ua, mac)
 
-#define IbmVethNumBufferPools 5
+#define IBMVETH_NUM_BUFF_POOLS 5
 #define IBMVETH_IO_ENTITLEMENT_DEFAULT 4243456 /* MTU of 1500 needs 4.2Mb */
 #define IBMVETH_BUFF_OH 22 /* Overhead: 14 ethernet header + 8 opaque handle */
-#define IBMVETH_MAX_MTU 68
+#define IBMVETH_MIN_MTU 68
 #define IBMVETH_MAX_POOL_COUNT 4096
 #define IBMVETH_BUFF_LIST_SIZE 4096
 #define IBMVETH_FILT_LIST_SIZE 4096
 #define IBMVETH_MAX_BUF_SIZE (1024 * 128)
 
 static int pool_size[] = { 512, 1024 * 2, 1024 * 16, 1024 * 32, 1024 * 64 };
-static int pool_count[] = { 256, 768, 256, 256, 256 };
+static int pool_count[] = { 256, 512, 256, 256, 256 };
 static int pool_active[] = { 1, 1, 0, 0, 0};
 
 #define IBM_VETH_INVALID_MAP ((u16)0xffff)
@@ -142,13 +144,15 @@ struct ibmveth_adapter {
     void * filter_list_addr;
     dma_addr_t buffer_list_dma;
     dma_addr_t filter_list_dma;
-    struct ibmveth_buff_pool rx_buff_pool[IbmVethNumBufferPools];
+    struct ibmveth_buff_pool rx_buff_pool[IBMVETH_NUM_BUFF_POOLS];
     struct ibmveth_rx_q rx_queue;
     int pool_config;
     int rx_csum;
     void *bounce_buffer;
     dma_addr_t bounce_buffer_dma;
 
+    u64 fw_ipv6_csum_support;
+    u64 fw_ipv4_csum_support;
     /* adapter specific stats */
     u64 replenish_task_cycles;
     u64 replenish_no_mem;
@@ -158,7 +162,6 @@ struct ibmveth_adapter {
     u64 rx_no_buffer;
     u64 tx_map_failed;
     u64 tx_send_failed;
-    spinlock_t stats_lock;
 };
 
 struct ibmveth_buf_desc_fields {
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index 187622f1c816..bc183f5487cb 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -132,6 +132,8 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
         case E1000_DEV_ID_82580_SERDES:
         case E1000_DEV_ID_82580_SGMII:
         case E1000_DEV_ID_82580_COPPER_DUAL:
+        case E1000_DEV_ID_DH89XXCC_SGMII:
+        case E1000_DEV_ID_DH89XXCC_SERDES:
                 mac->type = e1000_82580;
                 break;
         case E1000_DEV_ID_I350_COPPER:
@@ -282,10 +284,18 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
 
         /* Verify phy id and set remaining function pointers */
         switch (phy->id) {
+        case I347AT4_E_PHY_ID:
+        case M88E1112_E_PHY_ID:
         case M88E1111_I_PHY_ID:
                 phy->type                   = e1000_phy_m88;
                 phy->ops.get_phy_info       = igb_get_phy_info_m88;
-                phy->ops.get_cable_length   = igb_get_cable_length_m88;
+
+                if (phy->id == I347AT4_E_PHY_ID ||
+                    phy->id == M88E1112_E_PHY_ID)
+                        phy->ops.get_cable_length = igb_get_cable_length_m88_gen2;
+                else
+                        phy->ops.get_cable_length = igb_get_cable_length_m88;
+
                 phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_m88;
                 break;
         case IGP03E1000_E_PHY_ID:
@@ -1058,7 +1068,11 @@ static s32 igb_setup_copper_link_82575(struct e1000_hw *hw)
         }
         switch (hw->phy.type) {
         case e1000_phy_m88:
-                ret_val = igb_copper_link_setup_m88(hw);
+                if (hw->phy.id == I347AT4_E_PHY_ID ||
+                    hw->phy.id == M88E1112_E_PHY_ID)
+                        ret_val = igb_copper_link_setup_m88_gen2(hw);
+                else
+                        ret_val = igb_copper_link_setup_m88(hw);
                 break;
         case e1000_phy_igp_3:
                 ret_val = igb_copper_link_setup_igp(hw);
diff --git a/drivers/net/igb/e1000_defines.h b/drivers/net/igb/e1000_defines.h
index bbd2ec308eb0..62222796a8b3 100644
--- a/drivers/net/igb/e1000_defines.h
+++ b/drivers/net/igb/e1000_defines.h
@@ -634,6 +634,8 @@
  * E = External
  */
 #define M88E1111_I_PHY_ID    0x01410CC0
+#define M88E1112_E_PHY_ID    0x01410C90
+#define I347AT4_E_PHY_ID     0x01410DC0
 #define IGP03E1000_E_PHY_ID  0x02A80390
 #define I82580_I_PHY_ID      0x015403A0
 #define I350_I_PHY_ID        0x015403B0
@@ -702,6 +704,35 @@
 #define M88E1000_EPSCR_SLAVE_DOWNSHIFT_1X    0x0100
 #define M88E1000_EPSCR_TX_CLK_25      0x0070 /* 25  MHz TX_CLK */
 
+/* Intel i347-AT4 Registers */
+
+#define I347AT4_PCDL                   0x10 /* PHY Cable Diagnostics Length */
+#define I347AT4_PCDC                   0x15 /* PHY Cable Diagnostics Control */
+#define I347AT4_PAGE_SELECT            0x16
+
+/* i347-AT4 Extended PHY Specific Control Register */
+
+/*
+ *  Number of times we will attempt to autonegotiate before downshifting if we
+ *  are the master
+ */
+#define I347AT4_PSCR_DOWNSHIFT_ENABLE 0x0800
+#define I347AT4_PSCR_DOWNSHIFT_MASK   0x7000
+#define I347AT4_PSCR_DOWNSHIFT_1X     0x0000
+#define I347AT4_PSCR_DOWNSHIFT_2X     0x1000
+#define I347AT4_PSCR_DOWNSHIFT_3X     0x2000
+#define I347AT4_PSCR_DOWNSHIFT_4X     0x3000
+#define I347AT4_PSCR_DOWNSHIFT_5X     0x4000
+#define I347AT4_PSCR_DOWNSHIFT_6X     0x5000
+#define I347AT4_PSCR_DOWNSHIFT_7X     0x6000
+#define I347AT4_PSCR_DOWNSHIFT_8X     0x7000
+
+/* i347-AT4 PHY Cable Diagnostics Control */
+#define I347AT4_PCDC_CABLE_LENGTH_UNIT 0x0400 /* 0=cm 1=meters */
+
+/* Marvell 1112 only registers */
+#define M88E1112_VCT_DSP_DISTANCE       0x001A
+
 /* M88EC018 Rev 2 specific DownShift settings */
 #define M88EC018_EPSCR_DOWNSHIFT_COUNTER_MASK  0x0E00
 #define M88EC018_EPSCR_DOWNSHIFT_COUNTER_5X    0x0800
diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
index cb8db78b1a05..c0b017f8d782 100644
--- a/drivers/net/igb/e1000_hw.h
+++ b/drivers/net/igb/e1000_hw.h
@@ -54,6 +54,8 @@ struct e1000_hw;
 #define E1000_DEV_ID_82580_SERDES             0x1510
 #define E1000_DEV_ID_82580_SGMII              0x1511
 #define E1000_DEV_ID_82580_COPPER_DUAL        0x1516
+#define E1000_DEV_ID_DH89XXCC_SGMII           0x0436
+#define E1000_DEV_ID_DH89XXCC_SERDES          0x0438
 #define E1000_DEV_ID_I350_COPPER              0x1521
 #define E1000_DEV_ID_I350_FIBER               0x1522
 #define E1000_DEV_ID_I350_SERDES              0x1523
diff --git a/drivers/net/igb/e1000_phy.c b/drivers/net/igb/e1000_phy.c
index cf1f32300923..ddd036a78999 100644
--- a/drivers/net/igb/e1000_phy.c
+++ b/drivers/net/igb/e1000_phy.c
@@ -570,6 +570,89 @@ out:
 }
 
 /**
+ *  igb_copper_link_setup_m88_gen2 - Setup m88 PHY's for copper link
+ *  @hw: pointer to the HW structure
+ *
+ *  Sets up MDI/MDI-X and polarity for i347-AT4, m88e1322 and m88e1112 PHY's.
+ *  Also enables and sets the downshift parameters.
+ **/
+s32 igb_copper_link_setup_m88_gen2(struct e1000_hw *hw)
+{
+        struct e1000_phy_info *phy = &hw->phy;
+        s32 ret_val;
+        u16 phy_data;
+
+        if (phy->reset_disable) {
+                ret_val = 0;
+                goto out;
+        }
+
+        /* Enable CRS on Tx. This must be set for half-duplex operation. */
+        ret_val = phy->ops.read_reg(hw, M88E1000_PHY_SPEC_CTRL, &phy_data);
+        if (ret_val)
+                goto out;
+
+        /*
+         * Options:
+         *   MDI/MDI-X = 0 (default)
+         *   0 - Auto for all speeds
+         *   1 - MDI mode
+         *   2 - MDI-X mode
+         *   3 - Auto for 1000Base-T only (MDI-X for 10/100Base-T modes)
+         */
+        phy_data &= ~M88E1000_PSCR_AUTO_X_MODE;
+
+        switch (phy->mdix) {
+        case 1:
+                phy_data |= M88E1000_PSCR_MDI_MANUAL_MODE;
+                break;
+        case 2:
+                phy_data |= M88E1000_PSCR_MDIX_MANUAL_MODE;
+                break;
+        case 3:
+                /* M88E1112 does not support this mode) */
+                if (phy->id != M88E1112_E_PHY_ID) {
+                        phy_data |= M88E1000_PSCR_AUTO_X_1000T;
+                        break;
+                }
+        case 0:
+        default:
+                phy_data |= M88E1000_PSCR_AUTO_X_MODE;
+                break;
+        }
+
+        /*
+         * Options:
+         *   disable_polarity_correction = 0 (default)
+         *       Automatic Correction for Reversed Cable Polarity
+         *   0 - Disabled
+         *   1 - Enabled
+         */
+        phy_data &= ~M88E1000_PSCR_POLARITY_REVERSAL;
+        if (phy->disable_polarity_correction == 1)
+                phy_data |= M88E1000_PSCR_POLARITY_REVERSAL;
+
+        /* Enable downshift and setting it to X6 */
+        phy_data &= ~I347AT4_PSCR_DOWNSHIFT_MASK;
+        phy_data |= I347AT4_PSCR_DOWNSHIFT_6X;
+        phy_data |= I347AT4_PSCR_DOWNSHIFT_ENABLE;
+
+        ret_val = phy->ops.write_reg(hw, M88E1000_PHY_SPEC_CTRL, phy_data);
+        if (ret_val)
+                goto out;
+
+        /* Commit the changes. */
+        ret_val = igb_phy_sw_reset(hw);
+        if (ret_val) {
+                hw_dbg("Error committing the PHY changes\n");
+                goto out;
+        }
+
+out:
+        return ret_val;
+}
+
+/**
  *  igb_copper_link_setup_igp - Setup igp PHY's for copper link
  *  @hw: pointer to the HW structure
  *
@@ -1124,18 +1207,25 @@ s32 igb_phy_force_speed_duplex_m88(struct e1000_hw *hw)
                         goto out;
 
                 if (!link) {
-                        /*
-                         * We didn't get link.
-                         * Reset the DSP and cross our fingers.
-                         */
-                        ret_val = phy->ops.write_reg(hw,
-                                                     M88E1000_PHY_PAGE_SELECT,
-                                                     0x001d);
-                        if (ret_val)
-                                goto out;
-                        ret_val = igb_phy_reset_dsp(hw);
-                        if (ret_val)
-                                goto out;
+                        if (hw->phy.type != e1000_phy_m88 ||
+                            hw->phy.id == I347AT4_E_PHY_ID ||
+                            hw->phy.id == M88E1112_E_PHY_ID) {
+                                hw_dbg("Link taking longer than expected.\n");
+                        } else {
+
+                                /*
+                                 * We didn't get link.
+                                 * Reset the DSP and cross our fingers.
+                                 */
+                                ret_val = phy->ops.write_reg(hw,
+                                                             M88E1000_PHY_PAGE_SELECT,
+                                                             0x001d);
+                                if (ret_val)
+                                        goto out;
+                                ret_val = igb_phy_reset_dsp(hw);
+                                if (ret_val)
+                                        goto out;
+                        }
                 }
 
                 /* Try once more */
@@ -1145,6 +1235,11 @@ s32 igb_phy_force_speed_duplex_m88(struct e1000_hw *hw)
                         goto out;
         }
 
+        if (hw->phy.type != e1000_phy_m88 ||
+            hw->phy.id == I347AT4_E_PHY_ID ||
+            hw->phy.id == M88E1112_E_PHY_ID)
+                goto out;
+
         ret_val = phy->ops.read_reg(hw, M88E1000_EXT_PHY_SPEC_CTRL, &phy_data);
         if (ret_val)
                 goto out;
@@ -1557,6 +1652,93 @@ out:
         return ret_val;
 }
 
+s32 igb_get_cable_length_m88_gen2(struct e1000_hw *hw)
+{
+        struct e1000_phy_info *phy = &hw->phy;
+        s32 ret_val;
+        u16 phy_data, phy_data2, index, default_page, is_cm;
+
+        switch (hw->phy.id) {
+        case I347AT4_E_PHY_ID:
+                /* Remember the original page select and set it to 7 */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PAGE_SELECT,
+                                            &default_page);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0x07);
+                if (ret_val)
+                        goto out;
+
+                /* Get cable length from PHY Cable Diagnostics Control Reg */
+                ret_val = phy->ops.read_reg(hw, (I347AT4_PCDL + phy->addr),
+                                            &phy_data);
+                if (ret_val)
+                        goto out;
+
+                /* Check if the unit of cable length is meters or cm */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PCDC, &phy_data2);
+                if (ret_val)
+                        goto out;
+
+                is_cm = !(phy_data & I347AT4_PCDC_CABLE_LENGTH_UNIT);
+
+                /* Populate the phy structure with cable length in meters */
+                phy->min_cable_length = phy_data / (is_cm ? 100 : 1);
+                phy->max_cable_length = phy_data / (is_cm ? 100 : 1);
+                phy->cable_length = phy_data / (is_cm ? 100 : 1);
+
+                /* Reset the page selec to its original value */
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT,
+                                             default_page);
+                if (ret_val)
+                        goto out;
+                break;
+        case M88E1112_E_PHY_ID:
+                /* Remember the original page select and set it to 5 */
+                ret_val = phy->ops.read_reg(hw, I347AT4_PAGE_SELECT,
+                                            &default_page);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0x05);
+                if (ret_val)
+                        goto out;
+
+                ret_val = phy->ops.read_reg(hw, M88E1112_VCT_DSP_DISTANCE,
+                                            &phy_data);
+                if (ret_val)
+                        goto out;
+
+                index = (phy_data & M88E1000_PSSR_CABLE_LENGTH) >>
+                        M88E1000_PSSR_CABLE_LENGTH_SHIFT;
+                if (index >= M88E1000_CABLE_LENGTH_TABLE_SIZE - 1) {
+                        ret_val = -E1000_ERR_PHY;
+                        goto out;
+                }
+
+                phy->min_cable_length = e1000_m88_cable_length_table[index];
+                phy->max_cable_length = e1000_m88_cable_length_table[index + 1];
+
+                phy->cable_length = (phy->min_cable_length +
+                                     phy->max_cable_length) / 2;
+
+                /* Reset the page select to its original value */
+                ret_val = phy->ops.write_reg(hw, I347AT4_PAGE_SELECT,
+                                             default_page);
+                if (ret_val)
+                        goto out;
+
+                break;
+        default:
+                ret_val = -E1000_ERR_PHY;
+                goto out;
+        }
+
+out:
+        return ret_val;
+}
+
 /**
  *  igb_get_cable_length_igp_2 - Determine cable length for igp2 PHY
  *  @hw: pointer to the HW structure
diff --git a/drivers/net/igb/e1000_phy.h b/drivers/net/igb/e1000_phy.h
index 565a6dbb3714..2cc117705a31 100644
--- a/drivers/net/igb/e1000_phy.h
+++ b/drivers/net/igb/e1000_phy.h
@@ -45,9 +45,11 @@ s32  igb_check_downshift(struct e1000_hw *hw);
 s32  igb_check_reset_block(struct e1000_hw *hw);
 s32  igb_copper_link_setup_igp(struct e1000_hw *hw);
 s32  igb_copper_link_setup_m88(struct e1000_hw *hw);
+s32  igb_copper_link_setup_m88_gen2(struct e1000_hw *hw);
 s32  igb_phy_force_speed_duplex_igp(struct e1000_hw *hw);
 s32  igb_phy_force_speed_duplex_m88(struct e1000_hw *hw);
 s32  igb_get_cable_length_m88(struct e1000_hw *hw);
+s32  igb_get_cable_length_m88_gen2(struct e1000_hw *hw);
 s32  igb_get_cable_length_igp_2(struct e1000_hw *hw);
 s32  igb_get_phy_id(struct e1000_hw *hw);
 s32  igb_get_phy_info_igp(struct e1000_hw *hw);
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 6e63d9a7fc75..44e0ff1494e0 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -143,7 +143,7 @@ struct igb_buffer {
                         u16 next_to_watch;
                         unsigned int bytecount;
                         u16 gso_segs;
-                        union skb_shared_tx shtx;
+                        u8 tx_flags;
                         u8 mapped_as_page;
                 };
                 /* RX */
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 9b4e5895f5f9..0394ca95f3ba 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -71,6 +71,8 @@ static DEFINE_PCI_DEVICE_TABLE(igb_pci_tbl) = {
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_SGMII), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82580_COPPER_DUAL), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_DH89XXCC_SGMII), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_DH89XXCC_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_NS), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_NS_SERDES), board_82575 },
@@ -1856,8 +1858,10 @@ static int __devinit igb_probe(struct pci_dev *pdev,
         netdev->vlan_features |= NETIF_F_IPV6_CSUM;
         netdev->vlan_features |= NETIF_F_SG;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (hw->mac.type >= e1000_82576)
                 netdev->features |= NETIF_F_SCTP_CSUM;
@@ -1888,9 +1892,9 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                 goto err_eeprom;
         }
 
-        setup_timer(&adapter->watchdog_timer, &igb_watchdog,
+        setup_timer(&adapter->watchdog_timer, igb_watchdog,
                     (unsigned long) adapter);
-        setup_timer(&adapter->phy_info_timer, &igb_update_phy_info,
+        setup_timer(&adapter->phy_info_timer, igb_update_phy_info,
                     (unsigned long) adapter);
 
         INIT_WORK(&adapter->reset_task, igb_reset_task);
@@ -3954,7 +3958,7 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
         }
 
         tx_ring->buffer_info[i].skb = skb;
-        tx_ring->buffer_info[i].shtx = skb_shinfo(skb)->tx_flags;
+        tx_ring->buffer_info[i].tx_flags = skb_shinfo(skb)->tx_flags;
         /* multiply data chunks by size of headers */
         tx_ring->buffer_info[i].bytecount = ((gso_segs - 1) * hlen) + skb->len;
         tx_ring->buffer_info[i].gso_segs = gso_segs;
@@ -4088,7 +4092,6 @@ netdev_tx_t igb_xmit_frame_ring_adv(struct sk_buff *skb,
         u32 tx_flags = 0;
         u16 first;
         u8 hdr_len = 0;
-        union skb_shared_tx *shtx = skb_tx(skb);
 
         /* need: 1 descriptor per page,
          *       + 2 desc gap to keep tail from touching head,
@@ -4100,8 +4103,8 @@ netdev_tx_t igb_xmit_frame_ring_adv(struct sk_buff *skb,
                 return NETDEV_TX_BUSY;
         }
 
-        if (unlikely(shtx->hardware)) {
-                shtx->in_progress = 1;
+        if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
                 tx_flags |= IGB_TX_FLAGS_TSTAMP;
         }
 
@@ -4660,12 +4663,13 @@ static int igb_set_vf_promisc(struct igb_adapter *adapter, u32 *msgbuf, u32 vf)
         u32 vmolr = rd32(E1000_VMOLR(vf));
         struct vf_data_storage *vf_data = &adapter->vf_data[vf];
 
-        vf_data->flags |= ~(IGB_VF_FLAG_UNI_PROMISC |
+        vf_data->flags &= ~(IGB_VF_FLAG_UNI_PROMISC |
                             IGB_VF_FLAG_MULTI_PROMISC);
         vmolr &= ~(E1000_VMOLR_ROPE | E1000_VMOLR_ROMPE | E1000_VMOLR_MPME);
 
         if (*msgbuf & E1000_VF_SET_PROMISC_MULTICAST) {
                 vmolr |= E1000_VMOLR_MPME;
+                vf_data->flags |= IGB_VF_FLAG_MULTI_PROMISC;
                 *msgbuf &= ~E1000_VF_SET_PROMISC_MULTICAST;
         } else {
                 /*
@@ -5319,7 +5323,7 @@ static void igb_tx_hwtstamp(struct igb_q_vector *q_vector, struct igb_buffer *bu
         u64 regval;
 
         /* if skb does not support hw timestamp or TX stamp not valid exit */
-        if (likely(!buffer_info->shtx.hardware) ||
+        if (likely(!(buffer_info->tx_flags & SKBTX_HW_TSTAMP)) ||
             !(rd32(E1000_TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID))
                 return;
 
@@ -5431,7 +5435,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
         tx_ring->total_packets += total_packets;
         tx_ring->tx_stats.bytes += total_bytes;
         tx_ring->tx_stats.packets += total_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 /**
@@ -5456,7 +5460,7 @@ static void igb_receive_skb(struct igb_q_vector *q_vector,
 static inline void igb_rx_checksum_adv(struct igb_ring *ring,
                                        u32 status_err, struct sk_buff *skb)
 {
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* Ignore Checksum bit is set or checksum is disabled through ethtool */
         if (!(ring->flags & IGB_RING_FLAG_RX_CSUM) ||
@@ -5500,7 +5504,7 @@ static void igb_rx_hwtstamp(struct igb_q_vector *q_vector, u32 staterr,
          * values must belong to this one here and therefore we don't need to
          * compare any of the additional attributes stored for it.
          *
-         * If nothing went wrong, then it should have a skb_shared_tx that we
+         * If nothing went wrong, then it should have a shared tx_flags that we
          * can turn into a skb_shared_hwtstamps.
          */
         if (staterr & E1000_RXDADV_STAT_TSIP) {
diff --git a/drivers/net/igbvf/ethtool.c b/drivers/net/igbvf/ethtool.c
index 103b3aa1afc2..33add708bcbe 100644
--- a/drivers/net/igbvf/ethtool.c
+++ b/drivers/net/igbvf/ethtool.c
@@ -153,7 +153,7 @@ static int igbvf_set_rx_csum(struct net_device *netdev, u32 data)
 
 static u32 igbvf_get_tx_csum(struct net_device *netdev)
 {
-        return ((netdev->features & NETIF_F_IP_CSUM) != 0);
+        return (netdev->features & NETIF_F_IP_CSUM) != 0;
 }
 
 static int igbvf_set_tx_csum(struct net_device *netdev, u32 data)
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index c539f7c9c3e0..265501348f33 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -103,7 +103,7 @@ static void igbvf_receive_skb(struct igbvf_adapter *adapter,
 static inline void igbvf_rx_checksum_adv(struct igbvf_adapter *adapter,
                                          u32 status_err, struct sk_buff *skb)
 {
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* Ignore Checksum bit is set or checksum is disabled through ethtool */
         if ((status_err & E1000_RXD_STAT_IXSM) ||
@@ -845,7 +845,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
         }
         adapter->net_stats.tx_bytes += total_bytes;
         adapter->net_stats.tx_packets += total_packets;
-        return (count < tx_ring->count);
+        return count < tx_ring->count;
 }
 
 static irqreturn_t igbvf_msix_other(int irq, void *data)
diff --git a/drivers/net/ioc3-eth.c b/drivers/net/ioc3-eth.c
index 0b3f6df5cff7..c8ee8d28767b 100644
--- a/drivers/net/ioc3-eth.c
+++ b/drivers/net/ioc3-eth.c
@@ -827,7 +827,7 @@ static void ioc3_mii_start(struct ioc3_private *ip)
 {
         ip->ioc3_timer.expires = jiffies + (12 * HZ)/10;  /* 1.2 sec. */
         ip->ioc3_timer.data = (unsigned long) ip;
-        ip->ioc3_timer.function = &ioc3_timer;
+        ip->ioc3_timer.function = ioc3_timer;
         add_timer(&ip->ioc3_timer);
 }
 
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 72e3d2da9e9f..dc0198092343 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -1213,7 +1213,7 @@ static void ipg_nic_rx_with_start_and_end(struct net_device *dev,
 
         skb_put(skb, framelen);
         skb->protocol = eth_type_trans(skb, dev);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
         netif_rx(skb);
         sp->rx_buff[entry] = NULL;
 }
@@ -1278,7 +1278,7 @@ static void ipg_nic_rx_with_end(struct net_device *dev,
                                 jumbo->skb->protocol =
                                     eth_type_trans(jumbo->skb, dev);
 
-                                jumbo->skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(jumbo->skb);
                                 netif_rx(jumbo->skb);
                         }
                 }
@@ -1476,7 +1476,7 @@ static int ipg_nic_rx(struct net_device *dev)
                          * IP/TCP/UDP frame was received. Let the
                          * upper layer decide.
                          */
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                         /* Hand off frame for higher layer processing.
                          * The function netif_rx() releases the sk_buff
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 48bd5ec9f29b..b626cccbccd1 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -217,7 +217,7 @@ toshoboe_checkfcs (unsigned char *buf, int len)
   for (i = 0; i < len; ++i)
     fcs.value = irda_fcs (fcs.value, *(buf++));
 
-  return (fcs.value == GOOD_FCS);
+  return fcs.value == GOOD_FCS;
 }
 
 /***********************************************************************/
@@ -759,7 +759,7 @@ toshoboe_maketestpacket (unsigned char *buf, int badcrc, int fir)
   if (fir)
     {
       memset (buf, 0, TT_LEN);
-      return (TT_LEN);
+      return TT_LEN;
     }
 
   fcs.value = INIT_FCS;
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 4441fa3389c2..cce82f101f50 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1514,7 +1514,7 @@ static inline int irda_usb_parse_endpoints(struct irda_usb_cb *self, struct usb_
         IRDA_DEBUG(0, "%s(), And our endpoints are : in=%02X, out=%02X (%d), int=%02X\n",
                 __func__, self->bulk_in_ep, self->bulk_out_ep, self->bulk_out_mtu, self->bulk_int_ep);
 
-        return((self->bulk_in_ep != 0) && (self->bulk_out_ep != 0));
+        return (self->bulk_in_ep != 0) && (self->bulk_out_ep != 0);
 }
 
 #ifdef IU_DUMP_CLASS_DESC
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index 5b1036ac38d7..74b20f179cea 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -734,7 +734,7 @@ static int mcs_net_open(struct net_device *netdev)
         }
 
         if (!mcs_setup_urbs(mcs))
-        goto error3;
+                goto error3;
 
         ret = mcs_receive_start(mcs);
         if (ret)
diff --git a/drivers/net/irda/nsc-ircc.c b/drivers/net/irda/nsc-ircc.c
index e30cdbb14745..559fe854d76d 100644
--- a/drivers/net/irda/nsc-ircc.c
+++ b/drivers/net/irda/nsc-ircc.c
@@ -1348,7 +1348,7 @@ static __u8 nsc_ircc_change_speed(struct nsc_ircc_cb *self, __u32 speed)
         outb(bank, iobase+BSR);
 
         /* Make sure interrupt handlers keep the proper interrupt mask */
-        return(ier);
+        return ier;
 }
 
 /*
diff --git a/drivers/net/irda/sir_dev.c b/drivers/net/irda/sir_dev.c
index 1b051dab7b29..39d6e6f15d4f 100644
--- a/drivers/net/irda/sir_dev.c
+++ b/drivers/net/irda/sir_dev.c
@@ -336,7 +336,7 @@ static int sirdev_is_receiving(struct sir_dev *dev)
         if (!atomic_read(&dev->enable_rx))
                 return 0;
 
-        return (dev->rx_buff.state != OUTSIDE_FRAME);
+        return dev->rx_buff.state != OUTSIDE_FRAME;
 }
 
 int sirdev_set_dongle(struct sir_dev *dev, IRDA_DONGLE type)
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 850ca1c5ee19..8c57bfb5f098 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -2051,7 +2051,7 @@ static int smsc_ircc_sir_write(int iobase, int fifo_size, __u8 *buf, int len)
  */
 static int smsc_ircc_is_receiving(struct smsc_ircc_cb *self)
 {
-        return (self->rx_buff.state != OUTSIDE_FRAME);
+        return self->rx_buff.state != OUTSIDE_FRAME;
 }
 
 
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index e5698fa30a4f..41c96b3d8152 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -219,7 +219,7 @@ static inline int read_reg(struct stir_cb *stir, __u16 reg,
 
 static inline int isfir(u32 speed)
 {
-        return (speed == 4000000);
+        return speed == 4000000;
 }
 
 /*
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index b0a6cd815be1..67c0ad42d818 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -1182,12 +1182,13 @@ F01_E */
 
                 skb = dev_alloc_skb(len + 1 - 4);
                 /*
-                 * if frame size,data ptr,or skb ptr are wrong ,the get next
+                 * if frame size, data ptr, or skb ptr are wrong, then get next
                  * entry.
                  */
                 if ((skb == NULL) || (skb->data == NULL) ||
                     (self->rx_buff.data == NULL) || (len < 6)) {
                         self->netdev->stats.rx_dropped++;
+                        kfree_skb(skb);
                         return TRUE;
                 }
                 skb_reserve(skb, 1);
diff --git a/drivers/net/irda/via-ircc.h b/drivers/net/irda/via-ircc.h
index 5a84822b5a43..c6f58482b769 100644
--- a/drivers/net/irda/via-ircc.h
+++ b/drivers/net/irda/via-ircc.h
@@ -238,7 +238,7 @@ static void WriteLPCReg(int iRegNum, unsigned char iVal)
 
 static __u8 ReadReg(unsigned int BaseAddr, int iRegNum)
 {
-        return ((__u8) inb(BaseAddr + iRegNum));
+        return (__u8) inb(BaseAddr + iRegNum);
 }
 
 static void WriteReg(unsigned int BaseAddr, int iRegNum, unsigned char iVal)
diff --git a/drivers/net/irda/vlsi_ir.h b/drivers/net/irda/vlsi_ir.h
index 3f24a1f33022..d66fab854bf1 100644
--- a/drivers/net/irda/vlsi_ir.h
+++ b/drivers/net/irda/vlsi_ir.h
@@ -595,7 +595,7 @@ struct ring_descr {
 
 static inline int rd_is_active(struct ring_descr *rd)
 {
-        return ((rd->hw->rd_status & RD_ACTIVE) != 0);
+        return (rd->hw->rd_status & RD_ACTIVE) != 0;
 }
 
 static inline void rd_activate(struct ring_descr *rd)
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index ba1de5973fb2..8df645e78f2e 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -1524,7 +1524,7 @@ static void veth_receive(struct veth_lpar_connection *cnx,
 
                 skb_put(skb, length);
                 skb->protocol = eth_type_trans(skb, dev);
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 netif_rx(skb);  /* send it up */
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += length;
diff --git a/drivers/net/ixgb/ixgb_ee.c b/drivers/net/ixgb/ixgb_ee.c
index 813993f9c65c..c982ab9f9005 100644
--- a/drivers/net/ixgb/ixgb_ee.c
+++ b/drivers/net/ixgb/ixgb_ee.c
@@ -296,12 +296,12 @@ ixgb_wait_eeprom_command(struct ixgb_hw *hw)
                 eecd_reg = IXGB_READ_REG(hw, EECD);
 
                 if (eecd_reg & IXGB_EECD_DO)
-                        return (true);
+                        return true;
 
                 udelay(50);
         }
         ASSERT(0);
-        return (false);
+        return false;
 }
 
 /******************************************************************************
@@ -327,9 +327,9 @@ ixgb_validate_eeprom_checksum(struct ixgb_hw *hw)
                 checksum += ixgb_read_eeprom(hw, i);
 
         if (checksum == (u16) EEPROM_SUM)
-                return (true);
+                return true;
         else
-                return (false);
+                return false;
 }
 
 /******************************************************************************
@@ -439,7 +439,7 @@ ixgb_read_eeprom(struct ixgb_hw *hw,
         /*  End this read operation  */
         ixgb_standby_eeprom(hw);
 
-        return (data);
+        return data;
 }
 
 /******************************************************************************
@@ -476,16 +476,16 @@ ixgb_get_eeprom_data(struct ixgb_hw *hw)
                 /* clear the init_ctrl_reg_1 to signify that the cache is
                  * invalidated */
                 ee_map->init_ctrl_reg_1 = cpu_to_le16(EEPROM_ICW1_SIGNATURE_CLEAR);
-                return (false);
+                return false;
         }
 
         if ((ee_map->init_ctrl_reg_1 & cpu_to_le16(EEPROM_ICW1_SIGNATURE_MASK))
                  != cpu_to_le16(EEPROM_ICW1_SIGNATURE_VALID)) {
                 pr_debug("Signature invalid\n");
-                return(false);
+                return false;
         }
 
-        return(true);
+        return true;
 }
 
 /******************************************************************************
@@ -505,7 +505,7 @@ ixgb_check_and_get_eeprom_data (struct ixgb_hw* hw)
 
         if ((ee_map->init_ctrl_reg_1 & cpu_to_le16(EEPROM_ICW1_SIGNATURE_MASK))
             == cpu_to_le16(EEPROM_ICW1_SIGNATURE_VALID)) {
-                return (true);
+                return true;
         } else {
                 return ixgb_get_eeprom_data(hw);
         }
@@ -526,10 +526,10 @@ ixgb_get_eeprom_word(struct ixgb_hw *hw, u16 index)
 
         if ((index < IXGB_EEPROM_SIZE) &&
                 (ixgb_check_and_get_eeprom_data(hw) == true)) {
-           return(hw->eeprom[index]);
+           return hw->eeprom[index];
         }
 
-        return(0);
+        return 0;
 }
 
 /******************************************************************************
@@ -570,10 +570,10 @@ u32
 ixgb_get_ee_pba_number(struct ixgb_hw *hw)
 {
         if (ixgb_check_and_get_eeprom_data(hw) == true)
-                return (le16_to_cpu(hw->eeprom[EEPROM_PBA_1_2_REG])
-                        | (le16_to_cpu(hw->eeprom[EEPROM_PBA_3_4_REG])<<16));
+                return le16_to_cpu(hw->eeprom[EEPROM_PBA_1_2_REG])
+                        | (le16_to_cpu(hw->eeprom[EEPROM_PBA_3_4_REG])<<16);
 
-        return(0);
+        return 0;
 }
 
 
@@ -591,8 +591,8 @@ ixgb_get_ee_device_id(struct ixgb_hw *hw)
         struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
 
         if (ixgb_check_and_get_eeprom_data(hw) == true)
-                return (le16_to_cpu(ee_map->device_id));
+                return le16_to_cpu(ee_map->device_id);
 
-        return (0);
+        return 0;
 }
 
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index a4ed96caae69..43994c199991 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -410,7 +410,7 @@ static int
 ixgb_get_eeprom_len(struct net_device *netdev)
 {
         /* return size in bytes */
-        return (IXGB_EEPROM_SIZE << 1);
+        return IXGB_EEPROM_SIZE << 1;
 }
 
 static int
diff --git a/drivers/net/ixgb/ixgb_hw.c b/drivers/net/ixgb/ixgb_hw.c
index 397acabccab6..6cb2e42ff4c1 100644
--- a/drivers/net/ixgb/ixgb_hw.c
+++ b/drivers/net/ixgb/ixgb_hw.c
@@ -167,7 +167,7 @@ ixgb_adapter_stop(struct ixgb_hw *hw)
         /* Clear any pending interrupt events. */
         icr_reg = IXGB_READ_REG(hw, ICR);
 
-        return (ctrl_reg & IXGB_CTRL0_RST);
+        return ctrl_reg & IXGB_CTRL0_RST;
 }
 
 
@@ -209,7 +209,7 @@ ixgb_identify_xpak_vendor(struct ixgb_hw *hw)
                 xpak_vendor = ixgb_xpak_vendor_infineon;
         }
 
-        return (xpak_vendor);
+        return xpak_vendor;
 }
 
 /******************************************************************************
@@ -273,7 +273,7 @@ ixgb_identify_phy(struct ixgb_hw *hw)
         if (hw->subsystem_vendor_id == SUN_SUBVENDOR_ID)
                 phy_type = ixgb_phy_type_bcm;
 
-        return (phy_type);
+        return phy_type;
 }
 
 /******************************************************************************
@@ -366,7 +366,7 @@ ixgb_init_hw(struct ixgb_hw *hw)
         /* 82597EX errata: Call check-for-link in case lane deskew is locked */
         ixgb_check_for_link(hw);
 
-        return (status);
+        return status;
 }
 
 /******************************************************************************
@@ -531,7 +531,7 @@ ixgb_hash_mc_addr(struct ixgb_hw *hw,
         }
 
         hash_value &= 0xFFF;
-        return (hash_value);
+        return hash_value;
 }
 
 /******************************************************************************
@@ -715,7 +715,7 @@ ixgb_setup_fc(struct ixgb_hw *hw)
                 }
                 IXGB_WRITE_REG(hw, FCRTH, hw->fc.high_water);
         }
-        return (status);
+        return status;
 }
 
 /******************************************************************************
@@ -1140,7 +1140,7 @@ mac_addr_valid(u8 *mac_addr)
                 pr_debug("MAC address is all zeros\n");
                 is_valid = false;
         }
-        return (is_valid);
+        return is_valid;
 }
 
 /******************************************************************************
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 45fc89b9ba64..80e62578ffa0 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -446,8 +446,10 @@ ixgb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                            NETIF_F_HW_VLAN_FILTER;
         netdev->features |= NETIF_F_TSO;
 
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         /* make sure the EEPROM is good */
 
@@ -470,7 +472,7 @@ ixgb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->part_num = ixgb_get_ee_pba_number(&adapter->hw);
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &ixgb_watchdog;
+        adapter->watchdog_timer.function = ixgb_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
 
         INIT_WORK(&adapter->tx_timeout_task, ixgb_tx_timeout_task);
@@ -1905,7 +1907,7 @@ ixgb_rx_checksum(struct ixgb_adapter *adapter,
          */
         if ((rx_desc->status & IXGB_RX_DESC_STATUS_IXSM) ||
            (!(rx_desc->status & IXGB_RX_DESC_STATUS_TCPCS))) {
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 return;
         }
 
@@ -1913,7 +1915,7 @@ ixgb_rx_checksum(struct ixgb_adapter *adapter,
         /* now look at the TCP checksum error bit */
         if (rx_desc->errors & IXGB_RX_DESC_ERRORS_TCPE) {
                 /* let the stack verify checksum errors */
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 adapter->hw_csum_rx_error++;
         } else {
                 /* TCP checksum is good */
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 9e15eb93860e..5cebc3755b64 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -69,15 +69,20 @@
 #define IXGBE_MAX_FCPAUSE                0xFFFF
 
 /* Supported Rx Buffer Sizes */
-#define IXGBE_RXBUFFER_64    64     /* Used for packet split */
-#define IXGBE_RXBUFFER_128   128    /* Used for packet split */
-#define IXGBE_RXBUFFER_256   256    /* Used for packet split */
+#define IXGBE_RXBUFFER_512   512    /* Used for packet split */
 #define IXGBE_RXBUFFER_2048  2048
 #define IXGBE_RXBUFFER_4096  4096
 #define IXGBE_RXBUFFER_8192  8192
 #define IXGBE_MAX_RXBUFFER   16384  /* largest size for a single descriptor */
 
-#define IXGBE_RX_HDR_SIZE IXGBE_RXBUFFER_256
+/*
+ * NOTE: netdev_alloc_skb reserves up to 64 bytes, NET_IP_ALIGN mans we
+ * reserve 2 more, and skb_shared_info adds an additional 384 bytes more,
+ * this adds up to 512 bytes of extra data meaning the smallest allocation
+ * we could have is 1K.
+ * i.e. RXBUFFER_512 --> size-1024 slab
+ */
+#define IXGBE_RX_HDR_SIZE IXGBE_RXBUFFER_512
 
 #define MAXIMUM_ETHERNET_VLAN_SIZE (ETH_FRAME_LEN + ETH_FCS_LEN + VLAN_HLEN)
 
@@ -251,11 +256,11 @@ struct ixgbe_q_vector {
         (R)->next_to_clean - (R)->next_to_use - 1)
 
 #define IXGBE_RX_DESC_ADV(R, i)     \
-        (&(((union ixgbe_adv_rx_desc *)((R).desc))[i]))
+        (&(((union ixgbe_adv_rx_desc *)((R)->desc))[i]))
 #define IXGBE_TX_DESC_ADV(R, i)     \
-        (&(((union ixgbe_adv_tx_desc *)((R).desc))[i]))
+        (&(((union ixgbe_adv_tx_desc *)((R)->desc))[i]))
 #define IXGBE_TX_CTXTDESC_ADV(R, i)         \
-        (&(((struct ixgbe_adv_tx_context_desc *)((R).desc))[i]))
+        (&(((struct ixgbe_adv_tx_context_desc *)((R)->desc))[i]))
 
 #define IXGBE_MAX_JUMBO_FRAME_SIZE        16128
 #ifdef IXGBE_FCOE
@@ -448,9 +453,20 @@ extern int ixgbe_setup_rx_resources(struct ixgbe_adapter *, struct ixgbe_ring *)
 extern int ixgbe_setup_tx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
 extern void ixgbe_free_rx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
 extern void ixgbe_free_tx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
+extern void ixgbe_configure_rx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
+extern void ixgbe_configure_tx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
 extern void ixgbe_update_stats(struct ixgbe_adapter *adapter);
 extern int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter);
 extern void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter);
+extern netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *,
+                                         struct net_device *,
+                                         struct ixgbe_adapter *,
+                                         struct ixgbe_ring *);
+extern void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *,
+                                             struct ixgbe_tx_buffer *);
+extern void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *rx_ring,
+                                   int cleaned_count);
 extern void ixgbe_write_eitr(struct ixgbe_q_vector *);
 extern int ethtool_ioctl(struct ifreq *ifr);
 extern s32 ixgbe_reinit_fdir_tables_82599(struct ixgbe_hw *hw);
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 3e06a61da921..e80657c75506 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -1910,56 +1910,27 @@ s32 ixgbe_fdir_add_perfect_filter_82599(struct ixgbe_hw *hw,
                       (dst_port << IXGBE_FDIRPORT_DESTINATION_SHIFT)));
 
         /*
-         * Program the relevant mask registers.  If src/dst_port or src/dst_addr
-         * are zero, then assume a full mask for that field.  Also assume that
-         * a VLAN of 0 is unspecified, so mask that out as well.  L4type
-         * cannot be masked out in this implementation.
+         * Program the relevant mask registers.  L4type cannot be
+         * masked out in this implementation.
          *
          * This also assumes IPv4 only.  IPv6 masking isn't supported at this
          * point in time.
          */
-        if (src_ipv4 == 0)
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, 0xffffffff);
-        else
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, input_masks->src_ip_mask);
-
-        if (dst_ipv4 == 0)
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, 0xffffffff);
-        else
-                IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, input_masks->dst_ip_mask);
+        IXGBE_WRITE_REG(hw, IXGBE_FDIRSIP4M, input_masks->src_ip_mask);
+        IXGBE_WRITE_REG(hw, IXGBE_FDIRDIP4M, input_masks->dst_ip_mask);
 
         switch (l4type & IXGBE_ATR_L4TYPE_MASK) {
         case IXGBE_ATR_L4TYPE_TCP:
-                if (src_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM, 0xffff);
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                        input_masks->src_port_mask);
-
-                if (dst_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
-                                        (0xffff << 16)));
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
-                                        (input_masks->dst_port_mask << 16)));
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM, input_masks->src_port_mask);
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRTCPM,
+                                (IXGBE_READ_REG(hw, IXGBE_FDIRTCPM) |
+                                 (input_masks->dst_port_mask << 16)));
                 break;
         case IXGBE_ATR_L4TYPE_UDP:
-                if (src_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM, 0xffff);
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                        input_masks->src_port_mask);
-
-                if (dst_port == 0)
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
-                                        (0xffff << 16)));
-                else
-                        IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
-                                       (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
-                                        (input_masks->src_port_mask << 16)));
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM, input_masks->src_port_mask);
+                IXGBE_WRITE_REG(hw, IXGBE_FDIRUDPM,
+                                (IXGBE_READ_REG(hw, IXGBE_FDIRUDPM) |
+                                 (input_masks->src_port_mask << 16)));
                 break;
         default:
                 /* this already would have failed above */
@@ -1967,11 +1938,11 @@ s32 ixgbe_fdir_add_perfect_filter_82599(struct ixgbe_hw *hw,
         }
 
         /* Program the last mask register, FDIRM */
-        if (input_masks->vlan_id_mask || !vlan_id)
+        if (input_masks->vlan_id_mask)
                 /* Mask both VLAN and VLANP - bits 0 and 1 */
                 fdirm |= 0x3;
 
-        if (input_masks->data_mask || !flex_bytes)
+        if (input_masks->data_mask)
                 /* Flex bytes need masking, so mask the whole thing - bit 4 */
                 fdirm |= 0x10;
 
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index dcebc82c6f4d..d4ac94324fa0 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -401,7 +401,7 @@ static int ixgbe_set_pauseparam(struct net_device *netdev,
 static u32 ixgbe_get_rx_csum(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        return (adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED);
+        return adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED;
 }
 
 static int ixgbe_set_rx_csum(struct net_device *netdev, u32 data)
@@ -820,16 +820,19 @@ static void ixgbe_get_drvinfo(struct net_device *netdev,
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         char firmware_version[32];
 
-        strncpy(drvinfo->driver, ixgbe_driver_name, 32);
-        strncpy(drvinfo->version, ixgbe_driver_version, 32);
+        strncpy(drvinfo->driver, ixgbe_driver_name, sizeof(drvinfo->driver));
+        strncpy(drvinfo->version, ixgbe_driver_version,
+                sizeof(drvinfo->version));
 
-        sprintf(firmware_version, "%d.%d-%d",
-                (adapter->eeprom_version & 0xF000) >> 12,
-                (adapter->eeprom_version & 0x0FF0) >> 4,
-                adapter->eeprom_version & 0x000F);
+        snprintf(firmware_version, sizeof(firmware_version), "%d.%d-%d",
+                 (adapter->eeprom_version & 0xF000) >> 12,
+                 (adapter->eeprom_version & 0x0FF0) >> 4,
+                 adapter->eeprom_version & 0x000F);
 
-        strncpy(drvinfo->fw_version, firmware_version, 32);
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev), 32);
+        strncpy(drvinfo->fw_version, firmware_version,
+                sizeof(drvinfo->fw_version));
+        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+                sizeof(drvinfo->bus_info));
         drvinfo->n_stats = IXGBE_STATS_LEN;
         drvinfo->testinfo_len = IXGBE_TEST_LEN;
         drvinfo->regdump_len = ixgbe_get_regs_len(netdev);
@@ -985,8 +988,8 @@ static int ixgbe_get_sset_count(struct net_device *netdev, int sset)
         case ETH_SS_STATS:
                 return IXGBE_STATS_LEN;
         case ETH_SS_NTUPLE_FILTERS:
-                return (ETHTOOL_MAX_NTUPLE_LIST_ENTRY *
-                        ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY);
+                return ETHTOOL_MAX_NTUPLE_LIST_ENTRY *
+                       ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY;
         default:
                 return -EOPNOTSUPP;
         }
@@ -1435,9 +1438,7 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
         struct ixgbe_ring *tx_ring = &adapter->test_tx_ring;
         struct ixgbe_ring *rx_ring = &adapter->test_rx_ring;
         struct ixgbe_hw *hw = &adapter->hw;
-        struct pci_dev *pdev = adapter->pdev;
         u32 reg_ctl;
-        int i;
 
         /* shut down the DMA engines now so they can be reinitialized later */
 
@@ -1445,14 +1446,15 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
         reg_ctl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
         reg_ctl &= ~IXGBE_RXCTRL_RXEN;
         IXGBE_WRITE_REG(hw, IXGBE_RXCTRL, reg_ctl);
-        reg_ctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(0));
+        reg_ctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(rx_ring->reg_idx));
         reg_ctl &= ~IXGBE_RXDCTL_ENABLE;
-        IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(0), reg_ctl);
+        IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(rx_ring->reg_idx), reg_ctl);
 
         /* now Tx */
-        reg_ctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(0));
+        reg_ctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(tx_ring->reg_idx));
         reg_ctl &= ~IXGBE_TXDCTL_ENABLE;
-        IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(0), reg_ctl);
+        IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(tx_ring->reg_idx), reg_ctl);
+
         if (hw->mac.type == ixgbe_mac_82599EB) {
                 reg_ctl = IXGBE_READ_REG(hw, IXGBE_DMATXCTL);
                 reg_ctl &= ~IXGBE_DMATXCTL_TE;
@@ -1461,221 +1463,57 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
 
         ixgbe_reset(adapter);
 
-        if (tx_ring->desc && tx_ring->tx_buffer_info) {
-                for (i = 0; i < tx_ring->count; i++) {
-                        struct ixgbe_tx_buffer *buf =
-                                        &(tx_ring->tx_buffer_info[i]);
-                        if (buf->dma)
-                                dma_unmap_single(&pdev->dev, buf->dma,
-                                                 buf->length, DMA_TO_DEVICE);
-                        if (buf->skb)
-                                dev_kfree_skb(buf->skb);
-                }
-        }
-
-        if (rx_ring->desc && rx_ring->rx_buffer_info) {
-                for (i = 0; i < rx_ring->count; i++) {
-                        struct ixgbe_rx_buffer *buf =
-                                        &(rx_ring->rx_buffer_info[i]);
-                        if (buf->dma)
-                                dma_unmap_single(&pdev->dev, buf->dma,
-                                                 IXGBE_RXBUFFER_2048,
-                                                 DMA_FROM_DEVICE);
-                        if (buf->skb)
-                                dev_kfree_skb(buf->skb);
-                }
-        }
-
-        if (tx_ring->desc) {
-                dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
-                                  tx_ring->dma);
-                tx_ring->desc = NULL;
-        }
-        if (rx_ring->desc) {
-                dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
-                                  rx_ring->dma);
-                rx_ring->desc = NULL;
-        }
-
-        kfree(tx_ring->tx_buffer_info);
-        tx_ring->tx_buffer_info = NULL;
-        kfree(rx_ring->rx_buffer_info);
-        rx_ring->rx_buffer_info = NULL;
+        ixgbe_free_tx_resources(adapter, &adapter->test_tx_ring);
+        ixgbe_free_rx_resources(adapter, &adapter->test_rx_ring);
 }
 
 static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_ring *tx_ring = &adapter->test_tx_ring;
         struct ixgbe_ring *rx_ring = &adapter->test_rx_ring;
-        struct pci_dev *pdev = adapter->pdev;
         u32 rctl, reg_data;
-        int i, ret_val;
+        int ret_val;
+        int err;
 
         /* Setup Tx descriptor ring and Tx buffers */
+        tx_ring->count = IXGBE_DEFAULT_TXD;
+        tx_ring->queue_index = 0;
+        tx_ring->reg_idx = adapter->tx_ring[0]->reg_idx;
+        tx_ring->numa_node = adapter->node;
 
-        if (!tx_ring->count)
-                tx_ring->count = IXGBE_DEFAULT_TXD;
-
-        tx_ring->tx_buffer_info = kcalloc(tx_ring->count,
-                                          sizeof(struct ixgbe_tx_buffer),
-                                          GFP_KERNEL);
-        if (!(tx_ring->tx_buffer_info)) {
-                ret_val = 1;
-                goto err_nomem;
-        }
-
-        tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
-        tx_ring->size = ALIGN(tx_ring->size, 4096);
-        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
-                                           &tx_ring->dma, GFP_KERNEL);
-        if (!(tx_ring->desc)) {
-                ret_val = 2;
-                goto err_nomem;
-        }
-        tx_ring->next_to_use = tx_ring->next_to_clean = 0;
-
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDBAL(0),
-                        ((u64) tx_ring->dma & 0x00000000FFFFFFFF));
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDBAH(0),
-                        ((u64) tx_ring->dma >> 32));
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDLEN(0),
-                        tx_ring->count * sizeof(union ixgbe_adv_tx_desc));
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDH(0), 0);
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDT(0), 0);
-
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_HLREG0);
-        reg_data |= IXGBE_HLREG0_TXPADEN;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_HLREG0, reg_data);
+        err = ixgbe_setup_tx_resources(adapter, tx_ring);
+        if (err)
+                return 1;
 
         if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
                 reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_DMATXCTL);
                 reg_data |= IXGBE_DMATXCTL_TE;
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_DMATXCTL, reg_data);
         }
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_TXDCTL(0));
-        reg_data |= IXGBE_TXDCTL_ENABLE;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_TXDCTL(0), reg_data);
-
-        for (i = 0; i < tx_ring->count; i++) {
-                union ixgbe_adv_tx_desc *desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
-                struct sk_buff *skb;
-                unsigned int size = 1024;
-
-                skb = alloc_skb(size, GFP_KERNEL);
-                if (!skb) {
-                        ret_val = 3;
-                        goto err_nomem;
-                }
-                skb_put(skb, size);
-                tx_ring->tx_buffer_info[i].skb = skb;
-                tx_ring->tx_buffer_info[i].length = skb->len;
-                tx_ring->tx_buffer_info[i].dma =
-                        dma_map_single(&pdev->dev, skb->data, skb->len,
-                                       DMA_TO_DEVICE);
-                desc->read.buffer_addr =
-                                    cpu_to_le64(tx_ring->tx_buffer_info[i].dma);
-                desc->read.cmd_type_len = cpu_to_le32(skb->len);
-                desc->read.cmd_type_len |= cpu_to_le32(IXGBE_TXD_CMD_EOP |
-                                                       IXGBE_TXD_CMD_IFCS |
-                                                       IXGBE_TXD_CMD_RS);
-                desc->read.olinfo_status = 0;
-                if (adapter->hw.mac.type == ixgbe_mac_82599EB)
-                        desc->read.olinfo_status |=
-                                        (skb->len << IXGBE_ADVTXD_PAYLEN_SHIFT);
 
-        }
+        ixgbe_configure_tx_ring(adapter, tx_ring);
 
         /* Setup Rx Descriptor ring and Rx buffers */
-
-        if (!rx_ring->count)
-                rx_ring->count = IXGBE_DEFAULT_RXD;
-
-        rx_ring->rx_buffer_info = kcalloc(rx_ring->count,
-                                          sizeof(struct ixgbe_rx_buffer),
-                                          GFP_KERNEL);
-        if (!(rx_ring->rx_buffer_info)) {
+        rx_ring->count = IXGBE_DEFAULT_RXD;
+        rx_ring->queue_index = 0;
+        rx_ring->reg_idx = adapter->rx_ring[0]->reg_idx;
+        rx_ring->rx_buf_len = IXGBE_RXBUFFER_2048;
+        rx_ring->numa_node = adapter->node;
+
+        err = ixgbe_setup_rx_resources(adapter, rx_ring);
+        if (err) {
                 ret_val = 4;
                 goto err_nomem;
         }
 
-        rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
-        rx_ring->size = ALIGN(rx_ring->size, 4096);
-        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
-                                           &rx_ring->dma, GFP_KERNEL);
-        if (!(rx_ring->desc)) {
-                ret_val = 5;
-                goto err_nomem;
-        }
-        rx_ring->next_to_use = rx_ring->next_to_clean = 0;
-
         rctl = IXGBE_READ_REG(&adapter->hw, IXGBE_RXCTRL);
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_RXCTRL, rctl & ~IXGBE_RXCTRL_RXEN);
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDBAL(0),
-                        ((u64)rx_ring->dma & 0xFFFFFFFF));
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDBAH(0),
-                        ((u64) rx_ring->dma >> 32));
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDLEN(0), rx_ring->size);
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDH(0), 0);
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDT(0), 0);
 
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_FCTRL);
-        reg_data |= IXGBE_FCTRL_BAM | IXGBE_FCTRL_SBP | IXGBE_FCTRL_MPE;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCTRL, reg_data);
-
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_HLREG0);
-        reg_data &= ~IXGBE_HLREG0_LPBK;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_HLREG0, reg_data);
-
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_RDRXCTL);
-#define IXGBE_RDRXCTL_RDMTS_MASK    0x00000003 /* Receive Descriptor Minimum
-                                                  Threshold Size mask */
-        reg_data &= ~IXGBE_RDRXCTL_RDMTS_MASK;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDRXCTL, reg_data);
-
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_MCSTCTRL);
-#define IXGBE_MCSTCTRL_MO_MASK      0x00000003 /* Multicast Offset mask */
-        reg_data &= ~IXGBE_MCSTCTRL_MO_MASK;
-        reg_data |= adapter->hw.mac.mc_filter_type;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_MCSTCTRL, reg_data);
-
-        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_RXDCTL(0));
-        reg_data |= IXGBE_RXDCTL_ENABLE;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RXDCTL(0), reg_data);
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                int j = adapter->rx_ring[0]->reg_idx;
-                u32 k;
-                for (k = 0; k < 10; k++) {
-                        if (IXGBE_READ_REG(&adapter->hw,
-                                           IXGBE_RXDCTL(j)) & IXGBE_RXDCTL_ENABLE)
-                                break;
-                        else
-                                msleep(1);
-                }
-        }
+        ixgbe_configure_rx_ring(adapter, rx_ring);
 
         rctl |= IXGBE_RXCTRL_RXEN | IXGBE_RXCTRL_DMBYPS;
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_RXCTRL, rctl);
 
-        for (i = 0; i < rx_ring->count; i++) {
-                union ixgbe_adv_rx_desc *rx_desc =
-                                                 IXGBE_RX_DESC_ADV(*rx_ring, i);
-                struct sk_buff *skb;
-
-                skb = alloc_skb(IXGBE_RXBUFFER_2048 + NET_IP_ALIGN, GFP_KERNEL);
-                if (!skb) {
-                        ret_val = 6;
-                        goto err_nomem;
-                }
-                skb_reserve(skb, NET_IP_ALIGN);
-                rx_ring->rx_buffer_info[i].skb = skb;
-                rx_ring->rx_buffer_info[i].dma =
-                        dma_map_single(&pdev->dev, skb->data,
-                                       IXGBE_RXBUFFER_2048, DMA_FROM_DEVICE);
-                rx_desc->read.pkt_addr =
-                                cpu_to_le64(rx_ring->rx_buffer_info[i].dma);
-                memset(skb->data, 0x00, skb->len);
-        }
-
         return 0;
 
 err_nomem:
@@ -1689,16 +1527,21 @@ static int ixgbe_setup_loopback_test(struct ixgbe_adapter *adapter)
         u32 reg_data;
 
         /* right now we only support MAC loopback in the driver */
-
-        /* Setup MAC loopback */
         reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_HLREG0);
+        /* Setup MAC loopback */
         reg_data |= IXGBE_HLREG0_LPBK;
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_HLREG0, reg_data);
 
+        reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_FCTRL);
+        reg_data |= IXGBE_FCTRL_BAM | IXGBE_FCTRL_SBP | IXGBE_FCTRL_MPE;
+        IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCTRL, reg_data);
+
         reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_AUTOC);
         reg_data &= ~IXGBE_AUTOC_LMS_MASK;
         reg_data |= IXGBE_AUTOC_LMS_10G_LINK_NO_AN | IXGBE_AUTOC_FLU;
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_AUTOC, reg_data);
+        IXGBE_WRITE_FLUSH(&adapter->hw);
+        msleep(10);
 
         /* Disable Atlas Tx lanes; re-enabled in reset path */
         if (hw->mac.type == ixgbe_mac_82598EB) {
@@ -1756,15 +1599,81 @@ static int ixgbe_check_lbtest_frame(struct sk_buff *skb,
         return 13;
 }
 
+static u16 ixgbe_clean_test_rings(struct ixgbe_adapter *adapter,
+                                  struct ixgbe_ring *rx_ring,
+                                  struct ixgbe_ring *tx_ring,
+                                  unsigned int size)
+{
+        union ixgbe_adv_rx_desc *rx_desc;
+        struct ixgbe_rx_buffer *rx_buffer_info;
+        struct ixgbe_tx_buffer *tx_buffer_info;
+        const int bufsz = rx_ring->rx_buf_len;
+        u32 staterr;
+        u16 rx_ntc, tx_ntc, count = 0;
+
+        /* initialize next to clean and descriptor values */
+        rx_ntc = rx_ring->next_to_clean;
+        tx_ntc = tx_ring->next_to_clean;
+        rx_desc = IXGBE_RX_DESC_ADV(rx_ring, rx_ntc);
+        staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
+
+        while (staterr & IXGBE_RXD_STAT_DD) {
+                /* check Rx buffer */
+                rx_buffer_info = &rx_ring->rx_buffer_info[rx_ntc];
+
+                /* unmap Rx buffer, will be remapped by alloc_rx_buffers */
+                dma_unmap_single(&adapter->pdev->dev,
+                                 rx_buffer_info->dma,
+                                 bufsz,
+                                 DMA_FROM_DEVICE);
+                rx_buffer_info->dma = 0;
+
+                /* verify contents of skb */
+                if (!ixgbe_check_lbtest_frame(rx_buffer_info->skb, size))
+                        count++;
+
+                /* unmap buffer on Tx side */
+                tx_buffer_info = &tx_ring->tx_buffer_info[tx_ntc];
+                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
+
+                /* increment Rx/Tx next to clean counters */
+                rx_ntc++;
+                if (rx_ntc == rx_ring->count)
+                        rx_ntc = 0;
+                tx_ntc++;
+                if (tx_ntc == tx_ring->count)
+                        tx_ntc = 0;
+
+                /* fetch next descriptor */
+                rx_desc = IXGBE_RX_DESC_ADV(rx_ring, rx_ntc);
+                staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
+        }
+
+        /* re-map buffers to ring, store next to clean values */
+        ixgbe_alloc_rx_buffers(adapter, rx_ring, count);
+        rx_ring->next_to_clean = rx_ntc;
+        tx_ring->next_to_clean = tx_ntc;
+
+        return count;
+}
+
 static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_ring *tx_ring = &adapter->test_tx_ring;
         struct ixgbe_ring *rx_ring = &adapter->test_rx_ring;
-        struct pci_dev *pdev = adapter->pdev;
-        int i, j, k, l, lc, good_cnt, ret_val = 0;
-        unsigned long time;
+        int i, j, lc, good_cnt, ret_val = 0;
+        unsigned int size = 1024;
+        netdev_tx_t tx_ret_val;
+        struct sk_buff *skb;
+
+        /* allocate test skb */
+        skb = alloc_skb(size, GFP_KERNEL);
+        if (!skb)
+                return 11;
 
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_RDT(0), rx_ring->count - 1);
+        /* place data into test skb */
+        ixgbe_create_lbtest_frame(skb, size);
+        skb_put(skb, size);
 
         /*
          * Calculate the loop count based on the largest descriptor ring
@@ -1777,54 +1686,40 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
         else
                 lc = ((rx_ring->count / 64) * 2) + 1;
 
-        k = l = 0;
         for (j = 0; j <= lc; j++) {
-                for (i = 0; i < 64; i++) {
-                        ixgbe_create_lbtest_frame(
-                                        tx_ring->tx_buffer_info[k].skb,
-                                        1024);
-                        dma_sync_single_for_device(&pdev->dev,
-                                tx_ring->tx_buffer_info[k].dma,
-                                tx_ring->tx_buffer_info[k].length,
-                                DMA_TO_DEVICE);
-                        if (unlikely(++k == tx_ring->count))
-                                k = 0;
-                }
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_TDT(0), k);
-                msleep(200);
-                /* set the start time for the receive */
-                time = jiffies;
+                /* reset count of good packets */
                 good_cnt = 0;
-                do {
-                        /* receive the sent packets */
-                        dma_sync_single_for_cpu(&pdev->dev,
-                                        rx_ring->rx_buffer_info[l].dma,
-                                        IXGBE_RXBUFFER_2048,
-                                        DMA_FROM_DEVICE);
-                        ret_val = ixgbe_check_lbtest_frame(
-                                        rx_ring->rx_buffer_info[l].skb, 1024);
-                        if (!ret_val)
+
+                /* place 64 packets on the transmit queue*/
+                for (i = 0; i < 64; i++) {
+                        skb_get(skb);
+                        tx_ret_val = ixgbe_xmit_frame_ring(skb,
+                                                           adapter->netdev,
+                                                           adapter,
+                                                           tx_ring);
+                        if (tx_ret_val == NETDEV_TX_OK)
                                 good_cnt++;
-                        if (++l == rx_ring->count)
-                                l = 0;
-                        /*
-                         * time + 20 msecs (200 msecs on 2.4) is more than
-                         * enough time to complete the receives, if it's
-                         * exceeded, break and error off
-                         */
-                } while (good_cnt < 64 && jiffies < (time + 20));
+                }
+
                 if (good_cnt != 64) {
-                        /* ret_val is the same as mis-compare */
-                        ret_val = 13;
+                        ret_val = 12;
                         break;
                 }
-                if (jiffies >= (time + 20)) {
-                        /* Error code for time out error */
-                        ret_val = 14;
+
+                /* allow 200 milliseconds for packets to go from Tx to Rx */
+                msleep(200);
+
+                good_cnt = ixgbe_clean_test_rings(adapter, rx_ring,
+                                                  tx_ring, size);
+                if (good_cnt != 64) {
+                        ret_val = 13;
                         break;
                 }
         }
 
+        /* free the original skb */
+        kfree_skb(skb);
+
         return ret_val;
 }
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 072327c5e41a..2f1de8b90f9e 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -304,12 +304,13 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
         if (!ixgbe_rx_is_fcoe(rx_desc))
                 goto ddp_out;
 
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
         sterr = le32_to_cpu(rx_desc->wb.upper.status_error);
         fcerr = (sterr & IXGBE_RXDADV_ERR_FCERR);
         fceofe = (sterr & IXGBE_RXDADV_ERR_FCEOFE);
         if (fcerr == IXGBE_FCERR_BADCRC)
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
+        else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (eth_hdr(skb)->h_proto == htons(ETH_P_8021Q))
                 fh = (struct fc_frame_header *)(skb->data +
@@ -471,7 +472,7 @@ int ixgbe_fso(struct ixgbe_adapter *adapter,
 
         /* write context desc */
         i = tx_ring->next_to_use;
-        context_desc = IXGBE_TX_CTXTDESC_ADV(*tx_ring, i);
+        context_desc = IXGBE_TX_CTXTDESC_ADV(tx_ring, i);
         context_desc->vlan_macip_lens   = cpu_to_le32(vlan_macip_lens);
         context_desc->seqnum_seed       = cpu_to_le32(fcoe_sof_eof);
         context_desc->type_tucmd_mlhl   = cpu_to_le32(type_tucmd);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e32af434cc9d..4e0ce91321dd 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -50,7 +50,7 @@
 
 char ixgbe_driver_name[] = "ixgbe";
 static const char ixgbe_driver_string[] =
-                              "Intel(R) 10 Gigabit PCI Express Network Driver";
+                              "Intel(R) 10 Gigabit PCI Express Network Driver";
 
 #define DRV_VERSION "2.0.84-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
@@ -120,7 +120,7 @@ MODULE_DEVICE_TABLE(pci, ixgbe_pci_tbl);
 
 #ifdef CONFIG_IXGBE_DCA
 static int ixgbe_notify_dca(struct notifier_block *, unsigned long event,
-                            void *p);
+                            void *p);
 static struct notifier_block dca_notifier = {
         .notifier_call = ixgbe_notify_dca,
         .next          = NULL,
@@ -131,8 +131,8 @@ static struct notifier_block dca_notifier = {
 #ifdef CONFIG_PCI_IOV
 static unsigned int max_vfs;
 module_param(max_vfs, uint, 0);
-MODULE_PARM_DESC(max_vfs, "Maximum number of virtual functions to allocate "
-                 "per physical function");
+MODULE_PARM_DESC(max_vfs,
+                 "Maximum number of virtual functions to allocate per physical function");
 #endif /* CONFIG_PCI_IOV */
 
 MODULE_AUTHOR("Intel Corporation, <linux.nics@intel.com>");
@@ -169,8 +169,8 @@ static inline void ixgbe_disable_sriov(struct ixgbe_adapter *adapter)
 
         /* take a breather then clean up driver data */
         msleep(100);
-        if (adapter->vfinfo)
-                kfree(adapter->vfinfo);
+
+        kfree(adapter->vfinfo);
         adapter->vfinfo = NULL;
 
         adapter->num_vfs = 0;
@@ -282,17 +282,17 @@ static void ixgbe_regdump(struct ixgbe_hw *hw, struct ixgbe_reg_info *reginfo)
                         regs[i] = IXGBE_READ_REG(hw, IXGBE_TXDCTL(i));
                 break;
         default:
-                printk(KERN_INFO "%-15s %08x\n", reginfo->name,
+                pr_info("%-15s %08x\n", reginfo->name,
                         IXGBE_READ_REG(hw, reginfo->ofs));
                 return;
         }
 
         for (i = 0; i < 8; i++) {
                 snprintf(rname, 16, "%s[%d-%d]", reginfo->name, i*8, i*8+7);
-                printk(KERN_ERR "%-15s ", rname);
+                pr_err("%-15s", rname);
                 for (j = 0; j < 8; j++)
-                        printk(KERN_CONT "%08x ", regs[i*8+j]);
-                printk(KERN_CONT "\n");
+                        pr_cont(" %08x", regs[i*8+j]);
+                pr_cont("\n");
         }
 
 }
@@ -322,18 +322,18 @@ static void ixgbe_dump(struct ixgbe_adapter *adapter)
         /* Print netdevice Info */
         if (netdev) {
                 dev_info(&adapter->pdev->dev, "Net device Info\n");
-                printk(KERN_INFO "Device Name     state            "
+                pr_info("Device Name     state            "
                         "trans_start      last_rx\n");
-                printk(KERN_INFO "%-15s %016lX %016lX %016lX\n",
-                netdev->name,
-                netdev->state,
-                netdev->trans_start,
-                netdev->last_rx);
+                pr_info("%-15s %016lX %016lX %016lX\n",
+                        netdev->name,
+                        netdev->state,
+                        netdev->trans_start,
+                        netdev->last_rx);
         }
 
         /* Print Registers */
         dev_info(&adapter->pdev->dev, "Register Dump\n");
-        printk(KERN_INFO " Register Name   Value\n");
+        pr_info(" Register Name   Value\n");
         for (reginfo = (struct ixgbe_reg_info *)ixgbe_reg_info_tbl;
              reginfo->name; reginfo++) {
                 ixgbe_regdump(hw, reginfo);
@@ -344,13 +344,12 @@ static void ixgbe_dump(struct ixgbe_adapter *adapter)
                 goto exit;
 
         dev_info(&adapter->pdev->dev, "TX Rings Summary\n");
-        printk(KERN_INFO "Queue [NTU] [NTC] [bi(ntc)->dma  ] "
-                "leng ntw timestamp\n");
+        pr_info("Queue [NTU] [NTC] [bi(ntc)->dma  ] leng ntw timestamp\n");
         for (n = 0; n < adapter->num_tx_queues; n++) {
                 tx_ring = adapter->tx_ring[n];
                 tx_buffer_info =
                         &tx_ring->tx_buffer_info[tx_ring->next_to_clean];
-                printk(KERN_INFO " %5d %5X %5X %016llX %04X %3X %016llX\n",
+                pr_info(" %5d %5X %5X %016llX %04X %3X %016llX\n",
                            n, tx_ring->next_to_use, tx_ring->next_to_clean,
                            (u64)tx_buffer_info->dma,
                            tx_buffer_info->length,
@@ -377,18 +376,18 @@ static void ixgbe_dump(struct ixgbe_adapter *adapter)
 
         for (n = 0; n < adapter->num_tx_queues; n++) {
                 tx_ring = adapter->tx_ring[n];
-                printk(KERN_INFO "------------------------------------\n");
-                printk(KERN_INFO "TX QUEUE INDEX = %d\n", tx_ring->queue_index);
-                printk(KERN_INFO "------------------------------------\n");
-                printk(KERN_INFO "T [desc]     [address 63:0  ] "
+                pr_info("------------------------------------\n");
+                pr_info("TX QUEUE INDEX = %d\n", tx_ring->queue_index);
+                pr_info("------------------------------------\n");
+                pr_info("T [desc]     [address 63:0  ] "
                         "[PlPOIdStDDt Ln] [bi->dma       ] "
                         "leng  ntw timestamp        bi->skb\n");
 
                 for (i = 0; tx_ring->desc && (i < tx_ring->count); i++) {
-                        tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+                        tx_desc = IXGBE_TX_DESC_ADV(tx_ring, i);
                         tx_buffer_info = &tx_ring->tx_buffer_info[i];
                         u0 = (struct my_u0 *)tx_desc;
-                        printk(KERN_INFO "T [0x%03X]    %016llX %016llX %016llX"
+                        pr_info("T [0x%03X]    %016llX %016llX %016llX"
                                 " %04X  %3X %016llX %p", i,
                                 le64_to_cpu(u0->a),
                                 le64_to_cpu(u0->b),
@@ -399,13 +398,13 @@ static void ixgbe_dump(struct ixgbe_adapter *adapter)
                                 tx_buffer_info->skb);
                         if (i == tx_ring->next_to_use &&
                                 i == tx_ring->next_to_clean)
-                                printk(KERN_CONT " NTC/U\n");
+                                pr_cont(" NTC/U\n");
                         else if (i == tx_ring->next_to_use)
-                                printk(KERN_CONT " NTU\n");
+                                pr_cont(" NTU\n");
                         else if (i == tx_ring->next_to_clean)
-                                printk(KERN_CONT " NTC\n");
+                                pr_cont(" NTC\n");
                         else
-                                printk(KERN_CONT "\n");
+                                pr_cont("\n");
 
                         if (netif_msg_pktdata(adapter) &&
                                 tx_buffer_info->dma != 0)
@@ -419,11 +418,11 @@ static void ixgbe_dump(struct ixgbe_adapter *adapter)
         /* Print RX Rings Summary */
 rx_ring_summary:
         dev_info(&adapter->pdev->dev, "RX Rings Summary\n");
-        printk(KERN_INFO "Queue [NTU] [NTC]\n");
+        pr_info("Queue [NTU] [NTC]\n");
         for (n = 0; n < adapter->num_rx_queues; n++) {
                 rx_ring = adapter->rx_ring[n];
-                printk(KERN_INFO "%5d %5X %5X\n", n,
-                           rx_ring->next_to_use, rx_ring->next_to_clean);
+                pr_info("%5d %5X %5X\n",
+                        n, rx_ring->next_to_use, rx_ring->next_to_clean);
         }
 
         /* Print RX Rings */
@@ -454,30 +453,30 @@ rx_ring_summary:
          */
         for (n = 0; n < adapter->num_rx_queues; n++) {
                 rx_ring = adapter->rx_ring[n];
-                printk(KERN_INFO "------------------------------------\n");
-                printk(KERN_INFO "RX QUEUE INDEX = %d\n", rx_ring->queue_index);
-                printk(KERN_INFO "------------------------------------\n");
-                printk(KERN_INFO "R  [desc]      [ PktBuf     A0] "
+                pr_info("------------------------------------\n");
+                pr_info("RX QUEUE INDEX = %d\n", rx_ring->queue_index);
+                pr_info("------------------------------------\n");
+                pr_info("R  [desc]      [ PktBuf     A0] "
                         "[  HeadBuf   DD] [bi->dma       ] [bi->skb] "
                         "<-- Adv Rx Read format\n");
-                printk(KERN_INFO "RWB[desc]      [PcsmIpSHl PtRs] "
+                pr_info("RWB[desc]      [PcsmIpSHl PtRs] "
                         "[vl er S cks ln] ---------------- [bi->skb] "
                         "<-- Adv Rx Write-Back format\n");
 
                 for (i = 0; i < rx_ring->count; i++) {
                         rx_buffer_info = &rx_ring->rx_buffer_info[i];
-                        rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
+                        rx_desc = IXGBE_RX_DESC_ADV(rx_ring, i);
                         u0 = (struct my_u0 *)rx_desc;
                         staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
                         if (staterr & IXGBE_RXD_STAT_DD) {
                                 /* Descriptor Done */
-                                printk(KERN_INFO "RWB[0x%03X]     %016llX "
+                                pr_info("RWB[0x%03X]     %016llX "
                                         "%016llX ---------------- %p", i,
                                         le64_to_cpu(u0->a),
                                         le64_to_cpu(u0->b),
                                         rx_buffer_info->skb);
                         } else {
-                                printk(KERN_INFO "R  [0x%03X]     %016llX "
+                                pr_info("R  [0x%03X]     %016llX "
                                         "%016llX %016llX %p", i,
                                         le64_to_cpu(u0->a),
                                         le64_to_cpu(u0->b),
@@ -503,11 +502,11 @@ rx_ring_summary:
                         }
 
                         if (i == rx_ring->next_to_use)
-                                printk(KERN_CONT " NTU\n");
+                                pr_cont(" NTU\n");
                         else if (i == rx_ring->next_to_clean)
-                                printk(KERN_CONT " NTC\n");
+                                pr_cont(" NTC\n");
                         else
-                                printk(KERN_CONT "\n");
+                                pr_cont("\n");
 
                 }
         }
@@ -523,7 +522,7 @@ static void ixgbe_release_hw_control(struct ixgbe_adapter *adapter)
         /* Let firmware take over control of h/w */
         ctrl_ext = IXGBE_READ_REG(&adapter->hw, IXGBE_CTRL_EXT);
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_CTRL_EXT,
-                        ctrl_ext & ~IXGBE_CTRL_EXT_DRV_LOAD);
+                        ctrl_ext & ~IXGBE_CTRL_EXT_DRV_LOAD);
 }
 
 static void ixgbe_get_hw_control(struct ixgbe_adapter *adapter)
@@ -533,7 +532,7 @@ static void ixgbe_get_hw_control(struct ixgbe_adapter *adapter)
         /* Let firmware know the driver has taken over */
         ctrl_ext = IXGBE_READ_REG(&adapter->hw, IXGBE_CTRL_EXT);
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_CTRL_EXT,
-                        ctrl_ext | IXGBE_CTRL_EXT_DRV_LOAD);
+                        ctrl_ext | IXGBE_CTRL_EXT_DRV_LOAD);
 }
 
 /*
@@ -545,7 +544,7 @@ static void ixgbe_get_hw_control(struct ixgbe_adapter *adapter)
  *
  */
 static void ixgbe_set_ivar(struct ixgbe_adapter *adapter, s8 direction,
-                           u8 queue, u8 msix_vector)
+                           u8 queue, u8 msix_vector)
 {
         u32 ivar, index;
         struct ixgbe_hw *hw = &adapter->hw;
@@ -586,7 +585,7 @@ static void ixgbe_set_ivar(struct ixgbe_adapter *adapter, s8 direction,
 }
 
 static inline void ixgbe_irq_rearm_queues(struct ixgbe_adapter *adapter,
-                                          u64 qmask)
+                                          u64 qmask)
 {
         u32 mask;
 
@@ -601,9 +600,9 @@ static inline void ixgbe_irq_rearm_queues(struct ixgbe_adapter *adapter,
         }
 }
 
-static void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
-                                             struct ixgbe_tx_buffer
-                                             *tx_buffer_info)
+void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
+                                      struct ixgbe_tx_buffer
+                                      *tx_buffer_info)
 {
         if (tx_buffer_info->dma) {
                 if (tx_buffer_info->mapped_as_page)
@@ -637,7 +636,7 @@ static void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
  * Returns : true if in xon state (currently not paused)
  */
 static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
-                                      struct ixgbe_ring *tx_ring)
+                                      struct ixgbe_ring *tx_ring)
 {
         u32 txoff = IXGBE_TFCS_TXOFF;
 
@@ -682,8 +681,8 @@ static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
 }
 
 static inline bool ixgbe_check_tx_hang(struct ixgbe_adapter *adapter,
-                                       struct ixgbe_ring *tx_ring,
-                                       unsigned int eop)
+                                       struct ixgbe_ring *tx_ring,
+                                       unsigned int eop)
 {
         struct ixgbe_hw *hw = &adapter->hw;
 
@@ -695,7 +694,7 @@ static inline bool ixgbe_check_tx_hang(struct ixgbe_adapter *adapter,
             ixgbe_tx_xon_state(adapter, tx_ring)) {
                 /* detected Tx unit hang */
                 union ixgbe_adv_tx_desc *tx_desc;
-                tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
+                tx_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
                 e_err(drv, "Detected Tx Unit Hang\n"
                       "  Tx Queue             <%d>\n"
                       "  TDH, TDT             <%x>, <%x>\n"
@@ -732,7 +731,7 @@ static void ixgbe_tx_timeout(struct net_device *netdev);
  * @tx_ring: tx ring to clean
  **/
 static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
-                               struct ixgbe_ring *tx_ring)
+                               struct ixgbe_ring *tx_ring)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct net_device *netdev = adapter->netdev;
@@ -743,7 +742,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
 
         i = tx_ring->next_to_clean;
         eop = tx_ring->tx_buffer_info[i].next_to_watch;
-        eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
+        eop_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
 
         while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
                (count < tx_ring->work_limit)) {
@@ -751,7 +750,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
                 rmb(); /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
                         struct sk_buff *skb;
-                        tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+                        tx_desc = IXGBE_TX_DESC_ADV(tx_ring, i);
                         tx_buffer_info = &tx_ring->tx_buffer_info[i];
                         cleaned = (i == eop);
                         skb = tx_buffer_info->skb;
@@ -781,7 +780,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
                         }
 
                         ixgbe_unmap_and_free_tx_resource(adapter,
-                                                         tx_buffer_info);
+                                                         tx_buffer_info);
 
                         tx_desc->wb.status = 0;
 
@@ -791,14 +790,14 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
                 }
 
                 eop = tx_ring->tx_buffer_info[i].next_to_watch;
-                eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
+                eop_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
         }
 
         tx_ring->next_to_clean = i;
 
 #define TX_WAKE_THRESHOLD (DESC_NEEDED * 2)
         if (unlikely(count && netif_carrier_ok(netdev) &&
-                     (IXGBE_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
+                     (IXGBE_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
                 /* Make sure that anybody stopping the queue after this
                  * sees the new next_to_clean.
                  */
@@ -827,12 +826,12 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
         tx_ring->total_packets += total_packets;
         tx_ring->stats.packets += total_packets;
         tx_ring->stats.bytes += total_bytes;
-        return (count < tx_ring->work_limit);
+        return count < tx_ring->work_limit;
 }
 
 #ifdef CONFIG_IXGBE_DCA
 static void ixgbe_update_rx_dca(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *rx_ring)
+                                struct ixgbe_ring *rx_ring)
 {
         u32 rxctrl;
         int cpu = get_cpu();
@@ -846,13 +845,13 @@ static void ixgbe_update_rx_dca(struct ixgbe_adapter *adapter,
                 } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
                         rxctrl &= ~IXGBE_DCA_RXCTRL_CPUID_MASK_82599;
                         rxctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
-                                   IXGBE_DCA_RXCTRL_CPUID_SHIFT_82599);
+                                   IXGBE_DCA_RXCTRL_CPUID_SHIFT_82599);
                 }
                 rxctrl |= IXGBE_DCA_RXCTRL_DESC_DCA_EN;
                 rxctrl |= IXGBE_DCA_RXCTRL_HEAD_DCA_EN;
                 rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_RRO_EN);
                 rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_WRO_EN |
-                            IXGBE_DCA_RXCTRL_DESC_HSRO_EN);
+                            IXGBE_DCA_RXCTRL_DESC_HSRO_EN);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_DCA_RXCTRL(q), rxctrl);
                 rx_ring->cpu = cpu;
         }
@@ -860,7 +859,7 @@ static void ixgbe_update_rx_dca(struct ixgbe_adapter *adapter,
 }
 
 static void ixgbe_update_tx_dca(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *tx_ring)
+                                struct ixgbe_ring *tx_ring)
 {
         u32 txctrl;
         int cpu = get_cpu();
@@ -878,7 +877,7 @@ static void ixgbe_update_tx_dca(struct ixgbe_adapter *adapter,
                         txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(q));
                         txctrl &= ~IXGBE_DCA_TXCTRL_CPUID_MASK_82599;
                         txctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
-                                  IXGBE_DCA_TXCTRL_CPUID_SHIFT_82599);
+                                  IXGBE_DCA_TXCTRL_CPUID_SHIFT_82599);
                         txctrl |= IXGBE_DCA_TXCTRL_DESC_DCA_EN;
                         IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(q), txctrl);
                 }
@@ -946,16 +945,15 @@ static int __ixgbe_notify_dca(struct device *dev, void *data)
  * @rx_desc: rx descriptor
  **/
 static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
-                              struct sk_buff *skb, u8 status,
-                              struct ixgbe_ring *ring,
-                              union ixgbe_adv_rx_desc *rx_desc)
+                              struct sk_buff *skb, u8 status,
+                              struct ixgbe_ring *ring,
+                              union ixgbe_adv_rx_desc *rx_desc)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct napi_struct *napi = &q_vector->napi;
         bool is_vlan = (status & IXGBE_RXD_STAT_VP);
         u16 tag = le16_to_cpu(rx_desc->wb.upper.vlan);
 
-        skb_record_rx_queue(skb, ring->queue_index);
         if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
                 if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                         vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
@@ -981,7 +979,7 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
 {
         u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
 
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* Rx csum disabled */
         if (!(adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED))
@@ -1017,7 +1015,7 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
 }
 
 static inline void ixgbe_release_rx_desc(struct ixgbe_hw *hw,
-                                         struct ixgbe_ring *rx_ring, u32 val)
+                                         struct ixgbe_ring *rx_ring, u32 val)
 {
         /*
          * Force memory writes to complete before letting h/w
@@ -1033,25 +1031,27 @@ static inline void ixgbe_release_rx_desc(struct ixgbe_hw *hw,
  * ixgbe_alloc_rx_buffers - Replace used receive buffers; packet split
  * @adapter: address of board private structure
  **/
-static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
-                                   struct ixgbe_ring *rx_ring,
-                                   int cleaned_count)
+void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
+                            struct ixgbe_ring *rx_ring,
+                            int cleaned_count)
 {
+        struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
         union ixgbe_adv_rx_desc *rx_desc;
         struct ixgbe_rx_buffer *bi;
         unsigned int i;
+        unsigned int bufsz = rx_ring->rx_buf_len;
 
         i = rx_ring->next_to_use;
         bi = &rx_ring->rx_buffer_info[i];
 
         while (cleaned_count--) {
-                rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
+                rx_desc = IXGBE_RX_DESC_ADV(rx_ring, i);
 
                 if (!bi->page_dma &&
                     (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
                         if (!bi->page) {
-                                bi->page = alloc_page(GFP_ATOMIC);
+                                bi->page = netdev_alloc_page(netdev);
                                 if (!bi->page) {
                                         adapter->alloc_rx_page_failed++;
                                         goto no_buffers;
@@ -1063,29 +1063,28 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                         }
 
                         bi->page_dma = dma_map_page(&pdev->dev, bi->page,
-                                                    bi->page_offset,
-                                                    (PAGE_SIZE / 2),
+                                                    bi->page_offset,
+                                                    (PAGE_SIZE / 2),
                                                     DMA_FROM_DEVICE);
                 }
 
                 if (!bi->skb) {
-                        struct sk_buff *skb;
-                        /* netdev_alloc_skb reserves 32 bytes up front!! */
-                        uint bufsz = rx_ring->rx_buf_len + SMP_CACHE_BYTES;
-                        skb = netdev_alloc_skb(adapter->netdev, bufsz);
+                        struct sk_buff *skb = netdev_alloc_skb_ip_align(netdev,
+                                                                        bufsz);
+                        bi->skb = skb;
 
                         if (!skb) {
                                 adapter->alloc_rx_buff_failed++;
                                 goto no_buffers;
                         }
+                        /* initialize queue mapping */
+                        skb_record_rx_queue(skb, rx_ring->queue_index);
+                }
 
-                        /* advance the data pointer to the next cache line */
-                        skb_reserve(skb, (PTR_ALIGN(skb->data, SMP_CACHE_BYTES)
-                                          - skb->data));
-
-                        bi->skb = skb;
-                        bi->dma = dma_map_single(&pdev->dev, skb->data,
-                                                 rx_ring->rx_buf_len,
+                if (!bi->dma) {
+                        bi->dma = dma_map_single(&pdev->dev,
+                                                 bi->skb->data,
+                                                 rx_ring->rx_buf_len,
                                                  DMA_FROM_DEVICE);
                 }
                 /* Refresh the desc even if buffer_addrs didn't change because
@@ -1095,6 +1094,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                         rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                 } else {
                         rx_desc->read.pkt_addr = cpu_to_le64(bi->dma);
+                        rx_desc->read.hdr_addr = 0;
                 }
 
                 i++;
@@ -1126,8 +1126,8 @@ static inline u16 ixgbe_get_pkt_info(union ixgbe_adv_rx_desc *rx_desc)
 static inline u32 ixgbe_get_rsc_count(union ixgbe_adv_rx_desc *rx_desc)
 {
         return (le32_to_cpu(rx_desc->wb.lower.lo_dword.data) &
-                IXGBE_RXDADV_RSCCNT_MASK) >>
-                IXGBE_RXDADV_RSCCNT_SHIFT;
+                IXGBE_RXDADV_RSCCNT_MASK) >>
+                IXGBE_RXDADV_RSCCNT_SHIFT;
 }
 
 /**
@@ -1140,7 +1140,7 @@ static inline u32 ixgbe_get_rsc_count(union ixgbe_adv_rx_desc *rx_desc)
  * turns it into the frag list owner.
  **/
 static inline struct sk_buff *ixgbe_transform_rsc_queue(struct sk_buff *skb,
-                                                        u64 *count)
+                                                        u64 *count)
 {
         unsigned int frag_list_size = 0;
 
@@ -1168,8 +1168,8 @@ struct ixgbe_rsc_cb {
 #define IXGBE_RSC_CB(skb) ((struct ixgbe_rsc_cb *)(skb)->cb)
 
 static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
-                               struct ixgbe_ring *rx_ring,
-                               int *work_done, int work_to_do)
+                               struct ixgbe_ring *rx_ring,
+                               int *work_done, int work_to_do)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct net_device *netdev = adapter->netdev;
@@ -1188,7 +1188,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 #endif /* IXGBE_FCOE */
 
         i = rx_ring->next_to_clean;
-        rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
+        rx_desc = IXGBE_RX_DESC_ADV(rx_ring, i);
         staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
         rx_buffer_info = &rx_ring->rx_buffer_info[i];
 
@@ -1231,9 +1231,9 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                 IXGBE_RSC_CB(skb)->dma = rx_buffer_info->dma;
                         } else {
                                 dma_unmap_single(&pdev->dev,
-                                                 rx_buffer_info->dma,
-                                                 rx_ring->rx_buf_len,
-                                                 DMA_FROM_DEVICE);
+                                                 rx_buffer_info->dma,
+                                                 rx_ring->rx_buf_len,
+                                                 DMA_FROM_DEVICE);
                         }
                         rx_buffer_info->dma = 0;
                         skb_put(skb, len);
@@ -1244,9 +1244,9 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                        PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                         skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
-                                           rx_buffer_info->page,
-                                           rx_buffer_info->page_offset,
-                                           upper_len);
+                                           rx_buffer_info->page,
+                                           rx_buffer_info->page_offset,
+                                           upper_len);
 
                         if ((rx_ring->rx_buf_len > (PAGE_SIZE / 2)) ||
                             (page_count(rx_buffer_info->page) != 1))
@@ -1263,7 +1263,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 if (i == rx_ring->count)
                         i = 0;
 
-                next_rxd = IXGBE_RX_DESC_ADV(*rx_ring, i);
+                next_rxd = IXGBE_RX_DESC_ADV(rx_ring, i);
                 prefetch(next_rxd);
                 cleaned_count++;
 
@@ -1280,18 +1280,20 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 
                 if (staterr & IXGBE_RXD_STAT_EOP) {
                         if (skb->prev)
-                                skb = ixgbe_transform_rsc_queue(skb, &(rx_ring->rsc_count));
+                                skb = ixgbe_transform_rsc_queue(skb,
+                                                                &(rx_ring->rsc_count));
                         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                                 if (IXGBE_RSC_CB(skb)->delay_unmap) {
                                         dma_unmap_single(&pdev->dev,
                                                          IXGBE_RSC_CB(skb)->dma,
-                                                         rx_ring->rx_buf_len,
+                                                         rx_ring->rx_buf_len,
                                                          DMA_FROM_DEVICE);
                                         IXGBE_RSC_CB(skb)->dma = 0;
                                         IXGBE_RSC_CB(skb)->delay_unmap = false;
                                 }
                                 if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)
-                                        rx_ring->rsc_count += skb_shinfo(skb)->nr_frags;
+                                        rx_ring->rsc_count +=
+                                                skb_shinfo(skb)->nr_frags;
                                 else
                                         rx_ring->rsc_count++;
                                 rx_ring->rsc_flush++;
@@ -1403,24 +1405,24 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
                 q_vector = adapter->q_vector[v_idx];
                 /* XXX for_each_set_bit(...) */
                 r_idx = find_first_bit(q_vector->rxr_idx,
-                                       adapter->num_rx_queues);
+                                       adapter->num_rx_queues);
 
                 for (i = 0; i < q_vector->rxr_count; i++) {
                         j = adapter->rx_ring[r_idx]->reg_idx;
                         ixgbe_set_ivar(adapter, 0, j, v_idx);
                         r_idx = find_next_bit(q_vector->rxr_idx,
-                                              adapter->num_rx_queues,
-                                              r_idx + 1);
+                                              adapter->num_rx_queues,
+                                              r_idx + 1);
                 }
                 r_idx = find_first_bit(q_vector->txr_idx,
-                                       adapter->num_tx_queues);
+                                       adapter->num_tx_queues);
 
                 for (i = 0; i < q_vector->txr_count; i++) {
                         j = adapter->tx_ring[r_idx]->reg_idx;
                         ixgbe_set_ivar(adapter, 1, j, v_idx);
                         r_idx = find_next_bit(q_vector->txr_idx,
-                                              adapter->num_tx_queues,
-                                              r_idx + 1);
+                                              adapter->num_tx_queues,
+                                              r_idx + 1);
                 }
 
                 if (q_vector->txr_count && !q_vector->rxr_count)
@@ -1435,7 +1437,7 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
 
         if (adapter->hw.mac.type == ixgbe_mac_82598EB)
                 ixgbe_set_ivar(adapter, -1, IXGBE_IVAR_OTHER_CAUSES_INDEX,
-                               v_idx);
+                               v_idx);
         else if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                 ixgbe_set_ivar(adapter, -1, 1, v_idx);
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_EITR(v_idx), 1950);
@@ -1477,8 +1479,8 @@ enum latency_range {
  *      parameter (see ixgbe_param.c)
  **/
 static u8 ixgbe_update_itr(struct ixgbe_adapter *adapter,
-                           u32 eitr, u8 itr_setting,
-                           int packets, int bytes)
+                           u32 eitr, u8 itr_setting,
+                           int packets, int bytes)
 {
         unsigned int retval = itr_setting;
         u32 timepassed_us;
@@ -1567,30 +1569,30 @@ static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
         for (i = 0; i < q_vector->txr_count; i++) {
                 tx_ring = adapter->tx_ring[r_idx];
                 ret_itr = ixgbe_update_itr(adapter, q_vector->eitr,
-                                           q_vector->tx_itr,
-                                           tx_ring->total_packets,
-                                           tx_ring->total_bytes);
+                                           q_vector->tx_itr,
+                                           tx_ring->total_packets,
+                                           tx_ring->total_bytes);
                 /* if the result for this queue would decrease interrupt
                  * rate for this vector then use that result */
                 q_vector->tx_itr = ((q_vector->tx_itr > ret_itr) ?
-                                    q_vector->tx_itr - 1 : ret_itr);
+                                    q_vector->tx_itr - 1 : ret_itr);
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
         for (i = 0; i < q_vector->rxr_count; i++) {
                 rx_ring = adapter->rx_ring[r_idx];
                 ret_itr = ixgbe_update_itr(adapter, q_vector->eitr,
-                                           q_vector->rx_itr,
-                                           rx_ring->total_packets,
-                                           rx_ring->total_bytes);
+                                           q_vector->rx_itr,
+                                           rx_ring->total_packets,
+                                           rx_ring->total_bytes);
                 /* if the result for this queue would decrease interrupt
                  * rate for this vector then use that result */
                 q_vector->rx_itr = ((q_vector->rx_itr > ret_itr) ?
-                                    q_vector->rx_itr - 1 : ret_itr);
+                                    q_vector->rx_itr - 1 : ret_itr);
                 r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         current_itr = max(q_vector->rx_itr, q_vector->tx_itr);
@@ -1627,39 +1629,40 @@ static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
 static void ixgbe_check_overtemp_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     check_overtemp_task);
+                                                     struct ixgbe_adapter,
+                                                     check_overtemp_task);
         struct ixgbe_hw *hw = &adapter->hw;
         u32 eicr = adapter->interrupt_event;
 
-        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) {
-                switch (hw->device_id) {
-                case IXGBE_DEV_ID_82599_T3_LOM: {
-                        u32 autoneg;
-                        bool link_up = false;
+        if (!(adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE))
+                return;
+
+        switch (hw->device_id) {
+        case IXGBE_DEV_ID_82599_T3_LOM: {
+                u32 autoneg;
+                bool link_up = false;
 
-                        if (hw->mac.ops.check_link)
-                                hw->mac.ops.check_link(hw, &autoneg, &link_up, false);
+                if (hw->mac.ops.check_link)
+                        hw->mac.ops.check_link(hw, &autoneg, &link_up, false);
 
-                        if (((eicr & IXGBE_EICR_GPI_SDP0) && (!link_up)) ||
-                            (eicr & IXGBE_EICR_LSC))
-                                /* Check if this is due to overtemp */
-                                if (hw->phy.ops.check_overtemp(hw) == IXGBE_ERR_OVERTEMP)
-                                        break;
-                        }
+                if (((eicr & IXGBE_EICR_GPI_SDP0) && (!link_up)) ||
+                    (eicr & IXGBE_EICR_LSC))
+                        /* Check if this is due to overtemp */
+                        if (hw->phy.ops.check_overtemp(hw) == IXGBE_ERR_OVERTEMP)
+                                break;
+                return;
+        }
+        default:
+                if (!(eicr & IXGBE_EICR_GPI_SDP0))
                         return;
-                default:
-                        if (!(eicr & IXGBE_EICR_GPI_SDP0))
-                                return;
-                        break;
-                }
-                e_crit(drv, "Network adapter has been stopped because it has "
-                       "over heated. Restart the computer. If the problem "
-                       "persists, power off the system and replace the "
-                       "adapter\n");
-                /* write to clear the interrupt */
-                IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP0);
+                break;
         }
+        e_crit(drv,
+               "Network adapter has been stopped because it has over heated. "
+               "Restart the computer. If the problem persists, "
+               "power off the system and replace the adapter\n");
+        /* write to clear the interrupt */
+        IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP0);
 }
 
 static void ixgbe_check_fan_failure(struct ixgbe_adapter *adapter, u32 eicr)
@@ -1746,9 +1749,9 @@ static irqreturn_t ixgbe_msix_lsc(int irq, void *data)
                         netif_tx_stop_all_queues(netdev);
                         for (i = 0; i < adapter->num_tx_queues; i++) {
                                 struct ixgbe_ring *tx_ring =
-                                                            adapter->tx_ring[i];
+                                                            adapter->tx_ring[i];
                                 if (test_and_clear_bit(__IXGBE_FDIR_INIT_DONE,
-                                                       &tx_ring->reinit_state))
+                                                       &tx_ring->reinit_state))
                                         schedule_work(&adapter->fdir_reinit_task);
                         }
                 }
@@ -1777,7 +1780,7 @@ static inline void ixgbe_irq_enable_queues(struct ixgbe_adapter *adapter,
 }
 
 static inline void ixgbe_irq_disable_queues(struct ixgbe_adapter *adapter,
-                                            u64 qmask)
+                                            u64 qmask)
 {
         u32 mask;
 
@@ -1809,7 +1812,7 @@ static irqreturn_t ixgbe_msix_clean_tx(int irq, void *data)
                 tx_ring->total_bytes = 0;
                 tx_ring->total_packets = 0;
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         /* EIAM disabled interrupts (on this vector) for us */
@@ -1837,7 +1840,7 @@ static irqreturn_t ixgbe_msix_clean_rx(int irq, void *data)
                 rx_ring->total_bytes = 0;
                 rx_ring->total_packets = 0;
                 r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         if (!q_vector->rxr_count)
@@ -1867,7 +1870,7 @@ static irqreturn_t ixgbe_msix_clean_many(int irq, void *data)
                 ring->total_bytes = 0;
                 ring->total_packets = 0;
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
@@ -1876,7 +1879,7 @@ static irqreturn_t ixgbe_msix_clean_many(int irq, void *data)
                 ring->total_bytes = 0;
                 ring->total_packets = 0;
                 r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         /* EIAM disabled interrupts (on this vector) for us */
@@ -1896,7 +1899,7 @@ static irqreturn_t ixgbe_msix_clean_many(int irq, void *data)
 static int ixgbe_clean_rxonly(struct napi_struct *napi, int budget)
 {
         struct ixgbe_q_vector *q_vector =
-                               container_of(napi, struct ixgbe_q_vector, napi);
+                               container_of(napi, struct ixgbe_q_vector, napi);
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct ixgbe_ring *rx_ring = NULL;
         int work_done = 0;
@@ -1918,7 +1921,7 @@ static int ixgbe_clean_rxonly(struct napi_struct *napi, int budget)
                         ixgbe_set_itr_msix(q_vector);
                 if (!test_bit(__IXGBE_DOWN, &adapter->state))
                         ixgbe_irq_enable_queues(adapter,
-                                                ((u64)1 << q_vector->v_idx));
+                                                ((u64)1 << q_vector->v_idx));
         }
 
         return work_done;
@@ -1935,7 +1938,7 @@ static int ixgbe_clean_rxonly(struct napi_struct *napi, int budget)
 static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
 {
         struct ixgbe_q_vector *q_vector =
-                               container_of(napi, struct ixgbe_q_vector, napi);
+                               container_of(napi, struct ixgbe_q_vector, napi);
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct ixgbe_ring *ring = NULL;
         int work_done = 0, i;
@@ -1951,7 +1954,7 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
 #endif
                 tx_clean_complete &= ixgbe_clean_tx_irq(q_vector, ring);
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         /* attempt to distribute budget to each queue fairly, but don't allow
@@ -1967,7 +1970,7 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
 #endif
                 ixgbe_clean_rx_irq(q_vector, ring, &work_done, budget);
                 r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
+                                      r_idx + 1);
         }
 
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
@@ -1979,7 +1982,7 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
                         ixgbe_set_itr_msix(q_vector);
                 if (!test_bit(__IXGBE_DOWN, &adapter->state))
                         ixgbe_irq_enable_queues(adapter,
-                                                ((u64)1 << q_vector->v_idx));
+                                                ((u64)1 << q_vector->v_idx));
                 return 0;
         }
 
@@ -1997,7 +2000,7 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
 static int ixgbe_clean_txonly(struct napi_struct *napi, int budget)
 {
         struct ixgbe_q_vector *q_vector =
-                               container_of(napi, struct ixgbe_q_vector, napi);
+                               container_of(napi, struct ixgbe_q_vector, napi);
         struct ixgbe_adapter *adapter = q_vector->adapter;
         struct ixgbe_ring *tx_ring = NULL;
         int work_done = 0;
@@ -2019,14 +2022,15 @@ static int ixgbe_clean_txonly(struct napi_struct *napi, int budget)
                 if (adapter->tx_itr_setting & 1)
                         ixgbe_set_itr_msix(q_vector);
                 if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                        ixgbe_irq_enable_queues(adapter, ((u64)1 << q_vector->v_idx));
+                        ixgbe_irq_enable_queues(adapter,
+                                                ((u64)1 << q_vector->v_idx));
         }
 
         return work_done;
 }
 
 static inline void map_vector_to_rxq(struct ixgbe_adapter *a, int v_idx,
-                                     int r_idx)
+                                     int r_idx)
 {
         struct ixgbe_q_vector *q_vector = a->q_vector[v_idx];
 
@@ -2035,7 +2039,7 @@ static inline void map_vector_to_rxq(struct ixgbe_adapter *a, int v_idx,
 }
 
 static inline void map_vector_to_txq(struct ixgbe_adapter *a, int v_idx,
-                                     int t_idx)
+                                     int t_idx)
 {
         struct ixgbe_q_vector *q_vector = a->q_vector[v_idx];
 
@@ -2055,7 +2059,7 @@ static inline void map_vector_to_txq(struct ixgbe_adapter *a, int v_idx,
  * mapping configurations in here.
  **/
 static int ixgbe_map_rings_to_vectors(struct ixgbe_adapter *adapter,
-                                      int vectors)
+                                      int vectors)
 {
         int v_start = 0;
         int rxr_idx = 0, txr_idx = 0;
@@ -2122,7 +2126,7 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         irqreturn_t (*handler)(int, void *);
         int i, vector, q_vectors, err;
-        int ri=0, ti=0;
+        int ri = 0, ti = 0;
 
         /* Decrement for Other and TCP Timer vectors */
         q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
@@ -2133,26 +2137,24 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
                 goto out;
 
 #define SET_HANDLER(_v) ((!(_v)->rxr_count) ? &ixgbe_msix_clean_tx : \
-                         (!(_v)->txr_count) ? &ixgbe_msix_clean_rx : \
-                         &ixgbe_msix_clean_many)
+                         (!(_v)->txr_count) ? &ixgbe_msix_clean_rx : \
+                         &ixgbe_msix_clean_many)
         for (vector = 0; vector < q_vectors; vector++) {
                 handler = SET_HANDLER(adapter->q_vector[vector]);
 
-                if(handler == &ixgbe_msix_clean_rx) {
+                if (handler == &ixgbe_msix_clean_rx) {
                         sprintf(adapter->name[vector], "%s-%s-%d",
                                 netdev->name, "rx", ri++);
-                }
-                else if(handler == &ixgbe_msix_clean_tx) {
+                } else if (handler == &ixgbe_msix_clean_tx) {
                         sprintf(adapter->name[vector], "%s-%s-%d",
                                 netdev->name, "tx", ti++);
-                }
-                else
+                } else
                         sprintf(adapter->name[vector], "%s-%s-%d",
                                 netdev->name, "TxRx", vector);
 
                 err = request_irq(adapter->msix_entries[vector].vector,
-                                  handler, 0, adapter->name[vector],
-                                  adapter->q_vector[vector]);
+                                  handler, 0, adapter->name[vector],
+                                  adapter->q_vector[vector]);
                 if (err) {
                         e_err(probe, "request_irq failed for MSIX interrupt "
                               "Error: %d\n", err);
@@ -2162,7 +2164,7 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
 
         sprintf(adapter->name[vector], "%s:lsc", netdev->name);
         err = request_irq(adapter->msix_entries[vector].vector,
-                          ixgbe_msix_lsc, 0, adapter->name[vector], netdev);
+                          ixgbe_msix_lsc, 0, adapter->name[vector], netdev);
         if (err) {
                 e_err(probe, "request_irq for msix_lsc failed: %d\n", err);
                 goto free_queue_irqs;
@@ -2173,7 +2175,7 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
 free_queue_irqs:
         for (i = vector - 1; i >= 0; i--)
                 free_irq(adapter->msix_entries[--vector].vector,
-                         adapter->q_vector[i]);
+                         adapter->q_vector[i]);
         adapter->flags &= ~IXGBE_FLAG_MSIX_ENABLED;
         pci_disable_msix(adapter->pdev);
         kfree(adapter->msix_entries);
@@ -2191,13 +2193,13 @@ static void ixgbe_set_itr(struct ixgbe_adapter *adapter)
         struct ixgbe_ring *tx_ring = adapter->tx_ring[0];
 
         q_vector->tx_itr = ixgbe_update_itr(adapter, new_itr,
-                                            q_vector->tx_itr,
-                                            tx_ring->total_packets,
-                                            tx_ring->total_bytes);
+                                            q_vector->tx_itr,
+                                            tx_ring->total_packets,
+                                            tx_ring->total_bytes);
         q_vector->rx_itr = ixgbe_update_itr(adapter, new_itr,
-                                            q_vector->rx_itr,
-                                            rx_ring->total_packets,
-                                            rx_ring->total_bytes);
+                                            q_vector->rx_itr,
+                                            rx_ring->total_packets,
+                                            rx_ring->total_bytes);
 
         current_itr = max(q_vector->rx_itr, q_vector->tx_itr);
 
@@ -2343,10 +2345,10 @@ static int ixgbe_request_irq(struct ixgbe_adapter *adapter)
                 err = ixgbe_request_msix_irqs(adapter);
         } else if (adapter->flags & IXGBE_FLAG_MSI_ENABLED) {
                 err = request_irq(adapter->pdev->irq, ixgbe_intr, 0,
-                                  netdev->name, netdev);
+                                  netdev->name, netdev);
         } else {
                 err = request_irq(adapter->pdev->irq, ixgbe_intr, IRQF_SHARED,
-                                  netdev->name, netdev);
+                                  netdev->name, netdev);
         }
 
         if (err)
@@ -2370,7 +2372,7 @@ static void ixgbe_free_irq(struct ixgbe_adapter *adapter)
                 i--;
                 for (; i >= 0; i--) {
                         free_irq(adapter->msix_entries[i].vector,
-                                 adapter->q_vector[i]);
+                                 adapter->q_vector[i]);
                 }
 
                 ixgbe_reset_q_vectors(adapter);
@@ -2413,7 +2415,7 @@ static void ixgbe_configure_msi_and_legacy(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
 
         IXGBE_WRITE_REG(hw, IXGBE_EITR(0),
-                        EITR_INTS_PER_SEC_TO_REG(adapter->rx_eitr_param));
+                        EITR_INTS_PER_SEC_TO_REG(adapter->rx_eitr_param));
 
         ixgbe_set_ivar(adapter, 0, 0, 0);
         ixgbe_set_ivar(adapter, 1, 0, 0);
@@ -2425,95 +2427,140 @@ static void ixgbe_configure_msi_and_legacy(struct ixgbe_adapter *adapter)
 }
 
 /**
- * ixgbe_configure_tx - Configure 8259x Transmit Unit after Reset
+ * ixgbe_configure_tx_ring - Configure 8259x Tx ring after Reset
  * @adapter: board private structure
+ * @ring: structure containing ring specific data
  *
- * Configure the Tx unit of the MAC after a reset.
+ * Configure the Tx descriptor ring after a reset.
  **/
-static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
+void ixgbe_configure_tx_ring(struct ixgbe_adapter *adapter,
+                             struct ixgbe_ring *ring)
 {
-        u64 tdba;
         struct ixgbe_hw *hw = &adapter->hw;
-        u32 i, j, tdlen, txctrl;
+        u64 tdba = ring->dma;
+        int wait_loop = 10;
+        u32 txdctl;
+        u16 reg_idx = ring->reg_idx;
 
-        /* Setup the HW Tx Head and Tail descriptor pointers */
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                struct ixgbe_ring *ring = adapter->tx_ring[i];
-                j = ring->reg_idx;
-                tdba = ring->dma;
-                tdlen = ring->count * sizeof(union ixgbe_adv_tx_desc);
-                IXGBE_WRITE_REG(hw, IXGBE_TDBAL(j),
-                                (tdba & DMA_BIT_MASK(32)));
-                IXGBE_WRITE_REG(hw, IXGBE_TDBAH(j), (tdba >> 32));
-                IXGBE_WRITE_REG(hw, IXGBE_TDLEN(j), tdlen);
-                IXGBE_WRITE_REG(hw, IXGBE_TDH(j), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_TDT(j), 0);
-                adapter->tx_ring[i]->head = IXGBE_TDH(j);
-                adapter->tx_ring[i]->tail = IXGBE_TDT(j);
-                /*
-                 * Disable Tx Head Writeback RO bit, since this hoses
-                 * bookkeeping if things aren't delivered in order.
-                 */
-                switch (hw->mac.type) {
-                case ixgbe_mac_82598EB:
-                        txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(j));
-                        break;
-                case ixgbe_mac_82599EB:
-                default:
-                        txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(j));
-                        break;
-                }
-                txctrl &= ~IXGBE_DCA_TXCTRL_TX_WB_RO_EN;
-                switch (hw->mac.type) {
-                case ixgbe_mac_82598EB:
-                        IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(j), txctrl);
-                        break;
-                case ixgbe_mac_82599EB:
-                default:
-                        IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(j), txctrl);
-                        break;
-                }
+        /* disable queue to avoid issues while updating state */
+        txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(reg_idx));
+        IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(reg_idx),
+                        txdctl & ~IXGBE_TXDCTL_ENABLE);
+        IXGBE_WRITE_FLUSH(hw);
+
+        IXGBE_WRITE_REG(hw, IXGBE_TDBAL(reg_idx),
+                        (tdba & DMA_BIT_MASK(32)));
+        IXGBE_WRITE_REG(hw, IXGBE_TDBAH(reg_idx), (tdba >> 32));
+        IXGBE_WRITE_REG(hw, IXGBE_TDLEN(reg_idx),
+                        ring->count * sizeof(union ixgbe_adv_tx_desc));
+        IXGBE_WRITE_REG(hw, IXGBE_TDH(reg_idx), 0);
+        IXGBE_WRITE_REG(hw, IXGBE_TDT(reg_idx), 0);
+        ring->head = IXGBE_TDH(reg_idx);
+        ring->tail = IXGBE_TDT(reg_idx);
+
+        /* configure fetching thresholds */
+        if (adapter->rx_itr_setting == 0) {
+                /* cannot set wthresh when itr==0 */
+                txdctl &= ~0x007F0000;
+        } else {
+                /* enable WTHRESH=8 descriptors, to encourage burst writeback */
+                txdctl |= (8 << 16);
+        }
+        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+                /* PThresh workaround for Tx hang with DFP enabled. */
+                txdctl |= 32;
         }
 
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                u32 rttdcs;
-                u32 mask;
+        /* reinitialize flowdirector state */
+        set_bit(__IXGBE_FDIR_INIT_DONE, &ring->reinit_state);
 
-                /* disable the arbiter while setting MTQC */
-                rttdcs = IXGBE_READ_REG(hw, IXGBE_RTTDCS);
-                rttdcs |= IXGBE_RTTDCS_ARBDIS;
-                IXGBE_WRITE_REG(hw, IXGBE_RTTDCS, rttdcs);
+        /* enable queue */
+        txdctl |= IXGBE_TXDCTL_ENABLE;
+        IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(reg_idx), txdctl);
 
-                /* set transmit pool layout */
-                mask = (IXGBE_FLAG_SRIOV_ENABLED | IXGBE_FLAG_DCB_ENABLED);
-                switch (adapter->flags & mask) {
+        /* TXDCTL.EN will return 0 on 82598 if link is down, so skip it */
+        if (hw->mac.type == ixgbe_mac_82598EB &&
+            !(IXGBE_READ_REG(hw, IXGBE_LINKS) & IXGBE_LINKS_UP))
+                return;
 
-                case (IXGBE_FLAG_SRIOV_ENABLED):
-                        IXGBE_WRITE_REG(hw, IXGBE_MTQC,
-                                        (IXGBE_MTQC_VT_ENA | IXGBE_MTQC_64VF));
-                        break;
+        /* poll to verify queue is enabled */
+        do {
+                msleep(1);
+                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(reg_idx));
+        } while (--wait_loop && !(txdctl & IXGBE_TXDCTL_ENABLE));
+        if (!wait_loop)
+                e_err(drv, "Could not enable Tx Queue %d\n", reg_idx);
+}
 
-                case (IXGBE_FLAG_DCB_ENABLED):
-                        /* We enable 8 traffic classes, DCB only */
-                        IXGBE_WRITE_REG(hw, IXGBE_MTQC,
-                                      (IXGBE_MTQC_RT_ENA | IXGBE_MTQC_8TC_8TQ));
-                        break;
+static void ixgbe_setup_mtqc(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 rttdcs;
+        u32 mask;
 
-                default:
-                        IXGBE_WRITE_REG(hw, IXGBE_MTQC, IXGBE_MTQC_64Q_1PB);
-                        break;
-                }
+        if (hw->mac.type == ixgbe_mac_82598EB)
+                return;
+
+        /* disable the arbiter while setting MTQC */
+        rttdcs = IXGBE_READ_REG(hw, IXGBE_RTTDCS);
+        rttdcs |= IXGBE_RTTDCS_ARBDIS;
+        IXGBE_WRITE_REG(hw, IXGBE_RTTDCS, rttdcs);
+
+        /* set transmit pool layout */
+        mask = (IXGBE_FLAG_SRIOV_ENABLED | IXGBE_FLAG_DCB_ENABLED);
+        switch (adapter->flags & mask) {
+
+        case (IXGBE_FLAG_SRIOV_ENABLED):
+                IXGBE_WRITE_REG(hw, IXGBE_MTQC,
+                                (IXGBE_MTQC_VT_ENA | IXGBE_MTQC_64VF));
+                break;
+
+        case (IXGBE_FLAG_DCB_ENABLED):
+                /* We enable 8 traffic classes, DCB only */
+                IXGBE_WRITE_REG(hw, IXGBE_MTQC,
+                              (IXGBE_MTQC_RT_ENA | IXGBE_MTQC_8TC_8TQ));
+                break;
+
+        default:
+                IXGBE_WRITE_REG(hw, IXGBE_MTQC, IXGBE_MTQC_64Q_1PB);
+                break;
+        }
+
+        /* re-enable the arbiter */
+        rttdcs &= ~IXGBE_RTTDCS_ARBDIS;
+        IXGBE_WRITE_REG(hw, IXGBE_RTTDCS, rttdcs);
+}
+
+/**
+ * ixgbe_configure_tx - Configure 8259x Transmit Unit after Reset
+ * @adapter: board private structure
+ *
+ * Configure the Tx unit of the MAC after a reset.
+ **/
+static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 dmatxctl;
+        u32 i;
+
+        ixgbe_setup_mtqc(adapter);
 
-                /* re-eable the arbiter */
-                rttdcs &= ~IXGBE_RTTDCS_ARBDIS;
-                IXGBE_WRITE_REG(hw, IXGBE_RTTDCS, rttdcs);
+        if (hw->mac.type != ixgbe_mac_82598EB) {
+                /* DMATXCTL.EN must be before Tx queues are enabled */
+                dmatxctl = IXGBE_READ_REG(hw, IXGBE_DMATXCTL);
+                dmatxctl |= IXGBE_DMATXCTL_TE;
+                IXGBE_WRITE_REG(hw, IXGBE_DMATXCTL, dmatxctl);
         }
+
+        /* Setup the HW Tx Head and Tail descriptor pointers */
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                ixgbe_configure_tx_ring(adapter, adapter->tx_ring[i]);
 }
 
 #define IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT 2
 
 static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
-                                   struct ixgbe_ring *rx_ring)
+                                   struct ixgbe_ring *rx_ring)
 {
         u32 srrctl;
         int index;
@@ -2529,6 +2576,8 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
 
         srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
         srrctl &= ~IXGBE_SRRCTL_BSIZEPKT_MASK;
+        if (adapter->num_vfs)
+                srrctl |= IXGBE_SRRCTL_DROP_EN;
 
         srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                   IXGBE_SRRCTL_BSIZEHDR_MASK;
@@ -2549,20 +2598,46 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_SRRCTL(index), srrctl);
 }
 
-static u32 ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
+static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
 {
-        u32 mrqc = 0;
+        struct ixgbe_hw *hw = &adapter->hw;
+        static const u32 seed[10] = { 0xE291D73D, 0x1805EC6C, 0x2A94B30D,
+                          0xA54F2BEC, 0xEA49AF7C, 0xE214AD3D, 0xB855AABE,
+                          0x6A3E67EA, 0x14364D17, 0x3BED200D};
+        u32 mrqc = 0, reta = 0;
+        u32 rxcsum;
+        int i, j;
         int mask;
 
-        if (!(adapter->hw.mac.type == ixgbe_mac_82599EB))
-                return mrqc;
+        /* Fill out hash function seeds */
+        for (i = 0; i < 10; i++)
+                IXGBE_WRITE_REG(hw, IXGBE_RSSRK(i), seed[i]);
+
+        /* Fill out redirection table */
+        for (i = 0, j = 0; i < 128; i++, j++) {
+                if (j == adapter->ring_feature[RING_F_RSS].indices)
+                        j = 0;
+                /* reta = 4-byte sliding window of
+                 * 0x00..(indices-1)(indices-1)00..etc. */
+                reta = (reta << 8) | (j * 0x11);
+                if ((i & 3) == 3)
+                        IXGBE_WRITE_REG(hw, IXGBE_RETA(i >> 2), reta);
+        }
+
+        /* Disable indicating checksum in descriptor, enables RSS hash */
+        rxcsum = IXGBE_READ_REG(hw, IXGBE_RXCSUM);
+        rxcsum |= IXGBE_RXCSUM_PCSD;
+        IXGBE_WRITE_REG(hw, IXGBE_RXCSUM, rxcsum);
 
-        mask = adapter->flags & (IXGBE_FLAG_RSS_ENABLED
+        if (adapter->hw.mac.type == ixgbe_mac_82598EB)
+                mask = adapter->flags & IXGBE_FLAG_RSS_ENABLED;
+        else
+                mask = adapter->flags & (IXGBE_FLAG_RSS_ENABLED
 #ifdef CONFIG_IXGBE_DCB
-                                 | IXGBE_FLAG_DCB_ENABLED
+                                         | IXGBE_FLAG_DCB_ENABLED
 #endif
-                                 | IXGBE_FLAG_SRIOV_ENABLED
-                                );
+                                         | IXGBE_FLAG_SRIOV_ENABLED
+                                        );
 
         switch (mask) {
         case (IXGBE_FLAG_RSS_ENABLED):
@@ -2580,7 +2655,13 @@ static u32 ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
                 break;
         }
 
-        return mrqc;
+        /* Perform hash on these packet types */
+        mrqc |= IXGBE_MRQC_RSS_FIELD_IPV4
+              | IXGBE_MRQC_RSS_FIELD_IPV4_TCP
+              | IXGBE_MRQC_RSS_FIELD_IPV6
+              | IXGBE_MRQC_RSS_FIELD_IPV6_TCP;
+
+        IXGBE_WRITE_REG(hw, IXGBE_MRQC, mrqc);
 }
 
 /**
@@ -2588,25 +2669,26 @@ static u32 ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
  * @adapter:    address of board private structure
  * @index:      index of ring to set
  **/
-static void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter, int index)
+static void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *ring)
 {
-        struct ixgbe_ring *rx_ring;
         struct ixgbe_hw *hw = &adapter->hw;
-        int j;
         u32 rscctrl;
         int rx_buf_len;
+        u16 reg_idx = ring->reg_idx;
 
-        rx_ring = adapter->rx_ring[index];
-        j = rx_ring->reg_idx;
-        rx_buf_len = rx_ring->rx_buf_len;
-        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(j));
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))
+                return;
+
+        rx_buf_len = ring->rx_buf_len;
+        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(reg_idx));
         rscctrl |= IXGBE_RSCCTL_RSCEN;
         /*
          * we must limit the number of descriptors so that the
          * total size of max desc * buf_len is not greater
          * than 65535
          */
-        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
+        if (ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (MAX_SKB_FRAGS > 16)
                 rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
@@ -2624,31 +2706,181 @@ static void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter, int index)
                 else
                         rscctrl |= IXGBE_RSCCTL_MAXDESC_4;
         }
-        IXGBE_WRITE_REG(hw, IXGBE_RSCCTL(j), rscctrl);
+        IXGBE_WRITE_REG(hw, IXGBE_RSCCTL(reg_idx), rscctrl);
 }
 
 /**
- * ixgbe_configure_rx - Configure 8259x Receive Unit after Reset
- * @adapter: board private structure
+ *  ixgbe_set_uta - Set unicast filter table address
+ *  @adapter: board private structure
  *
- * Configure the Rx unit of the MAC after a reset.
+ *  The unicast table address is a register array of 32-bit registers.
+ *  The table is meant to be used in a way similar to how the MTA is used
+ *  however due to certain limitations in the hardware it is necessary to
+ *  set all the hash bits to 1 and use the VMOLR ROPE bit as a promiscuous
+ *  enable bit to allow vlan tag stripping when promiscuous mode is enabled
  **/
-static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
+static void ixgbe_set_uta(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int i;
+
+        /* The UTA table only exists on 82599 hardware and newer */
+        if (hw->mac.type < ixgbe_mac_82599EB)
+                return;
+
+        /* we only need to do this if VMDq is enabled */
+        if (!(adapter->flags & IXGBE_FLAG_SRIOV_ENABLED))
+                return;
+
+        for (i = 0; i < 128; i++)
+                IXGBE_WRITE_REG(hw, IXGBE_UTA(i), ~0);
+}
+
+#define IXGBE_MAX_RX_DESC_POLL 10
+static void ixgbe_rx_desc_queue_enable(struct ixgbe_adapter *adapter,
+                                       struct ixgbe_ring *ring)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int reg_idx = ring->reg_idx;
+        int wait_loop = IXGBE_MAX_RX_DESC_POLL;
+        u32 rxdctl;
+
+        /* RXDCTL.EN will return 0 on 82598 if link is down, so skip it */
+        if (hw->mac.type == ixgbe_mac_82598EB &&
+            !(IXGBE_READ_REG(hw, IXGBE_LINKS) & IXGBE_LINKS_UP))
+                return;
+
+        do {
+                msleep(1);
+                rxdctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(reg_idx));
+        } while (--wait_loop && !(rxdctl & IXGBE_RXDCTL_ENABLE));
+
+        if (!wait_loop) {
+                e_err(drv, "RXDCTL.ENABLE on Rx queue %d not set within "
+                      "the polling period\n", reg_idx);
+        }
+}
+
+void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter,
+                             struct ixgbe_ring *ring)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u64 rdba = ring->dma;
+        u32 rxdctl;
+        u16 reg_idx = ring->reg_idx;
+
+        /* disable queue to avoid issues while updating state */
+        rxdctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(reg_idx));
+        IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(reg_idx),
+                        rxdctl & ~IXGBE_RXDCTL_ENABLE);
+        IXGBE_WRITE_FLUSH(hw);
+
+        IXGBE_WRITE_REG(hw, IXGBE_RDBAL(reg_idx), (rdba & DMA_BIT_MASK(32)));
+        IXGBE_WRITE_REG(hw, IXGBE_RDBAH(reg_idx), (rdba >> 32));
+        IXGBE_WRITE_REG(hw, IXGBE_RDLEN(reg_idx),
+                        ring->count * sizeof(union ixgbe_adv_rx_desc));
+        IXGBE_WRITE_REG(hw, IXGBE_RDH(reg_idx), 0);
+        IXGBE_WRITE_REG(hw, IXGBE_RDT(reg_idx), 0);
+        ring->head = IXGBE_RDH(reg_idx);
+        ring->tail = IXGBE_RDT(reg_idx);
+
+        ixgbe_configure_srrctl(adapter, ring);
+        ixgbe_configure_rscctl(adapter, ring);
+
+        if (hw->mac.type == ixgbe_mac_82598EB) {
+                /*
+                 * enable cache line friendly hardware writes:
+                 * PTHRESH=32 descriptors (half the internal cache),
+                 * this also removes ugly rx_no_buffer_count increment
+                 * HTHRESH=4 descriptors (to minimize latency on fetch)
+                 * WTHRESH=8 burst writeback up to two cache lines
+                 */
+                rxdctl &= ~0x3FFFFF;
+                rxdctl |=  0x080420;
+        }
+
+        /* enable receive descriptor ring */
+        rxdctl |= IXGBE_RXDCTL_ENABLE;
+        IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(reg_idx), rxdctl);
+
+        ixgbe_rx_desc_queue_enable(adapter, ring);
+        ixgbe_alloc_rx_buffers(adapter, ring, IXGBE_DESC_UNUSED(ring));
+}
+
+static void ixgbe_setup_psrtype(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int p;
+
+        /* PSRTYPE must be initialized in non 82598 adapters */
+        u32 psrtype = IXGBE_PSRTYPE_TCPHDR |
+                      IXGBE_PSRTYPE_UDPHDR |
+                      IXGBE_PSRTYPE_IPV4HDR |
+                      IXGBE_PSRTYPE_L2HDR |
+                      IXGBE_PSRTYPE_IPV6HDR;
+
+        if (hw->mac.type == ixgbe_mac_82598EB)
+                return;
+
+        if (adapter->flags & IXGBE_FLAG_RSS_ENABLED)
+                psrtype |= (adapter->num_rx_queues_per_pool << 29);
+
+        for (p = 0; p < adapter->num_rx_pools; p++)
+                IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(adapter->num_vfs + p),
+                                psrtype);
+}
+
+static void ixgbe_configure_virtualization(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 gcr_ext;
+        u32 vt_reg_bits;
+        u32 reg_offset, vf_shift;
+        u32 vmdctl;
+
+        if (!(adapter->flags & IXGBE_FLAG_SRIOV_ENABLED))
+                return;
+
+        vmdctl = IXGBE_READ_REG(hw, IXGBE_VT_CTL);
+        vt_reg_bits = IXGBE_VMD_CTL_VMDQ_EN | IXGBE_VT_CTL_REPLEN;
+        vt_reg_bits |= (adapter->num_vfs << IXGBE_VT_CTL_POOL_SHIFT);
+        IXGBE_WRITE_REG(hw, IXGBE_VT_CTL, vmdctl | vt_reg_bits);
+
+        vf_shift = adapter->num_vfs % 32;
+        reg_offset = (adapter->num_vfs > 32) ? 1 : 0;
+
+        /* Enable only the PF's pool for Tx/Rx */
+        IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), (1 << vf_shift));
+        IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset ^ 1), 0);
+        IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset), (1 << vf_shift));
+        IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset ^ 1), 0);
+        IXGBE_WRITE_REG(hw, IXGBE_PFDTXGSWC, IXGBE_PFDTXGSWC_VT_LBEN);
+
+        /* Map PF MAC address in RAR Entry 0 to first pool following VFs */
+        hw->mac.ops.set_vmdq(hw, 0, adapter->num_vfs);
+
+        /*
+         * Set up VF register offsets for selected VT Mode,
+         * i.e. 32 or 64 VFs for SR-IOV
+         */
+        gcr_ext = IXGBE_READ_REG(hw, IXGBE_GCR_EXT);
+        gcr_ext |= IXGBE_GCR_EXT_MSIX_EN;
+        gcr_ext |= IXGBE_GCR_EXT_VT_MODE_64;
+        IXGBE_WRITE_REG(hw, IXGBE_GCR_EXT, gcr_ext);
+
+        /* enable Tx loopback for VF/PF communication */
+        IXGBE_WRITE_REG(hw, IXGBE_PFDTXGSWC, IXGBE_PFDTXGSWC_VT_LBEN);
+}
+
+static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
 {
-        u64 rdba;
         struct ixgbe_hw *hw = &adapter->hw;
-        struct ixgbe_ring *rx_ring;
         struct net_device *netdev = adapter->netdev;
         int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
-        int i, j;
-        u32 rdlen, rxctrl, rxcsum;
-        static const u32 seed[10] = { 0xE291D73D, 0x1805EC6C, 0x2A94B30D,
-                          0xA54F2BEC, 0xEA49AF7C, 0xE214AD3D, 0xB855AABE,
-                          0x6A3E67EA, 0x14364D17, 0x3BED200D};
-        u32 fctrl, hlreg0;
-        u32 reta = 0, mrqc = 0;
-        u32 rdrxctl;
         int rx_buf_len;
+        struct ixgbe_ring *rx_ring;
+        int i;
+        u32 mhadd, hlreg0;
 
         /* Decide whether to use packet split mode or not */
         /* Do not use packet split if we're in SR-IOV Mode */
@@ -2658,62 +2890,40 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         /* Set the RX buffer length according to the mode */
         if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                 rx_buf_len = IXGBE_RX_HDR_SIZE;
-                if (hw->mac.type == ixgbe_mac_82599EB) {
-                        /* PSRTYPE must be initialized in 82599 */
-                        u32 psrtype = IXGBE_PSRTYPE_TCPHDR |
-                                      IXGBE_PSRTYPE_UDPHDR |
-                                      IXGBE_PSRTYPE_IPV4HDR |
-                                      IXGBE_PSRTYPE_IPV6HDR |
-                                      IXGBE_PSRTYPE_L2HDR;
-                        IXGBE_WRITE_REG(hw,
-                                        IXGBE_PSRTYPE(adapter->num_vfs),
-                                        psrtype);
-                }
         } else {
                 if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                     (netdev->mtu <= ETH_DATA_LEN))
                         rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                 else
-                        rx_buf_len = ALIGN(max_frame, 1024);
+                        rx_buf_len = ALIGN(max_frame + VLAN_HLEN, 1024);
         }
 
-        fctrl = IXGBE_READ_REG(&adapter->hw, IXGBE_FCTRL);
-        fctrl |= IXGBE_FCTRL_BAM;
-        fctrl |= IXGBE_FCTRL_DPF; /* discard pause frames when FC enabled */
-        fctrl |= IXGBE_FCTRL_PMCF;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCTRL, fctrl);
+#ifdef IXGBE_FCOE
+        /* adjust max frame to be able to do baby jumbo for FCoE */
+        if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
+            (max_frame < IXGBE_FCOE_JUMBO_FRAME_SIZE))
+                max_frame = IXGBE_FCOE_JUMBO_FRAME_SIZE;
+
+#endif /* IXGBE_FCOE */
+        mhadd = IXGBE_READ_REG(hw, IXGBE_MHADD);
+        if (max_frame != (mhadd >> IXGBE_MHADD_MFS_SHIFT)) {
+                mhadd &= ~IXGBE_MHADD_MFS_MASK;
+                mhadd |= max_frame << IXGBE_MHADD_MFS_SHIFT;
+
+                IXGBE_WRITE_REG(hw, IXGBE_MHADD, mhadd);
+        }
 
         hlreg0 = IXGBE_READ_REG(hw, IXGBE_HLREG0);
-        if (adapter->netdev->mtu <= ETH_DATA_LEN)
-                hlreg0 &= ~IXGBE_HLREG0_JUMBOEN;
-        else
-                hlreg0 |= IXGBE_HLREG0_JUMBOEN;
-#ifdef IXGBE_FCOE
-        if (netdev->features & NETIF_F_FCOE_MTU)
-                hlreg0 |= IXGBE_HLREG0_JUMBOEN;
-#endif
+        /* set jumbo enable since MHADD.MFS is keeping size locked at max_frame */
+        hlreg0 |= IXGBE_HLREG0_JUMBOEN;
         IXGBE_WRITE_REG(hw, IXGBE_HLREG0, hlreg0);
 
-        rdlen = adapter->rx_ring[0]->count * sizeof(union ixgbe_adv_rx_desc);
-        /* disable receives while setting up the descriptors */
-        rxctrl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
-        IXGBE_WRITE_REG(hw, IXGBE_RXCTRL, rxctrl & ~IXGBE_RXCTRL_RXEN);
-
         /*
          * Setup the HW Rx Head and Tail Descriptor Pointers and
          * the Base and Length of the Rx Descriptor Ring
          */
         for (i = 0; i < adapter->num_rx_queues; i++) {
                 rx_ring = adapter->rx_ring[i];
-                rdba = rx_ring->dma;
-                j = rx_ring->reg_idx;
-                IXGBE_WRITE_REG(hw, IXGBE_RDBAL(j), (rdba & DMA_BIT_MASK(32)));
-                IXGBE_WRITE_REG(hw, IXGBE_RDBAH(j), (rdba >> 32));
-                IXGBE_WRITE_REG(hw, IXGBE_RDLEN(j), rdlen);
-                IXGBE_WRITE_REG(hw, IXGBE_RDH(j), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_RDT(j), 0);
-                rx_ring->head = IXGBE_RDH(j);
-                rx_ring->tail = IXGBE_RDT(j);
                 rx_ring->rx_buf_len = rx_buf_len;
 
                 if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
@@ -2729,15 +2939,21 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                                 rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
                                 if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
                                         rx_ring->rx_buf_len =
-                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
                         }
                 }
-
 #endif /* IXGBE_FCOE */
-                ixgbe_configure_srrctl(adapter, rx_ring);
         }
 
-        if (hw->mac.type == ixgbe_mac_82598EB) {
+}
+
+static void ixgbe_setup_rdrxctl(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 rdrxctl = IXGBE_READ_REG(hw, IXGBE_RDRXCTL);
+
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 /*
                  * For VMDq support of different descriptor types or
                  * buffer sizes through the use of multiple SRRCTL
@@ -2748,110 +2964,66 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                  * effects of setting this bit are only that SRRCTL must be
                  * fully programmed [0..15]
                  */
-                rdrxctl = IXGBE_READ_REG(hw, IXGBE_RDRXCTL);
                 rdrxctl |= IXGBE_RDRXCTL_MVMEN;
-                IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
+                break;
+        case ixgbe_mac_82599EB:
+                /* Disable RSC for ACK packets */
+                IXGBE_WRITE_REG(hw, IXGBE_RSCDBU,
+                   (IXGBE_RSCDBU_RSCACKDIS | IXGBE_READ_REG(hw, IXGBE_RSCDBU)));
+                rdrxctl &= ~IXGBE_RDRXCTL_RSCFRSTSIZE;
+                /* hardware requires some bits to be set by default */
+                rdrxctl |= (IXGBE_RDRXCTL_RSCACKC | IXGBE_RDRXCTL_FCOE_WRFIX);
+                rdrxctl |= IXGBE_RDRXCTL_CRCSTRIP;
+                break;
+        default:
+                /* We should do nothing since we don't know this hardware */
+                return;
         }
 
-        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
-                u32 vt_reg_bits;
-                u32 reg_offset, vf_shift;
-                u32 vmdctl = IXGBE_READ_REG(hw, IXGBE_VT_CTL);
-                vt_reg_bits = IXGBE_VMD_CTL_VMDQ_EN
-                        | IXGBE_VT_CTL_REPLEN;
-                vt_reg_bits |= (adapter->num_vfs <<
-                                IXGBE_VT_CTL_POOL_SHIFT);
-                IXGBE_WRITE_REG(hw, IXGBE_VT_CTL, vmdctl | vt_reg_bits);
-                IXGBE_WRITE_REG(hw, IXGBE_MRQC, 0);
-
-                vf_shift = adapter->num_vfs % 32;
-                reg_offset = adapter->num_vfs / 32;
-                IXGBE_WRITE_REG(hw, IXGBE_VFRE(0), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_VFRE(1), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_VFTE(0), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_VFTE(1), 0);
-                /* Enable only the PF's pool for Tx/Rx */
-                IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), (1 << vf_shift));
-                IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset), (1 << vf_shift));
-                IXGBE_WRITE_REG(hw, IXGBE_PFDTXGSWC, IXGBE_PFDTXGSWC_VT_LBEN);
-                ixgbe_set_vmolr(hw, adapter->num_vfs, true);
-        }
-
-        /* Program MRQC for the distribution of queues */
-        mrqc = ixgbe_setup_mrqc(adapter);
-
-        if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
-                /* Fill out redirection table */
-                for (i = 0, j = 0; i < 128; i++, j++) {
-                        if (j == adapter->ring_feature[RING_F_RSS].indices)
-                                j = 0;
-                        /* reta = 4-byte sliding window of
-                         * 0x00..(indices-1)(indices-1)00..etc. */
-                        reta = (reta << 8) | (j * 0x11);
-                        if ((i & 3) == 3)
-                                IXGBE_WRITE_REG(hw, IXGBE_RETA(i >> 2), reta);
-                }
-
-                /* Fill out hash function seeds */
-                for (i = 0; i < 10; i++)
-                        IXGBE_WRITE_REG(hw, IXGBE_RSSRK(i), seed[i]);
-
-                if (hw->mac.type == ixgbe_mac_82598EB)
-                        mrqc |= IXGBE_MRQC_RSSEN;
-                    /* Perform hash on these packet types */
-                mrqc |= IXGBE_MRQC_RSS_FIELD_IPV4
-                      | IXGBE_MRQC_RSS_FIELD_IPV4_TCP
-                      | IXGBE_MRQC_RSS_FIELD_IPV6
-                      | IXGBE_MRQC_RSS_FIELD_IPV6_TCP;
-        }
-        IXGBE_WRITE_REG(hw, IXGBE_MRQC, mrqc);
+        IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
+}
 
-        if (adapter->num_vfs) {
-                u32 reg;
+/**
+ * ixgbe_configure_rx - Configure 8259x Receive Unit after Reset
+ * @adapter: board private structure
+ *
+ * Configure the Rx unit of the MAC after a reset.
+ **/
+static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int i;
+        u32 rxctrl;
 
-                /* Map PF MAC address in RAR Entry 0 to first pool
-                 * following VFs */
-                hw->mac.ops.set_vmdq(hw, 0, adapter->num_vfs);
+        /* disable receives while setting up the descriptors */
+        rxctrl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
+        IXGBE_WRITE_REG(hw, IXGBE_RXCTRL, rxctrl & ~IXGBE_RXCTRL_RXEN);
 
-                /* Set up VF register offsets for selected VT Mode, i.e.
-                 * 64 VFs for SR-IOV */
-                reg = IXGBE_READ_REG(hw, IXGBE_GCR_EXT);
-                reg |= IXGBE_GCR_EXT_SRIOV;
-                IXGBE_WRITE_REG(hw, IXGBE_GCR_EXT, reg);
-        }
+        ixgbe_setup_psrtype(adapter);
+        ixgbe_setup_rdrxctl(adapter);
 
-        rxcsum = IXGBE_READ_REG(hw, IXGBE_RXCSUM);
+        /* Program registers for the distribution of queues */
+        ixgbe_setup_mrqc(adapter);
 
-        if (adapter->flags & IXGBE_FLAG_RSS_ENABLED ||
-            adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED) {
-                /* Disable indicating checksum in descriptor, enables
-                 * RSS hash */
-                rxcsum |= IXGBE_RXCSUM_PCSD;
-        }
-        if (!(rxcsum & IXGBE_RXCSUM_PCSD)) {
-                /* Enable IPv4 payload checksum for UDP fragments
-                 * if PCSD is not set */
-                rxcsum |= IXGBE_RXCSUM_IPPCSE;
-        }
+        ixgbe_set_uta(adapter);
 
-        IXGBE_WRITE_REG(hw, IXGBE_RXCSUM, rxcsum);
+        /* set_rx_buffer_len must be called before ring initialization */
+        ixgbe_set_rx_buffer_len(adapter);
 
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                rdrxctl = IXGBE_READ_REG(hw, IXGBE_RDRXCTL);
-                rdrxctl |= IXGBE_RDRXCTL_CRCSTRIP;
-                rdrxctl &= ~IXGBE_RDRXCTL_RSCFRSTSIZE;
-                IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
-        }
+        /*
+         * Setup the HW Rx Head and Tail Descriptor Pointers and
+         * the Base and Length of the Rx Descriptor Ring
+         */
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                ixgbe_configure_rx_ring(adapter, adapter->rx_ring[i]);
 
-        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
-                /* Enable 82599 HW-RSC */
-                for (i = 0; i < adapter->num_rx_queues; i++)
-                        ixgbe_configure_rscctl(adapter, i);
+        /* disable drop enable for 82598 parts */
+        if (hw->mac.type == ixgbe_mac_82598EB)
+                rxctrl |= IXGBE_RXCTRL_DMBYPS;
 
-                /* Disable RSC for ACK packets */
-                IXGBE_WRITE_REG(hw, IXGBE_RSCDBU,
-                   (IXGBE_RSCDBU_RSCACKDIS | IXGBE_READ_REG(hw, IXGBE_RSCDBU)));
-        }
+        /* enable all receives */
+        rxctrl |= IXGBE_RXCTRL_RXEN;
+        hw->mac.ops.enable_rx_dma(hw, rxctrl);
 }
 
 static void ixgbe_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
@@ -2955,7 +3127,7 @@ static void ixgbe_vlan_filter_enable(struct ixgbe_adapter *adapter)
 }
 
 static void ixgbe_vlan_rx_register(struct net_device *netdev,
-                                   struct vlan_group *grp)
+                                   struct vlan_group *grp)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
@@ -3052,6 +3224,11 @@ void ixgbe_set_rx_mode(struct net_device *netdev)
 
         fctrl = IXGBE_READ_REG(hw, IXGBE_FCTRL);
 
+        /* set all bits that we expect to always be set */
+        fctrl |= IXGBE_FCTRL_BAM;
+        fctrl |= IXGBE_FCTRL_DPF; /* discard pause frames when FC enabled */
+        fctrl |= IXGBE_FCTRL_PMCF;
+
         /* clear the bits we are changing the status of */
         fctrl &= ~(IXGBE_FCTRL_UPE | IXGBE_FCTRL_MPE);
 
@@ -3157,6 +3334,15 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
         u32 txdctl;
         int i, j;
 
+        if (!(adapter->flags & IXGBE_FLAG_DCB_ENABLED)) {
+                if (hw->mac.type == ixgbe_mac_82598EB)
+                        netif_set_gso_max_size(adapter->netdev, 65536);
+                return;
+        }
+
+        if (hw->mac.type == ixgbe_mac_82598EB)
+                netif_set_gso_max_size(adapter->netdev, 32768);
+
         ixgbe_dcb_check_config(&adapter->dcb_cfg);
         ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, DCB_TX_CONFIG);
         ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, DCB_RX_CONFIG);
@@ -3188,17 +3374,7 @@ static void ixgbe_configure(struct ixgbe_adapter *adapter)
 
         ixgbe_restore_vlan(adapter);
 #ifdef CONFIG_IXGBE_DCB
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                if (hw->mac.type == ixgbe_mac_82598EB)
-                        netif_set_gso_max_size(netdev, 32768);
-                else
-                        netif_set_gso_max_size(netdev, 65536);
-                ixgbe_configure_dcb(adapter);
-        } else {
-                netif_set_gso_max_size(netdev, 65536);
-        }
-#else
-        netif_set_gso_max_size(netdev, 65536);
+        ixgbe_configure_dcb(adapter);
 #endif
 
 #ifdef IXGBE_FCOE
@@ -3209,17 +3385,15 @@ static void ixgbe_configure(struct ixgbe_adapter *adapter)
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
                 for (i = 0; i < adapter->num_tx_queues; i++)
                         adapter->tx_ring[i]->atr_sample_rate =
-                                                       adapter->atr_sample_rate;
+                                                       adapter->atr_sample_rate;
                 ixgbe_init_fdir_signature_82599(hw, adapter->fdir_pballoc);
         } else if (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE) {
                 ixgbe_init_fdir_perfect_82599(hw, adapter->fdir_pballoc);
         }
+        ixgbe_configure_virtualization(adapter);
 
         ixgbe_configure_tx(adapter);
         ixgbe_configure_rx(adapter);
-        for (i = 0; i < adapter->num_rx_queues; i++)
-                ixgbe_alloc_rx_buffers(adapter, adapter->rx_ring[i],
-                                       (adapter->rx_ring[i]->count - 1));
 }
 
 static inline bool ixgbe_is_sfp(struct ixgbe_hw *hw)
@@ -3290,7 +3464,8 @@ static int ixgbe_non_sfp_link_config(struct ixgbe_hw *hw)
                 goto link_cfg_out;
 
         if (hw->mac.ops.get_link_capabilities)
-                ret = hw->mac.ops.get_link_capabilities(hw, &autoneg, &negotiation);
+                ret = hw->mac.ops.get_link_capabilities(hw, &autoneg,
+                                                        &negotiation);
         if (ret)
                 goto link_cfg_out;
 
@@ -3300,62 +3475,15 @@ link_cfg_out:
         return ret;
 }
 
-#define IXGBE_MAX_RX_DESC_POLL 10
-static inline void ixgbe_rx_desc_queue_enable(struct ixgbe_adapter *adapter,
-                                              int rxr)
-{
-        int j = adapter->rx_ring[rxr]->reg_idx;
-        int k;
-
-        for (k = 0; k < IXGBE_MAX_RX_DESC_POLL; k++) {
-                if (IXGBE_READ_REG(&adapter->hw,
-                                   IXGBE_RXDCTL(j)) & IXGBE_RXDCTL_ENABLE)
-                        break;
-                else
-                        msleep(1);
-        }
-        if (k >= IXGBE_MAX_RX_DESC_POLL) {
-                e_err(drv, "RXDCTL.ENABLE on Rx queue %d not set within "
-                      "the polling period\n", rxr);
-        }
-        ixgbe_release_rx_desc(&adapter->hw, adapter->rx_ring[rxr],
-                              (adapter->rx_ring[rxr]->count - 1));
-}
-
-static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
+static void ixgbe_setup_gpie(struct ixgbe_adapter *adapter)
 {
-        struct net_device *netdev = adapter->netdev;
         struct ixgbe_hw *hw = &adapter->hw;
-        int i, j = 0;
-        int num_rx_rings = adapter->num_rx_queues;
-        int err;
-        int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
-        u32 txdctl, rxdctl, mhadd;
-        u32 dmatxctl;
-        u32 gpie;
-        u32 ctrl_ext;
-
-        ixgbe_get_hw_control(adapter);
-
-        if ((adapter->flags & IXGBE_FLAG_MSIX_ENABLED) ||
-            (adapter->flags & IXGBE_FLAG_MSI_ENABLED)) {
-                if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
-                        gpie = (IXGBE_GPIE_MSIX_MODE | IXGBE_GPIE_EIAME |
-                                IXGBE_GPIE_PBA_SUPPORT | IXGBE_GPIE_OCD);
-                } else {
-                        /* MSI only */
-                        gpie = 0;
-                }
-                if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
-                        gpie &= ~IXGBE_GPIE_VTMODE_MASK;
-                        gpie |= IXGBE_GPIE_VTMODE_64;
-                }
-                /* XXX: to interrupt immediately for EICS writes, enable this */
-                /* gpie |= IXGBE_GPIE_EIMEN; */
-                IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
-        }
+        u32 gpie = 0;
 
         if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                gpie = IXGBE_GPIE_MSIX_MODE | IXGBE_GPIE_PBA_SUPPORT |
+                       IXGBE_GPIE_OCD;
+                gpie |= IXGBE_GPIE_EIAME;
                 /*
                  * use EIAM to auto-mask when MSI-X interrupt is asserted
                  * this saves a register write for every interrupt
@@ -3376,98 +3504,33 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_EIAM, IXGBE_EICS_RTX_QUEUE);
         }
 
-        /* Enable Thermal over heat sensor interrupt */
-        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) {
-                gpie = IXGBE_READ_REG(hw, IXGBE_GPIE);
-                gpie |= IXGBE_SDP0_GPIEN;
-                IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
+        /* XXX: to interrupt immediately for EICS writes, enable this */
+        /* gpie |= IXGBE_GPIE_EIMEN; */
+
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                gpie &= ~IXGBE_GPIE_VTMODE_MASK;
+                gpie |= IXGBE_GPIE_VTMODE_64;
         }
 
-        /* Enable fan failure interrupt if media type is copper */
-        if (adapter->flags & IXGBE_FLAG_FAN_FAIL_CAPABLE) {
-                gpie = IXGBE_READ_REG(hw, IXGBE_GPIE);
+        /* Enable fan failure interrupt */
+        if (adapter->flags & IXGBE_FLAG_FAN_FAIL_CAPABLE)
                 gpie |= IXGBE_SDP1_GPIEN;
-                IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
-        }
 
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                gpie = IXGBE_READ_REG(hw, IXGBE_GPIE);
+        if (hw->mac.type == ixgbe_mac_82599EB)
                 gpie |= IXGBE_SDP1_GPIEN;
                 gpie |= IXGBE_SDP2_GPIEN;
-                IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
-        }
-
-#ifdef IXGBE_FCOE
-        /* adjust max frame to be able to do baby jumbo for FCoE */
-        if ((netdev->features & NETIF_F_FCOE_MTU) &&
-            (max_frame < IXGBE_FCOE_JUMBO_FRAME_SIZE))
-                max_frame = IXGBE_FCOE_JUMBO_FRAME_SIZE;
 
-#endif /* IXGBE_FCOE */
-        mhadd = IXGBE_READ_REG(hw, IXGBE_MHADD);
-        if (max_frame != (mhadd >> IXGBE_MHADD_MFS_SHIFT)) {
-                mhadd &= ~IXGBE_MHADD_MFS_MASK;
-                mhadd |= max_frame << IXGBE_MHADD_MFS_SHIFT;
-
-                IXGBE_WRITE_REG(hw, IXGBE_MHADD, mhadd);
-        }
-
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                j = adapter->tx_ring[i]->reg_idx;
-                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                if (adapter->rx_itr_setting == 0) {
-                        /* cannot set wthresh when itr==0 */
-                        txdctl &= ~0x007F0000;
-                } else {
-                        /* enable WTHRESH=8 descriptors, to encourage burst writeback */
-                        txdctl |= (8 << 16);
-                }
-                IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j), txdctl);
-        }
+        IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
+}
 
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                /* DMATXCTL.EN must be set after all Tx queue config is done */
-                dmatxctl = IXGBE_READ_REG(hw, IXGBE_DMATXCTL);
-                dmatxctl |= IXGBE_DMATXCTL_TE;
-                IXGBE_WRITE_REG(hw, IXGBE_DMATXCTL, dmatxctl);
-        }
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                j = adapter->tx_ring[i]->reg_idx;
-                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                txdctl |= IXGBE_TXDCTL_ENABLE;
-                IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j), txdctl);
-                if (hw->mac.type == ixgbe_mac_82599EB) {
-                        int wait_loop = 10;
-                        /* poll for Tx Enable ready */
-                        do {
-                                msleep(1);
-                                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                        } while (--wait_loop &&
-                                 !(txdctl & IXGBE_TXDCTL_ENABLE));
-                        if (!wait_loop)
-                                e_err(drv, "Could not enable Tx Queue %d\n", j);
-                }
-        }
+static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int err;
+        u32 ctrl_ext;
 
-        for (i = 0; i < num_rx_rings; i++) {
-                j = adapter->rx_ring[i]->reg_idx;
-                rxdctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(j));
-                /* enable PTHRESH=32 descriptors (half the internal cache)
-                 * and HTHRESH=0 descriptors (to minimize latency on fetch),
-                 * this also removes a pesky rx_no_buffer_count increment */
-                rxdctl |= 0x0020;
-                rxdctl |= IXGBE_RXDCTL_ENABLE;
-                IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(j), rxdctl);
-                if (hw->mac.type == ixgbe_mac_82599EB)
-                        ixgbe_rx_desc_queue_enable(adapter, i);
-        }
-        /* enable all receives */
-        rxdctl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                rxdctl |= (IXGBE_RXCTRL_DMBYPS | IXGBE_RXCTRL_RXEN);
-        else
-                rxdctl |= IXGBE_RXCTRL_RXEN;
-        hw->mac.ops.enable_rx_dma(hw, rxdctl);
+        ixgbe_get_hw_control(adapter);
+        ixgbe_setup_gpie(adapter);
 
         if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED)
                 ixgbe_configure_msix(adapter);
@@ -3483,7 +3546,6 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
 
         /* clear any pending interrupts, may auto mask */
         IXGBE_READ_REG(hw, IXGBE_EICR);
-
         ixgbe_irq_enable(adapter);
 
         /*
@@ -3525,12 +3587,8 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
                         e_err(probe, "link_config FAILED %d\n", err);
         }
 
-        for (i = 0; i < adapter->num_tx_queues; i++)
-                set_bit(__IXGBE_FDIR_INIT_DONE,
-                        &(adapter->tx_ring[i]->reinit_state));
-
         /* enable transmits */
-        netif_tx_start_all_queues(netdev);
+        netif_tx_start_all_queues(adapter->netdev);
 
         /* bring the link up in the watchdog, this could race with our first
          * link up interrupt but shouldn't be a problem */
@@ -3609,21 +3667,24 @@ void ixgbe_reset(struct ixgbe_adapter *adapter)
  * @rx_ring: ring to free buffers from
  **/
 static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *rx_ring)
+                                struct ixgbe_ring *rx_ring)
 {
         struct pci_dev *pdev = adapter->pdev;
         unsigned long size;
         unsigned int i;
 
-        /* Free all the Rx ring sk_buffs */
+        /* ring already cleared, nothing to do */
+        if (!rx_ring->rx_buffer_info)
+                return;
 
+        /* Free all the Rx ring sk_buffs */
         for (i = 0; i < rx_ring->count; i++) {
                 struct ixgbe_rx_buffer *rx_buffer_info;
 
                 rx_buffer_info = &rx_ring->rx_buffer_info[i];
                 if (rx_buffer_info->dma) {
                         dma_unmap_single(&pdev->dev, rx_buffer_info->dma,
-                                         rx_ring->rx_buf_len,
+                                         rx_ring->rx_buf_len,
                                          DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
                 }
@@ -3635,7 +3696,7 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                                 if (IXGBE_RSC_CB(this)->delay_unmap) {
                                         dma_unmap_single(&pdev->dev,
                                                          IXGBE_RSC_CB(this)->dma,
-                                                         rx_ring->rx_buf_len,
+                                                         rx_ring->rx_buf_len,
                                                          DMA_FROM_DEVICE);
                                         IXGBE_RSC_CB(this)->dma = 0;
                                         IXGBE_RSC_CB(skb)->delay_unmap = false;
@@ -3677,14 +3738,17 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
  * @tx_ring: ring to be cleaned
  **/
 static void ixgbe_clean_tx_ring(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *tx_ring)
+                                struct ixgbe_ring *tx_ring)
 {
         struct ixgbe_tx_buffer *tx_buffer_info;
         unsigned long size;
         unsigned int i;
 
-        /* Free all the Tx ring sk_buffs */
+        /* ring already cleared, nothing to do */
+        if (!tx_ring->tx_buffer_info)
+                return;
 
+        /* Free all the Tx ring sk_buffs */
         for (i = 0; i < tx_ring->count; i++) {
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
                 ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
@@ -3786,13 +3850,13 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
                 j = adapter->tx_ring[i]->reg_idx;
                 txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
                 IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j),
-                                (txdctl & ~IXGBE_TXDCTL_ENABLE));
+                                (txdctl & ~IXGBE_TXDCTL_ENABLE));
         }
         /* Disable the Tx DMA engine on 82599 */
         if (hw->mac.type == ixgbe_mac_82599EB)
                 IXGBE_WRITE_REG(hw, IXGBE_DMATXCTL,
-                                (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
-                                 ~IXGBE_DMATXCTL_TE));
+                                (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
+                                 ~IXGBE_DMATXCTL_TE));
 
         /* power down the optics */
         if (hw->phy.multispeed_fiber)
@@ -3822,7 +3886,7 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
 static int ixgbe_poll(struct napi_struct *napi, int budget)
 {
         struct ixgbe_q_vector *q_vector =
-                                container_of(napi, struct ixgbe_q_vector, napi);
+                                container_of(napi, struct ixgbe_q_vector, napi);
         struct ixgbe_adapter *adapter = q_vector->adapter;
         int tx_clean_complete, work_done = 0;
 
@@ -3932,7 +3996,7 @@ static inline bool ixgbe_set_rss_queues(struct ixgbe_adapter *adapter)
  * Rx load across CPUs using RSS.
  *
  **/
-static bool inline ixgbe_set_fdir_queues(struct ixgbe_adapter *adapter)
+static inline bool ixgbe_set_fdir_queues(struct ixgbe_adapter *adapter)
 {
         bool ret = false;
         struct ixgbe_ring_feature *f_fdir = &adapter->ring_feature[RING_F_FDIR];
@@ -4061,7 +4125,7 @@ done:
 }
 
 static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
-                                       int vectors)
+                                       int vectors)
 {
         int err, vector_threshold;
 
@@ -4080,7 +4144,7 @@ static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
          */
         while (vectors >= vector_threshold) {
                 err = pci_enable_msix(adapter->pdev, adapter->msix_entries,
-                                      vectors);
+                                      vectors);
                 if (!err) /* Success in acquiring all requested vectors. */
                         break;
                 else if (err < 0)
@@ -4107,7 +4171,7 @@ static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
                  * vectors we were allocated.
                  */
                 adapter->num_msix_vectors = min(vectors,
-                                   adapter->max_msix_q_vectors + NON_Q_VECTORS);
+                                   adapter->max_msix_q_vectors + NON_Q_VECTORS);
         }
 }
 
@@ -4178,12 +4242,12 @@ static inline bool ixgbe_cache_ring_dcb(struct ixgbe_adapter *adapter)
                                 }
                                 for ( ; i < 5; i++) {
                                         adapter->tx_ring[i]->reg_idx =
-                                                                 ((i + 2) << 4);
+                                                                 ((i + 2) << 4);
                                         adapter->rx_ring[i]->reg_idx = i << 4;
                                 }
                                 for ( ; i < dcb_i; i++) {
                                         adapter->tx_ring[i]->reg_idx =
-                                                                 ((i + 8) << 3);
+                                                                 ((i + 8) << 3);
                                         adapter->rx_ring[i]->reg_idx = i << 4;
                                 }
 
@@ -4226,7 +4290,7 @@ static inline bool ixgbe_cache_ring_dcb(struct ixgbe_adapter *adapter)
  * Cache the descriptor ring offsets for Flow Director to the assigned rings.
  *
  **/
-static bool inline ixgbe_cache_ring_fdir(struct ixgbe_adapter *adapter)
+static inline bool ixgbe_cache_ring_fdir(struct ixgbe_adapter *adapter)
 {
         int i;
         bool ret = false;
@@ -4383,7 +4447,7 @@ static int ixgbe_alloc_queues(struct ixgbe_adapter *adapter)
                         adapter->node = cur_node;
                 }
                 ring = kzalloc_node(sizeof(struct ixgbe_ring), GFP_KERNEL,
-                                    adapter->node);
+                                    adapter->node);
                 if (!ring)
                         ring = kzalloc(sizeof(struct ixgbe_ring), GFP_KERNEL);
                 if (!ring)
@@ -4407,7 +4471,7 @@ static int ixgbe_alloc_queues(struct ixgbe_adapter *adapter)
                         adapter->node = cur_node;
                 }
                 ring = kzalloc_node(sizeof(struct ixgbe_ring), GFP_KERNEL,
-                                    adapter->node);
+                                    adapter->node);
                 if (!ring)
                         ring = kzalloc(sizeof(struct ixgbe_ring), GFP_KERNEL);
                 if (!ring)
@@ -4453,7 +4517,7 @@ static int ixgbe_set_interrupt_capability(struct ixgbe_adapter *adapter)
          * (roughly) the same number of vectors as there are CPU's.
          */
         v_budget = min(adapter->num_rx_queues + adapter->num_tx_queues,
-                       (int)num_online_cpus()) + NON_Q_VECTORS;
+                       (int)num_online_cpus()) + NON_Q_VECTORS;
 
         /*
          * At the same time, hardware can only support a maximum of
@@ -4467,7 +4531,7 @@ static int ixgbe_set_interrupt_capability(struct ixgbe_adapter *adapter)
         /* A failure in MSI-X entry allocation isn't fatal, but it does
          * mean we disable MSI-X capabilities of the adapter. */
         adapter->msix_entries = kcalloc(v_budget,
-                                        sizeof(struct msix_entry), GFP_KERNEL);
+                                        sizeof(struct msix_entry), GFP_KERNEL);
         if (adapter->msix_entries) {
                 for (vector = 0; vector < v_budget; vector++)
                         adapter->msix_entries[vector].entry = vector;
@@ -4529,10 +4593,10 @@ static int ixgbe_alloc_q_vectors(struct ixgbe_adapter *adapter)
 
         for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
                 q_vector = kzalloc_node(sizeof(struct ixgbe_q_vector),
-                                        GFP_KERNEL, adapter->node);
+                                        GFP_KERNEL, adapter->node);
                 if (!q_vector)
                         q_vector = kzalloc(sizeof(struct ixgbe_q_vector),
-                                           GFP_KERNEL);
+                                           GFP_KERNEL);
                 if (!q_vector)
                         goto err_out;
                 q_vector->adapter = adapter;
@@ -4693,8 +4757,8 @@ static void ixgbe_sfp_timer(unsigned long data)
 static void ixgbe_sfp_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     sfp_task);
+                                                     struct ixgbe_adapter,
+                                                     sfp_task);
         struct ixgbe_hw *hw = &adapter->hw;
 
         if ((hw->phy.type == ixgbe_phy_nl) &&
@@ -4719,7 +4783,7 @@ static void ixgbe_sfp_task(struct work_struct *work)
 reschedule:
         if (test_bit(__IXGBE_SFP_MODULE_NOT_FOUND, &adapter->state))
                 mod_timer(&adapter->sfp_timer,
-                          round_jiffies(jiffies + (2 * HZ)));
+                          round_jiffies(jiffies + (2 * HZ)));
 }
 
 /**
@@ -4775,7 +4839,7 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                         adapter->atr_sample_rate = 20;
                 }
                 adapter->ring_feature[RING_F_FDIR].indices =
-                                                         IXGBE_MAX_FDIR_INDICES;
+                                                         IXGBE_MAX_FDIR_INDICES;
                 adapter->fdir_pballoc = 0;
 #ifdef IXGBE_FCOE
                 adapter->flags |= IXGBE_FLAG_FCOE_CAPABLE;
@@ -4806,7 +4870,7 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
         adapter->dcb_cfg.round_robin_enable = false;
         adapter->dcb_set_bitmap = 0x00;
         ixgbe_copy_dcb_cfg(&adapter->dcb_cfg, &adapter->temp_dcb_cfg,
-                           adapter->ring_feature[RING_F_DCB].indices);
+                           adapter->ring_feature[RING_F_DCB].indices);
 
 #endif
 
@@ -4861,7 +4925,7 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
  * Return 0 on success, negative on failure
  **/
 int ixgbe_setup_tx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *tx_ring)
+                             struct ixgbe_ring *tx_ring)
 {
         struct pci_dev *pdev = adapter->pdev;
         int size;
@@ -4928,7 +4992,7 @@ static int ixgbe_setup_all_tx_resources(struct ixgbe_adapter *adapter)
  * Returns 0 on success, negative on failure
  **/
 int ixgbe_setup_rx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *rx_ring)
+                             struct ixgbe_ring *rx_ring)
 {
         struct pci_dev *pdev = adapter->pdev;
         int size;
@@ -5001,7 +5065,7 @@ static int ixgbe_setup_all_rx_resources(struct ixgbe_adapter *adapter)
  * Free all transmit software resources
  **/
 void ixgbe_free_tx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *tx_ring)
+                             struct ixgbe_ring *tx_ring)
 {
         struct pci_dev *pdev = adapter->pdev;
 
@@ -5039,7 +5103,7 @@ static void ixgbe_free_all_tx_resources(struct ixgbe_adapter *adapter)
  * Free all receive software resources
  **/
 void ixgbe_free_rx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *rx_ring)
+                             struct ixgbe_ring *rx_ring)
 {
         struct pci_dev *pdev = adapter->pdev;
 
@@ -5333,6 +5397,7 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
         u64 total_mpc = 0;
         u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
         u64 non_eop_descs = 0, restart_queue = 0;
+        struct ixgbe_hw_stats *hwstats = &adapter->stats;
 
         if (test_bit(__IXGBE_DOWN, &adapter->state) ||
             test_bit(__IXGBE_RESETTING, &adapter->state))
@@ -5343,7 +5408,7 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
                 u64 rsc_flush = 0;
                 for (i = 0; i < 16; i++)
                         adapter->hw_rx_no_dma_resources +=
-                                             IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
+                                IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         rsc_count += adapter->rx_ring[i]->rsc_count;
                         rsc_flush += adapter->rx_ring[i]->rsc_flush;
@@ -5361,119 +5426,118 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
                 non_eop_descs += adapter->rx_ring[i]->non_eop_descs;
         adapter->non_eop_descs = non_eop_descs;
 
-        adapter->stats.crcerrs += IXGBE_READ_REG(hw, IXGBE_CRCERRS);
+        hwstats->crcerrs += IXGBE_READ_REG(hw, IXGBE_CRCERRS);
         for (i = 0; i < 8; i++) {
                 /* for packet buffers not used, the register should read 0 */
                 mpc = IXGBE_READ_REG(hw, IXGBE_MPC(i));
                 missed_rx += mpc;
-                adapter->stats.mpc[i] += mpc;
-                total_mpc += adapter->stats.mpc[i];
+                hwstats->mpc[i] += mpc;
+                total_mpc += hwstats->mpc[i];
                 if (hw->mac.type == ixgbe_mac_82598EB)
-                        adapter->stats.rnbc[i] += IXGBE_READ_REG(hw, IXGBE_RNBC(i));
-                adapter->stats.qptc[i] += IXGBE_READ_REG(hw, IXGBE_QPTC(i));
-                adapter->stats.qbtc[i] += IXGBE_READ_REG(hw, IXGBE_QBTC(i));
-                adapter->stats.qprc[i] += IXGBE_READ_REG(hw, IXGBE_QPRC(i));
-                adapter->stats.qbrc[i] += IXGBE_READ_REG(hw, IXGBE_QBRC(i));
+                        hwstats->rnbc[i] += IXGBE_READ_REG(hw, IXGBE_RNBC(i));
+                hwstats->qptc[i] += IXGBE_READ_REG(hw, IXGBE_QPTC(i));
+                hwstats->qbtc[i] += IXGBE_READ_REG(hw, IXGBE_QBTC(i));
+                hwstats->qprc[i] += IXGBE_READ_REG(hw, IXGBE_QPRC(i));
+                hwstats->qbrc[i] += IXGBE_READ_REG(hw, IXGBE_QBRC(i));
                 if (hw->mac.type == ixgbe_mac_82599EB) {
-                        adapter->stats.pxonrxc[i] += IXGBE_READ_REG(hw,
-                                                            IXGBE_PXONRXCNT(i));
-                        adapter->stats.pxoffrxc[i] += IXGBE_READ_REG(hw,
-                                                           IXGBE_PXOFFRXCNT(i));
-                        adapter->stats.qprdc[i] += IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
+                        hwstats->pxonrxc[i] +=
+                                IXGBE_READ_REG(hw, IXGBE_PXONRXCNT(i));
+                        hwstats->pxoffrxc[i] +=
+                                IXGBE_READ_REG(hw, IXGBE_PXOFFRXCNT(i));
+                        hwstats->qprdc[i] += IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
                 } else {
-                        adapter->stats.pxonrxc[i] += IXGBE_READ_REG(hw,
-                                                              IXGBE_PXONRXC(i));
-                        adapter->stats.pxoffrxc[i] += IXGBE_READ_REG(hw,
-                                                             IXGBE_PXOFFRXC(i));
+                        hwstats->pxonrxc[i] +=
+                                IXGBE_READ_REG(hw, IXGBE_PXONRXC(i));
+                        hwstats->pxoffrxc[i] +=
+                                IXGBE_READ_REG(hw, IXGBE_PXOFFRXC(i));
                 }
-                adapter->stats.pxontxc[i] += IXGBE_READ_REG(hw,
-                                                            IXGBE_PXONTXC(i));
-                adapter->stats.pxofftxc[i] += IXGBE_READ_REG(hw,
-                                                             IXGBE_PXOFFTXC(i));
+                hwstats->pxontxc[i] += IXGBE_READ_REG(hw, IXGBE_PXONTXC(i));
+                hwstats->pxofftxc[i] += IXGBE_READ_REG(hw, IXGBE_PXOFFTXC(i));
         }
-        adapter->stats.gprc += IXGBE_READ_REG(hw, IXGBE_GPRC);
+        hwstats->gprc += IXGBE_READ_REG(hw, IXGBE_GPRC);
         /* work around hardware counting issue */
-        adapter->stats.gprc -= missed_rx;
+        hwstats->gprc -= missed_rx;
 
         /* 82598 hardware only has a 32 bit counter in the high register */
         if (hw->mac.type == ixgbe_mac_82599EB) {
                 u64 tmp;
-                adapter->stats.gorc += IXGBE_READ_REG(hw, IXGBE_GORCL);
-                tmp = IXGBE_READ_REG(hw, IXGBE_GORCH) & 0xF; /* 4 high bits of GORC */
-                adapter->stats.gorc += (tmp << 32);
-                adapter->stats.gotc += IXGBE_READ_REG(hw, IXGBE_GOTCL);
-                tmp = IXGBE_READ_REG(hw, IXGBE_GOTCH) & 0xF; /* 4 high bits of GOTC */
-                adapter->stats.gotc += (tmp << 32);
-                adapter->stats.tor += IXGBE_READ_REG(hw, IXGBE_TORL);
-                IXGBE_READ_REG(hw, IXGBE_TORH); /* to clear */
-                adapter->stats.lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXCNT);
-                adapter->stats.lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXCNT);
-                adapter->stats.fdirmatch += IXGBE_READ_REG(hw, IXGBE_FDIRMATCH);
-                adapter->stats.fdirmiss += IXGBE_READ_REG(hw, IXGBE_FDIRMISS);
+                hwstats->gorc += IXGBE_READ_REG(hw, IXGBE_GORCL);
+                tmp = IXGBE_READ_REG(hw, IXGBE_GORCH) & 0xF;
+                                                /* 4 high bits of GORC */
+                hwstats->gorc += (tmp << 32);
+                hwstats->gotc += IXGBE_READ_REG(hw, IXGBE_GOTCL);
+                tmp = IXGBE_READ_REG(hw, IXGBE_GOTCH) & 0xF;
+                                                /* 4 high bits of GOTC */
+                hwstats->gotc += (tmp << 32);
+                hwstats->tor += IXGBE_READ_REG(hw, IXGBE_TORL);
+                IXGBE_READ_REG(hw, IXGBE_TORH); /* to clear */
+                hwstats->lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXCNT);
+                hwstats->lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXCNT);
+                hwstats->fdirmatch += IXGBE_READ_REG(hw, IXGBE_FDIRMATCH);
+                hwstats->fdirmiss += IXGBE_READ_REG(hw, IXGBE_FDIRMISS);
 #ifdef IXGBE_FCOE
-                adapter->stats.fccrc += IXGBE_READ_REG(hw, IXGBE_FCCRC);
-                adapter->stats.fcoerpdc += IXGBE_READ_REG(hw, IXGBE_FCOERPDC);
-                adapter->stats.fcoeprc += IXGBE_READ_REG(hw, IXGBE_FCOEPRC);
-                adapter->stats.fcoeptc += IXGBE_READ_REG(hw, IXGBE_FCOEPTC);
-                adapter->stats.fcoedwrc += IXGBE_READ_REG(hw, IXGBE_FCOEDWRC);
-                adapter->stats.fcoedwtc += IXGBE_READ_REG(hw, IXGBE_FCOEDWTC);
+                hwstats->fccrc += IXGBE_READ_REG(hw, IXGBE_FCCRC);
+                hwstats->fcoerpdc += IXGBE_READ_REG(hw, IXGBE_FCOERPDC);
+                hwstats->fcoeprc += IXGBE_READ_REG(hw, IXGBE_FCOEPRC);
+                hwstats->fcoeptc += IXGBE_READ_REG(hw, IXGBE_FCOEPTC);
+                hwstats->fcoedwrc += IXGBE_READ_REG(hw, IXGBE_FCOEDWRC);
+                hwstats->fcoedwtc += IXGBE_READ_REG(hw, IXGBE_FCOEDWTC);
 #endif /* IXGBE_FCOE */
         } else {
-                adapter->stats.lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXC);
-                adapter->stats.lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXC);
-                adapter->stats.gorc += IXGBE_READ_REG(hw, IXGBE_GORCH);
-                adapter->stats.gotc += IXGBE_READ_REG(hw, IXGBE_GOTCH);
-                adapter->stats.tor += IXGBE_READ_REG(hw, IXGBE_TORH);
+                hwstats->lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXC);
+                hwstats->lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXC);
+                hwstats->gorc += IXGBE_READ_REG(hw, IXGBE_GORCH);
+                hwstats->gotc += IXGBE_READ_REG(hw, IXGBE_GOTCH);
+                hwstats->tor += IXGBE_READ_REG(hw, IXGBE_TORH);
         }
         bprc = IXGBE_READ_REG(hw, IXGBE_BPRC);
-        adapter->stats.bprc += bprc;
-        adapter->stats.mprc += IXGBE_READ_REG(hw, IXGBE_MPRC);
+        hwstats->bprc += bprc;
+        hwstats->mprc += IXGBE_READ_REG(hw, IXGBE_MPRC);
         if (hw->mac.type == ixgbe_mac_82598EB)
-                adapter->stats.mprc -= bprc;
-        adapter->stats.roc += IXGBE_READ_REG(hw, IXGBE_ROC);
-        adapter->stats.prc64 += IXGBE_READ_REG(hw, IXGBE_PRC64);
-        adapter->stats.prc127 += IXGBE_READ_REG(hw, IXGBE_PRC127);
-        adapter->stats.prc255 += IXGBE_READ_REG(hw, IXGBE_PRC255);
-        adapter->stats.prc511 += IXGBE_READ_REG(hw, IXGBE_PRC511);
-        adapter->stats.prc1023 += IXGBE_READ_REG(hw, IXGBE_PRC1023);
-        adapter->stats.prc1522 += IXGBE_READ_REG(hw, IXGBE_PRC1522);
-        adapter->stats.rlec += IXGBE_READ_REG(hw, IXGBE_RLEC);
+                hwstats->mprc -= bprc;
+        hwstats->roc += IXGBE_READ_REG(hw, IXGBE_ROC);
+        hwstats->prc64 += IXGBE_READ_REG(hw, IXGBE_PRC64);
+        hwstats->prc127 += IXGBE_READ_REG(hw, IXGBE_PRC127);
+        hwstats->prc255 += IXGBE_READ_REG(hw, IXGBE_PRC255);
+        hwstats->prc511 += IXGBE_READ_REG(hw, IXGBE_PRC511);
+        hwstats->prc1023 += IXGBE_READ_REG(hw, IXGBE_PRC1023);
+        hwstats->prc1522 += IXGBE_READ_REG(hw, IXGBE_PRC1522);
+        hwstats->rlec += IXGBE_READ_REG(hw, IXGBE_RLEC);
         lxon = IXGBE_READ_REG(hw, IXGBE_LXONTXC);
-        adapter->stats.lxontxc += lxon;
+        hwstats->lxontxc += lxon;
         lxoff = IXGBE_READ_REG(hw, IXGBE_LXOFFTXC);
-        adapter->stats.lxofftxc += lxoff;
-        adapter->stats.ruc += IXGBE_READ_REG(hw, IXGBE_RUC);
-        adapter->stats.gptc += IXGBE_READ_REG(hw, IXGBE_GPTC);
-        adapter->stats.mptc += IXGBE_READ_REG(hw, IXGBE_MPTC);
+        hwstats->lxofftxc += lxoff;
+        hwstats->ruc += IXGBE_READ_REG(hw, IXGBE_RUC);
+        hwstats->gptc += IXGBE_READ_REG(hw, IXGBE_GPTC);
+        hwstats->mptc += IXGBE_READ_REG(hw, IXGBE_MPTC);
         /*
          * 82598 errata - tx of flow control packets is included in tx counters
          */
         xon_off_tot = lxon + lxoff;
-        adapter->stats.gptc -= xon_off_tot;
-        adapter->stats.mptc -= xon_off_tot;
-        adapter->stats.gotc -= (xon_off_tot * (ETH_ZLEN + ETH_FCS_LEN));
-        adapter->stats.ruc += IXGBE_READ_REG(hw, IXGBE_RUC);
-        adapter->stats.rfc += IXGBE_READ_REG(hw, IXGBE_RFC);
-        adapter->stats.rjc += IXGBE_READ_REG(hw, IXGBE_RJC);
-        adapter->stats.tpr += IXGBE_READ_REG(hw, IXGBE_TPR);
-        adapter->stats.ptc64 += IXGBE_READ_REG(hw, IXGBE_PTC64);
-        adapter->stats.ptc64 -= xon_off_tot;
-        adapter->stats.ptc127 += IXGBE_READ_REG(hw, IXGBE_PTC127);
-        adapter->stats.ptc255 += IXGBE_READ_REG(hw, IXGBE_PTC255);
-        adapter->stats.ptc511 += IXGBE_READ_REG(hw, IXGBE_PTC511);
-        adapter->stats.ptc1023 += IXGBE_READ_REG(hw, IXGBE_PTC1023);
-        adapter->stats.ptc1522 += IXGBE_READ_REG(hw, IXGBE_PTC1522);
-        adapter->stats.bptc += IXGBE_READ_REG(hw, IXGBE_BPTC);
+        hwstats->gptc -= xon_off_tot;
+        hwstats->mptc -= xon_off_tot;
+        hwstats->gotc -= (xon_off_tot * (ETH_ZLEN + ETH_FCS_LEN));
+        hwstats->ruc += IXGBE_READ_REG(hw, IXGBE_RUC);
+        hwstats->rfc += IXGBE_READ_REG(hw, IXGBE_RFC);
+        hwstats->rjc += IXGBE_READ_REG(hw, IXGBE_RJC);
+        hwstats->tpr += IXGBE_READ_REG(hw, IXGBE_TPR);
+        hwstats->ptc64 += IXGBE_READ_REG(hw, IXGBE_PTC64);
+        hwstats->ptc64 -= xon_off_tot;
+        hwstats->ptc127 += IXGBE_READ_REG(hw, IXGBE_PTC127);
+        hwstats->ptc255 += IXGBE_READ_REG(hw, IXGBE_PTC255);
+        hwstats->ptc511 += IXGBE_READ_REG(hw, IXGBE_PTC511);
+        hwstats->ptc1023 += IXGBE_READ_REG(hw, IXGBE_PTC1023);
+        hwstats->ptc1522 += IXGBE_READ_REG(hw, IXGBE_PTC1522);
+        hwstats->bptc += IXGBE_READ_REG(hw, IXGBE_BPTC);
 
         /* Fill out the OS statistics structure */
-        netdev->stats.multicast = adapter->stats.mprc;
+        netdev->stats.multicast = hwstats->mprc;
 
         /* Rx Errors */
-        netdev->stats.rx_errors = adapter->stats.crcerrs +
-                                       adapter->stats.rlec;
+        netdev->stats.rx_errors = hwstats->crcerrs + hwstats->rlec;
         netdev->stats.rx_dropped = 0;
-        netdev->stats.rx_length_errors = adapter->stats.rlec;
-        netdev->stats.rx_crc_errors = adapter->stats.crcerrs;
+        netdev->stats.rx_length_errors = hwstats->rlec;
+        netdev->stats.rx_crc_errors = hwstats->crcerrs;
         netdev->stats.rx_missed_errors = total_mpc;
 }
 
@@ -5532,8 +5596,8 @@ watchdog_short_circuit:
 static void ixgbe_multispeed_fiber_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     multispeed_fiber_task);
+                                                     struct ixgbe_adapter,
+                                                     multispeed_fiber_task);
         struct ixgbe_hw *hw = &adapter->hw;
         u32 autoneg;
         bool negotiation;
@@ -5556,8 +5620,8 @@ static void ixgbe_multispeed_fiber_task(struct work_struct *work)
 static void ixgbe_sfp_config_module_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     sfp_config_module_task);
+                                                     struct ixgbe_adapter,
+                                                     sfp_config_module_task);
         struct ixgbe_hw *hw = &adapter->hw;
         u32 err;
 
@@ -5590,15 +5654,15 @@ static void ixgbe_sfp_config_module_task(struct work_struct *work)
 static void ixgbe_fdir_reinit_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     fdir_reinit_task);
+                                                     struct ixgbe_adapter,
+                                                     fdir_reinit_task);
         struct ixgbe_hw *hw = &adapter->hw;
         int i;
 
         if (ixgbe_reinit_fdir_tables_82599(hw) == 0) {
                 for (i = 0; i < adapter->num_tx_queues; i++)
                         set_bit(__IXGBE_FDIR_INIT_DONE,
-                                &(adapter->tx_ring[i]->reinit_state));
+                                &(adapter->tx_ring[i]->reinit_state));
         } else {
                 e_err(probe, "failed to finish FDIR re-initialization, "
                       "ignored adding FDIR ATR filters\n");
@@ -5616,8 +5680,8 @@ static DEFINE_MUTEX(ixgbe_watchdog_lock);
 static void ixgbe_watchdog_task(struct work_struct *work)
 {
         struct ixgbe_adapter *adapter = container_of(work,
-                                                     struct ixgbe_adapter,
-                                                     watchdog_task);
+                                                     struct ixgbe_adapter,
+                                                     watchdog_task);
         struct net_device *netdev = adapter->netdev;
         struct ixgbe_hw *hw = &adapter->hw;
         u32 link_speed;
@@ -5648,7 +5712,7 @@ static void ixgbe_watchdog_task(struct work_struct *work)
 
                 if (link_up ||
                     time_after(jiffies, (adapter->link_check_timeout +
-                                         IXGBE_TRY_LINK_TIMEOUT))) {
+                                         IXGBE_TRY_LINK_TIMEOUT))) {
                         adapter->flags &= ~IXGBE_FLAG_NEED_LINK_UPDATE;
                         IXGBE_WRITE_REG(hw, IXGBE_EIMS, IXGBE_EIMC_LSC);
                 }
@@ -5719,8 +5783,8 @@ static void ixgbe_watchdog_task(struct work_struct *work)
 }
 
 static int ixgbe_tso(struct ixgbe_adapter *adapter,
-                     struct ixgbe_ring *tx_ring, struct sk_buff *skb,
-                     u32 tx_flags, u8 *hdr_len)
+                     struct ixgbe_ring *tx_ring, struct sk_buff *skb,
+                     u32 tx_flags, u8 *hdr_len)
 {
         struct ixgbe_adv_tx_context_desc *context_desc;
         unsigned int i;
@@ -5743,28 +5807,28 @@ static int ixgbe_tso(struct ixgbe_adapter *adapter,
                         iph->tot_len = 0;
                         iph->check = 0;
                         tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
-                                                                 iph->daddr, 0,
-                                                                 IPPROTO_TCP,
-                                                                 0);
+                                                                 iph->daddr, 0,
+                                                                 IPPROTO_TCP,
+                                                                 0);
                 } else if (skb_is_gso_v6(skb)) {
                         ipv6_hdr(skb)->payload_len = 0;
                         tcp_hdr(skb)->check =
                             ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
-                                             &ipv6_hdr(skb)->daddr,
-                                             0, IPPROTO_TCP, 0);
+                                             &ipv6_hdr(skb)->daddr,
+                                             0, IPPROTO_TCP, 0);
                 }
 
                 i = tx_ring->next_to_use;
 
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                context_desc = IXGBE_TX_CTXTDESC_ADV(*tx_ring, i);
+                context_desc = IXGBE_TX_CTXTDESC_ADV(tx_ring, i);
 
                 /* VLAN MACLEN IPLEN */
                 if (tx_flags & IXGBE_TX_FLAGS_VLAN)
                         vlan_macip_lens |=
                             (tx_flags & IXGBE_TX_FLAGS_VLAN_MASK);
                 vlan_macip_lens |= ((skb_network_offset(skb)) <<
-                                    IXGBE_ADVTXD_MACLEN_SHIFT);
+                                    IXGBE_ADVTXD_MACLEN_SHIFT);
                 *hdr_len += skb_network_offset(skb);
                 vlan_macip_lens |=
                     (skb_transport_header(skb) - skb_network_header(skb));
@@ -5775,7 +5839,7 @@ static int ixgbe_tso(struct ixgbe_adapter *adapter,
 
                 /* ADV DTYP TUCMD MKRLOC/ISCSIHEDLEN */
                 type_tucmd_mlhl = (IXGBE_TXD_CMD_DEXT |
-                                   IXGBE_ADVTXD_DTYP_CTXT);
+                                   IXGBE_ADVTXD_DTYP_CTXT);
 
                 if (skb->protocol == htons(ETH_P_IP))
                         type_tucmd_mlhl |= IXGBE_ADVTXD_TUCMD_IPV4;
@@ -5803,9 +5867,53 @@ static int ixgbe_tso(struct ixgbe_adapter *adapter,
         return false;
 }
 
+static u32 ixgbe_psum(struct ixgbe_adapter *adapter, struct sk_buff *skb)
+{
+        u32 rtn = 0;
+        __be16 protocol;
+
+        if (skb->protocol == cpu_to_be16(ETH_P_8021Q))
+                protocol = ((const struct vlan_ethhdr *)skb->data)->
+                                        h_vlan_encapsulated_proto;
+        else
+                protocol = skb->protocol;
+
+        switch (protocol) {
+        case cpu_to_be16(ETH_P_IP):
+                rtn |= IXGBE_ADVTXD_TUCMD_IPV4;
+                switch (ip_hdr(skb)->protocol) {
+                case IPPROTO_TCP:
+                        rtn |= IXGBE_ADVTXD_TUCMD_L4T_TCP;
+                        break;
+                case IPPROTO_SCTP:
+                        rtn |= IXGBE_ADVTXD_TUCMD_L4T_SCTP;
+                        break;
+                }
+                break;
+        case cpu_to_be16(ETH_P_IPV6):
+                /* XXX what about other V6 headers?? */
+                switch (ipv6_hdr(skb)->nexthdr) {
+                case IPPROTO_TCP:
+                        rtn |= IXGBE_ADVTXD_TUCMD_L4T_TCP;
+                        break;
+                case IPPROTO_SCTP:
+                        rtn |= IXGBE_ADVTXD_TUCMD_L4T_SCTP;
+                        break;
+                }
+                break;
+        default:
+                if (unlikely(net_ratelimit()))
+                        e_warn(probe, "partial checksum but proto=%x!\n",
+                               skb->protocol);
+                break;
+        }
+
+        return rtn;
+}
+
 static bool ixgbe_tx_csum(struct ixgbe_adapter *adapter,
-                          struct ixgbe_ring *tx_ring,
-                          struct sk_buff *skb, u32 tx_flags)
+                          struct ixgbe_ring *tx_ring,
+                          struct sk_buff *skb, u32 tx_flags)
 {
         struct ixgbe_adv_tx_context_desc *context_desc;
         unsigned int i;
@@ -5816,63 +5924,25 @@ static bool ixgbe_tx_csum(struct ixgbe_adapter *adapter,
             (tx_flags & IXGBE_TX_FLAGS_VLAN)) {
                 i = tx_ring->next_to_use;
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                context_desc = IXGBE_TX_CTXTDESC_ADV(*tx_ring, i);
+                context_desc = IXGBE_TX_CTXTDESC_ADV(tx_ring, i);
 
                 if (tx_flags & IXGBE_TX_FLAGS_VLAN)
                         vlan_macip_lens |=
                             (tx_flags & IXGBE_TX_FLAGS_VLAN_MASK);
                 vlan_macip_lens |= (skb_network_offset(skb) <<
-                                    IXGBE_ADVTXD_MACLEN_SHIFT);
+                                    IXGBE_ADVTXD_MACLEN_SHIFT);
                 if (skb->ip_summed == CHECKSUM_PARTIAL)
                         vlan_macip_lens |= (skb_transport_header(skb) -
-                                            skb_network_header(skb));
+                                            skb_network_header(skb));
 
                 context_desc->vlan_macip_lens = cpu_to_le32(vlan_macip_lens);
                 context_desc->seqnum_seed = 0;
 
                 type_tucmd_mlhl |= (IXGBE_TXD_CMD_DEXT |
-                                    IXGBE_ADVTXD_DTYP_CTXT);
-
-                if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        __be16 protocol;
-
-                        if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
-                                const struct vlan_ethhdr *vhdr =
-                                        (const struct vlan_ethhdr *)skb->data;
-
-                                protocol = vhdr->h_vlan_encapsulated_proto;
-                        } else {
-                                protocol = skb->protocol;
-                        }
+                                    IXGBE_ADVTXD_DTYP_CTXT);
 
-                        switch (protocol) {
-                        case cpu_to_be16(ETH_P_IP):
-                                type_tucmd_mlhl |= IXGBE_ADVTXD_TUCMD_IPV4;
-                                if (ip_hdr(skb)->protocol == IPPROTO_TCP)
-                                        type_tucmd_mlhl |=
-                                                IXGBE_ADVTXD_TUCMD_L4T_TCP;
-                                else if (ip_hdr(skb)->protocol == IPPROTO_SCTP)
-                                        type_tucmd_mlhl |=
-                                                IXGBE_ADVTXD_TUCMD_L4T_SCTP;
-                                break;
-                        case cpu_to_be16(ETH_P_IPV6):
-                                /* XXX what about other V6 headers?? */
-                                if (ipv6_hdr(skb)->nexthdr == IPPROTO_TCP)
-                                        type_tucmd_mlhl |=
-                                                IXGBE_ADVTXD_TUCMD_L4T_TCP;
-                                else if (ipv6_hdr(skb)->nexthdr == IPPROTO_SCTP)
-                                        type_tucmd_mlhl |=
-                                                IXGBE_ADVTXD_TUCMD_L4T_SCTP;
-                                break;
-                        default:
-                                if (unlikely(net_ratelimit())) {
-                                        e_warn(probe, "partial checksum "
-                                               "but proto=%x!\n",
-                                               skb->protocol);
-                                }
-                                break;
-                        }
-                }
+                if (skb->ip_summed == CHECKSUM_PARTIAL)
+                        type_tucmd_mlhl |= ixgbe_psum(adapter, skb);
 
                 context_desc->type_tucmd_mlhl = cpu_to_le32(type_tucmd_mlhl);
                 /* use index zero for tx checksum offload */
@@ -5893,9 +5963,9 @@ static bool ixgbe_tx_csum(struct ixgbe_adapter *adapter,
 }
 
 static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
-                        struct ixgbe_ring *tx_ring,
-                        struct sk_buff *skb, u32 tx_flags,
-                        unsigned int first)
+                        struct ixgbe_ring *tx_ring,
+                        struct sk_buff *skb, u32 tx_flags,
+                        unsigned int first)
 {
         struct pci_dev *pdev = adapter->pdev;
         struct ixgbe_tx_buffer *tx_buffer_info;
@@ -5990,7 +6060,7 @@ dma_error:
 
         /* clear timestamp and dma mappings for remaining portion of packet */
         while (count--) {
-                if (i==0)
+                if (i == 0)
                         i += tx_ring->count;
                 i--;
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
@@ -6001,8 +6071,8 @@ dma_error:
 }
 
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
-                           struct ixgbe_ring *tx_ring,
-                           int tx_flags, int count, u32 paylen, u8 hdr_len)
+                           struct ixgbe_ring *tx_ring,
+                           int tx_flags, int count, u32 paylen, u8 hdr_len)
 {
         union ixgbe_adv_tx_desc *tx_desc = NULL;
         struct ixgbe_tx_buffer *tx_buffer_info;
@@ -6021,17 +6091,17 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
                 cmd_type_len |= IXGBE_ADVTXD_DCMD_TSE;
 
                 olinfo_status |= IXGBE_TXD_POPTS_TXSM <<
-                                 IXGBE_ADVTXD_POPTS_SHIFT;
+                                 IXGBE_ADVTXD_POPTS_SHIFT;
 
                 /* use index 1 context for tso */
                 olinfo_status |= (1 << IXGBE_ADVTXD_IDX_SHIFT);
                 if (tx_flags & IXGBE_TX_FLAGS_IPV4)
                         olinfo_status |= IXGBE_TXD_POPTS_IXSM <<
-                                         IXGBE_ADVTXD_POPTS_SHIFT;
+                                         IXGBE_ADVTXD_POPTS_SHIFT;
 
         } else if (tx_flags & IXGBE_TX_FLAGS_CSUM)
                 olinfo_status |= IXGBE_TXD_POPTS_TXSM <<
-                                 IXGBE_ADVTXD_POPTS_SHIFT;
+                                 IXGBE_ADVTXD_POPTS_SHIFT;
 
         if (tx_flags & IXGBE_TX_FLAGS_FCOE) {
                 olinfo_status |= IXGBE_ADVTXD_CC;
@@ -6045,10 +6115,10 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
         i = tx_ring->next_to_use;
         while (count--) {
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+                tx_desc = IXGBE_TX_DESC_ADV(tx_ring, i);
                 tx_desc->read.buffer_addr = cpu_to_le64(tx_buffer_info->dma);
                 tx_desc->read.cmd_type_len =
-                        cpu_to_le32(cmd_type_len | tx_buffer_info->length);
+                        cpu_to_le32(cmd_type_len | tx_buffer_info->length);
                 tx_desc->read.olinfo_status = cpu_to_le32(olinfo_status);
                 i++;
                 if (i == tx_ring->count)
@@ -6070,7 +6140,7 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
 }
 
 static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
-                      int queue, u32 tx_flags)
+                      int queue, u32 tx_flags)
 {
         struct ixgbe_atr_input atr_input;
         struct tcphdr *th;
@@ -6098,7 +6168,7 @@ static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
         memset(&atr_input, 0, sizeof(struct ixgbe_atr_input));
 
         vlan_id = (tx_flags & IXGBE_TX_FLAGS_VLAN_MASK) >>
-                   IXGBE_TX_FLAGS_VLAN_SHIFT;
+                   IXGBE_TX_FLAGS_VLAN_SHIFT;
         src_ipv4_addr = iph->saddr;
         dst_ipv4_addr = iph->daddr;
         flex_bytes = eth->h_proto;
@@ -6117,7 +6187,7 @@ static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
 }
 
 static int __ixgbe_maybe_stop_tx(struct net_device *netdev,
-                                 struct ixgbe_ring *tx_ring, int size)
+                                 struct ixgbe_ring *tx_ring, int size)
 {
         netif_stop_subqueue(netdev, tx_ring->queue_index);
         /* Herbert's original patch had:
@@ -6137,7 +6207,7 @@ static int __ixgbe_maybe_stop_tx(struct net_device *netdev,
 }
 
 static int ixgbe_maybe_stop_tx(struct net_device *netdev,
-                              struct ixgbe_ring *tx_ring, int size)
+                              struct ixgbe_ring *tx_ring, int size)
 {
         if (likely(IXGBE_DESC_UNUSED(tx_ring) >= size))
                 return 0;
@@ -6183,11 +6253,10 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
         return skb_tx_hash(dev, skb);
 }
 
-static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
-                                    struct net_device *netdev)
+netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev,
+                          struct ixgbe_adapter *adapter,
+                          struct ixgbe_ring *tx_ring)
 {
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
-        struct ixgbe_ring *tx_ring;
         struct netdev_queue *txq;
         unsigned int first;
         unsigned int tx_flags = 0;
@@ -6211,8 +6280,6 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
                 tx_flags |= IXGBE_TX_FLAGS_VLAN;
         }
 
-        tx_ring = adapter->tx_ring[skb->queue_mapping];
-
 #ifdef IXGBE_FCOE
         /* for FCoE with DCB, we force the priority to what
          * was specified by the switch */
@@ -6283,10 +6350,10 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
                 if (tx_ring->atr_sample_rate) {
                         ++tx_ring->atr_count;
                         if ((tx_ring->atr_count >= tx_ring->atr_sample_rate) &&
-                             test_bit(__IXGBE_FDIR_INIT_DONE,
-                                      &tx_ring->reinit_state)) {
+                             test_bit(__IXGBE_FDIR_INIT_DONE,
+                                      &tx_ring->reinit_state)) {
                                 ixgbe_atr(adapter, skb, tx_ring->queue_index,
-                                          tx_flags);
+                                          tx_flags);
                                 tx_ring->atr_count = 0;
                         }
                 }
@@ -6294,7 +6361,7 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
                 txq->tx_bytes += skb->len;
                 txq->tx_packets++;
                 ixgbe_tx_queue(adapter, tx_ring, tx_flags, count, skb->len,
-                               hdr_len);
+                               hdr_len);
                 ixgbe_maybe_stop_tx(netdev, tx_ring, DESC_NEEDED);
 
         } else {
@@ -6306,6 +6373,15 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
         return NETDEV_TX_OK;
 }
 
+static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_ring *tx_ring;
+
+        tx_ring = adapter->tx_ring[skb->queue_mapping];
+        return ixgbe_xmit_frame_ring(skb, netdev, adapter, tx_ring);
+}
+
 /**
  * ixgbe_set_mac - Change the Ethernet Address of the NIC
  * @netdev: network interface device structure
@@ -6437,7 +6513,7 @@ static void ixgbe_netpoll(struct net_device *netdev)
 #endif
 
 static const struct net_device_ops ixgbe_netdev_ops = {
-        .ndo_open               = ixgbe_open,
+        .ndo_open               = ixgbe_open,
         .ndo_stop               = ixgbe_close,
         .ndo_start_xmit         = ixgbe_xmit_frame,
         .ndo_select_queue       = ixgbe_select_queue,
@@ -6532,7 +6608,7 @@ err_novfs:
  * and a hardware reset occur.
  **/
 static int __devinit ixgbe_probe(struct pci_dev *pdev,
-                                 const struct pci_device_id *ent)
+                                 const struct pci_device_id *ent)
 {
         struct net_device *netdev;
         struct ixgbe_adapter *adapter = NULL;
@@ -6577,7 +6653,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         }
 
         err = pci_request_selected_regions(pdev, pci_select_bars(pdev,
-                                           IORESOURCE_MEM), ixgbe_driver_name);
+                                           IORESOURCE_MEM), ixgbe_driver_name);
         if (err) {
                 dev_err(&pdev->dev,
                         "pci_request_selected_regions failed 0x%x\n", err);
@@ -6617,7 +6693,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         adapter->msg_enable = (1 << DEFAULT_DEBUG_LEVEL_SHIFT) - 1;
 
         hw->hw_addr = ioremap(pci_resource_start(pdev, 0),
-                              pci_resource_len(pdev, 0));
+                              pci_resource_len(pdev, 0));
         if (!hw->hw_addr) {
                 err = -EIO;
                 goto err_ioremap;
@@ -6661,7 +6737,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
          * which might start the timer
          */
         init_timer(&adapter->sfp_timer);
-        adapter->sfp_timer.function = &ixgbe_sfp_timer;
+        adapter->sfp_timer.function = ixgbe_sfp_timer;
         adapter->sfp_timer.data = (unsigned long) adapter;
 
         INIT_WORK(&adapter->sfp_task, ixgbe_sfp_task);
@@ -6671,7 +6747,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 
         /* a new SFP+ module arrival, called from GPI SDP2 context */
         INIT_WORK(&adapter->sfp_config_module_task,
-                  ixgbe_sfp_config_module_task);
+                  ixgbe_sfp_config_module_task);
 
         ii->get_invariants(hw);
 
@@ -6723,10 +6799,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         ixgbe_probe_vf(adapter, ii);
 
         netdev->features = NETIF_F_SG |
-                           NETIF_F_IP_CSUM |
-                           NETIF_F_HW_VLAN_TX |
-                           NETIF_F_HW_VLAN_RX |
-                           NETIF_F_HW_VLAN_FILTER;
+                           NETIF_F_IP_CSUM |
+                           NETIF_F_HW_VLAN_TX |
+                           NETIF_F_HW_VLAN_RX |
+                           NETIF_F_HW_VLAN_FILTER;
 
         netdev->features |= NETIF_F_IPV6_CSUM;
         netdev->features |= NETIF_F_TSO;
@@ -6766,8 +6842,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 netdev->vlan_features |= NETIF_F_FCOE_MTU;
         }
 #endif /* IXGBE_FCOE */
-        if (pci_using_dac)
+        if (pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                 netdev->features |= NETIF_F_LRO;
@@ -6793,7 +6871,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 hw->mac.ops.disable_tx_laser(hw);
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &ixgbe_watchdog;
+        adapter->watchdog_timer.function = ixgbe_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
 
         INIT_WORK(&adapter->reset_task, ixgbe_reset_task);
@@ -6806,7 +6884,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         switch (pdev->device) {
         case IXGBE_DEV_ID_82599_KX4:
                 adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
-                                IXGBE_WUFC_MC | IXGBE_WUFC_BC);
+                                IXGBE_WUFC_MC | IXGBE_WUFC_BC);
                 break;
         default:
                 adapter->wol = 0;
@@ -6819,13 +6897,14 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 
         /* print bus type/speed/width info */
         e_dev_info("(PCI Express:%s:%s) %pM\n",
-                ((hw->bus.speed == ixgbe_bus_speed_5000) ? "5.0Gb/s":
-                 (hw->bus.speed == ixgbe_bus_speed_2500) ? "2.5Gb/s":"Unknown"),
-                ((hw->bus.width == ixgbe_bus_width_pcie_x8) ? "Width x8" :
-                 (hw->bus.width == ixgbe_bus_width_pcie_x4) ? "Width x4" :
-                 (hw->bus.width == ixgbe_bus_width_pcie_x1) ? "Width x1" :
-                 "Unknown"),
-                netdev->dev_addr);
+                   (hw->bus.speed == ixgbe_bus_speed_5000 ? "5.0Gb/s" :
+                    hw->bus.speed == ixgbe_bus_speed_2500 ? "2.5Gb/s" :
+                    "Unknown"),
+                   (hw->bus.width == ixgbe_bus_width_pcie_x8 ? "Width x8" :
+                    hw->bus.width == ixgbe_bus_width_pcie_x4 ? "Width x4" :
+                    hw->bus.width == ixgbe_bus_width_pcie_x1 ? "Width x1" :
+                    "Unknown"),
+                   netdev->dev_addr);
         ixgbe_read_pba_num_generic(hw, &part_num);
         if (ixgbe_is_sfp(hw) && hw->phy.sfp_type != ixgbe_sfp_type_not_present)
                 e_dev_info("MAC: %d, PHY: %d, SFP+: %d, "
@@ -6872,7 +6951,8 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 INIT_WORK(&adapter->fdir_reinit_task, ixgbe_fdir_reinit_task);
 
         if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE)
-                INIT_WORK(&adapter->check_overtemp_task, ixgbe_check_overtemp_task);
+                INIT_WORK(&adapter->check_overtemp_task,
+                          ixgbe_check_overtemp_task);
 #ifdef CONFIG_IXGBE_DCA
         if (dca_add_requester(&pdev->dev) == 0) {
                 adapter->flags |= IXGBE_FLAG_DCA_ENABLED;
@@ -6908,8 +6988,8 @@ err_eeprom:
 err_ioremap:
         free_netdev(netdev);
 err_alloc_etherdev:
-        pci_release_selected_regions(pdev, pci_select_bars(pdev,
-                                     IORESOURCE_MEM));
+        pci_release_selected_regions(pdev,
+                                     pci_select_bars(pdev, IORESOURCE_MEM));
 err_pci_reg:
 err_dma:
         pci_disable_device(pdev);
@@ -6976,7 +7056,7 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
 
         iounmap(adapter->hw.hw_addr);
         pci_release_selected_regions(pdev, pci_select_bars(pdev,
-                                     IORESOURCE_MEM));
+                                     IORESOURCE_MEM));
 
         e_dev_info("complete\n");
 
@@ -6996,7 +7076,7 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
  * this device has been detected.
  */
 static pci_ers_result_t ixgbe_io_error_detected(struct pci_dev *pdev,
-                                                pci_channel_state_t state)
+                                                pci_channel_state_t state)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
@@ -7102,8 +7182,7 @@ static struct pci_driver ixgbe_driver = {
 static int __init ixgbe_init_module(void)
 {
         int ret;
-        pr_info("%s - version %s\n", ixgbe_driver_string,
-                   ixgbe_driver_version);
+        pr_info("%s - version %s\n", ixgbe_driver_string, ixgbe_driver_version);
         pr_info("%s\n", ixgbe_copyright);
 
 #ifdef CONFIG_IXGBE_DCA
@@ -7132,12 +7211,12 @@ static void __exit ixgbe_exit_module(void)
 
 #ifdef CONFIG_IXGBE_DCA
 static int ixgbe_notify_dca(struct notifier_block *nb, unsigned long event,
-                            void *p)
+                            void *p)
 {
         int ret_val;
 
         ret_val = driver_for_each_device(&ixgbe_driver.driver, NULL, &event,
-                                         __ixgbe_notify_dca);
+                                         __ixgbe_notify_dca);
 
         return ret_val ? NOTIFY_BAD : NOTIFY_DONE;
 }
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 9587d975d66c..d3cc6ce7c973 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -871,6 +871,8 @@
 #define IXGBE_RDRXCTL_MVMEN         0x00000020
 #define IXGBE_RDRXCTL_DMAIDONE      0x00000008 /* DMA init cycle done */
 #define IXGBE_RDRXCTL_AGGDIS        0x00010000 /* Aggregation disable */
+#define IXGBE_RDRXCTL_RSCACKC       0x02000000 /* must set 1 when RSC enabled */
+#define IXGBE_RDRXCTL_FCOE_WRFIX    0x04000000 /* must set 1 when RSC enabled */
 
 /* RQTC Bit Masks and Shifts */
 #define IXGBE_RQTC_SHIFT_TC(_i)     ((_i) * 4)
diff --git a/drivers/net/ixgbevf/ethtool.c b/drivers/net/ixgbevf/ethtool.c
index 4680b069b84f..4cc817acfb62 100644
--- a/drivers/net/ixgbevf/ethtool.c
+++ b/drivers/net/ixgbevf/ethtool.c
@@ -330,10 +330,8 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
 {
         struct ixgbevf_adapter *adapter = netdev_priv(netdev);
         struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL;
-        int i, err;
+        int i, err = 0;
         u32 new_rx_count, new_tx_count;
-        bool need_tx_update = false;
-        bool need_rx_update = false;
 
         if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
                 return -EINVAL;
@@ -355,89 +353,96 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state))
                 msleep(1);
 
-        if (new_tx_count != adapter->tx_ring_count) {
-                tx_ring = kcalloc(adapter->num_tx_queues,
-                                  sizeof(struct ixgbevf_ring), GFP_KERNEL);
-                if (!tx_ring) {
-                        err = -ENOMEM;
-                        goto err_setup;
-                }
-                memcpy(tx_ring, adapter->tx_ring,
-                       adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
-                for (i = 0; i < adapter->num_tx_queues; i++) {
-                        tx_ring[i].count = new_tx_count;
-                        err = ixgbevf_setup_tx_resources(adapter,
-                                                         &tx_ring[i]);
-                        if (err) {
-                                while (i) {
-                                        i--;
-                                        ixgbevf_free_tx_resources(adapter,
-                                                                  &tx_ring[i]);
-                                }
-                                kfree(tx_ring);
-                                goto err_setup;
-                        }
-                        tx_ring[i].v_idx = adapter->tx_ring[i].v_idx;
-                }
-                need_tx_update = true;
+        /*
+         * If the adapter isn't up and running then just set the
+         * new parameters and scurry for the exits.
+         */
+        if (!netif_running(adapter->netdev)) {
+                for (i = 0; i < adapter->num_tx_queues; i++)
+                        adapter->tx_ring[i].count = new_tx_count;
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        adapter->rx_ring[i].count = new_rx_count;
+                adapter->tx_ring_count = new_tx_count;
+                adapter->rx_ring_count = new_rx_count;
+                goto clear_reset;
         }
 
-        if (new_rx_count != adapter->rx_ring_count) {
-                rx_ring = kcalloc(adapter->num_rx_queues,
-                                  sizeof(struct ixgbevf_ring), GFP_KERNEL);
-                if ((!rx_ring) && (need_tx_update)) {
-                        err = -ENOMEM;
-                        goto err_rx_setup;
-                }
-                memcpy(rx_ring, adapter->rx_ring,
-                       adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
-                for (i = 0; i < adapter->num_rx_queues; i++) {
-                        rx_ring[i].count = new_rx_count;
-                        err = ixgbevf_setup_rx_resources(adapter,
-                                                         &rx_ring[i]);
-                        if (err) {
-                                while (i) {
-                                        i--;
-                                        ixgbevf_free_rx_resources(adapter,
-                                                                  &rx_ring[i]);
-                                }
-                                kfree(rx_ring);
-                                goto err_rx_setup;
-                        }
-                        rx_ring[i].v_idx = adapter->rx_ring[i].v_idx;
-                }
-                need_rx_update = true;
+        tx_ring = kcalloc(adapter->num_tx_queues,
+                          sizeof(struct ixgbevf_ring), GFP_KERNEL);
+        if (!tx_ring) {
+                err = -ENOMEM;
+                goto clear_reset;
         }
 
-err_rx_setup:
-        /* if rings need to be updated, here's the place to do it in one shot */
-        if (need_tx_update || need_rx_update) {
-                if (netif_running(netdev))
-                        ixgbevf_down(adapter);
+        rx_ring = kcalloc(adapter->num_rx_queues,
+                          sizeof(struct ixgbevf_ring), GFP_KERNEL);
+        if (!rx_ring) {
+                err = -ENOMEM;
+                goto err_rx_setup;
         }
 
-        /* tx */
-        if (need_tx_update) {
-                kfree(adapter->tx_ring);
-                adapter->tx_ring = tx_ring;
-                tx_ring = NULL;
-                adapter->tx_ring_count = new_tx_count;
+        ixgbevf_down(adapter);
+
+        memcpy(tx_ring, adapter->tx_ring,
+               adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                tx_ring[i].count = new_tx_count;
+                err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
+                if (err) {
+                        while (i) {
+                                i--;
+                                ixgbevf_free_tx_resources(adapter,
+                                                          &tx_ring[i]);
+                        }
+                        goto err_tx_ring_setup;
+                }
+                tx_ring[i].v_idx = adapter->tx_ring[i].v_idx;
         }
 
-        /* rx */
-        if (need_rx_update) {
-                kfree(adapter->rx_ring);
-                adapter->rx_ring = rx_ring;
-                rx_ring = NULL;
-                adapter->rx_ring_count = new_rx_count;
+        memcpy(rx_ring, adapter->rx_ring,
+               adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                rx_ring[i].count = new_rx_count;
+                err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
+                if (err) {
+                        while (i) {
+                                i--;
+                                ixgbevf_free_rx_resources(adapter,
+                                                          &rx_ring[i]);
+                        }
+                                goto err_rx_ring_setup;
+                }
+                rx_ring[i].v_idx = adapter->rx_ring[i].v_idx;
         }
 
+        /*
+         * Only switch to new rings if all the prior allocations
+         * and ring setups have succeeded.
+         */
+        kfree(adapter->tx_ring);
+        adapter->tx_ring = tx_ring;
+        adapter->tx_ring_count = new_tx_count;
+
+        kfree(adapter->rx_ring);
+        adapter->rx_ring = rx_ring;
+        adapter->rx_ring_count = new_rx_count;
+
         /* success! */
-        err = 0;
-        if (netif_running(netdev))
-                ixgbevf_up(adapter);
+        ixgbevf_up(adapter);
+
+        goto clear_reset;
+
+err_rx_ring_setup:
+        for(i = 0; i < adapter->num_tx_queues; i++)
+                ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
+
+err_tx_ring_setup:
+        kfree(rx_ring);
+
+err_rx_setup:
+        kfree(tx_ring);
 
-err_setup:
+clear_reset:
         clear_bit(__IXGBEVF_RESETTING, &adapter->state);
         return err;
 }
diff --git a/drivers/net/ixgbevf/ixgbevf.h b/drivers/net/ixgbevf/ixgbevf.h
index f7015efbff05..da4033c6efa2 100644
--- a/drivers/net/ixgbevf/ixgbevf.h
+++ b/drivers/net/ixgbevf/ixgbevf.h
@@ -243,7 +243,6 @@ struct ixgbevf_adapter {
         /* OS defined structs */
         struct net_device *netdev;
         struct pci_dev *pdev;
-        struct net_device_stats net_stats;
 
         /* structs defined in ixgbe_vf.h */
         struct ixgbe_hw hw;
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index 918c00359b0a..0866a1cf4d7b 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -308,10 +308,10 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
         tx_ring->total_bytes += total_bytes;
         tx_ring->total_packets += total_packets;
 
-        adapter->net_stats.tx_bytes += total_bytes;
-        adapter->net_stats.tx_packets += total_packets;
+        netdev->stats.tx_bytes += total_bytes;
+        netdev->stats.tx_packets += total_packets;
 
-        return (count < tx_ring->work_limit);
+        return count < tx_ring->work_limit;
 }
 
 /**
@@ -356,7 +356,7 @@ static void ixgbevf_receive_skb(struct ixgbevf_q_vector *q_vector,
 static inline void ixgbevf_rx_checksum(struct ixgbevf_adapter *adapter,
                                        u32 status_err, struct sk_buff *skb)
 {
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* Rx csum disabled */
         if (!(adapter->flags & IXGBE_FLAG_RX_CSUM_ENABLED))
@@ -639,8 +639,8 @@ next_desc:
 
         rx_ring->total_packets += total_rx_packets;
         rx_ring->total_bytes += total_rx_bytes;
-        adapter->net_stats.rx_bytes += total_rx_bytes;
-        adapter->net_stats.rx_packets += total_rx_packets;
+        adapter->netdev->stats.rx_bytes += total_rx_bytes;
+        adapter->netdev->stats.rx_packets += total_rx_packets;
 
         return cleaned;
 }
@@ -2297,7 +2297,7 @@ void ixgbevf_update_stats(struct ixgbevf_adapter *adapter)
                                 adapter->stats.vfmprc);
 
         /* Fill out the OS statistics structure */
-        adapter->net_stats.multicast = adapter->stats.vfmprc -
+        adapter->netdev->stats.multicast = adapter->stats.vfmprc -
                 adapter->stats.base_vfmprc;
 }
 
@@ -3181,21 +3181,6 @@ static int ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 }
 
 /**
- * ixgbevf_get_stats - Get System Network Statistics
- * @netdev: network interface device structure
- *
- * Returns the address of the device statistics structure.
- * The statistics are actually updated from the timer callback.
- **/
-static struct net_device_stats *ixgbevf_get_stats(struct net_device *netdev)
-{
-        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
-
-        /* only return the current stats */
-        return &adapter->net_stats;
-}
-
-/**
  * ixgbevf_set_mac - Change the Ethernet Address of the NIC
  * @netdev: network interface device structure
  * @p: pointer to an address structure
@@ -3272,7 +3257,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_open               = &ixgbevf_open,
         .ndo_stop               = &ixgbevf_close,
         .ndo_start_xmit         = &ixgbevf_xmit_frame,
-        .ndo_get_stats          = &ixgbevf_get_stats,
         .ndo_set_rx_mode        = &ixgbevf_set_rx_mode,
         .ndo_set_multicast_list = &ixgbevf_set_rx_mode,
         .ndo_validate_addr      = eth_validate_addr,
@@ -3426,7 +3410,7 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
         }
 
         init_timer(&adapter->watchdog_timer);
-        adapter->watchdog_timer.function = &ixgbevf_watchdog;
+        adapter->watchdog_timer.function = ixgbevf_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
 
         INIT_WORK(&adapter->reset_task, ixgbevf_reset_task);
diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
index 94b750b8874f..61f9dc831424 100644
--- a/drivers/net/ixgbevf/vf.h
+++ b/drivers/net/ixgbevf/vf.h
@@ -124,8 +124,6 @@ struct ixgbe_hw {
         void *back;
 
         u8 __iomem *hw_addr;
-        u8 *flash_address;
-        unsigned long io_base;
 
         struct ixgbe_mac_info mac;
         struct ixgbe_mbx_info mbx;
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 99f24f5cac53..c04c096bc6a9 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -21,6 +21,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
@@ -73,7 +75,7 @@ read_again:
         }
 
         if (i == 0) {
-                jeprintk(jme->pdev, "phy(%d) read timeout : %d\n", phy, reg);
+                pr_err("phy(%d) read timeout : %d\n", phy, reg);
                 return 0;
         }
 
@@ -102,7 +104,7 @@ jme_mdio_write(struct net_device *netdev,
         }
 
         if (i == 0)
-                jeprintk(jme->pdev, "phy(%d) write timeout : %d\n", phy, reg);
+                pr_err("phy(%d) write timeout : %d\n", phy, reg);
 }
 
 static inline void
@@ -227,7 +229,7 @@ jme_reload_eeprom(struct jme_adapter *jme)
                 }
 
                 if (i == 0) {
-                        jeprintk(jme->pdev, "eeprom reload timeout\n");
+                        pr_err("eeprom reload timeout\n");
                         return -EIO;
                 }
         }
@@ -397,8 +399,7 @@ jme_check_link(struct net_device *netdev, int testonly)
                                         phylink = jread32(jme, JME_PHY_LINK);
                         }
                         if (!cnt)
-                                jeprintk(jme->pdev,
-                                        "Waiting speed resolve timeout.\n");
+                                pr_err("Waiting speed resolve timeout\n");
 
                         strcat(linkmsg, "ANed: ");
                 }
@@ -480,13 +481,13 @@ jme_check_link(struct net_device *netdev, int testonly)
                 strcat(linkmsg, (phylink & PHY_LINK_MDI_STAT) ?
                                         "MDI-X" :
                                         "MDI");
-                netif_info(jme, link, jme->dev, "Link is up at %s.\n", linkmsg);
+                netif_info(jme, link, jme->dev, "Link is up at %s\n", linkmsg);
                 netif_carrier_on(netdev);
         } else {
                 if (testonly)
                         goto out;
 
-                netif_info(jme, link, jme->dev, "Link is down.\n");
+                netif_info(jme, link, jme->dev, "Link is down\n");
                 jme->phylink = 0;
                 netif_carrier_off(netdev);
         }
@@ -648,7 +649,7 @@ jme_disable_tx_engine(struct jme_adapter *jme)
         }
 
         if (!i)
-                jeprintk(jme->pdev, "Disable TX engine timeout.\n");
+                pr_err("Disable TX engine timeout\n");
 }
 
 static void
@@ -867,7 +868,7 @@ jme_disable_rx_engine(struct jme_adapter *jme)
         }
 
         if (!i)
-                jeprintk(jme->pdev, "Disable RX engine timeout.\n");
+                pr_err("Disable RX engine timeout\n");
 
 }
 
@@ -887,13 +888,13 @@ jme_rxsum_ok(struct jme_adapter *jme, u16 flags)
         if (unlikely((flags & (RXWBFLAG_MF | RXWBFLAG_UDPON | RXWBFLAG_UDPCS))
                         == RXWBFLAG_UDPON)) {
                 if (flags & RXWBFLAG_IPV4)
-                        netif_err(jme, rx_err, jme->dev, "UDP Checksum error.\n");
+                        netif_err(jme, rx_err, jme->dev, "UDP Checksum error\n");
                 return false;
         }
 
         if (unlikely((flags & (RXWBFLAG_IPV4 | RXWBFLAG_IPCS))
                         == RXWBFLAG_IPV4)) {
-                netif_err(jme, rx_err, jme->dev, "IPv4 Checksum error.\n");
+                netif_err(jme, rx_err, jme->dev, "IPv4 Checksum error\n");
                 return false;
         }
 
@@ -936,7 +937,7 @@ jme_alloc_and_feed_skb(struct jme_adapter *jme, int idx)
                 if (jme_rxsum_ok(jme, le16_to_cpu(rxdesc->descwb.flags)))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                 if (rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_TAGON)) {
                         if (jme->vlgrp) {
@@ -1185,9 +1186,9 @@ jme_link_change_tasklet(unsigned long arg)
 
         while (!atomic_dec_and_test(&jme->link_changing)) {
                 atomic_inc(&jme->link_changing);
-                netif_info(jme, intr, jme->dev, "Get link change lock failed.\n");
+                netif_info(jme, intr, jme->dev, "Get link change lock failed\n");
                 while (atomic_read(&jme->link_changing) != 1)
-                        netif_info(jme, intr, jme->dev, "Waiting link change lock.\n");
+                        netif_info(jme, intr, jme->dev, "Waiting link change lock\n");
         }
 
         if (jme_check_link(netdev, 1) && jme->old_mtu == netdev->mtu)
@@ -1221,15 +1222,13 @@ jme_link_change_tasklet(unsigned long arg)
         if (netif_carrier_ok(netdev)) {
                 rc = jme_setup_rx_resources(jme);
                 if (rc) {
-                        jeprintk(jme->pdev, "Allocating resources for RX error"
-                                ", Device STOPPED!\n");
+                        pr_err("Allocating resources for RX error, Device STOPPED!\n");
                         goto out_enable_tasklet;
                 }
 
                 rc = jme_setup_tx_resources(jme);
                 if (rc) {
-                        jeprintk(jme->pdev, "Allocating resources for TX error"
-                                ", Device STOPPED!\n");
+                        pr_err("Allocating resources for TX error, Device STOPPED!\n");
                         goto err_out_free_rx_resources;
                 }
 
@@ -1324,7 +1323,7 @@ jme_wake_queue_if_stopped(struct jme_adapter *jme)
         smp_wmb();
         if (unlikely(netif_queue_stopped(jme->dev) &&
         atomic_read(&txring->nr_free) >= (jme->tx_wake_threshold))) {
-                netif_info(jme, tx_done, jme->dev, "TX Queue Waked.\n");
+                netif_info(jme, tx_done, jme->dev, "TX Queue Waked\n");
                 netif_wake_queue(jme->dev);
         }
 
@@ -1339,7 +1338,7 @@ jme_tx_clean_tasklet(unsigned long arg)
         struct jme_buffer_info *txbi = txring->bufinf, *ctxbi, *ttxbi;
         int i, j, cnt = 0, max, err, mask;
 
-        tx_dbg(jme, "Into txclean.\n");
+        tx_dbg(jme, "Into txclean\n");
 
         if (unlikely(!atomic_dec_and_test(&jme->tx_cleaning)))
                 goto out;
@@ -1361,7 +1360,7 @@ jme_tx_clean_tasklet(unsigned long arg)
                 !(txdesc[i].descwb.flags & TXWBFLAG_OWN))) {
 
                         tx_dbg(jme, "txclean: %d+%d@%lu\n",
-                                        i, ctxbi->nr_desc, jiffies);
+                               i, ctxbi->nr_desc, jiffies);
 
                         err = txdesc[i].descwb.flags & TXWBFLAG_ALLERR;
 
@@ -1402,7 +1401,7 @@ jme_tx_clean_tasklet(unsigned long arg)
                 ctxbi->nr_desc = 0;
         }
 
-        tx_dbg(jme, "txclean: done %d@%lu.\n", i, jiffies);
+        tx_dbg(jme, "txclean: done %d@%lu\n", i, jiffies);
         atomic_set(&txring->next_to_clean, i);
         atomic_add(cnt, &txring->nr_free);
 
@@ -1548,10 +1547,10 @@ jme_request_irq(struct jme_adapter *jme)
         rc = request_irq(jme->pdev->irq, handler, irq_flags, netdev->name,
                           netdev);
         if (rc) {
-                jeprintk(jme->pdev,
-                        "Unable to request %s interrupt (return: %d)\n",
-                        test_bit(JME_FLAG_MSI, &jme->flags) ? "MSI" : "INTx",
-                        rc);
+                netdev_err(netdev,
+                           "Unable to request %s interrupt (return: %d)\n",
+                           test_bit(JME_FLAG_MSI, &jme->flags) ? "MSI" : "INTx",
+                           rc);
 
                 if (test_bit(JME_FLAG_MSI, &jme->flags)) {
                         pci_disable_msi(jme->pdev);
@@ -1834,7 +1833,7 @@ jme_tx_csum(struct jme_adapter *jme, struct sk_buff *skb, u8 *flags)
                         *flags |= TXFLAG_UDPCS;
                         break;
                 default:
-                        netif_err(jme, tx_err, jme->dev, "Error upper layer protocol.\n");
+                        netif_err(jme, tx_err, jme->dev, "Error upper layer protocol\n");
                         break;
                 }
         }
@@ -1909,12 +1908,12 @@ jme_stop_queue_if_full(struct jme_adapter *jme)
         smp_wmb();
         if (unlikely(atomic_read(&txring->nr_free) < (MAX_SKB_FRAGS+2))) {
                 netif_stop_queue(jme->dev);
-                netif_info(jme, tx_queued, jme->dev, "TX Queue Paused.\n");
+                netif_info(jme, tx_queued, jme->dev, "TX Queue Paused\n");
                 smp_wmb();
                 if (atomic_read(&txring->nr_free)
                         >= (jme->tx_wake_threshold)) {
                         netif_wake_queue(jme->dev);
-                        netif_info(jme, tx_queued, jme->dev, "TX Queue Fast Waked.\n");
+                        netif_info(jme, tx_queued, jme->dev, "TX Queue Fast Waked\n");
                 }
         }
 
@@ -1922,7 +1921,8 @@ jme_stop_queue_if_full(struct jme_adapter *jme)
                         (jiffies - txbi->start_xmit) >= TX_TIMEOUT &&
                         txbi->skb)) {
                 netif_stop_queue(jme->dev);
-                netif_info(jme, tx_queued, jme->dev, "TX Queue Stopped %d@%lu.\n", idx, jiffies);
+                netif_info(jme, tx_queued, jme->dev,
+                           "TX Queue Stopped %d@%lu\n", idx, jiffies);
         }
 }
 
@@ -1945,7 +1945,8 @@ jme_start_xmit(struct sk_buff *skb, struct net_device *netdev)
 
         if (unlikely(idx < 0)) {
                 netif_stop_queue(netdev);
-                netif_err(jme, tx_err, jme->dev, "BUG! Tx ring full when queue awake!\n");
+                netif_err(jme, tx_err, jme->dev,
+                          "BUG! Tx ring full when queue awake!\n");
 
                 return NETDEV_TX_BUSY;
         }
@@ -1957,9 +1958,8 @@ jme_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                                 TXCS_QUEUE0S |
                                 TXCS_ENABLE);
 
-        tx_dbg(jme, "xmit: %d+%d@%lu\n", idx,
-                        skb_shinfo(skb)->nr_frags + 2,
-                        jiffies);
+        tx_dbg(jme, "xmit: %d+%d@%lu\n",
+               idx, skb_shinfo(skb)->nr_frags + 2, jiffies);
         jme_stop_queue_if_full(jme);
 
         return NETDEV_TX_OK;
@@ -2501,7 +2501,7 @@ jme_smb_read(struct jme_adapter *jme, unsigned int addr)
                 val = jread32(jme, JME_SMBCSR);
         }
         if (!to) {
-                netif_err(jme, hw, jme->dev, "SMB Bus Busy.\n");
+                netif_err(jme, hw, jme->dev, "SMB Bus Busy\n");
                 return 0xFF;
         }
 
@@ -2517,7 +2517,7 @@ jme_smb_read(struct jme_adapter *jme, unsigned int addr)
                 val = jread32(jme, JME_SMBINTF);
         }
         if (!to) {
-                netif_err(jme, hw, jme->dev, "SMB Bus Busy.\n");
+                netif_err(jme, hw, jme->dev, "SMB Bus Busy\n");
                 return 0xFF;
         }
 
@@ -2537,7 +2537,7 @@ jme_smb_write(struct jme_adapter *jme, unsigned int addr, u8 data)
                 val = jread32(jme, JME_SMBCSR);
         }
         if (!to) {
-                netif_err(jme, hw, jme->dev, "SMB Bus Busy.\n");
+                netif_err(jme, hw, jme->dev, "SMB Bus Busy\n");
                 return;
         }
 
@@ -2554,7 +2554,7 @@ jme_smb_write(struct jme_adapter *jme, unsigned int addr, u8 data)
                 val = jread32(jme, JME_SMBINTF);
         }
         if (!to) {
-                netif_err(jme, hw, jme->dev, "SMB Bus Busy.\n");
+                netif_err(jme, hw, jme->dev, "SMB Bus Busy\n");
                 return;
         }
 
@@ -2699,26 +2699,26 @@ jme_init_one(struct pci_dev *pdev,
          */
         rc = pci_enable_device(pdev);
         if (rc) {
-                jeprintk(pdev, "Cannot enable PCI device.\n");
+                pr_err("Cannot enable PCI device\n");
                 goto err_out;
         }
 
         using_dac = jme_pci_dma64(pdev);
         if (using_dac < 0) {
-                jeprintk(pdev, "Cannot set PCI DMA Mask.\n");
+                pr_err("Cannot set PCI DMA Mask\n");
                 rc = -EIO;
                 goto err_out_disable_pdev;
         }
 
         if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-                jeprintk(pdev, "No PCI resource region found.\n");
+                pr_err("No PCI resource region found\n");
                 rc = -ENOMEM;
                 goto err_out_disable_pdev;
         }
 
         rc = pci_request_regions(pdev, DRV_NAME);
         if (rc) {
-                jeprintk(pdev, "Cannot obtain PCI resource region.\n");
+                pr_err("Cannot obtain PCI resource region\n");
                 goto err_out_disable_pdev;
         }
 
@@ -2729,7 +2729,7 @@ jme_init_one(struct pci_dev *pdev,
          */
         netdev = alloc_etherdev(sizeof(*jme));
         if (!netdev) {
-                jeprintk(pdev, "Cannot allocate netdev structure.\n");
+                pr_err("Cannot allocate netdev structure\n");
                 rc = -ENOMEM;
                 goto err_out_release_regions;
         }
@@ -2767,7 +2767,7 @@ jme_init_one(struct pci_dev *pdev,
         jme->regs = ioremap(pci_resource_start(pdev, 0),
                              pci_resource_len(pdev, 0));
         if (!(jme->regs)) {
-                jeprintk(pdev, "Mapping PCI resource region error.\n");
+                pr_err("Mapping PCI resource region error\n");
                 rc = -ENOMEM;
                 goto err_out_free_netdev;
         }
@@ -2855,8 +2855,8 @@ jme_init_one(struct pci_dev *pdev,
 
                 if (!jme->mii_if.phy_id) {
                         rc = -EIO;
-                        jeprintk(pdev, "Can not find phy_id.\n");
-                         goto err_out_unmap;
+                        pr_err("Can not find phy_id\n");
+                        goto err_out_unmap;
                 }
 
                 jme->reg_ghc |= GHC_LINK_POLL;
@@ -2883,8 +2883,7 @@ jme_init_one(struct pci_dev *pdev,
         jme_reset_mac_processor(jme);
         rc = jme_reload_eeprom(jme);
         if (rc) {
-                jeprintk(pdev,
-                        "Reload eeprom for reading MAC Address error.\n");
+                pr_err("Reload eeprom for reading MAC Address error\n");
                 goto err_out_unmap;
         }
         jme_load_macaddr(netdev);
@@ -2900,7 +2899,7 @@ jme_init_one(struct pci_dev *pdev,
          */
         rc = register_netdev(netdev);
         if (rc) {
-                jeprintk(pdev, "Cannot register net device.\n");
+                pr_err("Cannot register net device\n");
                 goto err_out_unmap;
         }
 
@@ -3042,8 +3041,7 @@ static struct pci_driver jme_driver = {
 static int __init
 jme_init_module(void)
 {
-        printk(KERN_INFO PFX "JMicron JMC2XX ethernet "
-               "driver version %s\n", DRV_VERSION);
+        pr_info("JMicron JMC2XX ethernet driver version %s\n", DRV_VERSION);
         return pci_register_driver(&jme_driver);
 }
 
diff --git a/drivers/net/jme.h b/drivers/net/jme.h
index 07ad3a457185..1360f68861b8 100644
--- a/drivers/net/jme.h
+++ b/drivers/net/jme.h
@@ -41,9 +41,6 @@
         NETIF_MSG_TX_ERR | \
         NETIF_MSG_HW)
 
-#define jeprintk(pdev, fmt, args...) \
-        printk(KERN_ERR PFX fmt, ## args)
-
 #ifdef TX_DEBUG
 #define tx_dbg(priv, fmt, args...)                                      \
         printk(KERN_DEBUG "%s: " fmt, (priv)->dev->name, ##args)
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index bdf2149e5296..8762dcb84e8b 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -494,7 +494,7 @@ static u32 temac_setoptions(struct net_device *ndev, u32 options)
         lp->options |= options;
         mutex_unlock(&lp->indirect_mutex);
 
-        return (0);
+        return 0;
 }
 
 /* Initialize temac */
@@ -760,7 +760,7 @@ static void ll_temac_recv(struct net_device *ndev)
                 skb_put(skb, length);
                 skb->dev = ndev;
                 skb->protocol = eth_type_trans(skb, ndev);
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
                 /* if we're doing rx csum offload, set it up */
                 if (((lp->temac_features & TEMAC_FEATURE_RX_CSUM) != 0) &&
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 9a0996795321..4b0e30b564e5 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -74,7 +74,6 @@ struct pcpu_lstats {
 static netdev_tx_t loopback_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *pcpu_lstats;
         struct pcpu_lstats *lb_stats;
         int len;
 
@@ -83,8 +82,7 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
         skb->protocol = eth_type_trans(skb, dev);
 
         /* it's OK to use per_cpu_ptr() because BHs are off */
-        pcpu_lstats = (void __percpu __force *)dev->ml_priv;
-        lb_stats = this_cpu_ptr(pcpu_lstats);
+        lb_stats = this_cpu_ptr(dev->lstats);
 
         len = skb->len;
         if (likely(netif_rx(skb) == NET_RX_SUCCESS)) {
@@ -101,19 +99,17 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 static struct rtnl_link_stats64 *loopback_get_stats64(struct net_device *dev,
                                                       struct rtnl_link_stats64 *stats)
 {
-        const struct pcpu_lstats __percpu *pcpu_lstats;
         u64 bytes = 0;
         u64 packets = 0;
         u64 drops = 0;
         int i;
 
-        pcpu_lstats = (void __percpu __force *)dev->ml_priv;
         for_each_possible_cpu(i) {
                 const struct pcpu_lstats *lb_stats;
                 u64 tbytes, tpackets;
                 unsigned int start;
 
-                lb_stats = per_cpu_ptr(pcpu_lstats, i);
+                lb_stats = per_cpu_ptr(dev->lstats, i);
                 do {
                         start = u64_stats_fetch_begin(&lb_stats->syncp);
                         tbytes = lb_stats->bytes;
@@ -147,22 +143,16 @@ static const struct ethtool_ops loopback_ethtool_ops = {
 
 static int loopback_dev_init(struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *lstats;
-
-        lstats = alloc_percpu(struct pcpu_lstats);
-        if (!lstats)
+        dev->lstats = alloc_percpu(struct pcpu_lstats);
+        if (!dev->lstats)
                 return -ENOMEM;
 
-        dev->ml_priv = (void __force *)lstats;
         return 0;
 }
 
 static void loopback_dev_free(struct net_device *dev)
 {
-        struct pcpu_lstats __percpu *lstats =
-                (void __percpu __force *)dev->ml_priv;
-
-        free_percpu(lstats);
+        free_percpu(dev->lstats);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/lp486e.c b/drivers/net/lp486e.c
index 3df046a58b1d..3698824744cb 100644
--- a/drivers/net/lp486e.c
+++ b/drivers/net/lp486e.c
@@ -460,7 +460,7 @@ init_rx_bufs(struct net_device *dev, int num) {
         }
         lp->rbd_tail->next = rfd->rbd;
 #endif
-        return (i);
+        return i;
 }
 
 static inline void
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index 3832fa4961dd..f84f5e6ededb 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -562,19 +562,19 @@ static int __init mac8390_initdev(struct net_device *dev,
 
                 case ACCESS_16:
                         /* 16 bit card, register map is reversed */
-                        ei_status.reset_8390 = &mac8390_no_reset;
-                        ei_status.block_input = &slow_sane_block_input;
-                        ei_status.block_output = &slow_sane_block_output;
-                        ei_status.get_8390_hdr = &slow_sane_get_8390_hdr;
+                        ei_status.reset_8390 = mac8390_no_reset;
+                        ei_status.block_input = slow_sane_block_input;
+                        ei_status.block_output = slow_sane_block_output;
+                        ei_status.get_8390_hdr = slow_sane_get_8390_hdr;
                         ei_status.reg_offset = back4_offsets;
                         break;
 
                 case ACCESS_32:
                         /* 32 bit card, register map is reversed */
-                        ei_status.reset_8390 = &mac8390_no_reset;
-                        ei_status.block_input = &sane_block_input;
-                        ei_status.block_output = &sane_block_output;
-                        ei_status.get_8390_hdr = &sane_get_8390_hdr;
+                        ei_status.reset_8390 = mac8390_no_reset;
+                        ei_status.block_input = sane_block_input;
+                        ei_status.block_output = sane_block_output;
+                        ei_status.get_8390_hdr = sane_get_8390_hdr;
                         ei_status.reg_offset = back4_offsets;
                         access_bitmode = 1;
                         break;
@@ -586,19 +586,19 @@ static int __init mac8390_initdev(struct net_device *dev,
                  * but overwrite system memory when run at 32 bit.
                  * so we run them all at 16 bit.
                  */
-                ei_status.reset_8390 = &mac8390_no_reset;
-                ei_status.block_input = &slow_sane_block_input;
-                ei_status.block_output = &slow_sane_block_output;
-                ei_status.get_8390_hdr = &slow_sane_get_8390_hdr;
+                ei_status.reset_8390 = mac8390_no_reset;
+                ei_status.block_input = slow_sane_block_input;
+                ei_status.block_output = slow_sane_block_output;
+                ei_status.get_8390_hdr = slow_sane_get_8390_hdr;
                 ei_status.reg_offset = back4_offsets;
                 break;
 
         case MAC8390_CABLETRON:
                 /* 16 bit card, register map is short forward */
-                ei_status.reset_8390 = &mac8390_no_reset;
-                ei_status.block_input = &slow_sane_block_input;
-                ei_status.block_output = &slow_sane_block_output;
-                ei_status.get_8390_hdr = &slow_sane_get_8390_hdr;
+                ei_status.reset_8390 = mac8390_no_reset;
+                ei_status.block_input = slow_sane_block_input;
+                ei_status.block_output = slow_sane_block_output;
+                ei_status.get_8390_hdr = slow_sane_get_8390_hdr;
                 ei_status.reg_offset = fwrd2_offsets;
                 break;
 
@@ -606,19 +606,19 @@ static int __init mac8390_initdev(struct net_device *dev,
         case MAC8390_KINETICS:
                 /* 16 bit memory, register map is forward */
                 /* dayna and similar */
-                ei_status.reset_8390 = &mac8390_no_reset;
-                ei_status.block_input = &dayna_block_input;
-                ei_status.block_output = &dayna_block_output;
-                ei_status.get_8390_hdr = &dayna_get_8390_hdr;
+                ei_status.reset_8390 = mac8390_no_reset;
+                ei_status.block_input = dayna_block_input;
+                ei_status.block_output = dayna_block_output;
+                ei_status.get_8390_hdr = dayna_get_8390_hdr;
                 ei_status.reg_offset = fwrd4_offsets;
                 break;
 
         case MAC8390_INTERLAN:
                 /* 16 bit memory, register map is forward */
-                ei_status.reset_8390 = &interlan_reset;
-                ei_status.block_input = &slow_sane_block_input;
-                ei_status.block_output = &slow_sane_block_output;
-                ei_status.get_8390_hdr = &slow_sane_get_8390_hdr;
+                ei_status.reset_8390 = interlan_reset;
+                ei_status.block_input = slow_sane_block_input;
+                ei_status.block_output = slow_sane_block_output;
+                ei_status.get_8390_hdr = slow_sane_get_8390_hdr;
                 ei_status.reg_offset = fwrd4_offsets;
                 break;
 
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index ff2f158ab0b9..4297f6e8c4bc 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -407,7 +407,7 @@ static int macb_rx_frame(struct macb *bp, unsigned int first_frag,
         }
 
         skb_reserve(skb, RX_OFFSET);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
         skb_put(skb, len);
 
         for (frag = first_frag; ; frag = NEXT_RX(frag)) {
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 0ef0eb0db945..0fc9dc7f20db 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -788,6 +788,10 @@ static int macvlan_device_event(struct notifier_block *unused,
                 }
                 break;
         case NETDEV_UNREGISTER:
+                /* twiddle thumbs on netns device moves */
+                if (dev->reg_state != NETREG_UNREGISTERING)
+                        break;
+
                 list_for_each_entry_safe(vlan, next, &port->vlans, list)
                         vlan->dev->rtnl_link_ops->dellink(vlan->dev, NULL);
                 break;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 3b1c54a9c6ef..42567279843e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -84,26 +84,45 @@ static const struct proto_ops macvtap_socket_ops;
 static DEFINE_SPINLOCK(macvtap_lock);
 
 /*
- * Choose the next free queue, for now there is only one
+ * get_slot: return a [unused/occupied] slot in vlan->taps[]:
+ *      - if 'q' is NULL, return the first empty slot;
+ *      - otherwise, return the slot this pointer occupies.
  */
+static int get_slot(struct macvlan_dev *vlan, struct macvtap_queue *q)
+{
+        int i;
+
+        for (i = 0; i < MAX_MACVTAP_QUEUES; i++) {
+                if (rcu_dereference(vlan->taps[i]) == q)
+                        return i;
+        }
+
+        /* Should never happen */
+        BUG_ON(1);
+}
+
 static int macvtap_set_queue(struct net_device *dev, struct file *file,
                                 struct macvtap_queue *q)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
+        int index;
         int err = -EBUSY;
 
         spin_lock(&macvtap_lock);
-        if (rcu_dereference(vlan->tap))
+        if (vlan->numvtaps == MAX_MACVTAP_QUEUES)
                 goto out;
 
         err = 0;
+        index = get_slot(vlan, NULL);
         rcu_assign_pointer(q->vlan, vlan);
-        rcu_assign_pointer(vlan->tap, q);
+        rcu_assign_pointer(vlan->taps[index], q);
         sock_hold(&q->sk);
 
         q->file = file;
         file->private_data = q;
 
+        vlan->numvtaps++;
+
 out:
         spin_unlock(&macvtap_lock);
         return err;
@@ -124,9 +143,12 @@ static void macvtap_put_queue(struct macvtap_queue *q)
         spin_lock(&macvtap_lock);
         vlan = rcu_dereference(q->vlan);
         if (vlan) {
-                rcu_assign_pointer(vlan->tap, NULL);
+                int index = get_slot(vlan, q);
+
+                rcu_assign_pointer(vlan->taps[index], NULL);
                 rcu_assign_pointer(q->vlan, NULL);
                 sock_put(&q->sk);
+                --vlan->numvtaps;
         }
 
         spin_unlock(&macvtap_lock);
@@ -136,39 +158,82 @@ static void macvtap_put_queue(struct macvtap_queue *q)
 }
 
 /*
- * Since we only support one queue, just dereference the pointer.
+ * Select a queue based on the rxq of the device on which this packet
+ * arrived. If the incoming device is not mq, calculate a flow hash
+ * to select a queue. If all fails, find the first available queue.
+ * Cache vlan->numvtaps since it can become zero during the execution
+ * of this function.
  */
 static struct macvtap_queue *macvtap_get_queue(struct net_device *dev,
                                                struct sk_buff *skb)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
+        struct macvtap_queue *tap = NULL;
+        int numvtaps = vlan->numvtaps;
+        __u32 rxq;
+
+        if (!numvtaps)
+                goto out;
+
+        if (likely(skb_rx_queue_recorded(skb))) {
+                rxq = skb_get_rx_queue(skb);
+
+                while (unlikely(rxq >= numvtaps))
+                        rxq -= numvtaps;
+
+                tap = rcu_dereference(vlan->taps[rxq]);
+                if (tap)
+                        goto out;
+        }
+
+        /* Check if we can use flow to select a queue */
+        rxq = skb_get_rxhash(skb);
+        if (rxq) {
+                tap = rcu_dereference(vlan->taps[rxq % numvtaps]);
+                if (tap)
+                        goto out;
+        }
 
-        return rcu_dereference(vlan->tap);
+        /* Everything failed - find first available queue */
+        for (rxq = 0; rxq < MAX_MACVTAP_QUEUES; rxq++) {
+                tap = rcu_dereference(vlan->taps[rxq]);
+                if (tap)
+                        break;
+        }
+
+out:
+        return tap;
 }
 
 /*
  * The net_device is going away, give up the reference
- * that it holds on the queue (all the queues one day)
- * and safely set the pointer from the queues to NULL.
+ * that it holds on all queues and safely set the pointer
+ * from the queues to NULL.
  */
 static void macvtap_del_queues(struct net_device *dev)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
-        struct macvtap_queue *q;
+        struct macvtap_queue *q, *qlist[MAX_MACVTAP_QUEUES];
+        int i, j = 0;
 
+        /* macvtap_put_queue can free some slots, so go through all slots */
         spin_lock(&macvtap_lock);
-        q = rcu_dereference(vlan->tap);
-        if (!q) {
-                spin_unlock(&macvtap_lock);
-                return;
+        for (i = 0; i < MAX_MACVTAP_QUEUES && vlan->numvtaps; i++) {
+                q = rcu_dereference(vlan->taps[i]);
+                if (q) {
+                        qlist[j++] = q;
+                        rcu_assign_pointer(vlan->taps[i], NULL);
+                        rcu_assign_pointer(q->vlan, NULL);
+                        vlan->numvtaps--;
+                }
         }
-
-        rcu_assign_pointer(vlan->tap, NULL);
-        rcu_assign_pointer(q->vlan, NULL);
+        BUG_ON(vlan->numvtaps != 0);
         spin_unlock(&macvtap_lock);
 
         synchronize_rcu();
-        sock_put(&q->sk);
+
+        for (--j; j >= 0; j--)
+                sock_put(&qlist[j]->sk);
 }
 
 /*
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index 42e3294671d7..60135aa55802 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -461,7 +461,7 @@ static int meth_tx_full(struct net_device *dev)
 {
         struct meth_private *priv = netdev_priv(dev);
 
-        return (priv->tx_count >= TX_RING_ENTRIES - 1);
+        return priv->tx_count >= TX_RING_ENTRIES - 1;
 }
 
 static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
diff --git a/drivers/net/mlx4/Makefile b/drivers/net/mlx4/Makefile
index 1fd068e1d930..d1aa45a15854 100644
--- a/drivers/net/mlx4/Makefile
+++ b/drivers/net/mlx4/Makefile
@@ -6,4 +6,4 @@ mlx4_core-y :=	alloc.o catas.o cmd.o cq.o eq.o fw.o icm.o intf.o main.o mcg.o \
 obj-$(CONFIG_MLX4_EN)               += mlx4_en.o
 
 mlx4_en-y :=    en_main.o en_tx.o en_rx.o en_ethtool.o en_port.o en_cq.o \
-                en_resources.o en_netdev.o
+                en_resources.o en_netdev.o en_selftest.o
diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index 8c8515619b8e..8f4bf1f07c11 100644
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -74,7 +74,7 @@ void mlx4_bitmap_free(struct mlx4_bitmap *bitmap, u32 obj)
 
 u32 mlx4_bitmap_alloc_range(struct mlx4_bitmap *bitmap, int cnt, int align)
 {
-        u32 obj, i;
+        u32 obj;
 
         if (likely(cnt == 1 && align == 1))
                 return mlx4_bitmap_alloc(bitmap);
@@ -91,8 +91,7 @@ u32 mlx4_bitmap_alloc_range(struct mlx4_bitmap *bitmap, int cnt, int align)
         }
 
         if (obj < bitmap->max) {
-                for (i = 0; i < cnt; i++)
-                        set_bit(obj + i, bitmap->table);
+                bitmap_set(bitmap->table, obj, cnt);
                 if (obj == bitmap->last) {
                         bitmap->last = (obj + cnt);
                         if (bitmap->last >= bitmap->max)
@@ -109,13 +108,10 @@ u32 mlx4_bitmap_alloc_range(struct mlx4_bitmap *bitmap, int cnt, int align)
 
 void mlx4_bitmap_free_range(struct mlx4_bitmap *bitmap, u32 obj, int cnt)
 {
-        u32 i;
-
         obj &= bitmap->max + bitmap->reserved_top - 1;
 
         spin_lock(&bitmap->lock);
-        for (i = 0; i < cnt; i++)
-                clear_bit(obj + i, bitmap->table);
+        bitmap_clear(bitmap->table, obj, cnt);
         bitmap->last = min(bitmap->last, obj);
         bitmap->top = (bitmap->top + bitmap->max + bitmap->reserved_top)
                         & bitmap->mask;
@@ -125,8 +121,6 @@ void mlx4_bitmap_free_range(struct mlx4_bitmap *bitmap, u32 obj, int cnt)
 int mlx4_bitmap_init(struct mlx4_bitmap *bitmap, u32 num, u32 mask,
                      u32 reserved_bot, u32 reserved_top)
 {
-        int i;
-
         /* num must be a power of 2 */
         if (num != roundup_pow_of_two(num))
                 return -EINVAL;
@@ -142,8 +136,7 @@ int mlx4_bitmap_init(struct mlx4_bitmap *bitmap, u32 num, u32 mask,
         if (!bitmap->table)
                 return -ENOMEM;
 
-        for (i = 0; i < reserved_bot; ++i)
-                set_bit(i, bitmap->table);
+        bitmap_set(bitmap->table, 0, reserved_bot);
 
         return 0;
 }
@@ -188,7 +181,7 @@ int mlx4_buf_alloc(struct mlx4_dev *dev, int size, int max_direct,
                 buf->nbufs       = (size + PAGE_SIZE - 1) / PAGE_SIZE;
                 buf->npages      = buf->nbufs;
                 buf->page_shift  = PAGE_SHIFT;
-                buf->page_list   = kzalloc(buf->nbufs * sizeof *buf->page_list,
+                buf->page_list   = kcalloc(buf->nbufs, sizeof(*buf->page_list),
                                            GFP_KERNEL);
                 if (!buf->page_list)
                         return -ENOMEM;
diff --git a/drivers/net/mlx4/en_ethtool.c b/drivers/net/mlx4/en_ethtool.c
index b275238fe70d..056152b3ff58 100644
--- a/drivers/net/mlx4/en_ethtool.c
+++ b/drivers/net/mlx4/en_ethtool.c
@@ -39,21 +39,6 @@
 #include "en_port.h"
 
 
-static void mlx4_en_update_lro_stats(struct mlx4_en_priv *priv)
-{
-        int i;
-
-        priv->port_stats.lro_aggregated = 0;
-        priv->port_stats.lro_flushed = 0;
-        priv->port_stats.lro_no_desc = 0;
-
-        for (i = 0; i < priv->rx_ring_num; i++) {
-                priv->port_stats.lro_aggregated += priv->rx_ring[i].lro.stats.aggregated;
-                priv->port_stats.lro_flushed += priv->rx_ring[i].lro.stats.flushed;
-                priv->port_stats.lro_no_desc += priv->rx_ring[i].lro.stats.no_desc;
-        }
-}
-
 static void
 mlx4_en_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *drvinfo)
 {
@@ -112,7 +97,7 @@ static const char main_strings[][ETH_GSTRING_LEN] = {
         "tx_heartbeat_errors", "tx_window_errors",
 
         /* port statistics */
-        "lro_aggregated", "lro_flushed", "lro_no_desc", "tso_packets",
+        "tso_packets",
         "queue_stopped", "wake_queue", "tx_timeout", "rx_alloc_failed",
         "rx_csum_good", "rx_csum_none", "tx_chksum_offload",
 
@@ -125,6 +110,14 @@ static const char main_strings[][ETH_GSTRING_LEN] = {
 #define NUM_MAIN_STATS  21
 #define NUM_ALL_STATS   (NUM_MAIN_STATS + NUM_PORT_STATS + NUM_PKT_STATS + NUM_PERF_STATS)
 
+static const char mlx4_en_test_names[][ETH_GSTRING_LEN]= {
+        "Interupt Test",
+        "Link Test",
+        "Speed Test",
+        "Register Test",
+        "Loopback Test",
+};
+
 static u32 mlx4_en_get_msglevel(struct net_device *dev)
 {
         return ((struct mlx4_en_priv *) netdev_priv(dev))->msg_enable;
@@ -146,10 +139,15 @@ static int mlx4_en_get_sset_count(struct net_device *dev, int sset)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        if (sset != ETH_SS_STATS)
+        switch (sset) {
+        case ETH_SS_STATS:
+                return NUM_ALL_STATS +
+                        (priv->tx_ring_num + priv->rx_ring_num) * 2;
+        case ETH_SS_TEST:
+                return MLX4_EN_NUM_SELF_TEST - !(priv->mdev->dev->caps.loopback_support) * 2;
+        default:
                 return -EOPNOTSUPP;
-
-        return NUM_ALL_STATS + (priv->tx_ring_num + priv->rx_ring_num) * 2;
+        }
 }
 
 static void mlx4_en_get_ethtool_stats(struct net_device *dev,
@@ -161,8 +159,6 @@ static void mlx4_en_get_ethtool_stats(struct net_device *dev,
 
         spin_lock_bh(&priv->stats_lock);
 
-        mlx4_en_update_lro_stats(priv);
-
         for (i = 0; i < NUM_MAIN_STATS; i++)
                 data[index++] = ((unsigned long *) &priv->stats)[i];
         for (i = 0; i < NUM_PORT_STATS; i++)
@@ -181,6 +177,12 @@ static void mlx4_en_get_ethtool_stats(struct net_device *dev,
 
 }
 
+static void mlx4_en_self_test(struct net_device *dev,
+                              struct ethtool_test *etest, u64 *buf)
+{
+        mlx4_en_ex_selftest(dev, &etest->flags, buf);
+}
+
 static void mlx4_en_get_strings(struct net_device *dev,
                                 uint32_t stringset, uint8_t *data)
 {
@@ -188,44 +190,76 @@ static void mlx4_en_get_strings(struct net_device *dev,
         int index = 0;
         int i;
 
-        if (stringset != ETH_SS_STATS)
-                return;
-
-        /* Add main counters */
-        for (i = 0; i < NUM_MAIN_STATS; i++)
-                strcpy(data + (index++) * ETH_GSTRING_LEN, main_strings[i]);
-        for (i = 0; i < NUM_PORT_STATS; i++)
-                strcpy(data + (index++) * ETH_GSTRING_LEN,
+        switch (stringset) {
+        case ETH_SS_TEST:
+                for (i = 0; i < MLX4_EN_NUM_SELF_TEST - 2; i++)
+                        strcpy(data + i * ETH_GSTRING_LEN, mlx4_en_test_names[i]);
+                if (priv->mdev->dev->caps.loopback_support)
+                        for (; i < MLX4_EN_NUM_SELF_TEST; i++)
+                                strcpy(data + i * ETH_GSTRING_LEN, mlx4_en_test_names[i]);
+                break;
+
+        case ETH_SS_STATS:
+                /* Add main counters */
+                for (i = 0; i < NUM_MAIN_STATS; i++)
+                        strcpy(data + (index++) * ETH_GSTRING_LEN, main_strings[i]);
+                for (i = 0; i< NUM_PORT_STATS; i++)
+                        strcpy(data + (index++) * ETH_GSTRING_LEN,
                         main_strings[i + NUM_MAIN_STATS]);
-        for (i = 0; i < priv->tx_ring_num; i++) {
-                sprintf(data + (index++) * ETH_GSTRING_LEN,
-                        "tx%d_packets", i);
-                sprintf(data + (index++) * ETH_GSTRING_LEN,
-                        "tx%d_bytes", i);
-        }
-        for (i = 0; i < priv->rx_ring_num; i++) {
-                sprintf(data + (index++) * ETH_GSTRING_LEN,
-                        "rx%d_packets", i);
-                sprintf(data + (index++) * ETH_GSTRING_LEN,
-                        "rx%d_bytes", i);
-        }
-        for (i = 0; i < NUM_PKT_STATS; i++)
-                strcpy(data + (index++) * ETH_GSTRING_LEN,
+                for (i = 0; i < priv->tx_ring_num; i++) {
+                        sprintf(data + (index++) * ETH_GSTRING_LEN,
+                                "tx%d_packets", i);
+                        sprintf(data + (index++) * ETH_GSTRING_LEN,
+                                "tx%d_bytes", i);
+                }
+                for (i = 0; i < priv->rx_ring_num; i++) {
+                        sprintf(data + (index++) * ETH_GSTRING_LEN,
+                                "rx%d_packets", i);
+                        sprintf(data + (index++) * ETH_GSTRING_LEN,
+                                "rx%d_bytes", i);
+                }
+                for (i = 0; i< NUM_PKT_STATS; i++)
+                        strcpy(data + (index++) * ETH_GSTRING_LEN,
                         main_strings[i + NUM_MAIN_STATS + NUM_PORT_STATS]);
+                break;
+        }
 }
 
 static int mlx4_en_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
+        struct mlx4_en_priv *priv = netdev_priv(dev);
+        int trans_type;
+
         cmd->autoneg = AUTONEG_DISABLE;
         cmd->supported = SUPPORTED_10000baseT_Full;
-        cmd->advertising = ADVERTISED_1000baseT_Full;
+        cmd->advertising = ADVERTISED_10000baseT_Full;
+
+        if (mlx4_en_QUERY_PORT(priv->mdev, priv->port))
+                return -ENOMEM;
+
+        trans_type = priv->port_state.transciver;
         if (netif_carrier_ok(dev)) {
-                cmd->speed = SPEED_10000;
+                cmd->speed = priv->port_state.link_speed;
                 cmd->duplex = DUPLEX_FULL;
         } else {
                 cmd->speed = -1;
                 cmd->duplex = -1;
         }
+
+        if (trans_type > 0 && trans_type <= 0xC) {
+                cmd->port = PORT_FIBRE;
+                cmd->transceiver = XCVR_EXTERNAL;
+                cmd->supported |= SUPPORTED_FIBRE;
+                cmd->advertising |= ADVERTISED_FIBRE;
+        } else if (trans_type == 0x80 || trans_type == 0) {
+                cmd->port = PORT_TP;
+                cmd->transceiver = XCVR_INTERNAL;
+                cmd->supported |= SUPPORTED_TP;
+                cmd->advertising |= ADVERTISED_TP;
+        } else  {
+                cmd->port = -1;
+                cmd->transceiver = -1;
+        }
         return 0;
 }
 
@@ -343,8 +377,9 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
         tx_size = max_t(u32, tx_size, MLX4_EN_MIN_TX_SIZE);
         tx_size = min_t(u32, tx_size, MLX4_EN_MAX_TX_SIZE);
 
-        if (rx_size == priv->prof->rx_ring_size &&
-            tx_size == priv->prof->tx_ring_size)
+        if (rx_size == (priv->port_up ? priv->rx_ring[0].actual_size :
+                                        priv->rx_ring[0].size) &&
+            tx_size == priv->tx_ring[0].size)
                 return 0;
 
         mutex_lock(&mdev->state_lock);
@@ -378,49 +413,13 @@ static void mlx4_en_get_ringparam(struct net_device *dev,
                                   struct ethtool_ringparam *param)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
 
         memset(param, 0, sizeof(*param));
         param->rx_max_pending = MLX4_EN_MAX_RX_SIZE;
         param->tx_max_pending = MLX4_EN_MAX_TX_SIZE;
-        param->rx_pending = mdev->profile.prof[priv->port].rx_ring_size;
-        param->tx_pending = mdev->profile.prof[priv->port].tx_ring_size;
-}
-
-static int mlx4_ethtool_op_set_flags(struct net_device *dev, u32 data)
-{
-        struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
-        int rc = 0;
-        int changed = 0;
-
-        if (data & ~ETH_FLAG_LRO)
-                return -EOPNOTSUPP;
-
-        if (data & ETH_FLAG_LRO) {
-                if (mdev->profile.num_lro == 0)
-                        return -EOPNOTSUPP;
-                if (!(dev->features & NETIF_F_LRO))
-                        changed = 1;
-        } else if (dev->features & NETIF_F_LRO) {
-                changed = 1;
-        }
-
-        if (changed) {
-                if (netif_running(dev)) {
-                        mutex_lock(&mdev->state_lock);
-                        mlx4_en_stop_port(dev);
-                }
-                dev->features ^= NETIF_F_LRO;
-                if (netif_running(dev)) {
-                        rc = mlx4_en_start_port(dev);
-                        if (rc)
-                                en_err(priv, "Failed to restart port\n");
-                        mutex_unlock(&mdev->state_lock);
-                }
-        }
-
-        return rc;
+        param->rx_pending = priv->port_up ?
+                priv->rx_ring[0].actual_size : priv->rx_ring[0].size;
+        param->tx_pending = priv->tx_ring[0].size;
 }
 
 const struct ethtool_ops mlx4_en_ethtool_ops = {
@@ -441,6 +440,7 @@ const struct ethtool_ops mlx4_en_ethtool_ops = {
         .get_strings = mlx4_en_get_strings,
         .get_sset_count = mlx4_en_get_sset_count,
         .get_ethtool_stats = mlx4_en_get_ethtool_stats,
+        .self_test = mlx4_en_self_test,
         .get_wol = mlx4_en_get_wol,
         .get_msglevel = mlx4_en_get_msglevel,
         .set_msglevel = mlx4_en_set_msglevel,
@@ -451,7 +451,6 @@ const struct ethtool_ops mlx4_en_ethtool_ops = {
         .get_ringparam = mlx4_en_get_ringparam,
         .set_ringparam = mlx4_en_set_ringparam,
         .get_flags = ethtool_op_get_flags,
-        .set_flags = mlx4_ethtool_op_set_flags,
 };
 
 
diff --git a/drivers/net/mlx4/en_main.c b/drivers/net/mlx4/en_main.c
index 97934f1ec53a..143906417048 100644
--- a/drivers/net/mlx4/en_main.c
+++ b/drivers/net/mlx4/en_main.c
@@ -63,15 +63,12 @@ static const char mlx4_en_version[] =
  */
 
 
-/* Use a XOR rathern than Toeplitz hash function for RSS */
-MLX4_EN_PARM_INT(rss_xor, 0, "Use XOR hash function for RSS");
-
-/* RSS hash type mask - default to <saddr, daddr, sport, dport> */
-MLX4_EN_PARM_INT(rss_mask, 0xf, "RSS hash type bitmask");
-
-/* Number of LRO sessions per Rx ring (rounded up to a power of two) */
-MLX4_EN_PARM_INT(num_lro, MLX4_EN_MAX_LRO_DESCRIPTORS,
-                 "Number of LRO sessions per ring or disabled (0)");
+/* Enable RSS TCP traffic */
+MLX4_EN_PARM_INT(tcp_rss, 1,
+                 "Enable RSS for incomming TCP traffic or disabled (0)");
+/* Enable RSS UDP traffic */
+MLX4_EN_PARM_INT(udp_rss, 1,
+                 "Enable RSS for incomming UDP traffic or disabled (0)");
 
 /* Priority pausing */
 MLX4_EN_PARM_INT(pfctx, 0, "Priority based Flow Control policy on TX[7:0]."
@@ -107,9 +104,12 @@ static int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
         struct mlx4_en_profile *params = &mdev->profile;
         int i;
 
-        params->rss_xor = (rss_xor != 0);
-        params->rss_mask = rss_mask & 0x1f;
-        params->num_lro = min_t(int, num_lro , MLX4_EN_MAX_LRO_DESCRIPTORS);
+        params->tcp_rss = tcp_rss;
+        params->udp_rss = udp_rss;
+        if (params->udp_rss && !mdev->dev->caps.udp_rss) {
+                mlx4_warn(mdev, "UDP RSS is not supported on this device.\n");
+                params->udp_rss = 0;
+        }
         for (i = 1; i <= MLX4_MAX_PORTS; i++) {
                 params->prof[i].rx_pause = 1;
                 params->prof[i].rx_ppp = pfcrx;
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index a0d8a26f5a02..411bda581c04 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -109,7 +109,7 @@ static void mlx4_en_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
         mutex_unlock(&mdev->state_lock);
 }
 
-static u64 mlx4_en_mac_to_u64(u8 *addr)
+u64 mlx4_en_mac_to_u64(u8 *addr)
 {
         u64 mac = 0;
         int i;
@@ -513,6 +513,10 @@ static void mlx4_en_do_get_stats(struct work_struct *work)
 
                 queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
         }
+        if (mdev->mac_removed[MLX4_MAX_PORTS + 1 - priv->port]) {
+                queue_work(mdev->workqueue, &priv->mac_task);
+                mdev->mac_removed[MLX4_MAX_PORTS + 1 - priv->port] = 0;
+        }
         mutex_unlock(&mdev->state_lock);
 }
 
@@ -528,10 +532,10 @@ static void mlx4_en_linkstate(struct work_struct *work)
          * report to system log */
         if (priv->last_link_state != linkstate) {
                 if (linkstate == MLX4_DEV_EVENT_PORT_DOWN) {
-                        en_dbg(LINK, priv, "Link Down\n");
+                        en_info(priv, "Link Down\n");
                         netif_carrier_off(priv->dev);
                 } else {
-                        en_dbg(LINK, priv, "Link Up\n");
+                        en_info(priv, "Link Up\n");
                         netif_carrier_on(priv->dev);
                 }
         }
@@ -653,6 +657,7 @@ int mlx4_en_start_port(struct net_device *dev)
                 en_err(priv, "Failed setting port mac\n");
                 goto tx_err;
         }
+        mdev->mac_removed[priv->port] = 0;
 
         /* Init port */
         en_dbg(HW, priv, "Initializing port\n");
@@ -704,12 +709,12 @@ void mlx4_en_stop_port(struct net_device *dev)
         netif_tx_stop_all_queues(dev);
         netif_tx_unlock_bh(dev);
 
-        /* close port*/
+        /* Set port as not active */
         priv->port_up = false;
-        mlx4_CLOSE_PORT(mdev->dev, priv->port);
 
         /* Unregister Mac address for the port */
         mlx4_unregister_mac(mdev->dev, priv->port, priv->mac_index);
+        mdev->mac_removed[priv->port] = 1;
 
         /* Free TX Rings */
         for (i = 0; i < priv->tx_ring_num; i++) {
@@ -731,6 +736,9 @@ void mlx4_en_stop_port(struct net_device *dev)
                         msleep(1);
                 mlx4_en_deactivate_cq(priv, &priv->rx_cq[i]);
         }
+
+        /* close port*/
+        mlx4_CLOSE_PORT(mdev->dev, priv->port);
 }
 
 static void mlx4_en_restart(struct work_struct *work)
@@ -1023,9 +1031,10 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
 
         /* Set defualt MAC */
         dev->addr_len = ETH_ALEN;
-        for (i = 0; i < ETH_ALEN; i++)
-                dev->dev_addr[ETH_ALEN - 1 - i] =
-                (u8) (priv->mac >> (8 * i));
+        for (i = 0; i < ETH_ALEN; i++) {
+                dev->dev_addr[ETH_ALEN - 1 - i] = (u8) (priv->mac >> (8 * i));
+                dev->perm_addr[ETH_ALEN - 1 - i] = (u8) (priv->mac >> (8 * i));
+        }
 
         /*
          * Set driver features
@@ -1038,8 +1047,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         dev->features |= NETIF_F_HW_VLAN_TX |
                          NETIF_F_HW_VLAN_RX |
                          NETIF_F_HW_VLAN_FILTER;
-        if (mdev->profile.num_lro)
-                dev->features |= NETIF_F_LRO;
+        dev->features |= NETIF_F_GRO;
         if (mdev->LSO_support) {
                 dev->features |= NETIF_F_TSO;
                 dev->features |= NETIF_F_TSO6;
diff --git a/drivers/net/mlx4/en_port.c b/drivers/net/mlx4/en_port.c
index a29abe845d2e..aa3ef2aee5bf 100644
--- a/drivers/net/mlx4/en_port.c
+++ b/drivers/net/mlx4/en_port.c
@@ -142,6 +142,38 @@ int mlx4_SET_PORT_qpn_calc(struct mlx4_dev *dev, u8 port, u32 base_qpn,
         return err;
 }
 
+int mlx4_en_QUERY_PORT(struct mlx4_en_dev *mdev, u8 port)
+{
+        struct mlx4_en_query_port_context *qport_context;
+        struct mlx4_en_priv *priv = netdev_priv(mdev->pndev[port]);
+        struct mlx4_en_port_state *state = &priv->port_state;
+        struct mlx4_cmd_mailbox *mailbox;
+        int err;
+
+        mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
+        if (IS_ERR(mailbox))
+                return PTR_ERR(mailbox);
+        memset(mailbox->buf, 0, sizeof(*qport_context));
+        err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, port, 0,
+                           MLX4_CMD_QUERY_PORT, MLX4_CMD_TIME_CLASS_B);
+        if (err)
+                goto out;
+        qport_context = mailbox->buf;
+
+        /* This command is always accessed from Ethtool context
+         * already synchronized, no need in locking */
+        state->link_state = !!(qport_context->link_up & MLX4_EN_LINK_UP_MASK);
+        if ((qport_context->link_speed & MLX4_EN_SPEED_MASK) ==
+            MLX4_EN_1G_SPEED)
+                state->link_speed = 1000;
+        else
+                state->link_speed = 10000;
+        state->transciver = qport_context->transceiver;
+
+out:
+        mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+        return err;
+}
 
 int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 {
diff --git a/drivers/net/mlx4/en_port.h b/drivers/net/mlx4/en_port.h
index e6477f12beb5..f6511aa2b7df 100644
--- a/drivers/net/mlx4/en_port.h
+++ b/drivers/net/mlx4/en_port.h
@@ -84,6 +84,20 @@ enum {
         MLX4_MCAST_ENABLE       = 2,
 };
 
+struct mlx4_en_query_port_context {
+        u8 link_up;
+#define MLX4_EN_LINK_UP_MASK    0x80
+        u8 reserved;
+        __be16 mtu;
+        u8 reserved2;
+        u8 link_speed;
+#define MLX4_EN_SPEED_MASK      0x3
+#define MLX4_EN_1G_SPEED        0x2
+        u16 reserved3[5];
+        __be64 mac;
+        u8 transceiver;
+};
+
 
 struct mlx4_en_stat_out_mbox {
         /* Received frames with a length of 64 octets */
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 8e2fcb7103c3..570f2508fb30 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -42,18 +42,6 @@
 #include "mlx4_en.h"
 
 
-static int mlx4_en_get_frag_header(struct skb_frag_struct *frags, void **mac_hdr,
-                                   void **ip_hdr, void **tcpudp_hdr,
-                                   u64 *hdr_flags, void *priv)
-{
-        *mac_hdr = page_address(frags->page) + frags->page_offset;
-        *ip_hdr = *mac_hdr + ETH_HLEN;
-        *tcpudp_hdr = (struct tcphdr *)(*ip_hdr + sizeof(struct iphdr));
-        *hdr_flags = LRO_IPV4 | LRO_TCP;
-
-        return 0;
-}
-
 static int mlx4_en_alloc_frag(struct mlx4_en_priv *priv,
                               struct mlx4_en_rx_desc *rx_desc,
                               struct skb_frag_struct *skb_frags,
@@ -251,7 +239,6 @@ reduce_rings:
                         ring->prod--;
                         mlx4_en_free_rx_desc(priv, ring, ring->actual_size);
                 }
-                ring->size_mask = ring->actual_size - 1;
         }
 
         return 0;
@@ -313,28 +300,8 @@ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
         }
         ring->buf = ring->wqres.buf.direct.buf;
 
-        /* Configure lro mngr */
-        memset(&ring->lro, 0, sizeof(struct net_lro_mgr));
-        ring->lro.dev = priv->dev;
-        ring->lro.features = LRO_F_NAPI;
-        ring->lro.frag_align_pad = NET_IP_ALIGN;
-        ring->lro.ip_summed = CHECKSUM_UNNECESSARY;
-        ring->lro.ip_summed_aggr = CHECKSUM_UNNECESSARY;
-        ring->lro.max_desc = mdev->profile.num_lro;
-        ring->lro.max_aggr = MAX_SKB_FRAGS;
-        ring->lro.lro_arr = kzalloc(mdev->profile.num_lro *
-                                    sizeof(struct net_lro_desc),
-                                    GFP_KERNEL);
-        if (!ring->lro.lro_arr) {
-                en_err(priv, "Failed to allocate lro array\n");
-                goto err_map;
-        }
-        ring->lro.get_frag_header = mlx4_en_get_frag_header;
-
         return 0;
 
-err_map:
-        mlx4_en_unmap_buffer(&ring->wqres.buf);
 err_hwq:
         mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size);
 err_ring:
@@ -389,6 +356,7 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
         for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++) {
                 ring = &priv->rx_ring[ring_ind];
 
+                ring->size_mask = ring->actual_size - 1;
                 mlx4_en_update_rx_prod_db(ring);
         }
 
@@ -412,7 +380,6 @@ void mlx4_en_destroy_rx_ring(struct mlx4_en_priv *priv,
 {
         struct mlx4_en_dev *mdev = priv->mdev;
 
-        kfree(ring->lro.lro_arr);
         mlx4_en_unmap_buffer(&ring->wqres.buf);
         mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size + TXBB_SIZE);
         vfree(ring->rx_info);
@@ -459,7 +426,7 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                         goto fail;
 
                 /* Unmap buffer */
-                pci_unmap_single(mdev->pdev, dma, skb_frags[nr].size,
+                pci_unmap_single(mdev->pdev, dma, skb_frags_rx[nr].size,
                                  PCI_DMA_FROMDEVICE);
         }
         /* Adjust size of last fragment to match actual length */
@@ -541,6 +508,21 @@ static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
         return skb;
 }
 
+static void validate_loopback(struct mlx4_en_priv *priv, struct sk_buff *skb)
+{
+        int i;
+        int offset = ETH_HLEN;
+
+        for (i = 0; i < MLX4_LOOPBACK_TEST_PAYLOAD; i++, offset++) {
+                if (*(skb->data + offset) != (unsigned char) (i & 0xff))
+                        goto out_loopback;
+        }
+        /* Loopback found */
+        priv->loopback_ok = 1;
+
+out_loopback:
+        dev_kfree_skb_any(skb);
+}
 
 int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int budget)
 {
@@ -548,7 +530,6 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
         struct mlx4_cqe *cqe;
         struct mlx4_en_rx_ring *ring = &priv->rx_ring[cq->ring];
         struct skb_frag_struct *skb_frags;
-        struct skb_frag_struct lro_frags[MLX4_EN_MAX_RX_FRAGS];
         struct mlx4_en_rx_desc *rx_desc;
         struct sk_buff *skb;
         int index;
@@ -608,37 +589,35 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                                  * - TCP/IP (v4)
                                  * - without IP options
                                  * - not an IP fragment */
-                                if (mlx4_en_can_lro(cqe->status) &&
-                                    dev->features & NETIF_F_LRO) {
+                                if (dev->features & NETIF_F_GRO) {
+                                        struct sk_buff *gro_skb = napi_get_frags(&cq->napi);
+                                        if (!gro_skb)
+                                                goto next;
 
                                         nr = mlx4_en_complete_rx_desc(
                                                 priv, rx_desc,
-                                                skb_frags, lro_frags,
+                                                skb_frags, skb_shinfo(gro_skb)->frags,
                                                 ring->page_alloc, length);
                                         if (!nr)
                                                 goto next;
 
+                                        skb_shinfo(gro_skb)->nr_frags = nr;
+                                        gro_skb->len = length;
+                                        gro_skb->data_len = length;
+                                        gro_skb->truesize += length;
+                                        gro_skb->ip_summed = CHECKSUM_UNNECESSARY;
+
                                         if (priv->vlgrp && (cqe->vlan_my_qpn &
-                                                            cpu_to_be32(MLX4_CQE_VLAN_PRESENT_MASK))) {
-                                                lro_vlan_hwaccel_receive_frags(
-                                                       &ring->lro, lro_frags,
-                                                       length, length,
-                                                       priv->vlgrp,
-                                                       be16_to_cpu(cqe->sl_vid),
-                                                       NULL, 0);
-                                        } else
-                                                lro_receive_frags(&ring->lro,
-                                                                  lro_frags,
-                                                                  length,
-                                                                  length,
-                                                                  NULL, 0);
+                                                            cpu_to_be32(MLX4_CQE_VLAN_PRESENT_MASK)))
+                                                vlan_gro_frags(&cq->napi, priv->vlgrp, be16_to_cpu(cqe->sl_vid));
+                                        else
+                                                napi_gro_frags(&cq->napi);
 
                                         goto next;
                                 }
 
                                 /* LRO not possible, complete processing here */
                                 ip_summed = CHECKSUM_UNNECESSARY;
-                                INC_PERF_COUNTER(priv->pstats.lro_misses);
                         } else {
                                 ip_summed = CHECKSUM_NONE;
                                 priv->port_stats.rx_chksum_none++;
@@ -655,6 +634,11 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                         goto next;
                 }
 
+                if (unlikely(priv->validate_loopback)) {
+                        validate_loopback(priv, skb);
+                        goto next;
+                }
+
                 skb->ip_summed = ip_summed;
                 skb->protocol = eth_type_trans(skb, dev);
                 skb_record_rx_queue(skb, cq->ring);
@@ -674,14 +658,10 @@ next:
                 if (++polled == budget) {
                         /* We are here because we reached the NAPI budget -
                          * flush only pending LRO sessions */
-                        lro_flush_all(&ring->lro);
                         goto out;
                 }
         }
 
-        /* If CQ is empty flush all LRO sessions unconditionally */
-        lro_flush_all(&ring->lro);
-
 out:
         AVG_PERF_COUNTER(priv->pstats.rx_coal_avg, polled);
         mlx4_cq_set_ci(&cq->mcq);
@@ -816,7 +796,7 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv, int qpn,
         qp->event = mlx4_en_sqp_event;
 
         memset(context, 0, sizeof *context);
-        mlx4_en_fill_qp_context(priv, ring->size, ring->stride, 0, 0,
+        mlx4_en_fill_qp_context(priv, ring->actual_size, ring->stride, 0, 0,
                                 qpn, ring->cqn, context);
         context->db_rec_addr = cpu_to_be64(ring->wqres.db.dma);
 
@@ -839,8 +819,7 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
         struct mlx4_qp_context context;
         struct mlx4_en_rss_context *rss_context;
         void *ptr;
-        int rss_xor = mdev->profile.rss_xor;
-        u8 rss_mask = mdev->profile.rss_mask;
+        u8 rss_mask = 0x3f;
         int i, qpn;
         int err = 0;
         int good_qps = 0;
@@ -886,9 +865,10 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
         rss_context->base_qpn = cpu_to_be32(ilog2(priv->rx_ring_num) << 24 |
                                             (rss_map->base_qpn));
         rss_context->default_qpn = cpu_to_be32(rss_map->base_qpn);
-        rss_context->hash_fn = rss_xor & 0x3;
-        rss_context->flags = rss_mask << 2;
+        rss_context->flags = rss_mask;
 
+        if (priv->mdev->profile.udp_rss)
+                rss_context->base_qpn_udp = rss_context->default_qpn;
         err = mlx4_qp_to_ready(mdev->dev, &priv->res.mtt, &context,
                                &rss_map->indir_qp, &rss_map->indir_state);
         if (err)
diff --git a/drivers/net/mlx4/en_selftest.c b/drivers/net/mlx4/en_selftest.c
new file mode 100644
index 000000000000..9c91a92da705
--- /dev/null
+++ b/drivers/net/mlx4/en_selftest.c
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2007 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/ethtool.h>
+#include <linux/netdevice.h>
+#include <linux/delay.h>
+#include <linux/mlx4/driver.h>
+
+#include "mlx4_en.h"
+
+
+static int mlx4_en_test_registers(struct mlx4_en_priv *priv)
+{
+        return mlx4_cmd(priv->mdev->dev, 0, 0, 0, MLX4_CMD_HW_HEALTH_CHECK,
+                        MLX4_CMD_TIME_CLASS_A);
+}
+
+static int mlx4_en_test_loopback_xmit(struct mlx4_en_priv *priv)
+{
+        struct sk_buff *skb;
+        struct ethhdr *ethh;
+        unsigned char *packet;
+        unsigned int packet_size = MLX4_LOOPBACK_TEST_PAYLOAD;
+        unsigned int i;
+        int err;
+
+
+        /* build the pkt before xmit */
+        skb = netdev_alloc_skb(priv->dev, MLX4_LOOPBACK_TEST_PAYLOAD + ETH_HLEN + NET_IP_ALIGN);
+        if (!skb) {
+                en_err(priv, "-LOOPBACK_TEST_XMIT- failed to create skb for xmit\n");
+                return -ENOMEM;
+        }
+        skb_reserve(skb, NET_IP_ALIGN);
+
+        ethh = (struct ethhdr *)skb_put(skb, sizeof(struct ethhdr));
+        packet  = (unsigned char *)skb_put(skb, packet_size);
+        memcpy(ethh->h_dest, priv->dev->dev_addr, ETH_ALEN);
+        memset(ethh->h_source, 0, ETH_ALEN);
+        ethh->h_proto = htons(ETH_P_ARP);
+        skb_set_mac_header(skb, 0);
+        for (i = 0; i < packet_size; ++i)       /* fill our packet */
+                packet[i] = (unsigned char)(i & 0xff);
+
+        /* xmit the pkt */
+        err = mlx4_en_xmit(skb, priv->dev);
+        return err;
+}
+
+static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
+{
+        u32 loopback_ok = 0;
+        int i;
+
+
+        priv->loopback_ok = 0;
+        priv->validate_loopback = 1;
+
+        /* xmit */
+        if (mlx4_en_test_loopback_xmit(priv)) {
+                en_err(priv, "Transmitting loopback packet failed\n");
+                goto mlx4_en_test_loopback_exit;
+        }
+
+        /* polling for result */
+        for (i = 0; i < MLX4_EN_LOOPBACK_RETRIES; ++i) {
+                msleep(MLX4_EN_LOOPBACK_TIMEOUT);
+                if (priv->loopback_ok) {
+                        loopback_ok = 1;
+                        break;
+                }
+        }
+        if (!loopback_ok)
+                en_err(priv, "Loopback packet didn't arrive\n");
+
+mlx4_en_test_loopback_exit:
+
+        priv->validate_loopback = 0;
+        return !loopback_ok;
+}
+
+
+static int mlx4_en_test_link(struct mlx4_en_priv *priv)
+{
+        if (mlx4_en_QUERY_PORT(priv->mdev, priv->port))
+                return -ENOMEM;
+        if (priv->port_state.link_state == 1)
+                return 0;
+        else
+                return 1;
+}
+
+static int mlx4_en_test_speed(struct mlx4_en_priv *priv)
+{
+
+        if (mlx4_en_QUERY_PORT(priv->mdev, priv->port))
+                return -ENOMEM;
+
+        /* The device currently only supports 10G speed */
+        if (priv->port_state.link_speed != SPEED_10000)
+                return priv->port_state.link_speed;
+        return 0;
+}
+
+
+void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
+{
+        struct mlx4_en_priv *priv = netdev_priv(dev);
+        struct mlx4_en_dev *mdev = priv->mdev;
+        struct mlx4_en_tx_ring *tx_ring;
+        int i, carrier_ok;
+
+        memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
+
+        if (*flags & ETH_TEST_FL_OFFLINE) {
+                /* disable the interface */
+                carrier_ok = netif_carrier_ok(dev);
+
+                netif_carrier_off(dev);
+retry_tx:
+                /* Wait untill all tx queues are empty.
+                 * there should not be any additional incoming traffic
+                 * since we turned the carrier off */
+                msleep(200);
+                for (i = 0; i < priv->tx_ring_num && carrier_ok; i++) {
+                        tx_ring = &priv->tx_ring[i];
+                        if (tx_ring->prod != (tx_ring->cons + tx_ring->last_nr_txbb))
+                                goto retry_tx;
+                }
+
+                if (priv->mdev->dev->caps.loopback_support){
+                        buf[3] = mlx4_en_test_registers(priv);
+                        buf[4] = mlx4_en_test_loopback(priv);
+                }
+
+                if (carrier_ok)
+                        netif_carrier_on(dev);
+
+        }
+        buf[0] = mlx4_test_interrupts(mdev->dev);
+        buf[1] = mlx4_en_test_link(priv);
+        buf[2] = mlx4_en_test_speed(priv);
+
+        for (i = 0; i < MLX4_EN_NUM_SELF_TEST; i++) {
+                if (buf[i])
+                        *flags |= ETH_TEST_FL_FAILED;
+        }
+}
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 580968f304eb..98dd620042a8 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -38,6 +38,7 @@
 #include <linux/skbuff.h>
 #include <linux/if_vlan.h>
 #include <linux/vmalloc.h>
+#include <linux/tcp.h>
 
 #include "mlx4_en.h"
 
@@ -600,6 +601,9 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         struct mlx4_wqe_data_seg *data;
         struct skb_frag_struct *frag;
         struct mlx4_en_tx_info *tx_info;
+        struct ethhdr *ethh;
+        u64 mac;
+        u32 mac_l, mac_h;
         int tx_ind = 0;
         int nr_txbb;
         int desc_size;
@@ -612,6 +616,9 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         int lso_header_size;
         void *fragptr;
 
+        if (!priv->port_up)
+                goto tx_drop;
+
         real_size = get_real_size(skb, dev, &lso_header_size);
         if (unlikely(!real_size))
                 goto tx_drop;
@@ -676,6 +683,19 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                 priv->port_stats.tx_chksum_offload++;
         }
 
+        if (unlikely(priv->validate_loopback)) {
+                /* Copy dst mac address to wqe */
+                skb_reset_mac_header(skb);
+                ethh = eth_hdr(skb);
+                if (ethh && ethh->h_dest) {
+                        mac = mlx4_en_mac_to_u64(ethh->h_dest);
+                        mac_h = (u32) ((mac & 0xffff00000000ULL) >> 16);
+                        mac_l = (u32) (mac & 0xffffffff);
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(mac_h);
+                        tx_desc->ctrl.imm = cpu_to_be32(mac_l);
+                }
+        }
+
         /* Handle LSO (TSO) packets */
         if (lso_header_size) {
                 /* Mark opcode as LSO */
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index 6d7b2bf210ce..552d0fce6f67 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -699,3 +699,47 @@ void mlx4_cleanup_eq_table(struct mlx4_dev *dev)
 
         kfree(priv->eq_table.uar_map);
 }
+
+/* A test that verifies that we can accept interrupts on all
+ * the irq vectors of the device.
+ * Interrupts are checked using the NOP command.
+ */
+int mlx4_test_interrupts(struct mlx4_dev *dev)
+{
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int i;
+        int err;
+
+        err = mlx4_NOP(dev);
+        /* When not in MSI_X, there is only one irq to check */
+        if (!(dev->flags & MLX4_FLAG_MSI_X))
+                return err;
+
+        /* A loop over all completion vectors, for each vector we will check
+         * whether it works by mapping command completions to that vector
+         * and performing a NOP command
+         */
+        for(i = 0; !err && (i < dev->caps.num_comp_vectors); ++i) {
+                /* Temporary use polling for command completions */
+                mlx4_cmd_use_polling(dev);
+
+                /* Map the new eq to handle all asyncronous events */
+                err = mlx4_MAP_EQ(dev, MLX4_ASYNC_EVENT_MASK, 0,
+                                  priv->eq_table.eq[i].eqn);
+                if (err) {
+                        mlx4_warn(dev, "Failed mapping eq for interrupt test\n");
+                        mlx4_cmd_use_events(dev);
+                        break;
+                }
+
+                /* Go back to using events */
+                mlx4_cmd_use_events(dev);
+                err = mlx4_NOP(dev);
+        }
+
+        /* Return to default */
+        mlx4_MAP_EQ(dev, MLX4_ASYNC_EVENT_MASK, 0,
+                    priv->eq_table.eq[dev->caps.num_comp_vectors].eqn);
+        return err;
+}
+EXPORT_SYMBOL(mlx4_test_interrupts);
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index 04f42ae1eda0..b716e1a1b298 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -141,6 +141,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         struct mlx4_cmd_mailbox *mailbox;
         u32 *outbox;
         u8 field;
+        u32 field32;
         u16 size;
         u16 stat_rate;
         int err;
@@ -178,6 +179,8 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 #define QUERY_DEV_CAP_MAX_GID_OFFSET            0x3b
 #define QUERY_DEV_CAP_RATE_SUPPORT_OFFSET       0x3c
 #define QUERY_DEV_CAP_MAX_PKEY_OFFSET           0x3f
+#define QUERY_DEV_CAP_UDP_RSS_OFFSET            0x42
+#define QUERY_DEV_CAP_ETH_UC_LOOPBACK_OFFSET    0x43
 #define QUERY_DEV_CAP_FLAGS_OFFSET              0x44
 #define QUERY_DEV_CAP_RSVD_UAR_OFFSET           0x48
 #define QUERY_DEV_CAP_UAR_SZ_OFFSET             0x49
@@ -268,6 +271,10 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev_cap->max_msg_sz = 1 << (field & 0x1f);
         MLX4_GET(stat_rate, outbox, QUERY_DEV_CAP_RATE_SUPPORT_OFFSET);
         dev_cap->stat_rate_support = stat_rate;
+        MLX4_GET(field, outbox, QUERY_DEV_CAP_UDP_RSS_OFFSET);
+        dev_cap->udp_rss = field & 0x1;
+        MLX4_GET(field, outbox, QUERY_DEV_CAP_ETH_UC_LOOPBACK_OFFSET);
+        dev_cap->loopback_support = field & 0x1;
         MLX4_GET(dev_cap->flags, outbox, QUERY_DEV_CAP_FLAGS_OFFSET);
         MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_UAR_OFFSET);
         dev_cap->reserved_uars = field >> 4;
@@ -365,6 +372,9 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 #define QUERY_PORT_MAX_MACVLAN_OFFSET           0x0a
 #define QUERY_PORT_MAX_VL_OFFSET                0x0b
 #define QUERY_PORT_MAC_OFFSET                   0x10
+#define QUERY_PORT_TRANS_VENDOR_OFFSET          0x18
+#define QUERY_PORT_WAVELENGTH_OFFSET            0x1c
+#define QUERY_PORT_TRANS_CODE_OFFSET            0x20
 
                 for (i = 1; i <= dev_cap->num_ports; ++i) {
                         err = mlx4_cmd_box(dev, 0, mailbox->dma, i, 0, MLX4_CMD_QUERY_PORT,
@@ -388,6 +398,11 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                         dev_cap->log_max_vlans[i] = field >> 4;
                         MLX4_GET(dev_cap->eth_mtu[i], outbox, QUERY_PORT_ETH_MTU_OFFSET);
                         MLX4_GET(dev_cap->def_mac[i], outbox, QUERY_PORT_MAC_OFFSET);
+                        MLX4_GET(field32, outbox, QUERY_PORT_TRANS_VENDOR_OFFSET);
+                        dev_cap->trans_type[i] = field32 >> 24;
+                        dev_cap->vendor_oui[i] = field32 & 0xffffff;
+                        MLX4_GET(dev_cap->wavelength[i], outbox, QUERY_PORT_WAVELENGTH_OFFSET);
+                        MLX4_GET(dev_cap->trans_code[i], outbox, QUERY_PORT_TRANS_CODE_OFFSET);
                 }
         }
 
diff --git a/drivers/net/mlx4/fw.h b/drivers/net/mlx4/fw.h
index 526d7f30c041..65cc72eb899d 100644
--- a/drivers/net/mlx4/fw.h
+++ b/drivers/net/mlx4/fw.h
@@ -73,7 +73,13 @@ struct mlx4_dev_cap {
         int max_pkeys[MLX4_MAX_PORTS + 1];
         u64 def_mac[MLX4_MAX_PORTS + 1];
         u16 eth_mtu[MLX4_MAX_PORTS + 1];
+        int trans_type[MLX4_MAX_PORTS + 1];
+        int vendor_oui[MLX4_MAX_PORTS + 1];
+        u16 wavelength[MLX4_MAX_PORTS + 1];
+        u64 trans_code[MLX4_MAX_PORTS + 1];
         u16 stat_rate_support;
+        int udp_rss;
+        int loopback_support;
         u32 flags;
         int reserved_uars;
         int uar_size;
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 5102ab1ac561..569fa3df381f 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -184,6 +184,10 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 dev->caps.eth_mtu_cap[i]    = dev_cap->eth_mtu[i];
                 dev->caps.def_mac[i]        = dev_cap->def_mac[i];
                 dev->caps.supported_type[i] = dev_cap->supported_port_types[i];
+                dev->caps.trans_type[i]     = dev_cap->trans_type[i];
+                dev->caps.vendor_oui[i]     = dev_cap->vendor_oui[i];
+                dev->caps.wavelength[i]     = dev_cap->wavelength[i];
+                dev->caps.trans_code[i]     = dev_cap->trans_code[i];
         }
 
         dev->caps.num_uars           = dev_cap->uar_size / PAGE_SIZE;
@@ -221,6 +225,8 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev->caps.bmme_flags         = dev_cap->bmme_flags;
         dev->caps.reserved_lkey      = dev_cap->reserved_lkey;
         dev->caps.stat_rate_support  = dev_cap->stat_rate_support;
+        dev->caps.udp_rss            = dev_cap->udp_rss;
+        dev->caps.loopback_support   = dev_cap->loopback_support;
         dev->caps.max_gso_sz         = dev_cap->max_gso_sz;
 
         dev->caps.log_num_macs  = log_num_mac;
diff --git a/drivers/net/mlx4/mlx4_en.h b/drivers/net/mlx4/mlx4_en.h
index 449210994ee9..1fc16ab7ad2f 100644
--- a/drivers/net/mlx4/mlx4_en.h
+++ b/drivers/net/mlx4/mlx4_en.h
@@ -38,19 +38,19 @@
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
-#include <linux/inet_lro.h>
 
 #include <linux/mlx4/device.h>
 #include <linux/mlx4/qp.h>
 #include <linux/mlx4/cq.h>
 #include <linux/mlx4/srq.h>
 #include <linux/mlx4/doorbell.h>
+#include <linux/mlx4/cmd.h>
 
 #include "en_port.h"
 
 #define DRV_NAME        "mlx4_en"
-#define DRV_VERSION     "1.4.1.1"
-#define DRV_RELDATE     "June 2009"
+#define DRV_VERSION     "1.5.1.6"
+#define DRV_RELDATE     "August 2010"
 
 #define MLX4_EN_MSG_LEVEL       (NETIF_MSG_LINK | NETIF_MSG_IFDOWN)
 
@@ -61,7 +61,6 @@
 
 #define MLX4_EN_PAGE_SHIFT      12
 #define MLX4_EN_PAGE_SIZE       (1 << MLX4_EN_PAGE_SHIFT)
-#define MAX_TX_RINGS            16
 #define MAX_RX_RINGS            16
 #define TXBB_SIZE               64
 #define HEADROOM                (2048 / TXBB_SIZE + 1)
@@ -107,6 +106,7 @@ enum {
 #define MLX4_EN_SMALL_PKT_SIZE          64
 #define MLX4_EN_NUM_TX_RINGS            8
 #define MLX4_EN_NUM_PPP_RINGS           8
+#define MAX_TX_RINGS                    (MLX4_EN_NUM_TX_RINGS + MLX4_EN_NUM_PPP_RINGS)
 #define MLX4_EN_DEF_TX_RING_SIZE        512
 #define MLX4_EN_DEF_RX_RING_SIZE        1024
 
@@ -139,10 +139,14 @@ enum {
 
 #define SMALL_PACKET_SIZE      (256 - NET_IP_ALIGN)
 #define HEADER_COPY_SIZE       (128 - NET_IP_ALIGN)
+#define MLX4_LOOPBACK_TEST_PAYLOAD (HEADER_COPY_SIZE - ETH_HLEN)
 
 #define MLX4_EN_MIN_MTU         46
 #define ETH_BCAST               0xffffffffffffULL
 
+#define MLX4_EN_LOOPBACK_RETRIES        5
+#define MLX4_EN_LOOPBACK_TIMEOUT        100
+
 #ifdef MLX4_EN_PERF_STAT
 /* Number of samples to 'average' */
 #define AVG_SIZE                        128
@@ -249,7 +253,6 @@ struct mlx4_en_rx_desc {
 struct mlx4_en_rx_ring {
         struct mlx4_hwq_resources wqres;
         struct mlx4_en_rx_alloc page_alloc[MLX4_EN_MAX_RX_FRAGS];
-        struct net_lro_mgr lro;
         u32 size ;      /* number of Rx descs*/
         u32 actual_size;
         u32 size_mask;
@@ -313,7 +316,8 @@ struct mlx4_en_port_profile {
 
 struct mlx4_en_profile {
         int rss_xor;
-        int num_lro;
+        int tcp_rss;
+        int udp_rss;
         u8 rss_mask;
         u32 active_ports;
         u32 small_pkt_int;
@@ -337,6 +341,7 @@ struct mlx4_en_dev {
         struct mlx4_mr          mr;
         u32                     priv_pdn;
         spinlock_t              uar_lock;
+        u8                      mac_removed[MLX4_MAX_PORTS + 1];
 };
 
 
@@ -355,6 +360,13 @@ struct mlx4_en_rss_context {
         u8 hash_fn;
         u8 flags;
         __be32 rss_key[10];
+        __be32 base_qpn_udp;
+};
+
+struct mlx4_en_port_state {
+        int link_state;
+        int link_speed;
+        int transciver;
 };
 
 struct mlx4_en_pkt_stats {
@@ -365,9 +377,6 @@ struct mlx4_en_pkt_stats {
 };
 
 struct mlx4_en_port_stats {
-        unsigned long lro_aggregated;
-        unsigned long lro_flushed;
-        unsigned long lro_no_desc;
         unsigned long tso_packets;
         unsigned long queue_stopped;
         unsigned long wake_queue;
@@ -376,7 +385,7 @@ struct mlx4_en_port_stats {
         unsigned long rx_chksum_good;
         unsigned long rx_chksum_none;
         unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          11
+#define NUM_PORT_STATS          8
 };
 
 struct mlx4_en_perf_stats {
@@ -405,6 +414,7 @@ struct mlx4_en_priv {
         struct vlan_group *vlgrp;
         struct net_device_stats stats;
         struct net_device_stats ret_stats;
+        struct mlx4_en_port_state port_state;
         spinlock_t stats_lock;
 
         unsigned long last_moder_packets;
@@ -423,6 +433,8 @@ struct mlx4_en_priv {
         u16 sample_interval;
         u16 adaptive_rx_coal;
         u32 msg_enable;
+        u32 loopback_ok;
+        u32 validate_loopback;
 
         struct mlx4_hwq_resources res;
         int link_state;
@@ -531,6 +543,11 @@ int mlx4_SET_PORT_qpn_calc(struct mlx4_dev *dev, u8 port, u32 base_qpn,
                            u8 promisc);
 
 int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset);
+int mlx4_en_QUERY_PORT(struct mlx4_en_dev *mdev, u8 port);
+
+#define MLX4_EN_NUM_SELF_TEST   5
+void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf);
+u64 mlx4_en_mac_to_u64(u8 *addr);
 
 /*
  * Globals
@@ -555,6 +572,8 @@ do {								\
         en_print(KERN_WARNING, priv, format, ##arg)
 #define en_err(priv, format, arg...)                    \
         en_print(KERN_ERR, priv, format, ##arg)
+#define en_info(priv, format, arg...)                   \
+        en_print(KERN_INFO, priv, format, ## arg)
 
 #define mlx4_err(mdev, format, arg...)                  \
         pr_err("%s %s: " format, DRV_NAME,              \
diff --git a/drivers/net/mlx4/profile.c b/drivers/net/mlx4/profile.c
index 5caf0115fa5b..e749f82865fe 100644
--- a/drivers/net/mlx4/profile.c
+++ b/drivers/net/mlx4/profile.c
@@ -85,7 +85,7 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
         struct mlx4_resource tmp;
         int i, j;
 
-        profile = kzalloc(MLX4_RES_NUM * sizeof *profile, GFP_KERNEL);
+        profile = kcalloc(MLX4_RES_NUM, sizeof(*profile), GFP_KERNEL);
         if (!profile)
                 return -ENOMEM;
 
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index fb2c0927d3cc..4f3a3c0d6d08 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -1555,12 +1555,12 @@ static irqreturn_t myri10ge_intr(int irq, void *arg)
          * valid  since MSI-X irqs are not shared */
         if ((mgp->dev->real_num_tx_queues == 1) && (ss != mgp->ss)) {
                 napi_schedule(&ss->napi);
-                return (IRQ_HANDLED);
+                return IRQ_HANDLED;
         }
 
         /* make sure it is our IRQ, and that the DMA has finished */
         if (unlikely(!stats->valid))
-                return (IRQ_NONE);
+                return IRQ_NONE;
 
         /* low bit indicates receives are present, so schedule
          * napi poll handler */
@@ -1599,7 +1599,7 @@ static irqreturn_t myri10ge_intr(int irq, void *arg)
                 myri10ge_check_statblock(mgp);
 
         put_be32(htonl(3), ss->irq_claim + 1);
-        return (IRQ_HANDLED);
+        return IRQ_HANDLED;
 }
 
 static int
@@ -3753,8 +3753,8 @@ static void myri10ge_probe_slices(struct myri10ge_priv *mgp)
          * slices. We give up on MSI-X if we can only get a single
          * vector. */
 
-        mgp->msix_vectors = kzalloc(mgp->num_slices *
-                                    sizeof(*mgp->msix_vectors), GFP_KERNEL);
+        mgp->msix_vectors = kcalloc(mgp->num_slices, sizeof(*mgp->msix_vectors),
+                                    GFP_KERNEL);
         if (mgp->msix_vectors == NULL)
                 goto disable_msix;
         for (i = 0; i < mgp->num_slices; i++) {
diff --git a/drivers/net/myri_sbus.c b/drivers/net/myri_sbus.c
index 617f898ba5f0..4846e131a04e 100644
--- a/drivers/net/myri_sbus.c
+++ b/drivers/net/myri_sbus.c
@@ -735,7 +735,7 @@ static int myri_header(struct sk_buff *skb, struct net_device *dev,
                 int i;
                 for (i = 0; i < dev->addr_len; i++)
                         eth->h_dest[i] = 0;
-                return(dev->hard_header_len);
+                return dev->hard_header_len;
         }
 
         if (daddr) {
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index a6033d48b5cc..2fd39630b1e5 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -1570,7 +1570,7 @@ static int netdev_open(struct net_device *dev)
         init_timer(&np->timer);
         np->timer.expires = round_jiffies(jiffies + NATSEMI_TIMER_FREQ);
         np->timer.data = (unsigned long)dev;
-        np->timer.function = &netdev_timer; /* timer handler */
+        np->timer.function = netdev_timer; /* timer handler */
         add_timer(&np->timer);
 
         return 0;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index b075a35b85d4..a2d805aa75cd 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -346,7 +346,7 @@ static u32 netxen_decode_crb_addr(u32 addr)
         if (pci_base == NETXEN_ADDR_ERROR)
                 return pci_base;
         else
-                return (pci_base + offset);
+                return pci_base + offset;
 }
 
 #define NETXEN_MAX_ROM_WAIT_USEC        100
@@ -1789,7 +1789,7 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
         done = (sw_consumer == hw_consumer);
         spin_unlock(&adapter->tx_clean_lock);
 
-        return (done);
+        return done;
 }
 
 void
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 73d314592230..2c6ceeb592b3 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -177,7 +177,7 @@ netxen_alloc_sds_rings(struct netxen_recv_context *recv_ctx, int count)
 
         recv_ctx->sds_rings = kzalloc(size, GFP_KERNEL);
 
-        return (recv_ctx->sds_rings == NULL);
+        return recv_ctx->sds_rings == NULL;
 }
 
 static void
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index fe6983af6918..4cd92421708d 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -283,7 +283,7 @@ static int niu_enable_interrupts(struct niu *np, int on)
 
 static u32 phy_encode(u32 type, int port)
 {
-        return (type << (port * 2));
+        return type << (port * 2);
 }
 
 static u32 phy_decode(u32 val, int port)
@@ -3043,8 +3043,7 @@ static int tcam_flush_all(struct niu *np)
 
 static u64 hash_addr_regval(unsigned long index, unsigned long num_entries)
 {
-        return ((u64)index | (num_entries == 1 ?
-                              HASH_TBL_ADDR_AUTOINC : 0));
+        return (u64)index | (num_entries == 1 ? HASH_TBL_ADDR_AUTOINC : 0);
 }
 
 #if 0
@@ -3276,7 +3275,7 @@ static u16 tcam_get_index(struct niu *np, u16 idx)
         /* One entry reserved for IP fragment rule */
         if (idx >= (np->clas.tcam_sz - 1))
                 idx = 0;
-        return (np->clas.tcam_top + ((idx+1) * np->parent->num_ports));
+        return np->clas.tcam_top + ((idx+1) * np->parent->num_ports);
 }
 
 static u16 tcam_get_size(struct niu *np)
@@ -3313,7 +3312,7 @@ static unsigned int niu_hash_rxaddr(struct rx_ring_info *rp, u64 a)
         a >>= PAGE_SHIFT;
         a ^= (a >> ilog2(MAX_RBR_RING_SIZE));
 
-        return (a & (MAX_RBR_RING_SIZE - 1));
+        return a & (MAX_RBR_RING_SIZE - 1);
 }
 
 static struct page *niu_find_rxpage(struct rx_ring_info *rp, u64 addr,
@@ -3484,7 +3483,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                                      RCR_ENTRY_ERROR)))
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                         else
-                                skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(skb);
                 } else if (!(val & RCR_ENTRY_MULTI))
                         append_size = len - skb->len;
 
@@ -4504,7 +4503,7 @@ static int niu_alloc_channels(struct niu *np)
 
         np->dev->real_num_tx_queues = np->num_tx_rings;
 
-        np->rx_rings = kzalloc(np->num_rx_rings * sizeof(struct rx_ring_info),
+        np->rx_rings = kcalloc(np->num_rx_rings, sizeof(struct rx_ring_info),
                                GFP_KERNEL);
         err = -ENOMEM;
         if (!np->rx_rings)
@@ -4538,7 +4537,7 @@ static int niu_alloc_channels(struct niu *np)
                         return err;
         }
 
-        np->tx_rings = kzalloc(np->num_tx_rings * sizeof(struct tx_ring_info),
+        np->tx_rings = kcalloc(np->num_tx_rings, sizeof(struct tx_ring_info),
                                GFP_KERNEL);
         err = -ENOMEM;
         if (!np->tx_rings)
@@ -7462,10 +7461,12 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
         if (fsp->flow_type == IP_USER_FLOW) {
                 int i;
                 int add_usr_cls = 0;
-                int ipv6 = 0;
                 struct ethtool_usrip4_spec *uspec = &fsp->h_u.usr_ip4_spec;
                 struct ethtool_usrip4_spec *umask = &fsp->m_u.usr_ip4_spec;
 
+                if (uspec->ip_ver != ETH_RX_NFC_IP4)
+                        return -EINVAL;
+
                 niu_lock_parent(np, flags);
 
                 for (i = 0; i < NIU_L3_PROG_CLS; i++) {
@@ -7494,9 +7495,7 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
                                 default:
                                         break;
                                 }
-                                if (uspec->ip_ver == ETH_RX_NFC_IP6)
-                                        ipv6 = 1;
-                                ret = tcam_user_ip_class_set(np, class, ipv6,
+                                ret = tcam_user_ip_class_set(np, class, 0,
                                                              uspec->proto,
                                                              uspec->tos,
                                                              umask->tos);
@@ -7553,16 +7552,7 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
                 ret = -EINVAL;
                 goto out;
         case IP_USER_FLOW:
-                if (fsp->h_u.usr_ip4_spec.ip_ver == ETH_RX_NFC_IP4) {
-                        niu_get_tcamkey_from_ip4fs(fsp, tp, l2_rdc_table,
-                                                   class);
-                } else {
-                        /* Not yet implemented */
-                        netdev_info(np->dev, "niu%d: In %s(): usr flow for IPv6 not implemented\n",
-                                    parent->index, __func__);
-                        ret = -EINVAL;
-                        goto out;
-                }
+                niu_get_tcamkey_from_ip4fs(fsp, tp, l2_rdc_table, class);
                 break;
         default:
                 netdev_info(np->dev, "niu%d: In %s(): Unknown flow type %d\n",
@@ -7805,11 +7795,11 @@ static int niu_get_sset_count(struct net_device *dev, int stringset)
         if (stringset != ETH_SS_STATS)
                 return -EINVAL;
 
-        return ((np->flags & NIU_FLAGS_XMAC ?
+        return (np->flags & NIU_FLAGS_XMAC ?
                  NUM_XMAC_STAT_KEYS :
                  NUM_BMAC_STAT_KEYS) +
                 (np->num_rx_rings * NUM_RXCHAN_STAT_KEYS) +
-                (np->num_tx_rings * NUM_TXCHAN_STAT_KEYS));
+                (np->num_tx_rings * NUM_TXCHAN_STAT_KEYS);
 }
 
 static void niu_get_ethtool_stats(struct net_device *dev,
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 5a3488f76b38..3bbd0aab17e8 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -923,7 +923,7 @@ static void rx_irq(struct net_device *ndev)
                         if ((extsts & 0x002a0000) && !(extsts & 0x00540000)) {
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                         } else {
-                                skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(skb);
                         }
                         skb->protocol = eth_type_trans(skb, ndev);
 #ifdef NS83820_VLAN_ACCEL_SUPPORT
@@ -1246,7 +1246,6 @@ static int ns83820_get_settings(struct net_device *ndev,
 {
         struct ns83820 *dev = PRIV(ndev);
         u32 cfg, tanar, tbicr;
-        int have_optical = 0;
         int fullduplex   = 0;
 
         /*
@@ -1267,25 +1266,25 @@ static int ns83820_get_settings(struct net_device *ndev,
         tanar = readl(dev->base + TANAR);
         tbicr = readl(dev->base + TBICR);
 
-        if (dev->CFG_cache & CFG_TBI_EN) {
-                /* we have an optical interface */
-                have_optical = 1;
-                fullduplex = (cfg & CFG_DUPSTS) ? 1 : 0;
-
-        } else {
-                /* We have copper */
-                fullduplex = (cfg & CFG_DUPSTS) ? 1 : 0;
-        }
+        fullduplex = (cfg & CFG_DUPSTS) ? 1 : 0;
 
         cmd->supported = SUPPORTED_Autoneg;
 
-        /* we have optical interface */
         if (dev->CFG_cache & CFG_TBI_EN) {
+                /* we have optical interface */
                 cmd->supported |= SUPPORTED_1000baseT_Half |
                                         SUPPORTED_1000baseT_Full |
                                         SUPPORTED_FIBRE;
                 cmd->port       = PORT_FIBRE;
-        } /* TODO: else copper related  support */
+        } else {
+                /* we have copper */
+                cmd->supported |= SUPPORTED_10baseT_Half |
+                        SUPPORTED_10baseT_Full | SUPPORTED_100baseT_Half |
+                        SUPPORTED_100baseT_Full | SUPPORTED_1000baseT_Half |
+                        SUPPORTED_1000baseT_Full |
+                        SUPPORTED_MII;
+                cmd->port = PORT_MII;
+        }
 
         cmd->duplex = fullduplex ? DUPLEX_FULL : DUPLEX_HALF;
         switch (cfg / CFG_SPDSTS0 & 3) {
@@ -1299,7 +1298,8 @@ static int ns83820_get_settings(struct net_device *ndev,
                 cmd->speed = SPEED_10;
                 break;
         }
-        cmd->autoneg = (tbicr & TBICR_MR_AN_ENABLE) ? 1: 0;
+        cmd->autoneg = (tbicr & TBICR_MR_AN_ENABLE)
+                ? AUTONEG_ENABLE : AUTONEG_DISABLE;
         return 0;
 }
 
@@ -1405,6 +1405,13 @@ static const struct ethtool_ops ops = {
         .get_link        = ns83820_get_link
 };
 
+static inline void ns83820_disable_interrupts(struct ns83820 *dev)
+{
+        writel(0, dev->base + IMR);
+        writel(0, dev->base + IER);
+        readl(dev->base + IER);
+}
+
 /* this function is called in irq context from the ISR */
 static void ns83820_mib_isr(struct ns83820 *dev)
 {
@@ -1557,10 +1564,7 @@ static int ns83820_stop(struct net_device *ndev)
         /* FIXME: protect against interrupt handler? */
         del_timer_sync(&dev->tx_watchdog);
 
-        /* disable interrupts */
-        writel(0, dev->base + IMR);
-        writel(0, dev->base + IER);
-        readl(dev->base + IER);
+        ns83820_disable_interrupts(dev);
 
         dev->rx_info.up = 0;
         synchronize_irq(dev->pci_dev->irq);
@@ -2023,10 +2027,7 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev,
                 dev->tx_descs, (long)dev->tx_phy_descs,
                 dev->rx_info.descs, (long)dev->rx_info.phy_descs);
 
-        /* disable interrupts */
-        writel(0, dev->base + IMR);
-        writel(0, dev->base + IER);
-        readl(dev->base + IER);
+        ns83820_disable_interrupts(dev);
 
         dev->IMR_cache = 0;
 
@@ -2250,9 +2251,7 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev,
         return 0;
 
 out_cleanup:
-        writel(0, dev->base + IMR);     /* paranoia */
-        writel(0, dev->base + IER);
-        readl(dev->base + IER);
+        ns83820_disable_interrupts(dev); /* paranoia */
 out_free_irq:
         rtnl_unlock();
         free_irq(pci_dev->irq, ndev);
@@ -2277,9 +2276,7 @@ static void __devexit ns83820_remove_one(struct pci_dev *pci_dev)
         if (!ndev)                      /* paranoia */
                 return;
 
-        writel(0, dev->base + IMR);     /* paranoia */
-        writel(0, dev->base + IER);
-        readl(dev->base + IER);
+        ns83820_disable_interrupts(dev); /* paranoia */
 
         unregister_netdev(ndev);
         free_irq(dev->pci_dev->irq, ndev);
diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c
index 8ab6ae0a6107..828e97cacdbf 100644
--- a/drivers/net/pasemi_mac.c
+++ b/drivers/net/pasemi_mac.c
@@ -808,7 +808,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac_rxring *rx,
                         skb->csum = (macrx & XCT_MACRX_CSUM_M) >>
                                            XCT_MACRX_CSUM_S;
                 } else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                 packets++;
                 tot_bytes += len;
diff --git a/drivers/net/pasemi_mac_ethtool.c b/drivers/net/pasemi_mac_ethtool.c
index fefa79e34b95..4825959a0efe 100644
--- a/drivers/net/pasemi_mac_ethtool.c
+++ b/drivers/net/pasemi_mac_ethtool.c
@@ -90,21 +90,6 @@ pasemi_mac_ethtool_set_settings(struct net_device *netdev,
         return phy_ethtool_sset(phydev, cmd);
 }
 
-static void
-pasemi_mac_ethtool_get_drvinfo(struct net_device *netdev,
-                               struct ethtool_drvinfo *drvinfo)
-{
-        struct pasemi_mac *mac;
-        mac = netdev_priv(netdev);
-
-        /* clear and fill out info */
-        memset(drvinfo, 0, sizeof(struct ethtool_drvinfo));
-        strncpy(drvinfo->driver, "pasemi_mac", 12);
-        strcpy(drvinfo->version, "N/A");
-        strcpy(drvinfo->fw_version, "N/A");
-        strncpy(drvinfo->bus_info, pci_name(mac->pdev), 32);
-}
-
 static u32
 pasemi_mac_ethtool_get_msglevel(struct net_device *netdev)
 {
@@ -164,7 +149,6 @@ static void pasemi_mac_get_strings(struct net_device *netdev, u32 stringset,
 const struct ethtool_ops pasemi_mac_ethtool_ops = {
         .get_settings           = pasemi_mac_ethtool_get_settings,
         .set_settings           = pasemi_mac_ethtool_set_settings,
-        .get_drvinfo            = pasemi_mac_ethtool_get_drvinfo,
         .get_msglevel           = pasemi_mac_ethtool_get_msglevel,
         .set_msglevel           = pasemi_mac_ethtool_set_msglevel,
         .get_link               = ethtool_op_get_link,
diff --git a/drivers/net/pch_gbe/Makefile b/drivers/net/pch_gbe/Makefile
new file mode 100644
index 000000000000..31288d4ad248
--- /dev/null
+++ b/drivers/net/pch_gbe/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_PCH_GBE) += pch_gbe.o
+
+pch_gbe-y := pch_gbe_phy.o pch_gbe_ethtool.o pch_gbe_param.o
+pch_gbe-y += pch_gbe_api.o pch_gbe_main.o
diff --git a/drivers/net/pch_gbe/pch_gbe.h b/drivers/net/pch_gbe/pch_gbe.h
new file mode 100644
index 000000000000..b925ab359fc3
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe.h
@@ -0,0 +1,659 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifndef _PCH_GBE_H_
+#define _PCH_GBE_H_
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/mii.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/vmalloc.h>
+#include <net/ip.h>
+
+/**
+ * pch_gbe_regs_mac_adr - Structure holding values of mac address registers
+ * @high        Denotes the 1st to 4th byte from the initial of MAC address
+ * @low         Denotes the 5th to 6th byte from the initial of MAC address
+ */
+struct pch_gbe_regs_mac_adr {
+        u32 high;
+        u32 low;
+};
+/**
+ * pch_udc_regs - Structure holding values of MAC registers
+ */
+struct pch_gbe_regs {
+        u32 INT_ST;
+        u32 INT_EN;
+        u32 MODE;
+        u32 RESET;
+        u32 TCPIP_ACC;
+        u32 EX_LIST;
+        u32 INT_ST_HOLD;
+        u32 PHY_INT_CTRL;
+        u32 MAC_RX_EN;
+        u32 RX_FCTRL;
+        u32 PAUSE_REQ;
+        u32 RX_MODE;
+        u32 TX_MODE;
+        u32 RX_FIFO_ST;
+        u32 TX_FIFO_ST;
+        u32 TX_FID;
+        u32 TX_RESULT;
+        u32 PAUSE_PKT1;
+        u32 PAUSE_PKT2;
+        u32 PAUSE_PKT3;
+        u32 PAUSE_PKT4;
+        u32 PAUSE_PKT5;
+        u32 reserve[2];
+        struct pch_gbe_regs_mac_adr mac_adr[16];
+        u32 ADDR_MASK;
+        u32 MIIM;
+        u32 reserve2;
+        u32 RGMII_ST;
+        u32 RGMII_CTRL;
+        u32 reserve3[3];
+        u32 DMA_CTRL;
+        u32 reserve4[3];
+        u32 RX_DSC_BASE;
+        u32 RX_DSC_SIZE;
+        u32 RX_DSC_HW_P;
+        u32 RX_DSC_HW_P_HLD;
+        u32 RX_DSC_SW_P;
+        u32 reserve5[3];
+        u32 TX_DSC_BASE;
+        u32 TX_DSC_SIZE;
+        u32 TX_DSC_HW_P;
+        u32 TX_DSC_HW_P_HLD;
+        u32 TX_DSC_SW_P;
+        u32 reserve6[3];
+        u32 RX_DMA_ST;
+        u32 TX_DMA_ST;
+        u32 reserve7[2];
+        u32 WOL_ST;
+        u32 WOL_CTRL;
+        u32 WOL_ADDR_MASK;
+};
+
+/* Interrupt Status */
+/* Interrupt Status Hold */
+/* Interrupt Enable */
+#define PCH_GBE_INT_RX_DMA_CMPLT  0x00000001 /* Receive DMA Transfer Complete */
+#define PCH_GBE_INT_RX_VALID      0x00000002 /* MAC Normal Receive Complete */
+#define PCH_GBE_INT_RX_FRAME_ERR  0x00000004 /* Receive frame error */
+#define PCH_GBE_INT_RX_FIFO_ERR   0x00000008 /* Receive FIFO Overflow */
+#define PCH_GBE_INT_RX_DMA_ERR    0x00000010 /* Receive DMA Transfer Error */
+#define PCH_GBE_INT_RX_DSC_EMP    0x00000020 /* Receive Descriptor Empty */
+#define PCH_GBE_INT_TX_CMPLT      0x00000100 /* MAC Transmission Complete */
+#define PCH_GBE_INT_TX_DMA_CMPLT  0x00000200 /* DMA Transfer Complete */
+#define PCH_GBE_INT_TX_FIFO_ERR   0x00000400 /* Transmission FIFO underflow. */
+#define PCH_GBE_INT_TX_DMA_ERR    0x00000800 /* Transmission DMA Error */
+#define PCH_GBE_INT_PAUSE_CMPLT   0x00001000 /* Pause Transmission complete */
+#define PCH_GBE_INT_MIIM_CMPLT    0x00010000 /* MIIM I/F Read completion */
+#define PCH_GBE_INT_PHY_INT       0x00100000 /* Interruption from PHY */
+#define PCH_GBE_INT_WOL_DET       0x01000000 /* Wake On LAN Event detection. */
+#define PCH_GBE_INT_TCPIP_ERR     0x10000000 /* TCP/IP Accelerator Error */
+
+/* Mode */
+#define PCH_GBE_MODE_MII_ETHER      0x00000000  /* GIGA Ethernet Mode [MII] */
+#define PCH_GBE_MODE_GMII_ETHER     0x80000000  /* GIGA Ethernet Mode [GMII] */
+#define PCH_GBE_MODE_HALF_DUPLEX    0x00000000  /* Duplex Mode [half duplex] */
+#define PCH_GBE_MODE_FULL_DUPLEX    0x40000000  /* Duplex Mode [full duplex] */
+#define PCH_GBE_MODE_FR_BST         0x04000000  /* Frame bursting is done */
+
+/* Reset */
+#define PCH_GBE_ALL_RST         0x80000000  /* All reset */
+#define PCH_GBE_TX_RST          0x40000000  /* TX MAC, TX FIFO, TX DMA reset */
+#define PCH_GBE_RX_RST          0x04000000  /* RX MAC, RX FIFO, RX DMA reset */
+
+/* TCP/IP Accelerator Control */
+#define PCH_GBE_EX_LIST_EN      0x00000008  /* External List Enable */
+#define PCH_GBE_RX_TCPIPACC_OFF 0x00000004  /* RX TCP/IP ACC Disabled */
+#define PCH_GBE_TX_TCPIPACC_EN  0x00000002  /* TX TCP/IP ACC Enable */
+#define PCH_GBE_RX_TCPIPACC_EN  0x00000001  /* RX TCP/IP ACC Enable */
+
+/* MAC RX Enable */
+#define PCH_GBE_MRE_MAC_RX_EN   0x00000001      /* MAC Receive Enable */
+
+/* RX Flow Control */
+#define PCH_GBE_FL_CTRL_EN      0x80000000  /* Pause packet is enabled */
+
+/* Pause Packet Request */
+#define PCH_GBE_PS_PKT_RQ       0x80000000  /* Pause packet Request */
+
+/* RX Mode */
+#define PCH_GBE_ADD_FIL_EN      0x80000000  /* Address Filtering Enable */
+/* Multicast Filtering Enable */
+#define PCH_GBE_MLT_FIL_EN      0x40000000
+/* Receive Almost Empty Threshold */
+#define PCH_GBE_RH_ALM_EMP_4    0x00000000      /* 4 words */
+#define PCH_GBE_RH_ALM_EMP_8    0x00004000      /* 8 words */
+#define PCH_GBE_RH_ALM_EMP_16   0x00008000      /* 16 words */
+#define PCH_GBE_RH_ALM_EMP_32   0x0000C000      /* 32 words */
+/* Receive Almost Full Threshold */
+#define PCH_GBE_RH_ALM_FULL_4   0x00000000      /* 4 words */
+#define PCH_GBE_RH_ALM_FULL_8   0x00001000      /* 8 words */
+#define PCH_GBE_RH_ALM_FULL_16  0x00002000      /* 16 words */
+#define PCH_GBE_RH_ALM_FULL_32  0x00003000      /* 32 words */
+/* RX FIFO Read Triger Threshold */
+#define PCH_GBE_RH_RD_TRG_4     0x00000000      /* 4 words */
+#define PCH_GBE_RH_RD_TRG_8     0x00000200      /* 8 words */
+#define PCH_GBE_RH_RD_TRG_16    0x00000400      /* 16 words */
+#define PCH_GBE_RH_RD_TRG_32    0x00000600      /* 32 words */
+#define PCH_GBE_RH_RD_TRG_64    0x00000800      /* 64 words */
+#define PCH_GBE_RH_RD_TRG_128   0x00000A00      /* 128 words */
+#define PCH_GBE_RH_RD_TRG_256   0x00000C00      /* 256 words */
+#define PCH_GBE_RH_RD_TRG_512   0x00000E00      /* 512 words */
+
+/* Receive Descriptor bit definitions */
+#define PCH_GBE_RXD_ACC_STAT_BCAST          0x00000400
+#define PCH_GBE_RXD_ACC_STAT_MCAST          0x00000200
+#define PCH_GBE_RXD_ACC_STAT_UCAST          0x00000100
+#define PCH_GBE_RXD_ACC_STAT_TCPIPOK        0x000000C0
+#define PCH_GBE_RXD_ACC_STAT_IPOK           0x00000080
+#define PCH_GBE_RXD_ACC_STAT_TCPOK          0x00000040
+#define PCH_GBE_RXD_ACC_STAT_IP6ERR         0x00000020
+#define PCH_GBE_RXD_ACC_STAT_OFLIST         0x00000010
+#define PCH_GBE_RXD_ACC_STAT_TYPEIP         0x00000008
+#define PCH_GBE_RXD_ACC_STAT_MACL           0x00000004
+#define PCH_GBE_RXD_ACC_STAT_PPPOE          0x00000002
+#define PCH_GBE_RXD_ACC_STAT_VTAGT          0x00000001
+#define PCH_GBE_RXD_GMAC_STAT_PAUSE         0x0200
+#define PCH_GBE_RXD_GMAC_STAT_MARBR         0x0100
+#define PCH_GBE_RXD_GMAC_STAT_MARMLT        0x0080
+#define PCH_GBE_RXD_GMAC_STAT_MARIND        0x0040
+#define PCH_GBE_RXD_GMAC_STAT_MARNOTMT      0x0020
+#define PCH_GBE_RXD_GMAC_STAT_TLONG         0x0010
+#define PCH_GBE_RXD_GMAC_STAT_TSHRT         0x0008
+#define PCH_GBE_RXD_GMAC_STAT_NOTOCTAL      0x0004
+#define PCH_GBE_RXD_GMAC_STAT_NBLERR        0x0002
+#define PCH_GBE_RXD_GMAC_STAT_CRCERR        0x0001
+
+/* Transmit Descriptor bit definitions */
+#define PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF      0x0008
+#define PCH_GBE_TXD_CTRL_ITAG               0x0004
+#define PCH_GBE_TXD_CTRL_ICRC               0x0002
+#define PCH_GBE_TXD_CTRL_APAD               0x0001
+#define PCH_GBE_TXD_WORDS_SHIFT             2
+#define PCH_GBE_TXD_GMAC_STAT_CMPLT         0x2000
+#define PCH_GBE_TXD_GMAC_STAT_ABT           0x1000
+#define PCH_GBE_TXD_GMAC_STAT_EXCOL         0x0800
+#define PCH_GBE_TXD_GMAC_STAT_SNGCOL        0x0400
+#define PCH_GBE_TXD_GMAC_STAT_MLTCOL        0x0200
+#define PCH_GBE_TXD_GMAC_STAT_CRSER         0x0100
+#define PCH_GBE_TXD_GMAC_STAT_TLNG          0x0080
+#define PCH_GBE_TXD_GMAC_STAT_TSHRT         0x0040
+#define PCH_GBE_TXD_GMAC_STAT_LTCOL         0x0020
+#define PCH_GBE_TXD_GMAC_STAT_TFUNDFLW      0x0010
+#define PCH_GBE_TXD_GMAC_STAT_RTYCNT_MASK   0x000F
+
+/* TX Mode */
+#define PCH_GBE_TM_NO_RTRY     0x80000000 /* No Retransmission */
+#define PCH_GBE_TM_LONG_PKT    0x40000000 /* Long Packt TX Enable */
+#define PCH_GBE_TM_ST_AND_FD   0x20000000 /* Stare and Forward */
+#define PCH_GBE_TM_SHORT_PKT   0x10000000 /* Short Packet TX Enable */
+#define PCH_GBE_TM_LTCOL_RETX  0x08000000 /* Retransmission at Late Collision */
+/* Frame Start Threshold */
+#define PCH_GBE_TM_TH_TX_STRT_4    0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_TX_STRT_8    0x00004000    /* 8 words */
+#define PCH_GBE_TM_TH_TX_STRT_16   0x00008000    /* 16 words */
+#define PCH_GBE_TM_TH_TX_STRT_32   0x0000C000    /* 32 words */
+/* Transmit Almost Empty Threshold */
+#define PCH_GBE_TM_TH_ALM_EMP_4    0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_ALM_EMP_8    0x00000800    /* 8 words */
+#define PCH_GBE_TM_TH_ALM_EMP_16   0x00001000    /* 16 words */
+#define PCH_GBE_TM_TH_ALM_EMP_32   0x00001800    /* 32 words */
+#define PCH_GBE_TM_TH_ALM_EMP_64   0x00002000    /* 64 words */
+#define PCH_GBE_TM_TH_ALM_EMP_128  0x00002800    /* 128 words */
+#define PCH_GBE_TM_TH_ALM_EMP_256  0x00003000    /* 256 words */
+#define PCH_GBE_TM_TH_ALM_EMP_512  0x00003800    /* 512 words */
+/* Transmit Almost Full Threshold */
+#define PCH_GBE_TM_TH_ALM_FULL_4   0x00000000    /* 4 words */
+#define PCH_GBE_TM_TH_ALM_FULL_8   0x00000200    /* 8 words */
+#define PCH_GBE_TM_TH_ALM_FULL_16  0x00000400    /* 16 words */
+#define PCH_GBE_TM_TH_ALM_FULL_32  0x00000600    /* 32 words */
+
+/* RX FIFO Status */
+#define PCH_GBE_RF_ALM_FULL     0x80000000  /* RX FIFO is almost full. */
+#define PCH_GBE_RF_ALM_EMP      0x40000000  /* RX FIFO is almost empty. */
+#define PCH_GBE_RF_RD_TRG       0x20000000  /* Become more than RH_RD_TRG. */
+#define PCH_GBE_RF_STRWD        0x1FFE0000  /* The word count of RX FIFO. */
+#define PCH_GBE_RF_RCVING       0x00010000  /* Stored in RX FIFO. */
+
+/* MAC Address Mask */
+#define PCH_GBE_BUSY                0x80000000
+
+/* MIIM  */
+#define PCH_GBE_MIIM_OPER_WRITE     0x04000000
+#define PCH_GBE_MIIM_OPER_READ      0x00000000
+#define PCH_GBE_MIIM_OPER_READY     0x04000000
+#define PCH_GBE_MIIM_PHY_ADDR_SHIFT 21
+#define PCH_GBE_MIIM_REG_ADDR_SHIFT 16
+
+/* RGMII Status */
+#define PCH_GBE_LINK_UP             0x80000008
+#define PCH_GBE_RXC_SPEED_MSK       0x00000006
+#define PCH_GBE_RXC_SPEED_2_5M      0x00000000    /* 2.5MHz */
+#define PCH_GBE_RXC_SPEED_25M       0x00000002    /* 25MHz  */
+#define PCH_GBE_RXC_SPEED_125M      0x00000004    /* 100MHz */
+#define PCH_GBE_DUPLEX_FULL         0x00000001
+
+/* RGMII Control */
+#define PCH_GBE_CRS_SEL             0x00000010
+#define PCH_GBE_RGMII_RATE_125M     0x00000000
+#define PCH_GBE_RGMII_RATE_25M      0x00000008
+#define PCH_GBE_RGMII_RATE_2_5M     0x0000000C
+#define PCH_GBE_RGMII_MODE_GMII     0x00000000
+#define PCH_GBE_RGMII_MODE_RGMII    0x00000002
+#define PCH_GBE_CHIP_TYPE_EXTERNAL  0x00000000
+#define PCH_GBE_CHIP_TYPE_INTERNAL  0x00000001
+
+/* DMA Control */
+#define PCH_GBE_RX_DMA_EN       0x00000002   /* Enables Receive DMA */
+#define PCH_GBE_TX_DMA_EN       0x00000001   /* Enables Transmission DMA */
+
+/* Wake On LAN Status */
+#define PCH_GBE_WLS_BR          0x00000008 /* Broadcas Address */
+#define PCH_GBE_WLS_MLT         0x00000004 /* Multicast Address */
+
+/* The Frame registered in Address Recognizer */
+#define PCH_GBE_WLS_IND         0x00000002
+#define PCH_GBE_WLS_MP          0x00000001 /* Magic packet Address */
+
+/* Wake On LAN Control */
+#define PCH_GBE_WLC_WOL_MODE    0x00010000
+#define PCH_GBE_WLC_IGN_TLONG   0x00000100
+#define PCH_GBE_WLC_IGN_TSHRT   0x00000080
+#define PCH_GBE_WLC_IGN_OCTER   0x00000040
+#define PCH_GBE_WLC_IGN_NBLER   0x00000020
+#define PCH_GBE_WLC_IGN_CRCER   0x00000010
+#define PCH_GBE_WLC_BR          0x00000008
+#define PCH_GBE_WLC_MLT         0x00000004
+#define PCH_GBE_WLC_IND         0x00000002
+#define PCH_GBE_WLC_MP          0x00000001
+
+/* Wake On LAN Address Mask */
+#define PCH_GBE_WLA_BUSY        0x80000000
+
+
+
+/* TX/RX descriptor defines */
+#define PCH_GBE_MAX_TXD                     4096
+#define PCH_GBE_DEFAULT_TXD                  256
+#define PCH_GBE_MIN_TXD                        8
+#define PCH_GBE_MAX_RXD                     4096
+#define PCH_GBE_DEFAULT_RXD                  256
+#define PCH_GBE_MIN_RXD                        8
+
+/* Number of Transmit and Receive Descriptors must be a multiple of 8 */
+#define PCH_GBE_TX_DESC_MULTIPLE               8
+#define PCH_GBE_RX_DESC_MULTIPLE               8
+
+/* Read/Write operation is done through MII Management IF */
+#define PCH_GBE_HAL_MIIM_READ          ((u32)0x00000000)
+#define PCH_GBE_HAL_MIIM_WRITE         ((u32)0x04000000)
+
+/* flow control values */
+#define PCH_GBE_FC_NONE                 0
+#define PCH_GBE_FC_RX_PAUSE             1
+#define PCH_GBE_FC_TX_PAUSE             2
+#define PCH_GBE_FC_FULL                 3
+#define PCH_GBE_FC_DEFAULT              PCH_GBE_FC_FULL
+
+
+struct pch_gbe_hw;
+/**
+ * struct  pch_gbe_functions - HAL APi function pointer
+ * @get_bus_info:       for pch_gbe_hal_get_bus_info
+ * @init_hw:            for pch_gbe_hal_init_hw
+ * @read_phy_reg:       for pch_gbe_hal_read_phy_reg
+ * @write_phy_reg:      for pch_gbe_hal_write_phy_reg
+ * @reset_phy:          for pch_gbe_hal_phy_hw_reset
+ * @sw_reset_phy:       for pch_gbe_hal_phy_sw_reset
+ * @power_up_phy:       for pch_gbe_hal_power_up_phy
+ * @power_down_phy:     for pch_gbe_hal_power_down_phy
+ * @read_mac_addr:      for pch_gbe_hal_read_mac_addr
+ */
+struct pch_gbe_functions {
+        void (*get_bus_info) (struct pch_gbe_hw *);
+        s32 (*init_hw) (struct pch_gbe_hw *);
+        s32 (*read_phy_reg) (struct pch_gbe_hw *, u32, u16 *);
+        s32 (*write_phy_reg) (struct pch_gbe_hw *, u32, u16);
+        void (*reset_phy) (struct pch_gbe_hw *);
+        void (*sw_reset_phy) (struct pch_gbe_hw *);
+        void (*power_up_phy) (struct pch_gbe_hw *hw);
+        void (*power_down_phy) (struct pch_gbe_hw *hw);
+        s32 (*read_mac_addr) (struct pch_gbe_hw *);
+};
+
+/**
+ * struct pch_gbe_mac_info - MAC infomation
+ * @addr[6]:            Store the MAC address
+ * @fc:                 Mode of flow control
+ * @fc_autoneg:         Auto negotiation enable for flow control setting
+ * @tx_fc_enable:       Enable flag of Transmit flow control
+ * @max_frame_size:     Max transmit frame size
+ * @min_frame_size:     Min transmit frame size
+ * @autoneg:            Auto negotiation enable
+ * @link_speed:         Link speed
+ * @link_duplex:        Link duplex
+ */
+struct pch_gbe_mac_info {
+        u8 addr[6];
+        u8 fc;
+        u8 fc_autoneg;
+        u8 tx_fc_enable;
+        u32 max_frame_size;
+        u32 min_frame_size;
+        u8 autoneg;
+        u16 link_speed;
+        u16 link_duplex;
+};
+
+/**
+ * struct pch_gbe_phy_info - PHY infomation
+ * @addr:               PHY address
+ * @id:                 PHY's identifier
+ * @revision:           PHY's revision
+ * @reset_delay_us:     HW reset delay time[us]
+ * @autoneg_advertised: Autoneg advertised
+ */
+struct pch_gbe_phy_info {
+        u32 addr;
+        u32 id;
+        u32 revision;
+        u32 reset_delay_us;
+        u16 autoneg_advertised;
+};
+
+/*!
+ * @ingroup Gigabit Ether driver Layer
+ * @struct  pch_gbe_bus_info
+ * @brief   Bus infomation
+ */
+struct pch_gbe_bus_info {
+        u8 type;
+        u8 speed;
+        u8 width;
+};
+
+/*!
+ * @ingroup Gigabit Ether driver Layer
+ * @struct  pch_gbe_hw
+ * @brief   Hardware infomation
+ */
+struct pch_gbe_hw {
+        void *back;
+
+        struct pch_gbe_regs  __iomem *reg;
+        spinlock_t miim_lock;
+
+        const struct pch_gbe_functions *func;
+        struct pch_gbe_mac_info mac;
+        struct pch_gbe_phy_info phy;
+        struct pch_gbe_bus_info bus;
+};
+
+/**
+ * struct pch_gbe_rx_desc - Receive Descriptor
+ * @buffer_addr:        RX Frame Buffer Address
+ * @tcp_ip_status:      TCP/IP Accelerator Status
+ * @rx_words_eob:       RX word count and Byte position
+ * @gbec_status:        GMAC Status
+ * @dma_status:         DMA Status
+ * @reserved1:          Reserved
+ * @reserved2:          Reserved
+ */
+struct pch_gbe_rx_desc {
+        u32 buffer_addr;
+        u32 tcp_ip_status;
+        u16 rx_words_eob;
+        u16 gbec_status;
+        u8 dma_status;
+        u8 reserved1;
+        u16 reserved2;
+};
+
+/**
+ * struct pch_gbe_tx_desc - Transmit Descriptor
+ * @buffer_addr:        TX Frame Buffer Address
+ * @length:             Data buffer length
+ * @reserved1:          Reserved
+ * @tx_words_eob:       TX word count and Byte position
+ * @tx_frame_ctrl:      TX Frame Control
+ * @dma_status:         DMA Status
+ * @reserved2:          Reserved
+ * @gbec_status:        GMAC Status
+ */
+struct pch_gbe_tx_desc {
+        u32 buffer_addr;
+        u16 length;
+        u16 reserved1;
+        u16 tx_words_eob;
+        u16 tx_frame_ctrl;
+        u8 dma_status;
+        u8 reserved2;
+        u16 gbec_status;
+};
+
+
+/**
+ * struct pch_gbe_buffer - Buffer infomation
+ * @skb:        pointer to a socket buffer
+ * @dma:        DMA address
+ * @time_stamp: time stamp
+ * @length:     data size
+ */
+struct pch_gbe_buffer {
+        struct sk_buff *skb;
+        dma_addr_t dma;
+        unsigned long time_stamp;
+        u16 length;
+        bool mapped;
+};
+
+/**
+ * struct pch_gbe_tx_ring - tx ring infomation
+ * @tx_lock:    spinlock structs
+ * @desc:       pointer to the descriptor ring memory
+ * @dma:        physical address of the descriptor ring
+ * @size:       length of descriptor ring in bytes
+ * @count:      number of descriptors in the ring
+ * @next_to_use:        next descriptor to associate a buffer with
+ * @next_to_clean:      next descriptor to check for DD status bit
+ * @buffer_info:        array of buffer information structs
+ */
+struct pch_gbe_tx_ring {
+        spinlock_t tx_lock;
+        struct pch_gbe_tx_desc *desc;
+        dma_addr_t dma;
+        unsigned int size;
+        unsigned int count;
+        unsigned int next_to_use;
+        unsigned int next_to_clean;
+        struct pch_gbe_buffer *buffer_info;
+};
+
+/**
+ * struct pch_gbe_rx_ring - rx ring infomation
+ * @desc:       pointer to the descriptor ring memory
+ * @dma:        physical address of the descriptor ring
+ * @size:       length of descriptor ring in bytes
+ * @count:      number of descriptors in the ring
+ * @next_to_use:        next descriptor to associate a buffer with
+ * @next_to_clean:      next descriptor to check for DD status bit
+ * @buffer_info:        array of buffer information structs
+ */
+struct pch_gbe_rx_ring {
+        struct pch_gbe_rx_desc *desc;
+        dma_addr_t dma;
+        unsigned int size;
+        unsigned int count;
+        unsigned int next_to_use;
+        unsigned int next_to_clean;
+        struct pch_gbe_buffer *buffer_info;
+};
+
+/**
+ * struct pch_gbe_hw_stats - Statistics counters collected by the MAC
+ * @rx_packets:             total packets received
+ * @tx_packets:             total packets transmitted
+ * @rx_bytes:               total bytes received
+ * @tx_bytes:               total bytes transmitted
+ * @rx_errors:              bad packets received
+ * @tx_errors:              packet transmit problems
+ * @rx_dropped:             no space in Linux buffers
+ * @tx_dropped:             no space available in Linux
+ * @multicast:              multicast packets received
+ * @collisions:             collisions
+ * @rx_crc_errors:          received packet with crc error
+ * @rx_frame_errors:        received frame alignment error
+ * @rx_alloc_buff_failed:   allocate failure of a receive buffer
+ * @tx_length_errors:       transmit length error
+ * @tx_aborted_errors:      transmit aborted error
+ * @tx_carrier_errors:      transmit carrier error
+ * @tx_timeout_count:       Number of transmit timeout
+ * @tx_restart_count:       Number of transmit restert
+ * @intr_rx_dsc_empty_count:    Interrupt count of receive descriptor empty
+ * @intr_rx_frame_err_count:    Interrupt count of receive frame error
+ * @intr_rx_fifo_err_count:     Interrupt count of receive FIFO error
+ * @intr_rx_dma_err_count:      Interrupt count of receive DMA error
+ * @intr_tx_fifo_err_count:     Interrupt count of transmit FIFO error
+ * @intr_tx_dma_err_count:      Interrupt count of transmit DMA error
+ * @intr_tcpip_err_count:       Interrupt count of TCP/IP Accelerator
+ */
+struct pch_gbe_hw_stats {
+        u32 rx_packets;
+        u32 tx_packets;
+        u32 rx_bytes;
+        u32 tx_bytes;
+        u32 rx_errors;
+        u32 tx_errors;
+        u32 rx_dropped;
+        u32 tx_dropped;
+        u32 multicast;
+        u32 collisions;
+        u32 rx_crc_errors;
+        u32 rx_frame_errors;
+        u32 rx_alloc_buff_failed;
+        u32 tx_length_errors;
+        u32 tx_aborted_errors;
+        u32 tx_carrier_errors;
+        u32 tx_timeout_count;
+        u32 tx_restart_count;
+        u32 intr_rx_dsc_empty_count;
+        u32 intr_rx_frame_err_count;
+        u32 intr_rx_fifo_err_count;
+        u32 intr_rx_dma_err_count;
+        u32 intr_tx_fifo_err_count;
+        u32 intr_tx_dma_err_count;
+        u32 intr_tcpip_err_count;
+};
+
+/**
+ * struct pch_gbe_adapter - board specific private data structure
+ * @stats_lock: Spinlock structure for status
+ * @tx_queue_lock:      Spinlock structure for transmit
+ * @ethtool_lock:       Spinlock structure for ethtool
+ * @irq_sem:            Semaphore for interrupt
+ * @netdev:             Pointer of network device structure
+ * @pdev:               Pointer of pci device structure
+ * @polling_netdev:     Pointer of polling network device structure
+ * @napi:               NAPI structure
+ * @hw:                 Pointer of hardware structure
+ * @stats:              Hardware status
+ * @reset_task:         Reset task
+ * @mii:                MII information structure
+ * @watchdog_timer:     Watchdog timer list
+ * @wake_up_evt:        Wake up event
+ * @config_space:       Configuration space
+ * @msg_enable:         Driver message level
+ * @led_status:         LED status
+ * @tx_ring:            Pointer of Tx descriptor ring structure
+ * @rx_ring:            Pointer of Rx descriptor ring structure
+ * @rx_buffer_len:      Receive buffer length
+ * @tx_queue_len:       Transmit queue length
+ * @rx_csum:            Receive TCP/IP checksum enable/disable
+ * @tx_csum:            Transmit TCP/IP checksum enable/disable
+ * @have_msi:           PCI MSI mode flag
+ */
+
+struct pch_gbe_adapter {
+        spinlock_t stats_lock;
+        spinlock_t tx_queue_lock;
+        spinlock_t ethtool_lock;
+        atomic_t irq_sem;
+        struct net_device *netdev;
+        struct pci_dev *pdev;
+        struct net_device *polling_netdev;
+        struct napi_struct napi;
+        struct pch_gbe_hw hw;
+        struct pch_gbe_hw_stats stats;
+        struct work_struct reset_task;
+        struct mii_if_info mii;
+        struct timer_list watchdog_timer;
+        u32 wake_up_evt;
+        u32 *config_space;
+        unsigned long led_status;
+        struct pch_gbe_tx_ring *tx_ring;
+        struct pch_gbe_rx_ring *rx_ring;
+        unsigned long rx_buffer_len;
+        unsigned long tx_queue_len;
+        bool rx_csum;
+        bool tx_csum;
+        bool have_msi;
+};
+
+extern const char pch_driver_version[];
+
+/* pch_gbe_main.c */
+extern int pch_gbe_up(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_down(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter);
+extern void pch_gbe_reset(struct pch_gbe_adapter *adapter);
+extern int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_tx_ring *txdr);
+extern int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_rx_ring *rxdr);
+extern void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_tx_ring *tx_ring);
+extern void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
+                                       struct pch_gbe_rx_ring *rx_ring);
+extern void pch_gbe_update_stats(struct pch_gbe_adapter *adapter);
+extern int pch_gbe_mdio_read(struct net_device *netdev, int addr, int reg);
+extern void pch_gbe_mdio_write(struct net_device *netdev, int addr, int reg,
+                                int data);
+/* pch_gbe_param.c */
+extern void pch_gbe_check_options(struct pch_gbe_adapter *adapter);
+
+/* pch_gbe_ethtool.c */
+extern void pch_gbe_set_ethtool_ops(struct net_device *netdev);
+
+/* pch_gbe_mac.c */
+extern s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw);
+extern s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw);
+extern u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw,
+                                  u32 addr, u32 dir, u32 reg, u16 data);
+#endif /* _PCH_GBE_H_ */
diff --git a/drivers/net/pch_gbe/pch_gbe_api.c b/drivers/net/pch_gbe/pch_gbe_api.c
new file mode 100644
index 000000000000..db53d2a943e0
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_api.c
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#include "pch_gbe.h"
+#include "pch_gbe_phy.h"
+
+/* bus type values */
+#define pch_gbe_bus_type_unknown        0
+#define pch_gbe_bus_type_pci            1
+#define pch_gbe_bus_type_pcix           2
+#define pch_gbe_bus_type_pci_express    3
+#define pch_gbe_bus_type_reserved       4
+
+/* bus speed values */
+#define pch_gbe_bus_speed_unknown       0
+#define pch_gbe_bus_speed_33            1
+#define pch_gbe_bus_speed_66            2
+#define pch_gbe_bus_speed_100           3
+#define pch_gbe_bus_speed_120           4
+#define pch_gbe_bus_speed_133           5
+#define pch_gbe_bus_speed_2500          6
+#define pch_gbe_bus_speed_reserved      7
+
+/* bus width values */
+#define pch_gbe_bus_width_unknown       0
+#define pch_gbe_bus_width_pcie_x1       1
+#define pch_gbe_bus_width_pcie_x2       2
+#define pch_gbe_bus_width_pcie_x4       4
+#define pch_gbe_bus_width_32            5
+#define pch_gbe_bus_width_64            6
+#define pch_gbe_bus_width_reserved      7
+
+/**
+ * pch_gbe_plat_get_bus_info - Obtain bus information for adapter
+ * @hw: Pointer to the HW structure
+ */
+static void pch_gbe_plat_get_bus_info(struct pch_gbe_hw *hw)
+{
+        hw->bus.type  = pch_gbe_bus_type_pci_express;
+        hw->bus.speed = pch_gbe_bus_speed_2500;
+        hw->bus.width = pch_gbe_bus_width_pcie_x1;
+}
+
+/**
+ * pch_gbe_plat_init_hw - Initialize hardware
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed-EBUSY
+ */
+static s32 pch_gbe_plat_init_hw(struct pch_gbe_hw *hw)
+{
+        s32 ret_val;
+
+        ret_val = pch_gbe_phy_get_id(hw);
+        if (ret_val) {
+                pr_err("pch_gbe_phy_get_id error\n");
+                return ret_val;
+        }
+        pch_gbe_phy_init_setting(hw);
+        /* Setup Mac interface option RGMII */
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        pch_gbe_phy_set_rgmii(hw);
+#endif
+        return ret_val;
+}
+
+static const struct pch_gbe_functions pch_gbe_ops = {
+        .get_bus_info      = pch_gbe_plat_get_bus_info,
+        .init_hw           = pch_gbe_plat_init_hw,
+        .read_phy_reg      = pch_gbe_phy_read_reg_miic,
+        .write_phy_reg     = pch_gbe_phy_write_reg_miic,
+        .reset_phy         = pch_gbe_phy_hw_reset,
+        .sw_reset_phy      = pch_gbe_phy_sw_reset,
+        .power_up_phy      = pch_gbe_phy_power_up,
+        .power_down_phy    = pch_gbe_phy_power_down,
+        .read_mac_addr     = pch_gbe_mac_read_mac_addr
+};
+
+/**
+ * pch_gbe_plat_init_function_pointers - Init func ptrs
+ * @hw: Pointer to the HW structure
+ */
+void pch_gbe_plat_init_function_pointers(struct pch_gbe_hw *hw)
+{
+        /* Set PHY parameter */
+        hw->phy.reset_delay_us     = PCH_GBE_PHY_RESET_DELAY_US;
+        /* Set function pointers */
+        hw->func = &pch_gbe_ops;
+}
+
+/**
+ * pch_gbe_hal_setup_init_funcs - Initializes function pointers
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_setup_init_funcs(struct pch_gbe_hw *hw)
+{
+        if (!hw->reg) {
+                pr_err("ERROR: Registers not mapped\n");
+                return -ENOSYS;
+        }
+        pch_gbe_plat_init_function_pointers(hw);
+        return 0;
+}
+
+/**
+ * pch_gbe_hal_get_bus_info - Obtain bus information for adapter
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_get_bus_info(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->get_bus_info)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->get_bus_info(hw);
+}
+
+/**
+ * pch_gbe_hal_init_hw - Initialize hardware
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_init_hw(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->init_hw) {
+                pr_err("ERROR: configuration\n");
+                return -ENOSYS;
+        }
+        return hw->func->init_hw(hw);
+}
+
+/**
+ * pch_gbe_hal_read_phy_reg - Reads PHY register
+ * @hw:     Pointer to the HW structure
+ * @offset: The register to read
+ * @data:   The buffer to store the 16-bit read.
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+inline s32 pch_gbe_hal_read_phy_reg(struct pch_gbe_hw *hw, u32 offset,
+                                        u16 *data)
+{
+        if (!hw->func->read_phy_reg)
+                return 0;
+        return hw->func->read_phy_reg(hw, offset, data);
+}
+
+/**
+ * pch_gbe_hal_write_phy_reg - Writes PHY register
+ * @hw:     Pointer to the HW structure
+ * @offset: The register to read
+ * @data:   The value to write.
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+inline s32 pch_gbe_hal_write_phy_reg(struct pch_gbe_hw *hw, u32 offset,
+                                        u16 data)
+{
+        if (!hw->func->write_phy_reg)
+                return 0;
+        return hw->func->write_phy_reg(hw, offset, data);
+}
+
+/**
+ * pch_gbe_hal_phy_hw_reset - Hard PHY reset
+ * @hw:     Pointer to the HW structure
+ */
+inline void pch_gbe_hal_phy_hw_reset(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->reset_phy)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->reset_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_phy_sw_reset - Soft PHY reset
+ * @hw:     Pointer to the HW structure
+ */
+inline void pch_gbe_hal_phy_sw_reset(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->sw_reset_phy)
+                pr_err("ERROR: configuration\n");
+        else
+                hw->func->sw_reset_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_read_mac_addr - Reads MAC address
+ * @hw: Pointer to the HW structure
+ * Returns
+ *      0:      Successfully
+ *      ENOSYS: Function is not registered
+ */
+inline s32 pch_gbe_hal_read_mac_addr(struct pch_gbe_hw *hw)
+{
+        if (!hw->func->read_mac_addr) {
+                pr_err("ERROR: configuration\n");
+                return -ENOSYS;
+        }
+        return hw->func->read_mac_addr(hw);
+}
+
+/**
+ * pch_gbe_hal_power_up_phy - Power up PHY
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_power_up_phy(struct pch_gbe_hw *hw)
+{
+        if (hw->func->power_up_phy)
+                hw->func->power_up_phy(hw);
+}
+
+/**
+ * pch_gbe_hal_power_down_phy - Power down PHY
+ * @hw: Pointer to the HW structure
+ */
+inline void pch_gbe_hal_power_down_phy(struct pch_gbe_hw *hw)
+{
+        if (hw->func->power_down_phy)
+                hw->func->power_down_phy(hw);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_api.h b/drivers/net/pch_gbe/pch_gbe_api.h
new file mode 100644
index 000000000000..94aaac5b057b
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_api.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#ifndef _PCH_GBE_API_H_
+#define _PCH_GBE_API_H_
+
+#include "pch_gbe_phy.h"
+
+s32 pch_gbe_hal_setup_init_funcs(struct pch_gbe_hw *hw);
+void pch_gbe_hal_get_bus_info(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_init_hw(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_read_phy_reg(struct pch_gbe_hw *hw, u32 offset, u16 *data);
+s32 pch_gbe_hal_write_phy_reg(struct pch_gbe_hw *hw, u32 offset, u16 data);
+void pch_gbe_hal_phy_hw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_hal_phy_sw_reset(struct pch_gbe_hw *hw);
+s32 pch_gbe_hal_read_mac_addr(struct pch_gbe_hw *hw);
+void pch_gbe_hal_power_up_phy(struct pch_gbe_hw *hw);
+void pch_gbe_hal_power_down_phy(struct pch_gbe_hw *hw);
+
+#endif
diff --git a/drivers/net/pch_gbe/pch_gbe_ethtool.c b/drivers/net/pch_gbe/pch_gbe_ethtool.c
new file mode 100644
index 000000000000..e06c6aea4527
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_ethtool.c
@@ -0,0 +1,584 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#include "pch_gbe.h"
+#include "pch_gbe_api.h"
+
+/**
+ * pch_gbe_stats - Stats item infomation
+ */
+struct pch_gbe_stats {
+        char string[ETH_GSTRING_LEN];
+        size_t size;
+        size_t offset;
+};
+
+#define PCH_GBE_STAT(m)                                         \
+{                                                               \
+        .string = #m,                                           \
+        .size = FIELD_SIZEOF(struct pch_gbe_hw_stats, m),       \
+        .offset = offsetof(struct pch_gbe_hw_stats, m),         \
+}
+
+/**
+ * pch_gbe_gstrings_stats - ethtool information status name list
+ */
+static const struct pch_gbe_stats pch_gbe_gstrings_stats[] = {
+        PCH_GBE_STAT(rx_packets),
+        PCH_GBE_STAT(tx_packets),
+        PCH_GBE_STAT(rx_bytes),
+        PCH_GBE_STAT(tx_bytes),
+        PCH_GBE_STAT(rx_errors),
+        PCH_GBE_STAT(tx_errors),
+        PCH_GBE_STAT(rx_dropped),
+        PCH_GBE_STAT(tx_dropped),
+        PCH_GBE_STAT(multicast),
+        PCH_GBE_STAT(collisions),
+        PCH_GBE_STAT(rx_crc_errors),
+        PCH_GBE_STAT(rx_frame_errors),
+        PCH_GBE_STAT(rx_alloc_buff_failed),
+        PCH_GBE_STAT(tx_length_errors),
+        PCH_GBE_STAT(tx_aborted_errors),
+        PCH_GBE_STAT(tx_carrier_errors),
+        PCH_GBE_STAT(tx_timeout_count),
+        PCH_GBE_STAT(tx_restart_count),
+        PCH_GBE_STAT(intr_rx_dsc_empty_count),
+        PCH_GBE_STAT(intr_rx_frame_err_count),
+        PCH_GBE_STAT(intr_rx_fifo_err_count),
+        PCH_GBE_STAT(intr_rx_dma_err_count),
+        PCH_GBE_STAT(intr_tx_fifo_err_count),
+        PCH_GBE_STAT(intr_tx_dma_err_count),
+        PCH_GBE_STAT(intr_tcpip_err_count)
+};
+
+#define PCH_GBE_QUEUE_STATS_LEN 0
+#define PCH_GBE_GLOBAL_STATS_LEN        ARRAY_SIZE(pch_gbe_gstrings_stats)
+#define PCH_GBE_STATS_LEN (PCH_GBE_GLOBAL_STATS_LEN + PCH_GBE_QUEUE_STATS_LEN)
+
+#define PCH_GBE_MAC_REGS_LEN    (sizeof(struct pch_gbe_regs) / 4)
+#define PCH_GBE_REGS_LEN        (PCH_GBE_MAC_REGS_LEN + PCH_GBE_PHY_REGS_LEN)
+/**
+ * pch_gbe_get_settings - Get device-specific settings
+ * @netdev: Network interface device structure
+ * @ecmd:   Ethtool command
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_get_settings(struct net_device *netdev,
+                                 struct ethtool_cmd *ecmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int ret;
+
+        ret = mii_ethtool_gset(&adapter->mii, ecmd);
+        ecmd->supported &= ~(SUPPORTED_TP | SUPPORTED_1000baseT_Half);
+        ecmd->advertising &= ~(ADVERTISED_TP | ADVERTISED_1000baseT_Half);
+
+        if (!netif_carrier_ok(adapter->netdev))
+                ecmd->speed = -1;
+        return ret;
+}
+
+/**
+ * pch_gbe_set_settings - Set device-specific settings
+ * @netdev: Network interface device structure
+ * @ecmd:   Ethtool command
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_settings(struct net_device *netdev,
+                                 struct ethtool_cmd *ecmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int ret;
+
+        pch_gbe_hal_write_phy_reg(hw, MII_BMCR, BMCR_RESET);
+
+        if (ecmd->speed == -1)
+                ecmd->speed = SPEED_1000;
+                ecmd->duplex = DUPLEX_FULL;
+        ret = mii_ethtool_sset(&adapter->mii, ecmd);
+        if (ret) {
+                pr_err("Error: mii_ethtool_sset\n");
+                return ret;
+        }
+        hw->mac.link_speed = ecmd->speed;
+        hw->mac.link_duplex = ecmd->duplex;
+        hw->phy.autoneg_advertised = ecmd->advertising;
+        hw->mac.autoneg = ecmd->autoneg;
+        pch_gbe_hal_phy_sw_reset(hw);
+
+        /* reset the link */
+        if (netif_running(adapter->netdev)) {
+                pch_gbe_down(adapter);
+                ret = pch_gbe_up(adapter);
+        } else {
+                pch_gbe_reset(adapter);
+        }
+        return ret;
+}
+
+/**
+ * pch_gbe_get_regs_len - Report the size of device registers
+ * @netdev: Network interface device structure
+ * Returns: the size of device registers.
+ */
+static int pch_gbe_get_regs_len(struct net_device *netdev)
+{
+        return PCH_GBE_REGS_LEN * (int)sizeof(u32);
+}
+
+/**
+ * pch_gbe_get_drvinfo - Report driver information
+ * @netdev:  Network interface device structure
+ * @drvinfo: Driver information structure
+ */
+static void pch_gbe_get_drvinfo(struct net_device *netdev,
+                                 struct ethtool_drvinfo *drvinfo)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        strcpy(drvinfo->driver, KBUILD_MODNAME);
+        strcpy(drvinfo->version, pch_driver_version);
+        strcpy(drvinfo->fw_version, "N/A");
+        strcpy(drvinfo->bus_info, pci_name(adapter->pdev));
+        drvinfo->regdump_len = pch_gbe_get_regs_len(netdev);
+}
+
+/**
+ * pch_gbe_get_regs - Get device registers
+ * @netdev: Network interface device structure
+ * @regs:   Ethtool register structure
+ * @p:      Buffer pointer of read device register date
+ */
+static void pch_gbe_get_regs(struct net_device *netdev,
+                                struct ethtool_regs *regs, void *p)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pci_dev *pdev = adapter->pdev;
+        u32 *regs_buff = p;
+        u16 i, tmp;
+
+        regs->version = 0x1000000 | (__u32)pdev->revision << 16 | pdev->device;
+        for (i = 0; i < PCH_GBE_MAC_REGS_LEN; i++)
+                *regs_buff++ = ioread32(&hw->reg->INT_ST + i);
+        /* PHY register */
+        for (i = 0; i < PCH_GBE_PHY_REGS_LEN; i++) {
+                pch_gbe_hal_read_phy_reg(&adapter->hw, i, &tmp);
+                *regs_buff++ = tmp;
+        }
+}
+
+/**
+ * pch_gbe_get_wol - Report whether Wake-on-Lan is enabled
+ * @netdev: Network interface device structure
+ * @wol:    Wake-on-Lan information
+ */
+static void pch_gbe_get_wol(struct net_device *netdev,
+                                struct ethtool_wolinfo *wol)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        wol->supported = WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | WAKE_MAGIC;
+        wol->wolopts = 0;
+
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_IND))
+                wol->wolopts |= WAKE_UCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_MLT))
+                wol->wolopts |= WAKE_MCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_BR))
+                wol->wolopts |= WAKE_BCAST;
+        if ((adapter->wake_up_evt & PCH_GBE_WLC_MP))
+                wol->wolopts |= WAKE_MAGIC;
+}
+
+/**
+ * pch_gbe_set_wol - Turn Wake-on-Lan on or off
+ * @netdev: Network interface device structure
+ * @wol:    Pointer of wake-on-Lan information straucture
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_wol(struct net_device *netdev,
+                                struct ethtool_wolinfo *wol)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        if ((wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE)))
+                return -EOPNOTSUPP;
+        /* these settings will always override what we currently have */
+        adapter->wake_up_evt = 0;
+
+        if ((wol->wolopts & WAKE_UCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_IND;
+        if ((wol->wolopts & WAKE_MCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_MLT;
+        if ((wol->wolopts & WAKE_BCAST))
+                adapter->wake_up_evt |= PCH_GBE_WLC_BR;
+        if ((wol->wolopts & WAKE_MAGIC))
+                adapter->wake_up_evt |= PCH_GBE_WLC_MP;
+        return 0;
+}
+
+/**
+ * pch_gbe_nway_reset - Restart autonegotiation
+ * @netdev: Network interface device structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_nway_reset(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        return mii_nway_restart(&adapter->mii);
+}
+
+/**
+ * pch_gbe_get_ringparam - Report ring sizes
+ * @netdev:  Network interface device structure
+ * @ring:    Ring param structure
+ */
+static void pch_gbe_get_ringparam(struct net_device *netdev,
+                                        struct ethtool_ringparam *ring)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *txdr = adapter->tx_ring;
+        struct pch_gbe_rx_ring *rxdr = adapter->rx_ring;
+
+        ring->rx_max_pending = PCH_GBE_MAX_RXD;
+        ring->tx_max_pending = PCH_GBE_MAX_TXD;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->rx_pending = rxdr->count;
+        ring->tx_pending = txdr->count;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+}
+
+/**
+ * pch_gbe_set_ringparam - Set ring sizes
+ * @netdev:  Network interface device structure
+ * @ring:    Ring param structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_ringparam(struct net_device *netdev,
+                                        struct ethtool_ringparam *ring)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *txdr, *tx_old;
+        struct pch_gbe_rx_ring *rxdr, *rx_old;
+        int tx_ring_size, rx_ring_size;
+        int err = 0;
+
+        if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
+                return -EINVAL;
+        tx_ring_size = (int)sizeof(struct pch_gbe_tx_ring);
+        rx_ring_size = (int)sizeof(struct pch_gbe_rx_ring);
+
+        if ((netif_running(adapter->netdev)))
+                pch_gbe_down(adapter);
+        tx_old = adapter->tx_ring;
+        rx_old = adapter->rx_ring;
+
+        txdr = kzalloc(tx_ring_size, GFP_KERNEL);
+        if (!txdr) {
+                err = -ENOMEM;
+                goto err_alloc_tx;
+        }
+        rxdr = kzalloc(rx_ring_size, GFP_KERNEL);
+        if (!rxdr) {
+                err = -ENOMEM;
+                goto err_alloc_rx;
+        }
+        adapter->tx_ring = txdr;
+        adapter->rx_ring = rxdr;
+
+        rxdr->count =
+                clamp_val(ring->rx_pending, PCH_GBE_MIN_RXD, PCH_GBE_MAX_RXD);
+        rxdr->count = roundup(rxdr->count, PCH_GBE_RX_DESC_MULTIPLE);
+
+        txdr->count =
+                clamp_val(ring->tx_pending, PCH_GBE_MIN_RXD, PCH_GBE_MAX_RXD);
+        txdr->count = roundup(txdr->count, PCH_GBE_TX_DESC_MULTIPLE);
+
+        if ((netif_running(adapter->netdev))) {
+                /* Try to get new resources before deleting old */
+                err = pch_gbe_setup_rx_resources(adapter, adapter->rx_ring);
+                if (err)
+                        goto err_setup_rx;
+                err = pch_gbe_setup_tx_resources(adapter, adapter->tx_ring);
+                if (err)
+                        goto err_setup_tx;
+                /* save the new, restore the old in order to free it,
+                 * then restore the new back again */
+#ifdef RINGFREE
+                adapter->rx_ring = rx_old;
+                adapter->tx_ring = tx_old;
+                pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+                pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+                kfree(tx_old);
+                kfree(rx_old);
+                adapter->rx_ring = rxdr;
+                adapter->tx_ring = txdr;
+#else
+                pch_gbe_free_rx_resources(adapter, rx_old);
+                pch_gbe_free_tx_resources(adapter, tx_old);
+                kfree(tx_old);
+                kfree(rx_old);
+                adapter->rx_ring = rxdr;
+                adapter->tx_ring = txdr;
+#endif
+                err = pch_gbe_up(adapter);
+        }
+        return err;
+
+err_setup_tx:
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+err_setup_rx:
+        adapter->rx_ring = rx_old;
+        adapter->tx_ring = tx_old;
+        kfree(rxdr);
+err_alloc_rx:
+        kfree(txdr);
+err_alloc_tx:
+        if (netif_running(adapter->netdev))
+                pch_gbe_up(adapter);
+        return err;
+}
+
+/**
+ * pch_gbe_get_pauseparam - Report pause parameters
+ * @netdev:  Network interface device structure
+ * @pause:   Pause parameters structure
+ */
+static void pch_gbe_get_pauseparam(struct net_device *netdev,
+                                       struct ethtool_pauseparam *pause)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pause->autoneg =
+            ((hw->mac.fc_autoneg) ? AUTONEG_ENABLE : AUTONEG_DISABLE);
+
+        if (hw->mac.fc == PCH_GBE_FC_RX_PAUSE) {
+                pause->rx_pause = 1;
+        } else if (hw->mac.fc == PCH_GBE_FC_TX_PAUSE) {
+                pause->tx_pause = 1;
+        } else if (hw->mac.fc == PCH_GBE_FC_FULL) {
+                pause->rx_pause = 1;
+                pause->tx_pause = 1;
+        }
+}
+
+/**
+ * pch_gbe_set_pauseparam - Set pause paramters
+ * @netdev:  Network interface device structure
+ * @pause:   Pause parameters structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_pauseparam(struct net_device *netdev,
+                                       struct ethtool_pauseparam *pause)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int ret = 0;
+
+        hw->mac.fc_autoneg = pause->autoneg;
+        if ((pause->rx_pause) && (pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_FULL;
+        else if ((pause->rx_pause) && (!pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_RX_PAUSE;
+        else if ((!pause->rx_pause) && (pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_TX_PAUSE;
+        else if ((!pause->rx_pause) && (!pause->tx_pause))
+                hw->mac.fc = PCH_GBE_FC_NONE;
+
+        if (hw->mac.fc_autoneg == AUTONEG_ENABLE) {
+                if ((netif_running(adapter->netdev))) {
+                        pch_gbe_down(adapter);
+                        ret = pch_gbe_up(adapter);
+                } else {
+                        pch_gbe_reset(adapter);
+                }
+        } else {
+                ret = pch_gbe_mac_force_mac_fc(hw);
+        }
+        return ret;
+}
+
+/**
+ * pch_gbe_get_rx_csum - Report whether receive checksums are turned on or off
+ * @netdev:  Network interface device structure
+ * Returns
+ *      true(1):  Checksum On
+ *      false(0): Checksum Off
+ */
+static u32 pch_gbe_get_rx_csum(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        return adapter->rx_csum;
+}
+
+/**
+ * pch_gbe_set_rx_csum - Turn receive checksum on or off
+ * @netdev:  Network interface device structure
+ * @data:    Checksum On[true] or Off[false]
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_rx_csum(struct net_device *netdev, u32 data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        adapter->rx_csum = data;
+        if ((netif_running(netdev)))
+                pch_gbe_reinit_locked(adapter);
+        else
+                pch_gbe_reset(adapter);
+
+        return 0;
+}
+
+/**
+ * pch_gbe_get_tx_csum - Report whether transmit checksums are turned on or off
+ * @netdev:  Network interface device structure
+ * Returns
+ *      true(1):  Checksum On
+ *      false(0): Checksum Off
+ */
+static u32 pch_gbe_get_tx_csum(struct net_device *netdev)
+{
+        return (netdev->features & NETIF_F_HW_CSUM) != 0;
+}
+
+/**
+ * pch_gbe_set_tx_csum - Turn transmit checksums on or off
+ * @netdev: Network interface device structure
+ * @data:   Checksum on[true] or off[false]
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_set_tx_csum(struct net_device *netdev, u32 data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        adapter->tx_csum = data;
+        if (data)
+                netdev->features |= NETIF_F_HW_CSUM;
+        else
+                netdev->features &= ~NETIF_F_HW_CSUM;
+        return 0;
+}
+
+/**
+ * pch_gbe_get_strings - Return a set of strings that describe the requested
+ *                       objects
+ * @netdev:    Network interface device structure
+ * @stringset: Select the stringset. [ETH_SS_TEST] [ETH_SS_STATS]
+ * @data:      Pointer of read string data.
+ */
+static void pch_gbe_get_strings(struct net_device *netdev, u32 stringset,
+                                        u8 *data)
+{
+        u8 *p = data;
+        int i;
+
+        switch (stringset) {
+        case (u32) ETH_SS_STATS:
+                for (i = 0; i < PCH_GBE_GLOBAL_STATS_LEN; i++) {
+                        memcpy(p, pch_gbe_gstrings_stats[i].string,
+                               ETH_GSTRING_LEN);
+                        p += ETH_GSTRING_LEN;
+                }
+                break;
+        }
+}
+
+/**
+ * pch_gbe_get_ethtool_stats - Return statistics about the device
+ * @netdev: Network interface device structure
+ * @stats:  Ethtool statue structure
+ * @data:   Pointer of read status area
+ */
+static void pch_gbe_get_ethtool_stats(struct net_device *netdev,
+                                  struct ethtool_stats *stats, u64 *data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int i;
+        const struct pch_gbe_stats *gstats = pch_gbe_gstrings_stats;
+        char *hw_stats = (char *)&adapter->stats;
+
+        pch_gbe_update_stats(adapter);
+        for (i = 0; i < PCH_GBE_GLOBAL_STATS_LEN; i++) {
+                char *p = hw_stats + gstats->offset;
+                data[i] = gstats->size == sizeof(u64) ? *(u64 *)p:(*(u32 *)p);
+                gstats++;
+        }
+}
+
+static int pch_gbe_get_sset_count(struct net_device *netdev, int sset)
+{
+        switch (sset) {
+        case ETH_SS_STATS:
+                return PCH_GBE_STATS_LEN;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static const struct ethtool_ops pch_gbe_ethtool_ops = {
+        .get_settings = pch_gbe_get_settings,
+        .set_settings = pch_gbe_set_settings,
+        .get_drvinfo = pch_gbe_get_drvinfo,
+        .get_regs_len = pch_gbe_get_regs_len,
+        .get_regs = pch_gbe_get_regs,
+        .get_wol = pch_gbe_get_wol,
+        .set_wol = pch_gbe_set_wol,
+        .nway_reset = pch_gbe_nway_reset,
+        .get_link = ethtool_op_get_link,
+        .get_ringparam = pch_gbe_get_ringparam,
+        .set_ringparam = pch_gbe_set_ringparam,
+        .get_pauseparam = pch_gbe_get_pauseparam,
+        .set_pauseparam = pch_gbe_set_pauseparam,
+        .get_rx_csum = pch_gbe_get_rx_csum,
+        .set_rx_csum = pch_gbe_set_rx_csum,
+        .get_tx_csum = pch_gbe_get_tx_csum,
+        .set_tx_csum = pch_gbe_set_tx_csum,
+        .get_strings = pch_gbe_get_strings,
+        .get_ethtool_stats = pch_gbe_get_ethtool_stats,
+        .get_sset_count = pch_gbe_get_sset_count,
+};
+
+void pch_gbe_set_ethtool_ops(struct net_device *netdev)
+{
+        SET_ETHTOOL_OPS(netdev, &pch_gbe_ethtool_ops);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
new file mode 100644
index 000000000000..53c56cf8aca2
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -0,0 +1,2473 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+#include "pch_gbe_api.h"
+
+#define DRV_VERSION     "1.00"
+const char pch_driver_version[] = DRV_VERSION;
+
+#define PCI_DEVICE_ID_INTEL_IOH1_GBE    0x8802          /* Pci device ID */
+#define PCH_GBE_MAR_ENTRIES             16
+#define PCH_GBE_SHORT_PKT               64
+#define DSC_INIT16                      0xC000
+#define PCH_GBE_DMA_ALIGN               0
+#define PCH_GBE_WATCHDOG_PERIOD         (1 * HZ)        /* watchdog time */
+#define PCH_GBE_COPYBREAK_DEFAULT       256
+#define PCH_GBE_PCI_BAR                 1
+
+#define PCH_GBE_TX_WEIGHT         64
+#define PCH_GBE_RX_WEIGHT         64
+#define PCH_GBE_RX_BUFFER_WRITE   16
+
+/* Initialize the wake-on-LAN settings */
+#define PCH_GBE_WL_INIT_SETTING    (PCH_GBE_WLC_MP)
+
+#define PCH_GBE_MAC_RGMII_CTRL_SETTING ( \
+        PCH_GBE_CHIP_TYPE_INTERNAL | \
+        PCH_GBE_RGMII_MODE_RGMII   | \
+        PCH_GBE_CRS_SEL              \
+        )
+
+/* Ethertype field values */
+#define PCH_GBE_MAX_JUMBO_FRAME_SIZE    10318
+#define PCH_GBE_FRAME_SIZE_2048         2048
+#define PCH_GBE_FRAME_SIZE_4096         4096
+#define PCH_GBE_FRAME_SIZE_8192         8192
+
+#define PCH_GBE_GET_DESC(R, i, type)    (&(((struct type *)((R).desc))[i]))
+#define PCH_GBE_RX_DESC(R, i)           PCH_GBE_GET_DESC(R, i, pch_gbe_rx_desc)
+#define PCH_GBE_TX_DESC(R, i)           PCH_GBE_GET_DESC(R, i, pch_gbe_tx_desc)
+#define PCH_GBE_DESC_UNUSED(R) \
+        ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
+        (R)->next_to_clean - (R)->next_to_use - 1)
+
+/* Pause packet value */
+#define PCH_GBE_PAUSE_PKT1_VALUE    0x00C28001
+#define PCH_GBE_PAUSE_PKT2_VALUE    0x00000100
+#define PCH_GBE_PAUSE_PKT4_VALUE    0x01000888
+#define PCH_GBE_PAUSE_PKT5_VALUE    0x0000FFFF
+
+#define PCH_GBE_ETH_ALEN            6
+
+/* This defines the bits that are set in the Interrupt Mask
+ * Set/Read Register.  Each bit is documented below:
+ *   o RXT0   = Receiver Timer Interrupt (ring 0)
+ *   o TXDW   = Transmit Descriptor Written Back
+ *   o RXDMT0 = Receive Descriptor Minimum Threshold hit (ring 0)
+ *   o RXSEQ  = Receive Sequence Error
+ *   o LSC    = Link Status Change
+ */
+#define PCH_GBE_INT_ENABLE_MASK ( \
+        PCH_GBE_INT_RX_DMA_CMPLT |    \
+        PCH_GBE_INT_RX_DSC_EMP   |    \
+        PCH_GBE_INT_WOL_DET      |    \
+        PCH_GBE_INT_TX_CMPLT          \
+        )
+
+
+static unsigned int copybreak __read_mostly = PCH_GBE_COPYBREAK_DEFAULT;
+
+/**
+ * pch_gbe_mac_read_mac_addr - Read MAC address
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ */
+s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw)
+{
+        u32  adr1a, adr1b;
+
+        adr1a = ioread32(&hw->reg->mac_adr[0].high);
+        adr1b = ioread32(&hw->reg->mac_adr[0].low);
+
+        hw->mac.addr[0] = (u8)(adr1a & 0xFF);
+        hw->mac.addr[1] = (u8)((adr1a >> 8) & 0xFF);
+        hw->mac.addr[2] = (u8)((adr1a >> 16) & 0xFF);
+        hw->mac.addr[3] = (u8)((adr1a >> 24) & 0xFF);
+        hw->mac.addr[4] = (u8)(adr1b & 0xFF);
+        hw->mac.addr[5] = (u8)((adr1b >> 8) & 0xFF);
+
+        pr_debug("hw->mac.addr : %pM\n", hw->mac.addr);
+        return 0;
+}
+
+/**
+ * pch_gbe_wait_clr_bit - Wait to clear a bit
+ * @reg:        Pointer of register
+ * @busy:       Busy bit
+ */
+void pch_gbe_wait_clr_bit(void *reg, u32 bit)
+{
+        u32 tmp;
+        /* wait busy */
+        tmp = 1000;
+        while ((ioread32(reg) & bit) && --tmp)
+                cpu_relax();
+        if (!tmp)
+                pr_err("Error: busy bit is not cleared\n");
+}
+/**
+ * pch_gbe_mac_mar_set - Set MAC address register
+ * @hw:     Pointer to the HW structure
+ * @addr:   Pointer to the MAC address
+ * @index:  MAC address array register
+ */
+void pch_gbe_mac_mar_set(struct pch_gbe_hw *hw, u8 * addr, u32 index)
+{
+        u32 mar_low, mar_high, adrmask;
+
+        pr_debug("index : 0x%x\n", index);
+
+        /*
+         * HW expects these in little endian so we reverse the byte order
+         * from network order (big endian) to little endian
+         */
+        mar_high = ((u32) addr[0] | ((u32) addr[1] << 8) |
+                   ((u32) addr[2] << 16) | ((u32) addr[3] << 24));
+        mar_low = ((u32) addr[4] | ((u32) addr[5] << 8));
+        /* Stop the MAC Address of index. */
+        adrmask = ioread32(&hw->reg->ADDR_MASK);
+        iowrite32((adrmask | (0x0001 << index)), &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+        /* Set the MAC address to the MAC address 1A/1B register */
+        iowrite32(mar_high, &hw->reg->mac_adr[index].high);
+        iowrite32(mar_low, &hw->reg->mac_adr[index].low);
+        /* Start the MAC address of index */
+        iowrite32((adrmask & ~(0x0001 << index)), &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+}
+
+/**
+ * pch_gbe_mac_reset_hw - Reset hardware
+ * @hw: Pointer to the HW structure
+ */
+void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
+{
+        /* Read the MAC address. and store to the private data */
+        pch_gbe_mac_read_mac_addr(hw);
+        iowrite32(PCH_GBE_ALL_RST, &hw->reg->RESET);
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        iowrite32(PCH_GBE_MODE_GMII_ETHER, &hw->reg->MODE);
+#endif
+        pch_gbe_wait_clr_bit(&hw->reg->RESET, PCH_GBE_ALL_RST);
+        /* Setup the receive address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+        return;
+}
+
+/**
+ * pch_gbe_mac_init_rx_addrs - Initialize receive address's
+ * @hw: Pointer to the HW structure
+ * @mar_count: Receive address registers
+ */
+void pch_gbe_mac_init_rx_addrs(struct pch_gbe_hw *hw, u16 mar_count)
+{
+        u32 i;
+
+        /* Setup the receive address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+
+        /* Zero out the other receive addresses */
+        for (i = 1; i < mar_count; i++) {
+                iowrite32(0, &hw->reg->mac_adr[i].high);
+                iowrite32(0, &hw->reg->mac_adr[i].low);
+        }
+        iowrite32(0xFFFE, &hw->reg->ADDR_MASK);
+        /* wait busy */
+        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+}
+
+
+/**
+ * pch_gbe_mac_mc_addr_list_update - Update Multicast addresses
+ * @hw:             Pointer to the HW structure
+ * @mc_addr_list:   Array of multicast addresses to program
+ * @mc_addr_count:  Number of multicast addresses to program
+ * @mar_used_count: The first MAC Address register free to program
+ * @mar_total_num:  Total number of supported MAC Address Registers
+ */
+void pch_gbe_mac_mc_addr_list_update(struct pch_gbe_hw *hw,
+                                     u8 *mc_addr_list, u32 mc_addr_count,
+                                     u32 mar_used_count, u32 mar_total_num)
+{
+        u32 i, adrmask;
+
+        /* Load the first set of multicast addresses into the exact
+         * filters (RAR).  If there are not enough to fill the RAR
+         * array, clear the filters.
+         */
+        for (i = mar_used_count; i < mar_total_num; i++) {
+                if (mc_addr_count) {
+                        pch_gbe_mac_mar_set(hw, mc_addr_list, i);
+                        mc_addr_count--;
+                        mc_addr_list += PCH_GBE_ETH_ALEN;
+                } else {
+                        /* Clear MAC address mask */
+                        adrmask = ioread32(&hw->reg->ADDR_MASK);
+                        iowrite32((adrmask | (0x0001 << i)),
+                                        &hw->reg->ADDR_MASK);
+                        /* wait busy */
+                        pch_gbe_wait_clr_bit(&hw->reg->ADDR_MASK, PCH_GBE_BUSY);
+                        /* Clear MAC address */
+                        iowrite32(0, &hw->reg->mac_adr[i].high);
+                        iowrite32(0, &hw->reg->mac_adr[i].low);
+                }
+        }
+}
+
+/**
+ * pch_gbe_mac_force_mac_fc - Force the MAC's flow control settings
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_mac_info *mac = &hw->mac;
+        u32 rx_fctrl;
+
+        pr_debug("mac->fc = %u\n", mac->fc);
+
+        rx_fctrl = ioread32(&hw->reg->RX_FCTRL);
+
+        switch (mac->fc) {
+        case PCH_GBE_FC_NONE:
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = false;
+                break;
+        case PCH_GBE_FC_RX_PAUSE:
+                rx_fctrl |= PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = false;
+                break;
+        case PCH_GBE_FC_TX_PAUSE:
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = true;
+                break;
+        case PCH_GBE_FC_FULL:
+                rx_fctrl |= PCH_GBE_FL_CTRL_EN;
+                mac->tx_fc_enable = true;
+                break;
+        default:
+                pr_err("Flow control param set incorrectly\n");
+                return -EINVAL;
+        }
+        if (mac->link_duplex == DUPLEX_HALF)
+                rx_fctrl &= ~PCH_GBE_FL_CTRL_EN;
+        iowrite32(rx_fctrl, &hw->reg->RX_FCTRL);
+        pr_debug("RX_FCTRL reg : 0x%08x  mac->tx_fc_enable : %d\n",
+                 ioread32(&hw->reg->RX_FCTRL), mac->tx_fc_enable);
+        return 0;
+}
+
+/**
+ * pch_gbe_mac_set_wol_event - Set wake-on-lan event
+ * @hw:     Pointer to the HW structure
+ * @wu_evt: Wake up event
+ */
+void pch_gbe_mac_set_wol_event(struct pch_gbe_hw *hw, u32 wu_evt)
+{
+        u32 addr_mask;
+
+        pr_debug("wu_evt : 0x%08x  ADDR_MASK reg : 0x%08x\n",
+                 wu_evt, ioread32(&hw->reg->ADDR_MASK));
+
+        if (wu_evt) {
+                /* Set Wake-On-Lan address mask */
+                addr_mask = ioread32(&hw->reg->ADDR_MASK);
+                iowrite32(addr_mask, &hw->reg->WOL_ADDR_MASK);
+                /* wait busy */
+                pch_gbe_wait_clr_bit(&hw->reg->WOL_ADDR_MASK, PCH_GBE_WLA_BUSY);
+                iowrite32(0, &hw->reg->WOL_ST);
+                iowrite32((wu_evt | PCH_GBE_WLC_WOL_MODE), &hw->reg->WOL_CTRL);
+                iowrite32(0x02, &hw->reg->TCPIP_ACC);
+                iowrite32(PCH_GBE_INT_ENABLE_MASK, &hw->reg->INT_EN);
+        } else {
+                iowrite32(0, &hw->reg->WOL_CTRL);
+                iowrite32(0, &hw->reg->WOL_ST);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_mac_ctrl_miim - Control MIIM interface
+ * @hw:   Pointer to the HW structure
+ * @addr: Address of PHY
+ * @dir:  Operetion. (Write or Read)
+ * @reg:  Access register of PHY
+ * @data: Write data.
+ *
+ * Returns: Read date.
+ */
+u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw, u32 addr, u32 dir, u32 reg,
+                        u16 data)
+{
+        u32 data_out = 0;
+        unsigned int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hw->miim_lock, flags);
+
+        for (i = 100; i; --i) {
+                if ((ioread32(&hw->reg->MIIM) & PCH_GBE_MIIM_OPER_READY))
+                        break;
+                udelay(20);
+        }
+        if (i == 0) {
+                pr_err("pch-gbe.miim won't go Ready\n");
+                spin_unlock_irqrestore(&hw->miim_lock, flags);
+                return 0;       /* No way to indicate timeout error */
+        }
+        iowrite32(((reg << PCH_GBE_MIIM_REG_ADDR_SHIFT) |
+                  (addr << PCH_GBE_MIIM_PHY_ADDR_SHIFT) |
+                  dir | data), &hw->reg->MIIM);
+        for (i = 0; i < 100; i++) {
+                udelay(20);
+                data_out = ioread32(&hw->reg->MIIM);
+                if ((data_out & PCH_GBE_MIIM_OPER_READY))
+                        break;
+        }
+        spin_unlock_irqrestore(&hw->miim_lock, flags);
+
+        pr_debug("PHY %s: reg=%d, data=0x%04X\n",
+                 dir == PCH_GBE_MIIM_OPER_READ ? "READ" : "WRITE", reg,
+                 dir == PCH_GBE_MIIM_OPER_READ ? data_out : data);
+        return (u16) data_out;
+}
+
+/**
+ * pch_gbe_mac_set_pause_packet - Set pause packet
+ * @hw:   Pointer to the HW structure
+ */
+void pch_gbe_mac_set_pause_packet(struct pch_gbe_hw *hw)
+{
+        unsigned long tmp2, tmp3;
+
+        /* Set Pause packet */
+        tmp2 = hw->mac.addr[1];
+        tmp2 = (tmp2 << 8) | hw->mac.addr[0];
+        tmp2 = PCH_GBE_PAUSE_PKT2_VALUE | (tmp2 << 16);
+
+        tmp3 = hw->mac.addr[5];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[4];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[3];
+        tmp3 = (tmp3 << 8) | hw->mac.addr[2];
+
+        iowrite32(PCH_GBE_PAUSE_PKT1_VALUE, &hw->reg->PAUSE_PKT1);
+        iowrite32(tmp2, &hw->reg->PAUSE_PKT2);
+        iowrite32(tmp3, &hw->reg->PAUSE_PKT3);
+        iowrite32(PCH_GBE_PAUSE_PKT4_VALUE, &hw->reg->PAUSE_PKT4);
+        iowrite32(PCH_GBE_PAUSE_PKT5_VALUE, &hw->reg->PAUSE_PKT5);
+
+        /* Transmit Pause Packet */
+        iowrite32(PCH_GBE_PS_PKT_RQ, &hw->reg->PAUSE_REQ);
+
+        pr_debug("PAUSE_PKT1-5 reg : 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                 ioread32(&hw->reg->PAUSE_PKT1), ioread32(&hw->reg->PAUSE_PKT2),
+                 ioread32(&hw->reg->PAUSE_PKT3), ioread32(&hw->reg->PAUSE_PKT4),
+                 ioread32(&hw->reg->PAUSE_PKT5));
+
+        return;
+}
+
+
+/**
+ * pch_gbe_alloc_queues - Allocate memory for all rings
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_alloc_queues(struct pch_gbe_adapter *adapter)
+{
+        int size;
+
+        size = (int)sizeof(struct pch_gbe_tx_ring);
+        adapter->tx_ring = kzalloc(size, GFP_KERNEL);
+        if (!adapter->tx_ring)
+                return -ENOMEM;
+        size = (int)sizeof(struct pch_gbe_rx_ring);
+        adapter->rx_ring = kzalloc(size, GFP_KERNEL);
+        if (!adapter->rx_ring) {
+                kfree(adapter->tx_ring);
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+/**
+ * pch_gbe_init_stats - Initialize status
+ * @adapter:  Board private structure to initialize
+ */
+static void pch_gbe_init_stats(struct pch_gbe_adapter *adapter)
+{
+        memset(&adapter->stats, 0, sizeof(adapter->stats));
+        return;
+}
+
+/**
+ * pch_gbe_init_phy - Initialize PHY
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_init_phy(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        u32 addr;
+        u16 bmcr, stat;
+
+        /* Discover phy addr by searching addrs in order {1,0,2,..., 31} */
+        for (addr = 0; addr < PCH_GBE_PHY_REGS_LEN; addr++) {
+                adapter->mii.phy_id = (addr == 0) ? 1 : (addr == 1) ? 0 : addr;
+                bmcr = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMCR);
+                stat = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMSR);
+                stat = pch_gbe_mdio_read(netdev, adapter->mii.phy_id, MII_BMSR);
+                if (!((bmcr == 0xFFFF) || ((stat == 0) && (bmcr == 0))))
+                        break;
+        }
+        adapter->hw.phy.addr = adapter->mii.phy_id;
+        pr_debug("phy_addr = %d\n", adapter->mii.phy_id);
+        if (addr == 32)
+                return -EAGAIN;
+        /* Selected the phy and isolate the rest */
+        for (addr = 0; addr < PCH_GBE_PHY_REGS_LEN; addr++) {
+                if (addr != adapter->mii.phy_id) {
+                        pch_gbe_mdio_write(netdev, addr, MII_BMCR,
+                                           BMCR_ISOLATE);
+                } else {
+                        bmcr = pch_gbe_mdio_read(netdev, addr, MII_BMCR);
+                        pch_gbe_mdio_write(netdev, addr, MII_BMCR,
+                                           bmcr & ~BMCR_ISOLATE);
+                }
+        }
+
+        /* MII setup */
+        adapter->mii.phy_id_mask = 0x1F;
+        adapter->mii.reg_num_mask = 0x1F;
+        adapter->mii.dev = adapter->netdev;
+        adapter->mii.mdio_read = pch_gbe_mdio_read;
+        adapter->mii.mdio_write = pch_gbe_mdio_write;
+        adapter->mii.supports_gmii = mii_check_gmii_support(&adapter->mii);
+        return 0;
+}
+
+/**
+ * pch_gbe_mdio_read - The read function for mii
+ * @netdev: Network interface device structure
+ * @addr:   Phy ID
+ * @reg:    Access location
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_mdio_read(struct net_device *netdev, int addr, int reg)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        return pch_gbe_mac_ctrl_miim(hw, addr, PCH_GBE_HAL_MIIM_READ, reg,
+                                     (u16) 0);
+}
+
+/**
+ * pch_gbe_mdio_write - The write function for mii
+ * @netdev: Network interface device structure
+ * @addr:   Phy ID (not used)
+ * @reg:    Access location
+ * @data:   Write data
+ */
+void pch_gbe_mdio_write(struct net_device *netdev, int addr, int reg, int data)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pch_gbe_mac_ctrl_miim(hw, addr, PCH_GBE_HAL_MIIM_WRITE, reg, data);
+}
+
+/**
+ * pch_gbe_reset_task - Reset processing at the time of transmission timeout
+ * @work:  Pointer of board private structure
+ */
+static void pch_gbe_reset_task(struct work_struct *work)
+{
+        struct pch_gbe_adapter *adapter;
+        adapter = container_of(work, struct pch_gbe_adapter, reset_task);
+
+        pch_gbe_reinit_locked(adapter);
+}
+
+/**
+ * pch_gbe_reinit_locked- Re-initialization
+ * @adapter:  Board private structure
+ */
+void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                pch_gbe_down(adapter);
+                pch_gbe_up(adapter);
+        }
+        rtnl_unlock();
+}
+
+/**
+ * pch_gbe_reset - Reset GbE
+ * @adapter:  Board private structure
+ */
+void pch_gbe_reset(struct pch_gbe_adapter *adapter)
+{
+        pch_gbe_mac_reset_hw(&adapter->hw);
+        /* Setup the receive address. */
+        pch_gbe_mac_init_rx_addrs(&adapter->hw, PCH_GBE_MAR_ENTRIES);
+        if (pch_gbe_hal_init_hw(&adapter->hw))
+                pr_err("Hardware Error\n");
+}
+
+/**
+ * pch_gbe_free_irq - Free an interrupt
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_free_irq(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        free_irq(adapter->pdev->irq, netdev);
+        if (adapter->have_msi) {
+                pci_disable_msi(adapter->pdev);
+                pr_debug("call pci_disable_msi\n");
+        }
+}
+
+/**
+ * pch_gbe_irq_disable - Mask off interrupt generation on the NIC
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_irq_disable(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        atomic_inc(&adapter->irq_sem);
+        iowrite32(0, &hw->reg->INT_EN);
+        ioread32(&hw->reg->INT_ST);
+        synchronize_irq(adapter->pdev->irq);
+
+        pr_debug("INT_EN reg : 0x%08x\n", ioread32(&hw->reg->INT_EN));
+}
+
+/**
+ * pch_gbe_irq_enable - Enable default interrupt generation settings
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_irq_enable(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        if (likely(atomic_dec_and_test(&adapter->irq_sem)))
+                iowrite32(PCH_GBE_INT_ENABLE_MASK, &hw->reg->INT_EN);
+        ioread32(&hw->reg->INT_ST);
+        pr_debug("INT_EN reg : 0x%08x\n", ioread32(&hw->reg->INT_EN));
+}
+
+
+
+/**
+ * pch_gbe_setup_tctl - configure the Transmit control registers
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_setup_tctl(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 tx_mode, tcpip;
+
+        tx_mode = PCH_GBE_TM_LONG_PKT |
+                PCH_GBE_TM_ST_AND_FD |
+                PCH_GBE_TM_SHORT_PKT |
+                PCH_GBE_TM_TH_TX_STRT_8 |
+                PCH_GBE_TM_TH_ALM_EMP_4 | PCH_GBE_TM_TH_ALM_FULL_8;
+
+        iowrite32(tx_mode, &hw->reg->TX_MODE);
+
+        tcpip = ioread32(&hw->reg->TCPIP_ACC);
+        tcpip |= PCH_GBE_TX_TCPIPACC_EN;
+        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
+        return;
+}
+
+/**
+ * pch_gbe_configure_tx - Configure Transmit Unit after Reset
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_configure_tx(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 tdba, tdlen, dctrl;
+
+        pr_debug("dma addr = 0x%08llx  size = 0x%08x\n",
+                 (unsigned long long)adapter->tx_ring->dma,
+                 adapter->tx_ring->size);
+
+        /* Setup the HW Tx Head and Tail descriptor pointers */
+        tdba = adapter->tx_ring->dma;
+        tdlen = adapter->tx_ring->size - 0x10;
+        iowrite32(tdba, &hw->reg->TX_DSC_BASE);
+        iowrite32(tdlen, &hw->reg->TX_DSC_SIZE);
+        iowrite32(tdba, &hw->reg->TX_DSC_SW_P);
+
+        /* Enables Transmission DMA */
+        dctrl = ioread32(&hw->reg->DMA_CTRL);
+        dctrl |= PCH_GBE_TX_DMA_EN;
+        iowrite32(dctrl, &hw->reg->DMA_CTRL);
+}
+
+/**
+ * pch_gbe_setup_rctl - Configure the receive control registers
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rx_mode, tcpip;
+
+        rx_mode = PCH_GBE_ADD_FIL_EN | PCH_GBE_MLT_FIL_EN |
+        PCH_GBE_RH_ALM_EMP_4 | PCH_GBE_RH_ALM_FULL_4 | PCH_GBE_RH_RD_TRG_8;
+
+        iowrite32(rx_mode, &hw->reg->RX_MODE);
+
+        tcpip = ioread32(&hw->reg->TCPIP_ACC);
+
+        if (adapter->rx_csum) {
+                tcpip &= ~PCH_GBE_RX_TCPIPACC_OFF;
+                tcpip |= PCH_GBE_RX_TCPIPACC_EN;
+        } else {
+                tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
+                tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
+        }
+        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
+        return;
+}
+
+/**
+ * pch_gbe_configure_rx - Configure Receive Unit after Reset
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rdba, rdlen, rctl, rxdma;
+
+        pr_debug("dma adr = 0x%08llx  size = 0x%08x\n",
+                 (unsigned long long)adapter->rx_ring->dma,
+                 adapter->rx_ring->size);
+
+        pch_gbe_mac_force_mac_fc(hw);
+
+        /* Disables Receive MAC */
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
+        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
+
+        /* Disables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma &= ~PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+
+        pr_debug("MAC_RX_EN reg = 0x%08x  DMA_CTRL reg = 0x%08x\n",
+                 ioread32(&hw->reg->MAC_RX_EN),
+                 ioread32(&hw->reg->DMA_CTRL));
+
+        /* Setup the HW Rx Head and Tail Descriptor Pointers and
+         * the Base and Length of the Rx Descriptor Ring */
+        rdba = adapter->rx_ring->dma;
+        rdlen = adapter->rx_ring->size - 0x10;
+        iowrite32(rdba, &hw->reg->RX_DSC_BASE);
+        iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
+        iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
+
+        /* Enables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma |= PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Enables Receive */
+        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+}
+
+/**
+ * pch_gbe_unmap_and_free_tx_resource - Unmap and free tx socket buffer
+ * @adapter:     Board private structure
+ * @buffer_info: Buffer information structure
+ */
+static void pch_gbe_unmap_and_free_tx_resource(
+        struct pch_gbe_adapter *adapter, struct pch_gbe_buffer *buffer_info)
+{
+        if (buffer_info->mapped) {
+                dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                 buffer_info->length, DMA_TO_DEVICE);
+                buffer_info->mapped = false;
+        }
+        if (buffer_info->skb) {
+                dev_kfree_skb_any(buffer_info->skb);
+                buffer_info->skb = NULL;
+        }
+}
+
+/**
+ * pch_gbe_unmap_and_free_rx_resource - Unmap and free rx socket buffer
+ * @adapter:      Board private structure
+ * @buffer_info:  Buffer information structure
+ */
+static void pch_gbe_unmap_and_free_rx_resource(
+                                        struct pch_gbe_adapter *adapter,
+                                        struct pch_gbe_buffer *buffer_info)
+{
+        if (buffer_info->mapped) {
+                dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                 buffer_info->length, DMA_FROM_DEVICE);
+                buffer_info->mapped = false;
+        }
+        if (buffer_info->skb) {
+                dev_kfree_skb_any(buffer_info->skb);
+                buffer_info->skb = NULL;
+        }
+}
+
+/**
+ * pch_gbe_clean_tx_ring - Free Tx Buffers
+ * @adapter:  Board private structure
+ * @tx_ring:  Ring to be cleaned
+ */
+static void pch_gbe_clean_tx_ring(struct pch_gbe_adapter *adapter,
+                                   struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned long size;
+        unsigned int i;
+
+        /* Free all the Tx ring sk_buffs */
+        for (i = 0; i < tx_ring->count; i++) {
+                buffer_info = &tx_ring->buffer_info[i];
+                pch_gbe_unmap_and_free_tx_resource(adapter, buffer_info);
+        }
+        pr_debug("call pch_gbe_unmap_and_free_tx_resource() %d count\n", i);
+
+        size = (unsigned long)sizeof(struct pch_gbe_buffer) * tx_ring->count;
+        memset(tx_ring->buffer_info, 0, size);
+
+        /* Zero out the descriptor ring */
+        memset(tx_ring->desc, 0, tx_ring->size);
+        tx_ring->next_to_use = 0;
+        tx_ring->next_to_clean = 0;
+        iowrite32(tx_ring->dma, &hw->reg->TX_DSC_HW_P);
+        iowrite32((tx_ring->size - 0x10), &hw->reg->TX_DSC_SIZE);
+}
+
+/**
+ * pch_gbe_clean_rx_ring - Free Rx Buffers
+ * @adapter:  Board private structure
+ * @rx_ring:  Ring to free buffers from
+ */
+static void
+pch_gbe_clean_rx_ring(struct pch_gbe_adapter *adapter,
+                      struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned long size;
+        unsigned int i;
+
+        /* Free all the Rx ring sk_buffs */
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                pch_gbe_unmap_and_free_rx_resource(adapter, buffer_info);
+        }
+        pr_debug("call pch_gbe_unmap_and_free_rx_resource() %d count\n", i);
+        size = (unsigned long)sizeof(struct pch_gbe_buffer) * rx_ring->count;
+        memset(rx_ring->buffer_info, 0, size);
+
+        /* Zero out the descriptor ring */
+        memset(rx_ring->desc, 0, rx_ring->size);
+        rx_ring->next_to_clean = 0;
+        rx_ring->next_to_use = 0;
+        iowrite32(rx_ring->dma, &hw->reg->RX_DSC_HW_P);
+        iowrite32((rx_ring->size - 0x10), &hw->reg->RX_DSC_SIZE);
+}
+
+static void pch_gbe_set_rgmii_ctrl(struct pch_gbe_adapter *adapter, u16 speed,
+                                    u16 duplex)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        unsigned long rgmii = 0;
+
+        /* Set the RGMII control. */
+#ifdef PCH_GBE_MAC_IFOP_RGMII
+        switch (speed) {
+        case SPEED_10:
+                rgmii = (PCH_GBE_RGMII_RATE_2_5M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        case SPEED_100:
+                rgmii = (PCH_GBE_RGMII_RATE_25M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        case SPEED_1000:
+                rgmii = (PCH_GBE_RGMII_RATE_125M |
+                         PCH_GBE_MAC_RGMII_CTRL_SETTING);
+                break;
+        }
+        iowrite32(rgmii, &hw->reg->RGMII_CTRL);
+#else   /* GMII */
+        rgmii = 0;
+        iowrite32(rgmii, &hw->reg->RGMII_CTRL);
+#endif
+}
+static void pch_gbe_set_mode(struct pch_gbe_adapter *adapter, u16 speed,
+                              u16 duplex)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        unsigned long mode = 0;
+
+        /* Set the communication mode */
+        switch (speed) {
+        case SPEED_10:
+                mode = PCH_GBE_MODE_MII_ETHER;
+                netdev->tx_queue_len = 10;
+                break;
+        case SPEED_100:
+                mode = PCH_GBE_MODE_MII_ETHER;
+                netdev->tx_queue_len = 100;
+                break;
+        case SPEED_1000:
+                mode = PCH_GBE_MODE_GMII_ETHER;
+                break;
+        }
+        if (duplex == DUPLEX_FULL)
+                mode |= PCH_GBE_MODE_FULL_DUPLEX;
+        else
+                mode |= PCH_GBE_MODE_HALF_DUPLEX;
+        iowrite32(mode, &hw->reg->MODE);
+}
+
+/**
+ * pch_gbe_watchdog - Watchdog process
+ * @data:  Board private structure
+ */
+static void pch_gbe_watchdog(unsigned long data)
+{
+        struct pch_gbe_adapter *adapter = (struct pch_gbe_adapter *)data;
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct ethtool_cmd cmd;
+
+        pr_debug("right now = %ld\n", jiffies);
+
+        pch_gbe_update_stats(adapter);
+        if ((mii_link_ok(&adapter->mii)) && (!netif_carrier_ok(netdev))) {
+                netdev->tx_queue_len = adapter->tx_queue_len;
+                /* mii library handles link maintenance tasks */
+                if (mii_ethtool_gset(&adapter->mii, &cmd)) {
+                        pr_err("ethtool get setting Error\n");
+                        mod_timer(&adapter->watchdog_timer,
+                                  round_jiffies(jiffies +
+                                                PCH_GBE_WATCHDOG_PERIOD));
+                        return;
+                }
+                hw->mac.link_speed = cmd.speed;
+                hw->mac.link_duplex = cmd.duplex;
+                /* Set the RGMII control. */
+                pch_gbe_set_rgmii_ctrl(adapter, hw->mac.link_speed,
+                                                hw->mac.link_duplex);
+                /* Set the communication mode */
+                pch_gbe_set_mode(adapter, hw->mac.link_speed,
+                                 hw->mac.link_duplex);
+                netdev_dbg(netdev,
+                           "Link is Up %d Mbps %s-Duplex\n",
+                           cmd.speed,
+                           cmd.duplex == DUPLEX_FULL ? "Full" : "Half");
+                netif_carrier_on(netdev);
+                netif_wake_queue(netdev);
+        } else if ((!mii_link_ok(&adapter->mii)) &&
+                   (netif_carrier_ok(netdev))) {
+                netdev_dbg(netdev, "NIC Link is Down\n");
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                netif_carrier_off(netdev);
+                netif_stop_queue(netdev);
+        }
+        mod_timer(&adapter->watchdog_timer,
+                  round_jiffies(jiffies + PCH_GBE_WATCHDOG_PERIOD));
+}
+
+/**
+ * pch_gbe_tx_queue - Carry out queuing of the transmission data
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring structure
+ * @skb:      Sockt buffer structure
+ */
+static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter,
+                              struct pch_gbe_tx_ring *tx_ring,
+                              struct sk_buff *skb)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_tx_desc *tx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *tmp_skb;
+        unsigned int frame_ctrl;
+        unsigned int ring_num;
+        unsigned long flags;
+
+        /*-- Set frame control --*/
+        frame_ctrl = 0;
+        if (unlikely(skb->len < PCH_GBE_SHORT_PKT))
+                frame_ctrl |= PCH_GBE_TXD_CTRL_APAD;
+        if (unlikely(!adapter->tx_csum))
+                frame_ctrl |= PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF;
+
+        /* Performs checksum processing */
+        /*
+         * It is because the hardware accelerator does not support a checksum,
+         * when the received data size is less than 64 bytes.
+         */
+        if ((skb->len < PCH_GBE_SHORT_PKT) && (adapter->tx_csum)) {
+                frame_ctrl |= PCH_GBE_TXD_CTRL_APAD |
+                              PCH_GBE_TXD_CTRL_TCPIP_ACC_OFF;
+                if (skb->protocol == htons(ETH_P_IP)) {
+                        struct iphdr *iph = ip_hdr(skb);
+                        unsigned int offset;
+                        iph->check = 0;
+                        iph->check = ip_fast_csum((u8 *) iph, iph->ihl);
+                        offset = skb_transport_offset(skb);
+                        if (iph->protocol == IPPROTO_TCP) {
+                                skb->csum = 0;
+                                tcp_hdr(skb)->check = 0;
+                                skb->csum = skb_checksum(skb, offset,
+                                                         skb->len - offset, 0);
+                                tcp_hdr(skb)->check =
+                                        csum_tcpudp_magic(iph->saddr,
+                                                          iph->daddr,
+                                                          skb->len - offset,
+                                                          IPPROTO_TCP,
+                                                          skb->csum);
+                        } else if (iph->protocol == IPPROTO_UDP) {
+                                skb->csum = 0;
+                                udp_hdr(skb)->check = 0;
+                                skb->csum =
+                                        skb_checksum(skb, offset,
+                                                     skb->len - offset, 0);
+                                udp_hdr(skb)->check =
+                                        csum_tcpudp_magic(iph->saddr,
+                                                          iph->daddr,
+                                                          skb->len - offset,
+                                                          IPPROTO_UDP,
+                                                          skb->csum);
+                        }
+                }
+        }
+        spin_lock_irqsave(&tx_ring->tx_lock, flags);
+        ring_num = tx_ring->next_to_use;
+        if (unlikely((ring_num + 1) == tx_ring->count))
+                tx_ring->next_to_use = 0;
+        else
+                tx_ring->next_to_use = ring_num + 1;
+
+        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+        buffer_info = &tx_ring->buffer_info[ring_num];
+        tmp_skb = buffer_info->skb;
+
+        /* [Header:14][payload] ---> [Header:14][paddong:2][payload]    */
+        memcpy(tmp_skb->data, skb->data, ETH_HLEN);
+        tmp_skb->data[ETH_HLEN] = 0x00;
+        tmp_skb->data[ETH_HLEN + 1] = 0x00;
+        tmp_skb->len = skb->len;
+        memcpy(&tmp_skb->data[ETH_HLEN + 2], &skb->data[ETH_HLEN],
+               (skb->len - ETH_HLEN));
+        /*-- Set Buffer infomation --*/
+        buffer_info->length = tmp_skb->len;
+        buffer_info->dma = dma_map_single(&adapter->pdev->dev, tmp_skb->data,
+                                          buffer_info->length,
+                                          DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
+                pr_err("TX DMA map failed\n");
+                buffer_info->dma = 0;
+                buffer_info->time_stamp = 0;
+                tx_ring->next_to_use = ring_num;
+                return;
+        }
+        buffer_info->mapped = true;
+        buffer_info->time_stamp = jiffies;
+
+        /*-- Set Tx descriptor --*/
+        tx_desc = PCH_GBE_TX_DESC(*tx_ring, ring_num);
+        tx_desc->buffer_addr = (buffer_info->dma);
+        tx_desc->length = (tmp_skb->len);
+        tx_desc->tx_words_eob = ((tmp_skb->len + 3));
+        tx_desc->tx_frame_ctrl = (frame_ctrl);
+        tx_desc->gbec_status = (DSC_INIT16);
+
+        if (unlikely(++ring_num == tx_ring->count))
+                ring_num = 0;
+
+        /* Update software pointer of TX descriptor */
+        iowrite32(tx_ring->dma +
+                  (int)sizeof(struct pch_gbe_tx_desc) * ring_num,
+                  &hw->reg->TX_DSC_SW_P);
+        dev_kfree_skb_any(skb);
+}
+
+/**
+ * pch_gbe_update_stats - Update the board statistics counters
+ * @adapter:  Board private structure
+ */
+void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_hw_stats *stats = &adapter->stats;
+        unsigned long flags;
+
+        /*
+         * Prevent stats update while adapter is being reset, or if the pci
+         * connection is down.
+         */
+        if ((pdev->error_state) && (pdev->error_state != pci_channel_io_normal))
+                return;
+
+        spin_lock_irqsave(&adapter->stats_lock, flags);
+
+        /* Update device status "adapter->stats" */
+        stats->rx_errors = stats->rx_crc_errors + stats->rx_frame_errors;
+        stats->tx_errors = stats->tx_length_errors +
+            stats->tx_aborted_errors +
+            stats->tx_carrier_errors + stats->tx_timeout_count;
+
+        /* Update network device status "adapter->net_stats" */
+        netdev->stats.rx_packets = stats->rx_packets;
+        netdev->stats.rx_bytes = stats->rx_bytes;
+        netdev->stats.rx_dropped = stats->rx_dropped;
+        netdev->stats.tx_packets = stats->tx_packets;
+        netdev->stats.tx_bytes = stats->tx_bytes;
+        netdev->stats.tx_dropped = stats->tx_dropped;
+        /* Fill out the OS statistics structure */
+        netdev->stats.multicast = stats->multicast;
+        netdev->stats.collisions = stats->collisions;
+        /* Rx Errors */
+        netdev->stats.rx_errors = stats->rx_errors;
+        netdev->stats.rx_crc_errors = stats->rx_crc_errors;
+        netdev->stats.rx_frame_errors = stats->rx_frame_errors;
+        /* Tx Errors */
+        netdev->stats.tx_errors = stats->tx_errors;
+        netdev->stats.tx_aborted_errors = stats->tx_aborted_errors;
+        netdev->stats.tx_carrier_errors = stats->tx_carrier_errors;
+
+        spin_unlock_irqrestore(&adapter->stats_lock, flags);
+}
+
+/**
+ * pch_gbe_intr - Interrupt Handler
+ * @irq:   Interrupt number
+ * @data:  Pointer to a network interface device structure
+ * Returns
+ *      - IRQ_HANDLED:  Our interrupt
+ *      - IRQ_NONE:     Not our interrupt
+ */
+static irqreturn_t pch_gbe_intr(int irq, void *data)
+{
+        struct net_device *netdev = data;
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 int_st;
+        u32 int_en;
+
+        /* Check request status */
+        int_st = ioread32(&hw->reg->INT_ST);
+        int_st = int_st & ioread32(&hw->reg->INT_EN);
+        /* When request status is no interruption factor */
+        if (unlikely(!int_st))
+                return IRQ_NONE;        /* Not our interrupt. End processing. */
+        pr_debug("%s occur int_st = 0x%08x\n", __func__, int_st);
+        if (int_st & PCH_GBE_INT_RX_FRAME_ERR)
+                adapter->stats.intr_rx_frame_err_count++;
+        if (int_st & PCH_GBE_INT_RX_FIFO_ERR)
+                adapter->stats.intr_rx_fifo_err_count++;
+        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
+                adapter->stats.intr_rx_dma_err_count++;
+        if (int_st & PCH_GBE_INT_TX_FIFO_ERR)
+                adapter->stats.intr_tx_fifo_err_count++;
+        if (int_st & PCH_GBE_INT_TX_DMA_ERR)
+                adapter->stats.intr_tx_dma_err_count++;
+        if (int_st & PCH_GBE_INT_TCPIP_ERR)
+                adapter->stats.intr_tcpip_err_count++;
+        /* When Rx descriptor is empty  */
+        if ((int_st & PCH_GBE_INT_RX_DSC_EMP)) {
+                adapter->stats.intr_rx_dsc_empty_count++;
+                pr_err("Rx descriptor is empty\n");
+                int_en = ioread32(&hw->reg->INT_EN);
+                iowrite32((int_en & ~PCH_GBE_INT_RX_DSC_EMP), &hw->reg->INT_EN);
+                if (hw->mac.tx_fc_enable) {
+                        /* Set Pause packet */
+                        pch_gbe_mac_set_pause_packet(hw);
+                }
+                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
+                    == 0) {
+                        return IRQ_HANDLED;
+                }
+        }
+
+        /* When request status is Receive interruption */
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+                if (likely(napi_schedule_prep(&adapter->napi))) {
+                        /* Enable only Rx Descriptor empty */
+                        atomic_inc(&adapter->irq_sem);
+                        int_en = ioread32(&hw->reg->INT_EN);
+                        int_en &=
+                            ~(PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT);
+                        iowrite32(int_en, &hw->reg->INT_EN);
+                        /* Start polling for NAPI */
+                        __napi_schedule(&adapter->napi);
+                }
+        }
+        pr_debug("return = 0x%08x  INT_EN reg = 0x%08x\n",
+                 IRQ_HANDLED, ioread32(&hw->reg->INT_EN));
+        return IRQ_HANDLED;
+}
+
+/**
+ * pch_gbe_alloc_rx_buffers - Replace used receive buffers; legacy & extended
+ * @adapter:       Board private structure
+ * @rx_ring:       Rx descriptor ring
+ * @cleaned_count: Cleaned count
+ */
+static void
+pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
+                         struct pch_gbe_rx_ring *rx_ring, int cleaned_count)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct pch_gbe_rx_desc *rx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int bufsz;
+
+        bufsz = adapter->rx_buffer_len + PCH_GBE_DMA_ALIGN;
+        i = rx_ring->next_to_use;
+
+        while ((cleaned_count--)) {
+                buffer_info = &rx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+                if (skb) {
+                        skb_trim(skb, 0);
+                } else {
+                        skb = netdev_alloc_skb(netdev, bufsz);
+                        if (unlikely(!skb)) {
+                                /* Better luck next round */
+                                adapter->stats.rx_alloc_buff_failed++;
+                                break;
+                        }
+                        /* 64byte align */
+                        skb_reserve(skb, PCH_GBE_DMA_ALIGN);
+
+                        buffer_info->skb = skb;
+                        buffer_info->length = adapter->rx_buffer_len;
+                }
+                buffer_info->dma = dma_map_single(&pdev->dev,
+                                                  skb->data,
+                                                  buffer_info->length,
+                                                  DMA_FROM_DEVICE);
+                if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->dma = 0;
+                        adapter->stats.rx_alloc_buff_failed++;
+                        break; /* while !buffer_info->skb */
+                }
+                buffer_info->mapped = true;
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, i);
+                rx_desc->buffer_addr = (buffer_info->dma);
+                rx_desc->gbec_status = DSC_INIT16;
+
+                pr_debug("i = %d  buffer_info->dma = 0x08%llx  buffer_info->length = 0x%x\n",
+                         i, (unsigned long long)buffer_info->dma,
+                         buffer_info->length);
+
+                if (unlikely(++i == rx_ring->count))
+                        i = 0;
+        }
+        if (likely(rx_ring->next_to_use != i)) {
+                rx_ring->next_to_use = i;
+                if (unlikely(i-- == 0))
+                        i = (rx_ring->count - 1);
+                iowrite32(rx_ring->dma +
+                          (int)sizeof(struct pch_gbe_rx_desc) * i,
+                          &hw->reg->RX_DSC_SW_P);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_alloc_tx_buffers - Allocate transmit buffers
+ * @adapter:   Board private structure
+ * @tx_ring:   Tx descriptor ring
+ */
+static void pch_gbe_alloc_tx_buffers(struct pch_gbe_adapter *adapter,
+                                        struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int bufsz;
+        struct pch_gbe_tx_desc *tx_desc;
+
+        bufsz =
+            adapter->hw.mac.max_frame_size + PCH_GBE_DMA_ALIGN + NET_IP_ALIGN;
+
+        for (i = 0; i < tx_ring->count; i++) {
+                buffer_info = &tx_ring->buffer_info[i];
+                skb = netdev_alloc_skb(adapter->netdev, bufsz);
+                skb_reserve(skb, PCH_GBE_DMA_ALIGN);
+                buffer_info->skb = skb;
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+                tx_desc->gbec_status = (DSC_INIT16);
+        }
+        return;
+}
+
+/**
+ * pch_gbe_clean_tx - Reclaim resources after transmit completes
+ * @adapter:   Board private structure
+ * @tx_ring:   Tx descriptor ring
+ * Returns
+ *      true:  Cleaned the descriptor
+ *      false: Not cleaned the descriptor
+ */
+static bool
+pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
+                 struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pch_gbe_tx_desc *tx_desc;
+        struct pch_gbe_buffer *buffer_info;
+        struct sk_buff *skb;
+        unsigned int i;
+        unsigned int cleaned_count = 0;
+        bool cleaned = false;
+
+        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
+
+        i = tx_ring->next_to_clean;
+        tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+        pr_debug("gbec_status:0x%04x  dma_status:0x%04x\n",
+                 tx_desc->gbec_status, tx_desc->dma_status);
+
+        while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
+                pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
+                cleaned = true;
+                buffer_info = &tx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+
+                if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_ABT)) {
+                        adapter->stats.tx_aborted_errors++;
+                        pr_err("Transfer Abort Error\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_CRSER)
+                          ) {
+                        adapter->stats.tx_carrier_errors++;
+                        pr_err("Transfer Carrier Sense Error\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_EXCOL)
+                          ) {
+                        adapter->stats.tx_aborted_errors++;
+                        pr_err("Transfer Collision Abort Error\n");
+                } else if ((tx_desc->gbec_status &
+                            (PCH_GBE_TXD_GMAC_STAT_SNGCOL |
+                             PCH_GBE_TXD_GMAC_STAT_MLTCOL))) {
+                        adapter->stats.collisions++;
+                        adapter->stats.tx_packets++;
+                        adapter->stats.tx_bytes += skb->len;
+                        pr_debug("Transfer Collision\n");
+                } else if ((tx_desc->gbec_status & PCH_GBE_TXD_GMAC_STAT_CMPLT)
+                          ) {
+                        adapter->stats.tx_packets++;
+                        adapter->stats.tx_bytes += skb->len;
+                }
+                if (buffer_info->mapped) {
+                        pr_debug("unmap buffer_info->dma : %d\n", i);
+                        dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                         buffer_info->length, DMA_TO_DEVICE);
+                        buffer_info->mapped = false;
+                }
+                if (buffer_info->skb) {
+                        pr_debug("trim buffer_info->skb : %d\n", i);
+                        skb_trim(buffer_info->skb, 0);
+                }
+                tx_desc->gbec_status = DSC_INIT16;
+                if (unlikely(++i == tx_ring->count))
+                        i = 0;
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
+
+                /* weight of a sort for tx, to avoid endless transmit cleanup */
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                        break;
+        }
+        pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
+                 cleaned_count);
+        /* Recover from running out of Tx resources in xmit_frame */
+        if (unlikely(cleaned && (netif_queue_stopped(adapter->netdev)))) {
+                netif_wake_queue(adapter->netdev);
+                adapter->stats.tx_restart_count++;
+                pr_debug("Tx wake queue\n");
+        }
+        spin_lock(&adapter->tx_queue_lock);
+        tx_ring->next_to_clean = i;
+        spin_unlock(&adapter->tx_queue_lock);
+        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
+        return cleaned;
+}
+
+/**
+ * pch_gbe_clean_rx - Send received data up the network stack; legacy
+ * @adapter:     Board private structure
+ * @rx_ring:     Rx descriptor ring
+ * @work_done:   Completed count
+ * @work_to_do:  Request count
+ * Returns
+ *      true:  Cleaned the descriptor
+ *      false: Not cleaned the descriptor
+ */
+static bool
+pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
+                 struct pch_gbe_rx_ring *rx_ring,
+                 int *work_done, int work_to_do)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_buffer *buffer_info;
+        struct pch_gbe_rx_desc *rx_desc;
+        u32 length;
+        unsigned char tmp_packet[ETH_HLEN];
+        unsigned int i;
+        unsigned int cleaned_count = 0;
+        bool cleaned = false;
+        struct sk_buff *skb;
+        u8 dma_status;
+        u16 gbec_status;
+        u32 tcp_ip_status;
+        u8 skb_copy_flag = 0;
+        u8 skb_padding_flag = 0;
+
+        i = rx_ring->next_to_clean;
+
+        while (*work_done < work_to_do) {
+                /* Check Rx descriptor status */
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, i);
+                if (rx_desc->gbec_status == DSC_INIT16)
+                        break;
+                cleaned = true;
+                cleaned_count++;
+
+                dma_status = rx_desc->dma_status;
+                gbec_status = rx_desc->gbec_status;
+                tcp_ip_status = rx_desc->tcp_ip_status;
+                rx_desc->gbec_status = DSC_INIT16;
+                buffer_info = &rx_ring->buffer_info[i];
+                skb = buffer_info->skb;
+
+                /* unmap dma */
+                dma_unmap_single(&pdev->dev, buffer_info->dma,
+                                   buffer_info->length, DMA_FROM_DEVICE);
+                buffer_info->mapped = false;
+                /* Prefetch the packet */
+                prefetch(skb->data);
+
+                pr_debug("RxDecNo = 0x%04x  Status[DMA:0x%02x GBE:0x%04x "
+                         "TCP:0x%08x]  BufInf = 0x%p\n",
+                         i, dma_status, gbec_status, tcp_ip_status,
+                         buffer_info);
+                /* Error check */
+                if (unlikely(gbec_status & PCH_GBE_RXD_GMAC_STAT_NOTOCTAL)) {
+                        adapter->stats.rx_frame_errors++;
+                        pr_err("Receive Not Octal Error\n");
+                } else if (unlikely(gbec_status &
+                                PCH_GBE_RXD_GMAC_STAT_NBLERR)) {
+                        adapter->stats.rx_frame_errors++;
+                        pr_err("Receive Nibble Error\n");
+                } else if (unlikely(gbec_status &
+                                PCH_GBE_RXD_GMAC_STAT_CRCERR)) {
+                        adapter->stats.rx_crc_errors++;
+                        pr_err("Receive CRC Error\n");
+                } else {
+                        /* get receive length */
+                        /* length convert[-3], padding[-2] */
+                        length = (rx_desc->rx_words_eob) - 3 - 2;
+
+                        /* Decide the data conversion method */
+                        if (!adapter->rx_csum) {
+                                /* [Header:14][payload] */
+                                skb_padding_flag = 0;
+                                skb_copy_flag = 1;
+                        } else {
+                                /* [Header:14][padding:2][payload] */
+                                skb_padding_flag = 1;
+                                if (length < copybreak)
+                                        skb_copy_flag = 1;
+                                else
+                                        skb_copy_flag = 0;
+                        }
+
+                        /* Data conversion */
+                        if (skb_copy_flag) {    /* recycle  skb */
+                                struct sk_buff *new_skb;
+                                new_skb =
+                                    netdev_alloc_skb(netdev,
+                                                     length + NET_IP_ALIGN);
+                                if (new_skb) {
+                                        if (!skb_padding_flag) {
+                                                skb_reserve(new_skb,
+                                                                NET_IP_ALIGN);
+                                        }
+                                        memcpy(new_skb->data, skb->data,
+                                                length);
+                                        /* save the skb
+                                         * in buffer_info as good */
+                                        skb = new_skb;
+                                } else if (!skb_padding_flag) {
+                                        /* dorrop error */
+                                        pr_err("New skb allocation Error\n");
+                                        goto dorrop;
+                                }
+                        } else {
+                                buffer_info->skb = NULL;
+                        }
+                        if (skb_padding_flag) {
+                                memcpy(&tmp_packet[0], &skb->data[0], ETH_HLEN);
+                                memcpy(&skb->data[NET_IP_ALIGN], &tmp_packet[0],
+                                        ETH_HLEN);
+                                skb_reserve(skb, NET_IP_ALIGN);
+
+                        }
+
+                        /* update status of driver */
+                        adapter->stats.rx_bytes += length;
+                        adapter->stats.rx_packets++;
+                        if ((gbec_status & PCH_GBE_RXD_GMAC_STAT_MARMLT))
+                                adapter->stats.multicast++;
+                        /* Write meta date of skb */
+                        skb_put(skb, length);
+                        skb->protocol = eth_type_trans(skb, netdev);
+                        if ((tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK) ==
+                            PCH_GBE_RXD_ACC_STAT_TCPIPOK) {
+                                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        } else {
+                                skb->ip_summed = CHECKSUM_NONE;
+                        }
+                        napi_gro_receive(&adapter->napi, skb);
+                        (*work_done)++;
+                        pr_debug("Receive skb->ip_summed: %d length: %d\n",
+                                 skb->ip_summed, length);
+                }
+dorrop:
+                /* return some buffers to hardware, one at a time is too slow */
+                if (unlikely(cleaned_count >= PCH_GBE_RX_BUFFER_WRITE)) {
+                        pch_gbe_alloc_rx_buffers(adapter, rx_ring,
+                                                 cleaned_count);
+                        cleaned_count = 0;
+                }
+                if (++i == rx_ring->count)
+                        i = 0;
+        }
+        rx_ring->next_to_clean = i;
+        if (cleaned_count)
+                pch_gbe_alloc_rx_buffers(adapter, rx_ring, cleaned_count);
+        return cleaned;
+}
+
+/**
+ * pch_gbe_setup_tx_resources - Allocate Tx resources (Descriptors)
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring (for a specific queue) to setup
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_tx_desc *tx_desc;
+        int size;
+        int desNo;
+
+        size = (int)sizeof(struct pch_gbe_buffer) * tx_ring->count;
+        tx_ring->buffer_info = vmalloc(size);
+        if (!tx_ring->buffer_info) {
+                pr_err("Unable to allocate memory for the buffer infomation\n");
+                return -ENOMEM;
+        }
+        memset(tx_ring->buffer_info, 0, size);
+
+        tx_ring->size = tx_ring->count * (int)sizeof(struct pch_gbe_tx_desc);
+
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
+        if (!tx_ring->desc) {
+                vfree(tx_ring->buffer_info);
+                pr_err("Unable to allocate memory for the transmit descriptor ring\n");
+                return -ENOMEM;
+        }
+        memset(tx_ring->desc, 0, tx_ring->size);
+
+        tx_ring->next_to_use = 0;
+        tx_ring->next_to_clean = 0;
+        spin_lock_init(&tx_ring->tx_lock);
+
+        for (desNo = 0; desNo < tx_ring->count; desNo++) {
+                tx_desc = PCH_GBE_TX_DESC(*tx_ring, desNo);
+                tx_desc->gbec_status = DSC_INIT16;
+        }
+        pr_debug("tx_ring->desc = 0x%p  tx_ring->dma = 0x%08llx\n"
+                 "next_to_clean = 0x%08x  next_to_use = 0x%08x\n",
+                 tx_ring->desc, (unsigned long long)tx_ring->dma,
+                 tx_ring->next_to_clean, tx_ring->next_to_use);
+        return 0;
+}
+
+/**
+ * pch_gbe_setup_rx_resources - Allocate Rx resources (Descriptors)
+ * @adapter:  Board private structure
+ * @rx_ring:  Rx descriptor ring (for a specific queue) to setup
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_rx_desc *rx_desc;
+        int size;
+        int desNo;
+
+        size = (int)sizeof(struct pch_gbe_buffer) * rx_ring->count;
+        rx_ring->buffer_info = vmalloc(size);
+        if (!rx_ring->buffer_info) {
+                pr_err("Unable to allocate memory for the receive descriptor ring\n");
+                return -ENOMEM;
+        }
+        memset(rx_ring->buffer_info, 0, size);
+        rx_ring->size = rx_ring->count * (int)sizeof(struct pch_gbe_rx_desc);
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
+
+        if (!rx_ring->desc) {
+                pr_err("Unable to allocate memory for the receive descriptor ring\n");
+                vfree(rx_ring->buffer_info);
+                return -ENOMEM;
+        }
+        memset(rx_ring->desc, 0, rx_ring->size);
+        rx_ring->next_to_clean = 0;
+        rx_ring->next_to_use = 0;
+        for (desNo = 0; desNo < rx_ring->count; desNo++) {
+                rx_desc = PCH_GBE_RX_DESC(*rx_ring, desNo);
+                rx_desc->gbec_status = DSC_INIT16;
+        }
+        pr_debug("rx_ring->desc = 0x%p  rx_ring->dma = 0x%08llx "
+                 "next_to_clean = 0x%08x  next_to_use = 0x%08x\n",
+                 rx_ring->desc, (unsigned long long)rx_ring->dma,
+                 rx_ring->next_to_clean, rx_ring->next_to_use);
+        return 0;
+}
+
+/**
+ * pch_gbe_free_tx_resources - Free Tx Resources
+ * @adapter:  Board private structure
+ * @tx_ring:  Tx descriptor ring for a specific queue
+ */
+void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_tx_ring *tx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        pch_gbe_clean_tx_ring(adapter, tx_ring);
+        vfree(tx_ring->buffer_info);
+        tx_ring->buffer_info = NULL;
+        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        tx_ring->desc = NULL;
+}
+
+/**
+ * pch_gbe_free_rx_resources - Free Rx Resources
+ * @adapter:  Board private structure
+ * @rx_ring:  Ring to clean the resources from
+ */
+void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
+                                struct pch_gbe_rx_ring *rx_ring)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        pch_gbe_clean_rx_ring(adapter, rx_ring);
+        vfree(rx_ring->buffer_info);
+        rx_ring->buffer_info = NULL;
+        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        rx_ring->desc = NULL;
+}
+
+/**
+ * pch_gbe_request_irq - Allocate an interrupt line
+ * @adapter:  Board private structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_request_irq(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        int err;
+        int flags;
+
+        flags = IRQF_SHARED;
+        adapter->have_msi = false;
+        err = pci_enable_msi(adapter->pdev);
+        pr_debug("call pci_enable_msi\n");
+        if (err) {
+                pr_debug("call pci_enable_msi - Error: %d\n", err);
+        } else {
+                flags = 0;
+                adapter->have_msi = true;
+        }
+        err = request_irq(adapter->pdev->irq, &pch_gbe_intr,
+                          flags, netdev->name, netdev);
+        if (err)
+                pr_err("Unable to allocate interrupt Error: %d\n", err);
+        pr_debug("adapter->have_msi : %d  flags : 0x%04x  return : 0x%04x\n",
+                 adapter->have_msi, flags, err);
+        return err;
+}
+
+
+static void pch_gbe_set_multi(struct net_device *netdev);
+/**
+ * pch_gbe_up - Up GbE network device
+ * @adapter:  Board private structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+int pch_gbe_up(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
+        int err;
+
+        /* hardware has been reset, we need to reload some things */
+        pch_gbe_set_multi(netdev);
+
+        pch_gbe_setup_tctl(adapter);
+        pch_gbe_configure_tx(adapter);
+        pch_gbe_setup_rctl(adapter);
+        pch_gbe_configure_rx(adapter);
+
+        err = pch_gbe_request_irq(adapter);
+        if (err) {
+                pr_err("Error: can't bring device up\n");
+                return err;
+        }
+        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
+        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
+        adapter->tx_queue_len = netdev->tx_queue_len;
+
+        mod_timer(&adapter->watchdog_timer, jiffies);
+
+        napi_enable(&adapter->napi);
+        pch_gbe_irq_enable(adapter);
+        netif_start_queue(adapter->netdev);
+
+        return 0;
+}
+
+/**
+ * pch_gbe_down - Down GbE network device
+ * @adapter:  Board private structure
+ */
+void pch_gbe_down(struct pch_gbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        /* signal that we're down so the interrupt handler does not
+         * reschedule our watchdog timer */
+        napi_disable(&adapter->napi);
+        atomic_set(&adapter->irq_sem, 0);
+
+        pch_gbe_irq_disable(adapter);
+        pch_gbe_free_irq(adapter);
+
+        del_timer_sync(&adapter->watchdog_timer);
+
+        netdev->tx_queue_len = adapter->tx_queue_len;
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+
+        pch_gbe_reset(adapter);
+        pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
+        pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
+}
+
+/**
+ * pch_gbe_sw_init - Initialize general software structures (struct pch_gbe_adapter)
+ * @adapter:  Board private structure to initialize
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_sw_init(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct net_device *netdev = adapter->netdev;
+
+        adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_2048;
+        hw->mac.max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
+        hw->mac.min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
+
+        /* Initialize the hardware-specific values */
+        if (pch_gbe_hal_setup_init_funcs(hw)) {
+                pr_err("Hardware Initialization Failure\n");
+                return -EIO;
+        }
+        if (pch_gbe_alloc_queues(adapter)) {
+                pr_err("Unable to allocate memory for queues\n");
+                return -ENOMEM;
+        }
+        spin_lock_init(&adapter->hw.miim_lock);
+        spin_lock_init(&adapter->tx_queue_lock);
+        spin_lock_init(&adapter->stats_lock);
+        spin_lock_init(&adapter->ethtool_lock);
+        atomic_set(&adapter->irq_sem, 0);
+        pch_gbe_irq_disable(adapter);
+
+        pch_gbe_init_stats(adapter);
+
+        pr_debug("rx_buffer_len : %d  mac.min_frame_size : %d  mac.max_frame_size : %d\n",
+                 (u32) adapter->rx_buffer_len,
+                 hw->mac.min_frame_size, hw->mac.max_frame_size);
+        return 0;
+}
+
+/**
+ * pch_gbe_open - Called when a network interface is made active
+ * @netdev:     Network interface device structure
+ * Returns
+ *      0:              Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_open(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int err;
+
+        /* allocate transmit descriptors */
+        err = pch_gbe_setup_tx_resources(adapter, adapter->tx_ring);
+        if (err)
+                goto err_setup_tx;
+        /* allocate receive descriptors */
+        err = pch_gbe_setup_rx_resources(adapter, adapter->rx_ring);
+        if (err)
+                goto err_setup_rx;
+        pch_gbe_hal_power_up_phy(hw);
+        err = pch_gbe_up(adapter);
+        if (err)
+                goto err_up;
+        pr_debug("Success End\n");
+        return 0;
+
+err_up:
+        if (!adapter->wake_up_evt)
+                pch_gbe_hal_power_down_phy(hw);
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+err_setup_rx:
+        pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+err_setup_tx:
+        pch_gbe_reset(adapter);
+        pr_err("Error End\n");
+        return err;
+}
+
+/**
+ * pch_gbe_stop - Disables a network interface
+ * @netdev:  Network interface device structure
+ * Returns
+ *      0: Successfully
+ */
+static int pch_gbe_stop(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        pch_gbe_down(adapter);
+        if (!adapter->wake_up_evt)
+                pch_gbe_hal_power_down_phy(hw);
+        pch_gbe_free_tx_resources(adapter, adapter->tx_ring);
+        pch_gbe_free_rx_resources(adapter, adapter->rx_ring);
+        return 0;
+}
+
+/**
+ * pch_gbe_xmit_frame - Packet transmitting start
+ * @skb:     Socket buffer structure
+ * @netdev:  Network interface device structure
+ * Returns
+ *      - NETDEV_TX_OK:   Normal end
+ *      - NETDEV_TX_BUSY: Error end
+ */
+static int pch_gbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+        unsigned long flags;
+
+        if (unlikely(skb->len > (adapter->hw.mac.max_frame_size - 4))) {
+                dev_kfree_skb_any(skb);
+                pr_err("Transfer length Error: skb len: %d > max: %d\n",
+                       skb->len, adapter->hw.mac.max_frame_size);
+                adapter->stats.tx_length_errors++;
+                return NETDEV_TX_OK;
+        }
+        if (!spin_trylock_irqsave(&tx_ring->tx_lock, flags)) {
+                /* Collision - tell upper layer to requeue */
+                return NETDEV_TX_LOCKED;
+        }
+        if (unlikely(!PCH_GBE_DESC_UNUSED(tx_ring))) {
+                netif_stop_queue(netdev);
+                spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+                pr_debug("Return : BUSY  next_to use : 0x%08x  next_to clean : 0x%08x\n",
+                         tx_ring->next_to_use, tx_ring->next_to_clean);
+                return NETDEV_TX_BUSY;
+        }
+        spin_unlock_irqrestore(&tx_ring->tx_lock, flags);
+
+        /* CRC,ITAG no support */
+        pch_gbe_tx_queue(adapter, tx_ring, skb);
+        return NETDEV_TX_OK;
+}
+
+/**
+ * pch_gbe_get_stats - Get System Network Statistics
+ * @netdev:  Network interface device structure
+ * Returns:  The current stats
+ */
+static struct net_device_stats *pch_gbe_get_stats(struct net_device *netdev)
+{
+        /* only return the current stats */
+        return &netdev->stats;
+}
+
+/**
+ * pch_gbe_set_multi - Multicast and Promiscuous mode set
+ * @netdev:   Network interface device structure
+ */
+static void pch_gbe_set_multi(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        struct netdev_hw_addr *ha;
+        u8 *mta_list;
+        u32 rctl;
+        int i;
+        int mc_count;
+
+        pr_debug("netdev->flags : 0x%08x\n", netdev->flags);
+
+        /* Check for Promiscuous and All Multicast modes */
+        rctl = ioread32(&hw->reg->RX_MODE);
+        mc_count = netdev_mc_count(netdev);
+        if ((netdev->flags & IFF_PROMISC)) {
+                rctl &= ~PCH_GBE_ADD_FIL_EN;
+                rctl &= ~PCH_GBE_MLT_FIL_EN;
+        } else if ((netdev->flags & IFF_ALLMULTI)) {
+                /* all the multicasting receive permissions */
+                rctl |= PCH_GBE_ADD_FIL_EN;
+                rctl &= ~PCH_GBE_MLT_FIL_EN;
+        } else {
+                if (mc_count >= PCH_GBE_MAR_ENTRIES) {
+                        /* all the multicasting receive permissions */
+                        rctl |= PCH_GBE_ADD_FIL_EN;
+                        rctl &= ~PCH_GBE_MLT_FIL_EN;
+                } else {
+                        rctl |= (PCH_GBE_ADD_FIL_EN | PCH_GBE_MLT_FIL_EN);
+                }
+        }
+        iowrite32(rctl, &hw->reg->RX_MODE);
+
+        if (mc_count >= PCH_GBE_MAR_ENTRIES)
+                return;
+        mta_list = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+        if (!mta_list)
+                return;
+
+        /* The shared function expects a packed array of only addresses. */
+        i = 0;
+        netdev_for_each_mc_addr(ha, netdev) {
+                if (i == mc_count)
+                        break;
+                memcpy(mta_list + (i++ * ETH_ALEN), &ha->addr, ETH_ALEN);
+        }
+        pch_gbe_mac_mc_addr_list_update(hw, mta_list, i, 1,
+                                        PCH_GBE_MAR_ENTRIES);
+        kfree(mta_list);
+
+        pr_debug("RX_MODE reg(check bit31,30 ADD,MLT) : 0x%08x  netdev->mc_count : 0x%08x\n",
+                 ioread32(&hw->reg->RX_MODE), mc_count);
+}
+
+/**
+ * pch_gbe_set_mac - Change the Ethernet Address of the NIC
+ * @netdev: Network interface device structure
+ * @addr:   Pointer to an address structure
+ * Returns
+ *      0:              Successfully
+ *      -EADDRNOTAVAIL: Failed
+ */
+static int pch_gbe_set_mac(struct net_device *netdev, void *addr)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct sockaddr *skaddr = addr;
+        int ret_val;
+
+        if (!is_valid_ether_addr(skaddr->sa_data)) {
+                ret_val = -EADDRNOTAVAIL;
+        } else {
+                memcpy(netdev->dev_addr, skaddr->sa_data, netdev->addr_len);
+                memcpy(adapter->hw.mac.addr, skaddr->sa_data, netdev->addr_len);
+                pch_gbe_mac_mar_set(&adapter->hw, adapter->hw.mac.addr, 0);
+                ret_val = 0;
+        }
+        pr_debug("ret_val : 0x%08x\n", ret_val);
+        pr_debug("dev_addr : %pM\n", netdev->dev_addr);
+        pr_debug("mac_addr : %pM\n", adapter->hw.mac.addr);
+        pr_debug("MAC_ADR1AB reg : 0x%08x 0x%08x\n",
+                 ioread32(&adapter->hw.reg->mac_adr[0].high),
+                 ioread32(&adapter->hw.reg->mac_adr[0].low));
+        return ret_val;
+}
+
+/**
+ * pch_gbe_change_mtu - Change the Maximum Transfer Unit
+ * @netdev:   Network interface device structure
+ * @new_mtu:  New value for maximum frame size
+ * Returns
+ *      0:              Successfully
+ *      -EINVAL:        Failed
+ */
+static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        int max_frame;
+
+        max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+        if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
+                (max_frame > PCH_GBE_MAX_JUMBO_FRAME_SIZE)) {
+                pr_err("Invalid MTU setting\n");
+                return -EINVAL;
+        }
+        if (max_frame <= PCH_GBE_FRAME_SIZE_2048)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_2048;
+        else if (max_frame <= PCH_GBE_FRAME_SIZE_4096)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_4096;
+        else if (max_frame <= PCH_GBE_FRAME_SIZE_8192)
+                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_8192;
+        else
+                adapter->rx_buffer_len = PCH_GBE_MAX_JUMBO_FRAME_SIZE;
+        netdev->mtu = new_mtu;
+        adapter->hw.mac.max_frame_size = max_frame;
+
+        if (netif_running(netdev))
+                pch_gbe_reinit_locked(adapter);
+        else
+                pch_gbe_reset(adapter);
+
+        pr_debug("max_frame : %d  rx_buffer_len : %d  mtu : %d  max_frame_size : %d\n",
+                 max_frame, (u32) adapter->rx_buffer_len, netdev->mtu,
+                 adapter->hw.mac.max_frame_size);
+        return 0;
+}
+
+/**
+ * pch_gbe_ioctl - Controls register through a MII interface
+ * @netdev:   Network interface device structure
+ * @ifr:      Pointer to ifr structure
+ * @cmd:      Control command
+ * Returns
+ *      0:      Successfully
+ *      Negative value: Failed
+ */
+static int pch_gbe_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        pr_debug("cmd : 0x%04x\n", cmd);
+
+        return generic_mii_ioctl(&adapter->mii, if_mii(ifr), cmd, NULL);
+}
+
+/**
+ * pch_gbe_tx_timeout - Respond to a Tx Hang
+ * @netdev:   Network interface device structure
+ */
+static void pch_gbe_tx_timeout(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        /* Do the reset outside of interrupt context */
+        adapter->stats.tx_timeout_count++;
+        schedule_work(&adapter->reset_task);
+}
+
+/**
+ * pch_gbe_napi_poll - NAPI receive and transfer polling callback
+ * @napi:    Pointer of polling device struct
+ * @budget:  The maximum number of a packet
+ * Returns
+ *      false:  Exit the polling mode
+ *      true:   Continue the polling mode
+ */
+static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
+{
+        struct pch_gbe_adapter *adapter =
+            container_of(napi, struct pch_gbe_adapter, napi);
+        struct net_device *netdev = adapter->netdev;
+        int work_done = 0;
+        bool poll_end_flag = false;
+        bool cleaned = false;
+
+        pr_debug("budget : %d\n", budget);
+
+        /* Keep link state information with original netdev */
+        if (!netif_carrier_ok(netdev)) {
+                poll_end_flag = true;
+        } else {
+                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
+                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+
+                if (cleaned)
+                        work_done = budget;
+                /* If no Tx and not enough Rx work done,
+                 * exit the polling mode
+                 */
+                if ((work_done < budget) || !netif_running(netdev))
+                        poll_end_flag = true;
+        }
+
+        if (poll_end_flag) {
+                napi_complete(napi);
+                pch_gbe_irq_enable(adapter);
+        }
+
+        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
+                 poll_end_flag, work_done, budget);
+
+        return work_done;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/**
+ * pch_gbe_netpoll - Used by things like netconsole to send skbs
+ * @netdev:  Network interface device structure
+ */
+static void pch_gbe_netpoll(struct net_device *netdev)
+{
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        disable_irq(adapter->pdev->irq);
+        pch_gbe_intr(adapter->pdev->irq, netdev);
+        enable_irq(adapter->pdev->irq);
+}
+#endif
+
+static const struct net_device_ops pch_gbe_netdev_ops = {
+        .ndo_open = pch_gbe_open,
+        .ndo_stop = pch_gbe_stop,
+        .ndo_start_xmit = pch_gbe_xmit_frame,
+        .ndo_get_stats = pch_gbe_get_stats,
+        .ndo_set_mac_address = pch_gbe_set_mac,
+        .ndo_tx_timeout = pch_gbe_tx_timeout,
+        .ndo_change_mtu = pch_gbe_change_mtu,
+        .ndo_do_ioctl = pch_gbe_ioctl,
+        .ndo_set_multicast_list = &pch_gbe_set_multi,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = pch_gbe_netpoll,
+#endif
+};
+
+static pci_ers_result_t pch_gbe_io_error_detected(struct pci_dev *pdev,
+                                                pci_channel_state_t state)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        netif_device_detach(netdev);
+        if (netif_running(netdev))
+                pch_gbe_down(adapter);
+        pci_disable_device(pdev);
+        /* Request a slot slot reset. */
+        return PCI_ERS_RESULT_NEED_RESET;
+}
+
+static pci_ers_result_t pch_gbe_io_slot_reset(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        if (pci_enable_device(pdev)) {
+                pr_err("Cannot re-enable PCI device after reset\n");
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+        pci_set_master(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+        pch_gbe_hal_power_up_phy(hw);
+        pch_gbe_reset(adapter);
+        /* Clear wake up status */
+        pch_gbe_mac_set_wol_event(hw, 0);
+
+        return PCI_ERS_RESULT_RECOVERED;
+}
+
+static void pch_gbe_io_resume(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        if (netif_running(netdev)) {
+                if (pch_gbe_up(adapter)) {
+                        pr_debug("can't bring device back up after reset\n");
+                        return;
+                }
+        }
+        netif_device_attach(netdev);
+}
+
+static int __pch_gbe_suspend(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 wufc = adapter->wake_up_evt;
+        int retval = 0;
+
+        netif_device_detach(netdev);
+        if (netif_running(netdev))
+                pch_gbe_down(adapter);
+        if (wufc) {
+                pch_gbe_set_multi(netdev);
+                pch_gbe_setup_rctl(adapter);
+                pch_gbe_configure_rx(adapter);
+                pch_gbe_set_rgmii_ctrl(adapter, hw->mac.link_speed,
+                                        hw->mac.link_duplex);
+                pch_gbe_set_mode(adapter, hw->mac.link_speed,
+                                        hw->mac.link_duplex);
+                pch_gbe_mac_set_wol_event(hw, wufc);
+                pci_disable_device(pdev);
+        } else {
+                pch_gbe_hal_power_down_phy(hw);
+                pch_gbe_mac_set_wol_event(hw, wufc);
+                pci_disable_device(pdev);
+        }
+        return retval;
+}
+
+#ifdef CONFIG_PM
+static int pch_gbe_suspend(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+
+        return __pch_gbe_suspend(pdev);
+}
+
+static int pch_gbe_resume(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 err;
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                pr_err("Cannot enable PCI device from suspend\n");
+                return err;
+        }
+        pci_set_master(pdev);
+        pch_gbe_hal_power_up_phy(hw);
+        pch_gbe_reset(adapter);
+        /* Clear wake on lan control and status */
+        pch_gbe_mac_set_wol_event(hw, 0);
+
+        if (netif_running(netdev))
+                pch_gbe_up(adapter);
+        netif_device_attach(netdev);
+
+        return 0;
+}
+#endif /* CONFIG_PM */
+
+static void pch_gbe_shutdown(struct pci_dev *pdev)
+{
+        __pch_gbe_suspend(pdev);
+        if (system_state == SYSTEM_POWER_OFF) {
+                pci_wake_from_d3(pdev, true);
+                pci_set_power_state(pdev, PCI_D3hot);
+        }
+}
+
+static void pch_gbe_remove(struct pci_dev *pdev)
+{
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
+
+        flush_scheduled_work();
+        unregister_netdev(netdev);
+
+        pch_gbe_hal_phy_hw_reset(&adapter->hw);
+
+        kfree(adapter->tx_ring);
+        kfree(adapter->rx_ring);
+
+        iounmap(adapter->hw.reg);
+        pci_release_regions(pdev);
+        free_netdev(netdev);
+        pci_disable_device(pdev);
+}
+
+static int pch_gbe_probe(struct pci_dev *pdev,
+                          const struct pci_device_id *pci_id)
+{
+        struct net_device *netdev;
+        struct pch_gbe_adapter *adapter;
+        int ret;
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
+                || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+                ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                if (ret) {
+                        ret = pci_set_consistent_dma_mask(pdev,
+                                                          DMA_BIT_MASK(32));
+                        if (ret) {
+                                dev_err(&pdev->dev, "ERR: No usable DMA "
+                                        "configuration, aborting\n");
+                                goto err_disable_device;
+                        }
+                }
+        }
+
+        ret = pci_request_regions(pdev, KBUILD_MODNAME);
+        if (ret) {
+                dev_err(&pdev->dev,
+                        "ERR: Can't reserve PCI I/O and memory resources\n");
+                goto err_disable_device;
+        }
+        pci_set_master(pdev);
+
+        netdev = alloc_etherdev((int)sizeof(struct pch_gbe_adapter));
+        if (!netdev) {
+                ret = -ENOMEM;
+                dev_err(&pdev->dev,
+                        "ERR: Can't allocate and set up an Ethernet device\n");
+                goto err_release_pci;
+        }
+        SET_NETDEV_DEV(netdev, &pdev->dev);
+
+        pci_set_drvdata(pdev, netdev);
+        adapter = netdev_priv(netdev);
+        adapter->netdev = netdev;
+        adapter->pdev = pdev;
+        adapter->hw.back = adapter;
+        adapter->hw.reg = pci_iomap(pdev, PCH_GBE_PCI_BAR, 0);
+        if (!adapter->hw.reg) {
+                ret = -EIO;
+                dev_err(&pdev->dev, "Can't ioremap\n");
+                goto err_free_netdev;
+        }
+
+        netdev->netdev_ops = &pch_gbe_netdev_ops;
+        netdev->watchdog_timeo = PCH_GBE_WATCHDOG_PERIOD;
+        netif_napi_add(netdev, &adapter->napi,
+                       pch_gbe_napi_poll, PCH_GBE_RX_WEIGHT);
+        netdev->features = NETIF_F_HW_CSUM | NETIF_F_GRO;
+        pch_gbe_set_ethtool_ops(netdev);
+
+        pch_gbe_mac_reset_hw(&adapter->hw);
+
+        /* setup the private structure */
+        ret = pch_gbe_sw_init(adapter);
+        if (ret)
+                goto err_iounmap;
+
+        /* Initialize PHY */
+        ret = pch_gbe_init_phy(adapter);
+        if (ret) {
+                dev_err(&pdev->dev, "PHY initialize error\n");
+                goto err_free_adapter;
+        }
+        pch_gbe_hal_get_bus_info(&adapter->hw);
+
+        /* Read the MAC address. and store to the private data */
+        ret = pch_gbe_hal_read_mac_addr(&adapter->hw);
+        if (ret) {
+                dev_err(&pdev->dev, "MAC address Read Error\n");
+                goto err_free_adapter;
+        }
+
+        memcpy(netdev->dev_addr, adapter->hw.mac.addr, netdev->addr_len);
+        if (!is_valid_ether_addr(netdev->dev_addr)) {
+                dev_err(&pdev->dev, "Invalid MAC Address\n");
+                ret = -EIO;
+                goto err_free_adapter;
+        }
+        setup_timer(&adapter->watchdog_timer, pch_gbe_watchdog,
+                    (unsigned long)adapter);
+
+        INIT_WORK(&adapter->reset_task, pch_gbe_reset_task);
+
+        pch_gbe_check_options(adapter);
+
+        if (adapter->tx_csum)
+                netdev->features |= NETIF_F_HW_CSUM;
+        else
+                netdev->features &= ~NETIF_F_HW_CSUM;
+
+        /* initialize the wol settings based on the eeprom settings */
+        adapter->wake_up_evt = PCH_GBE_WL_INIT_SETTING;
+        dev_info(&pdev->dev, "MAC address : %pM\n", netdev->dev_addr);
+
+        /* reset the hardware with the new settings */
+        pch_gbe_reset(adapter);
+
+        ret = register_netdev(netdev);
+        if (ret)
+                goto err_free_adapter;
+        /* tell the stack to leave us alone until pch_gbe_open() is called */
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+
+        dev_dbg(&pdev->dev, "OKIsemi(R) PCH Network Connection\n");
+
+        device_set_wakeup_enable(&pdev->dev, 1);
+        return 0;
+
+err_free_adapter:
+        pch_gbe_hal_phy_hw_reset(&adapter->hw);
+        kfree(adapter->tx_ring);
+        kfree(adapter->rx_ring);
+err_iounmap:
+        iounmap(adapter->hw.reg);
+err_free_netdev:
+        free_netdev(netdev);
+err_release_pci:
+        pci_release_regions(pdev);
+err_disable_device:
+        pci_disable_device(pdev);
+        return ret;
+}
+
+static const struct pci_device_id pch_gbe_pcidev_id[] = {
+        {.vendor = PCI_VENDOR_ID_INTEL,
+         .device = PCI_DEVICE_ID_INTEL_IOH1_GBE,
+         .subvendor = PCI_ANY_ID,
+         .subdevice = PCI_ANY_ID,
+         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+         .class_mask = (0xFFFF00)
+         },
+        /* required last entry */
+        {0}
+};
+
+#ifdef CONFIG_PM
+static const struct dev_pm_ops pch_gbe_pm_ops = {
+        .suspend = pch_gbe_suspend,
+        .resume = pch_gbe_resume,
+        .freeze = pch_gbe_suspend,
+        .thaw = pch_gbe_resume,
+        .poweroff = pch_gbe_suspend,
+        .restore = pch_gbe_resume,
+};
+#endif
+
+static struct pci_error_handlers pch_gbe_err_handler = {
+        .error_detected = pch_gbe_io_error_detected,
+        .slot_reset = pch_gbe_io_slot_reset,
+        .resume = pch_gbe_io_resume
+};
+
+static struct pci_driver pch_gbe_pcidev = {
+        .name = KBUILD_MODNAME,
+        .id_table = pch_gbe_pcidev_id,
+        .probe = pch_gbe_probe,
+        .remove = pch_gbe_remove,
+#ifdef CONFIG_PM_OPS
+        .driver.pm = &pch_gbe_pm_ops,
+#endif
+        .shutdown = pch_gbe_shutdown,
+        .err_handler = &pch_gbe_err_handler
+};
+
+
+static int __init pch_gbe_init_module(void)
+{
+        int ret;
+
+        ret = pci_register_driver(&pch_gbe_pcidev);
+        if (copybreak != PCH_GBE_COPYBREAK_DEFAULT) {
+                if (copybreak == 0) {
+                        pr_info("copybreak disabled\n");
+                } else {
+                        pr_info("copybreak enabled for packets <= %u bytes\n",
+                                copybreak);
+                }
+        }
+        return ret;
+}
+
+static void __exit pch_gbe_exit_module(void)
+{
+        pci_unregister_driver(&pch_gbe_pcidev);
+}
+
+module_init(pch_gbe_init_module);
+module_exit(pch_gbe_exit_module);
+
+MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
+MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
+
+module_param(copybreak, uint, 0644);
+MODULE_PARM_DESC(copybreak,
+        "Maximum size of packet that is copied to a new buffer on receive");
+
+/* pch_gbe_main.c */
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
new file mode 100644
index 000000000000..2510146fc560
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -0,0 +1,499 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+
+#define OPTION_UNSET   -1
+#define OPTION_DISABLED 0
+#define OPTION_ENABLED  1
+
+/**
+ * TxDescriptors - Transmit Descriptor Count
+ * @Valid Range:   PCH_GBE_MIN_TXD - PCH_GBE_MAX_TXD
+ * @Default Value: PCH_GBE_DEFAULT_TXD
+ */
+static int TxDescriptors = OPTION_UNSET;
+module_param(TxDescriptors, int, 0);
+MODULE_PARM_DESC(TxDescriptors, "Number of transmit descriptors");
+
+/**
+ * RxDescriptors -Receive Descriptor Count
+ * @Valid Range:   PCH_GBE_MIN_RXD - PCH_GBE_MAX_RXD
+ * @Default Value: PCH_GBE_DEFAULT_RXD
+ */
+static int RxDescriptors = OPTION_UNSET;
+module_param(RxDescriptors, int, 0);
+MODULE_PARM_DESC(RxDescriptors, "Number of receive descriptors");
+
+/**
+ * Speed - User Specified Speed Override
+ * @Valid Range: 0, 10, 100, 1000
+ *   - 0:    auto-negotiate at all supported speeds
+ *   - 10:   only link at 10 Mbps
+ *   - 100:  only link at 100 Mbps
+ *   - 1000: only link at 1000 Mbps
+ * @Default Value: 0
+ */
+static int Speed = OPTION_UNSET;
+module_param(Speed, int, 0);
+MODULE_PARM_DESC(Speed, "Speed setting");
+
+/**
+ * Duplex - User Specified Duplex Override
+ * @Valid Range: 0-2
+ *   - 0:  auto-negotiate for duplex
+ *   - 1:  only link at half duplex
+ *   - 2:  only link at full duplex
+ * @Default Value: 0
+ */
+static int Duplex = OPTION_UNSET;
+module_param(Duplex, int, 0);
+MODULE_PARM_DESC(Duplex, "Duplex setting");
+
+#define HALF_DUPLEX 1
+#define FULL_DUPLEX 2
+
+/**
+ * AutoNeg - Auto-negotiation Advertisement Override
+ * @Valid Range: 0x01-0x0F, 0x20-0x2F
+ *
+ *       The AutoNeg value is a bit mask describing which speed and duplex
+ *       combinations should be advertised during auto-negotiation.
+ *       The supported speed and duplex modes are listed below
+ *
+ *       Bit           7     6     5      4      3     2     1      0
+ *       Speed (Mbps)  N/A   N/A   1000   N/A    100   100   10     10
+ *       Duplex                    Full          Full  Half  Full   Half
+ *
+ * @Default Value: 0x2F (copper)
+ */
+static int AutoNeg = OPTION_UNSET;
+module_param(AutoNeg, int, 0);
+MODULE_PARM_DESC(AutoNeg, "Advertised auto-negotiation setting");
+
+#define PHY_ADVERTISE_10_HALF      0x0001
+#define PHY_ADVERTISE_10_FULL      0x0002
+#define PHY_ADVERTISE_100_HALF     0x0004
+#define PHY_ADVERTISE_100_FULL     0x0008
+#define PHY_ADVERTISE_1000_HALF    0x0010 /* Not used, just FYI */
+#define PHY_ADVERTISE_1000_FULL    0x0020
+#define PCH_AUTONEG_ADVERTISE_DEFAULT   0x2F
+
+/**
+ * FlowControl - User Specified Flow Control Override
+ * @Valid Range: 0-3
+ *    - 0:  No Flow Control
+ *    - 1:  Rx only, respond to PAUSE frames but do not generate them
+ *    - 2:  Tx only, generate PAUSE frames but ignore them on receive
+ *    - 3:  Full Flow Control Support
+ * @Default Value: Read flow control settings from the EEPROM
+ */
+static int FlowControl = OPTION_UNSET;
+module_param(FlowControl, int, 0);
+MODULE_PARM_DESC(FlowControl, "Flow Control setting");
+
+/*
+ * XsumRX - Receive Checksum Offload Enable/Disable
+ * @Valid Range: 0, 1
+ *    - 0:  disables all checksum offload
+ *    - 1:  enables receive IP/TCP/UDP checksum offload
+ * @Default Value: PCH_GBE_DEFAULT_RX_CSUM
+ */
+static int XsumRX = OPTION_UNSET;
+module_param(XsumRX, int, 0);
+MODULE_PARM_DESC(XsumRX, "Disable or enable Receive Checksum offload");
+
+#define PCH_GBE_DEFAULT_RX_CSUM             true        /* trueorfalse */
+
+/*
+ * XsumTX - Transmit Checksum Offload Enable/Disable
+ * @Valid Range: 0, 1
+ *    - 0:  disables all checksum offload
+ *    - 1:  enables transmit IP/TCP/UDP checksum offload
+ * @Default Value: PCH_GBE_DEFAULT_TX_CSUM
+ */
+static int XsumTX = OPTION_UNSET;
+module_param(XsumTX, int, 0);
+MODULE_PARM_DESC(XsumTX, "Disable or enable Transmit Checksum offload");
+
+#define PCH_GBE_DEFAULT_TX_CSUM             true        /* trueorfalse */
+
+/**
+ * pch_gbe_option - Force the MAC's flow control settings
+ * @hw:             Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+struct pch_gbe_option {
+        enum { enable_option, range_option, list_option } type;
+        char *name;
+        char *err;
+        int  def;
+        union {
+                struct { /* range_option info */
+                        int min;
+                        int max;
+                } r;
+                struct { /* list_option info */
+                        int nr;
+                        const struct pch_gbe_opt_list { int i; char *str; } *p;
+                } l;
+        } arg;
+};
+
+static const struct pch_gbe_opt_list speed_list[] = {
+        { 0, "" },
+        { SPEED_10, "" },
+        { SPEED_100, "" },
+        { SPEED_1000, "" }
+};
+
+static const struct pch_gbe_opt_list dplx_list[] = {
+        { 0, "" },
+        { HALF_DUPLEX, "" },
+        { FULL_DUPLEX, "" }
+};
+
+static const struct pch_gbe_opt_list an_list[] =
+        #define AA "AutoNeg advertising "
+        {{ 0x01, AA "10/HD" },
+         { 0x02, AA "10/FD" },
+         { 0x03, AA "10/FD, 10/HD" },
+         { 0x04, AA "100/HD" },
+         { 0x05, AA "100/HD, 10/HD" },
+         { 0x06, AA "100/HD, 10/FD" },
+         { 0x07, AA "100/HD, 10/FD, 10/HD" },
+         { 0x08, AA "100/FD" },
+         { 0x09, AA "100/FD, 10/HD" },
+         { 0x0a, AA "100/FD, 10/FD" },
+         { 0x0b, AA "100/FD, 10/FD, 10/HD" },
+         { 0x0c, AA "100/FD, 100/HD" },
+         { 0x0d, AA "100/FD, 100/HD, 10/HD" },
+         { 0x0e, AA "100/FD, 100/HD, 10/FD" },
+         { 0x0f, AA "100/FD, 100/HD, 10/FD, 10/HD" },
+         { 0x20, AA "1000/FD" },
+         { 0x21, AA "1000/FD, 10/HD" },
+         { 0x22, AA "1000/FD, 10/FD" },
+         { 0x23, AA "1000/FD, 10/FD, 10/HD" },
+         { 0x24, AA "1000/FD, 100/HD" },
+         { 0x25, AA "1000/FD, 100/HD, 10/HD" },
+         { 0x26, AA "1000/FD, 100/HD, 10/FD" },
+         { 0x27, AA "1000/FD, 100/HD, 10/FD, 10/HD" },
+         { 0x28, AA "1000/FD, 100/FD" },
+         { 0x29, AA "1000/FD, 100/FD, 10/HD" },
+         { 0x2a, AA "1000/FD, 100/FD, 10/FD" },
+         { 0x2b, AA "1000/FD, 100/FD, 10/FD, 10/HD" },
+         { 0x2c, AA "1000/FD, 100/FD, 100/HD" },
+         { 0x2d, AA "1000/FD, 100/FD, 100/HD, 10/HD" },
+         { 0x2e, AA "1000/FD, 100/FD, 100/HD, 10/FD" },
+         { 0x2f, AA "1000/FD, 100/FD, 100/HD, 10/FD, 10/HD" }
+};
+
+static const struct pch_gbe_opt_list fc_list[] = {
+        { PCH_GBE_FC_NONE, "Flow Control Disabled" },
+        { PCH_GBE_FC_RX_PAUSE, "Flow Control Receive Only" },
+        { PCH_GBE_FC_TX_PAUSE, "Flow Control Transmit Only" },
+        { PCH_GBE_FC_FULL, "Flow Control Enabled" }
+};
+
+/**
+ * pch_gbe_validate_option - Validate option
+ * @value:    value
+ * @opt:      option
+ * @adapter:  Board private structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+static int pch_gbe_validate_option(int *value,
+                                    const struct pch_gbe_option *opt,
+                                    struct pch_gbe_adapter *adapter)
+{
+        if (*value == OPTION_UNSET) {
+                *value = opt->def;
+                return 0;
+        }
+
+        switch (opt->type) {
+        case enable_option:
+                switch (*value) {
+                case OPTION_ENABLED:
+                        pr_debug("%s Enabled\n", opt->name);
+                        return 0;
+                case OPTION_DISABLED:
+                        pr_debug("%s Disabled\n", opt->name);
+                        return 0;
+                }
+                break;
+        case range_option:
+                if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
+                        pr_debug("%s set to %i\n", opt->name, *value);
+                        return 0;
+                }
+                break;
+        case list_option: {
+                int i;
+                const struct pch_gbe_opt_list *ent;
+
+                for (i = 0; i < opt->arg.l.nr; i++) {
+                        ent = &opt->arg.l.p[i];
+                        if (*value == ent->i) {
+                                if (ent->str[0] != '\0')
+                                        pr_debug("%s\n", ent->str);
+                                return 0;
+                        }
+                }
+        }
+                break;
+        default:
+                BUG();
+        }
+
+        pr_debug("Invalid %s value specified (%i) %s\n",
+                 opt->name, *value, opt->err);
+        *value = opt->def;
+        return -1;
+}
+
+/**
+ * pch_gbe_check_copper_options - Range Checking for Link Options, Copper Version
+ * @adapter:  Board private structure
+ */
+static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        int speed, dplx;
+
+        { /* Speed */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Speed",
+                        .err  = "parameter ignored",
+                        .def  = 0,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(speed_list),
+                                         .p = speed_list } }
+                };
+                speed = Speed;
+                pch_gbe_validate_option(&speed, &opt, adapter);
+        }
+        { /* Duplex */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Duplex",
+                        .err  = "parameter ignored",
+                        .def  = 0,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(dplx_list),
+                                         .p = dplx_list } }
+                };
+                dplx = Duplex;
+                pch_gbe_validate_option(&dplx, &opt, adapter);
+        }
+
+        { /* Autoneg */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "AutoNeg",
+                        .err  = "parameter ignored",
+                        .def  = PCH_AUTONEG_ADVERTISE_DEFAULT,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(an_list),
+                                         .p = an_list} }
+                };
+                if (speed || dplx) {
+                        pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
+                        hw->phy.autoneg_advertised = opt.def;
+                } else {
+                        hw->phy.autoneg_advertised = AutoNeg;
+                        pch_gbe_validate_option(
+                                (int *)(&hw->phy.autoneg_advertised),
+                                &opt, adapter);
+                }
+        }
+
+        switch (speed + dplx) {
+        case 0:
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                if ((speed || dplx))
+                        pr_debug("Speed and duplex autonegotiation enabled\n");
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case HALF_DUPLEX:
+                pr_debug("Half Duplex specified without Speed\n");
+                pr_debug("Using Autonegotiation at Half Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_HALF |
+                                                PHY_ADVERTISE_100_HALF;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case FULL_DUPLEX:
+                pr_debug("Full Duplex specified without Speed\n");
+                pr_debug("Using Autonegotiation at Full Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_FULL |
+                                                PHY_ADVERTISE_100_FULL |
+                                                PHY_ADVERTISE_1000_FULL;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_10:
+                pr_debug("10 Mbps Speed specified without Duplex\n");
+                pr_debug("Using Autonegotiation at 10 Mbps only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_10_HALF |
+                                                PHY_ADVERTISE_10_FULL;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_10 + HALF_DUPLEX:
+                pr_debug("Forcing to 10 Mbps Half Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_10 + FULL_DUPLEX:
+                pr_debug("Forcing to 10 Mbps Full Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_10;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_100:
+                pr_debug("100 Mbps Speed specified without Duplex\n");
+                pr_debug("Using Autonegotiation at 100 Mbps only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_100_HALF |
+                                                PHY_ADVERTISE_100_FULL;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_100 + HALF_DUPLEX:
+                pr_debug("Forcing to 100 Mbps Half Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_HALF;
+                break;
+        case SPEED_100 + FULL_DUPLEX:
+                pr_debug("Forcing to 100 Mbps Full Duplex\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 0;
+                hw->phy.autoneg_advertised = 0;
+                hw->mac.link_speed = SPEED_100;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        case SPEED_1000:
+                pr_debug("1000 Mbps Speed specified without Duplex\n");
+                goto full_duplex_only;
+        case SPEED_1000 + HALF_DUPLEX:
+                pr_debug("Half Duplex is not supported at 1000 Mbps\n");
+                /* fall through */
+        case SPEED_1000 + FULL_DUPLEX:
+full_duplex_only:
+                pr_debug("Using Autonegotiation at 1000 Mbps Full Duplex only\n");
+                hw->mac.autoneg = hw->mac.fc_autoneg = 1;
+                hw->phy.autoneg_advertised = PHY_ADVERTISE_1000_FULL;
+                hw->mac.link_speed = SPEED_1000;
+                hw->mac.link_duplex = DUPLEX_FULL;
+                break;
+        default:
+                BUG();
+        }
+}
+
+/**
+ * pch_gbe_check_options - Range Checking for Command Line Parameters
+ * @adapter:  Board private structure
+ */
+void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+
+        { /* Transmit Descriptor Count */
+                static const struct pch_gbe_option opt = {
+                        .type = range_option,
+                        .name = "Transmit Descriptors",
+                        .err  = "using default of "
+                                __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
+                        .def  = PCH_GBE_DEFAULT_TXD,
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
+                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                };
+                struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
+                tx_ring->count = TxDescriptors;
+                pch_gbe_validate_option(&tx_ring->count, &opt, adapter);
+                tx_ring->count = roundup(tx_ring->count,
+                                        PCH_GBE_TX_DESC_MULTIPLE);
+        }
+        { /* Receive Descriptor Count */
+                static const struct pch_gbe_option opt = {
+                        .type = range_option,
+                        .name = "Receive Descriptors",
+                        .err  = "using default of "
+                                __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
+                        .def  = PCH_GBE_DEFAULT_RXD,
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
+                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                };
+                struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
+                rx_ring->count = RxDescriptors;
+                pch_gbe_validate_option(&rx_ring->count, &opt, adapter);
+                rx_ring->count = roundup(rx_ring->count,
+                                PCH_GBE_RX_DESC_MULTIPLE);
+        }
+        { /* Checksum Offload Enable/Disable */
+                static const struct pch_gbe_option opt = {
+                        .type = enable_option,
+                        .name = "Checksum Offload",
+                        .err  = "defaulting to Enabled",
+                        .def  = PCH_GBE_DEFAULT_RX_CSUM
+                };
+                adapter->rx_csum = XsumRX;
+                pch_gbe_validate_option((int *)(&adapter->rx_csum),
+                                        &opt, adapter);
+        }
+        { /* Checksum Offload Enable/Disable */
+                static const struct pch_gbe_option opt = {
+                        .type = enable_option,
+                        .name = "Checksum Offload",
+                        .err  = "defaulting to Enabled",
+                        .def  = PCH_GBE_DEFAULT_TX_CSUM
+                };
+                adapter->tx_csum = XsumTX;
+                pch_gbe_validate_option((int *)(&adapter->tx_csum),
+                                                &opt, adapter);
+        }
+        { /* Flow Control */
+                static const struct pch_gbe_option opt = {
+                        .type = list_option,
+                        .name = "Flow Control",
+                        .err  = "reading default settings from EEPROM",
+                        .def  = PCH_GBE_FC_DEFAULT,
+                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
+                                         .p = fc_list } }
+                };
+                hw->mac.fc = FlowControl;
+                pch_gbe_validate_option((int *)(&hw->mac.fc),
+                                                &opt, adapter);
+        }
+
+        pch_gbe_check_copper_options(adapter);
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_phy.c b/drivers/net/pch_gbe/pch_gbe_phy.c
new file mode 100644
index 000000000000..923a687acd30
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_phy.c
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "pch_gbe.h"
+#include "pch_gbe_phy.h"
+
+#define PHY_MAX_REG_ADDRESS   0x1F      /* 5 bit address bus (0-0x1F) */
+
+/* PHY 1000 MII Register/Bit Definitions */
+/* PHY Registers defined by IEEE */
+#define PHY_CONTROL           0x00  /* Control Register */
+#define PHY_STATUS            0x01  /* Status Regiser */
+#define PHY_ID1               0x02  /* Phy Id Register (word 1) */
+#define PHY_ID2               0x03  /* Phy Id Register (word 2) */
+#define PHY_AUTONEG_ADV       0x04  /* Autoneg Advertisement */
+#define PHY_LP_ABILITY        0x05  /* Link Partner Ability (Base Page) */
+#define PHY_AUTONEG_EXP       0x06  /* Autoneg Expansion Register */
+#define PHY_NEXT_PAGE_TX      0x07  /* Next Page TX */
+#define PHY_LP_NEXT_PAGE      0x08  /* Link Partner Next Page */
+#define PHY_1000T_CTRL        0x09  /* 1000Base-T Control Register */
+#define PHY_1000T_STATUS      0x0A  /* 1000Base-T Status Register */
+#define PHY_EXT_STATUS        0x0F  /* Extended Status Register */
+#define PHY_PHYSP_CONTROL     0x10  /* PHY Specific Control Register */
+#define PHY_EXT_PHYSP_CONTROL 0x14  /* Extended PHY Specific Control Register */
+#define PHY_LED_CONTROL       0x18  /* LED Control Register */
+#define PHY_EXT_PHYSP_STATUS  0x1B  /* Extended PHY Specific Status Register */
+
+/* PHY Control Register */
+#define MII_CR_SPEED_SELECT_MSB 0x0040  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_COLL_TEST_ENABLE 0x0080  /* Collision test enable */
+#define MII_CR_FULL_DUPLEX      0x0100  /* FDX =1, half duplex =0 */
+#define MII_CR_RESTART_AUTO_NEG 0x0200  /* Restart auto negotiation */
+#define MII_CR_ISOLATE          0x0400  /* Isolate PHY from MII */
+#define MII_CR_POWER_DOWN       0x0800  /* Power down */
+#define MII_CR_AUTO_NEG_EN      0x1000  /* Auto Neg Enable */
+#define MII_CR_SPEED_SELECT_LSB 0x2000  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_LOOPBACK         0x4000  /* 0 = normal, 1 = loopback */
+#define MII_CR_RESET            0x8000  /* 0 = normal, 1 = PHY reset */
+#define MII_CR_SPEED_1000       0x0040
+#define MII_CR_SPEED_100        0x2000
+#define MII_CR_SPEED_10         0x0000
+
+/* PHY Status Register */
+#define MII_SR_EXTENDED_CAPS     0x0001 /* Extended register capabilities */
+#define MII_SR_JABBER_DETECT     0x0002 /* Jabber Detected */
+#define MII_SR_LINK_STATUS       0x0004 /* Link Status 1 = link */
+#define MII_SR_AUTONEG_CAPS      0x0008 /* Auto Neg Capable */
+#define MII_SR_REMOTE_FAULT      0x0010 /* Remote Fault Detect */
+#define MII_SR_AUTONEG_COMPLETE  0x0020 /* Auto Neg Complete */
+#define MII_SR_PREAMBLE_SUPPRESS 0x0040 /* Preamble may be suppressed */
+#define MII_SR_EXTENDED_STATUS   0x0100 /* Ext. status info in Reg 0x0F */
+#define MII_SR_100T2_HD_CAPS     0x0200 /* 100T2 Half Duplex Capable */
+#define MII_SR_100T2_FD_CAPS     0x0400 /* 100T2 Full Duplex Capable */
+#define MII_SR_10T_HD_CAPS       0x0800 /* 10T   Half Duplex Capable */
+#define MII_SR_10T_FD_CAPS       0x1000 /* 10T   Full Duplex Capable */
+#define MII_SR_100X_HD_CAPS      0x2000 /* 100X  Half Duplex Capable */
+#define MII_SR_100X_FD_CAPS      0x4000 /* 100X  Full Duplex Capable */
+#define MII_SR_100T4_CAPS        0x8000 /* 100T4 Capable */
+
+/* Phy Id Register (word 2) */
+#define PHY_REVISION_MASK        0x000F
+
+/* PHY Specific Control Register */
+#define PHYSP_CTRL_ASSERT_CRS_TX  0x0800
+
+
+/* Default value of PHY register */
+#define PHY_CONTROL_DEFAULT         0x1140 /* Control Register */
+#define PHY_AUTONEG_ADV_DEFAULT     0x01e0 /* Autoneg Advertisement */
+#define PHY_NEXT_PAGE_TX_DEFAULT    0x2001 /* Next Page TX */
+#define PHY_1000T_CTRL_DEFAULT      0x0300 /* 1000Base-T Control Register */
+#define PHY_PHYSP_CONTROL_DEFAULT   0x01EE /* PHY Specific Control Register */
+
+/**
+ * pch_gbe_phy_get_id - Retrieve the PHY ID and revision
+ * @hw:        Pointer to the HW structure
+ * Returns
+ *      0:                      Successful.
+ *      Negative value:         Failed.
+ */
+s32 pch_gbe_phy_get_id(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+        s32 ret;
+        u16 phy_id1;
+        u16 phy_id2;
+
+        ret = pch_gbe_phy_read_reg_miic(hw, PHY_ID1, &phy_id1);
+        if (ret)
+                return ret;
+        ret = pch_gbe_phy_read_reg_miic(hw, PHY_ID2, &phy_id2);
+        if (ret)
+                return ret;
+        /*
+         * PHY_ID1: [bit15-0:ID(21-6)]
+         * PHY_ID2: [bit15-10:ID(5-0)][bit9-4:Model][bit3-0:revision]
+         */
+        phy->id = (u32)phy_id1;
+        phy->id = ((phy->id << 6) | ((phy_id2 & 0xFC00) >> 10));
+        phy->revision = (u32) (phy_id2 & 0x000F);
+        pr_debug("phy->id : 0x%08x  phy->revision : 0x%08x\n",
+                 phy->id, phy->revision);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_read_reg_miic - Read MII control register
+ * @hw:      Pointer to the HW structure
+ * @offset:  Register offset to be read
+ * @data:    Pointer to the read data
+ * Returns
+ *      0:              Successful.
+ *      -EINVAL:        Invalid argument.
+ */
+s32 pch_gbe_phy_read_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 *data)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+
+        if (offset > PHY_MAX_REG_ADDRESS) {
+                pr_err("PHY Address %d is out of range\n", offset);
+                return -EINVAL;
+        }
+        *data = pch_gbe_mac_ctrl_miim(hw, phy->addr, PCH_GBE_HAL_MIIM_READ,
+                                      offset, (u16)0);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_write_reg_miic - Write MII control register
+ * @hw:      Pointer to the HW structure
+ * @offset:  Register offset to be read
+ * @data:    data to write to register at offset
+ * Returns
+ *      0:              Successful.
+ *      -EINVAL:        Invalid argument.
+ */
+s32 pch_gbe_phy_write_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 data)
+{
+        struct pch_gbe_phy_info *phy = &hw->phy;
+
+        if (offset > PHY_MAX_REG_ADDRESS) {
+                pr_err("PHY Address %d is out of range\n", offset);
+                return -EINVAL;
+        }
+        pch_gbe_mac_ctrl_miim(hw, phy->addr, PCH_GBE_HAL_MIIM_WRITE,
+                                 offset, data);
+        return 0;
+}
+
+/**
+ * pch_gbe_phy_sw_reset - PHY software reset
+ * @hw:             Pointer to the HW structure
+ */
+void pch_gbe_phy_sw_reset(struct pch_gbe_hw *hw)
+{
+        u16 phy_ctrl;
+
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &phy_ctrl);
+        phy_ctrl |= MII_CR_RESET;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, phy_ctrl);
+        udelay(1);
+}
+
+/**
+ * pch_gbe_phy_hw_reset - PHY hardware reset
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_hw_reset(struct pch_gbe_hw *hw)
+{
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, PHY_CONTROL_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_AUTONEG_ADV,
+                                        PHY_AUTONEG_ADV_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_NEXT_PAGE_TX,
+                                        PHY_NEXT_PAGE_TX_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_1000T_CTRL, PHY_1000T_CTRL_DEFAULT);
+        pch_gbe_phy_write_reg_miic(hw, PHY_PHYSP_CONTROL,
+                                        PHY_PHYSP_CONTROL_DEFAULT);
+}
+
+/**
+ * pch_gbe_phy_power_up - restore link in case the phy was powered down
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_power_up(struct pch_gbe_hw *hw)
+{
+        u16 mii_reg;
+
+        mii_reg = 0;
+        /* Just clear the power down bit to wake the phy back up */
+        /* according to the manual, the phy will retain its
+         * settings across a power-down/up cycle */
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &mii_reg);
+        mii_reg &= ~MII_CR_POWER_DOWN;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, mii_reg);
+}
+
+/**
+ * pch_gbe_phy_power_down - Power down PHY
+ * @hw:    Pointer to the HW structure
+ */
+void pch_gbe_phy_power_down(struct pch_gbe_hw *hw)
+{
+        u16 mii_reg;
+
+        mii_reg = 0;
+        /* Power down the PHY so no link is implied when interface is down *
+         * The PHY cannot be powered down if any of the following is TRUE *
+         * (a) WoL is enabled
+         * (b) AMT is active
+         */
+        pch_gbe_phy_read_reg_miic(hw, PHY_CONTROL, &mii_reg);
+        mii_reg |= MII_CR_POWER_DOWN;
+        pch_gbe_phy_write_reg_miic(hw, PHY_CONTROL, mii_reg);
+        mdelay(1);
+}
+
+/**
+ * pch_gbe_phy_set_rgmii - RGMII interface setting
+ * @hw:             Pointer to the HW structure
+ */
+inline void pch_gbe_phy_set_rgmii(struct pch_gbe_hw *hw)
+{
+        pch_gbe_phy_sw_reset(hw);
+}
+
+/**
+ * pch_gbe_phy_init_setting - PHY initial setting
+ * @hw:             Pointer to the HW structure
+ */
+void pch_gbe_phy_init_setting(struct pch_gbe_hw *hw)
+{
+        struct pch_gbe_adapter *adapter;
+        struct ethtool_cmd     cmd;
+        int ret;
+        u16 mii_reg;
+
+        adapter = container_of(hw, struct pch_gbe_adapter, hw);
+        ret = mii_ethtool_gset(&adapter->mii, &cmd);
+        if (ret)
+                pr_err("Error: mii_ethtool_gset\n");
+
+        cmd.speed = hw->mac.link_speed;
+        cmd.duplex = hw->mac.link_duplex;
+        cmd.advertising = hw->phy.autoneg_advertised;
+        cmd.autoneg = hw->mac.autoneg;
+        pch_gbe_phy_write_reg_miic(hw, MII_BMCR, BMCR_RESET);
+        ret = mii_ethtool_sset(&adapter->mii, &cmd);
+        if (ret)
+                pr_err("Error: mii_ethtool_sset\n");
+
+        pch_gbe_phy_sw_reset(hw);
+
+        pch_gbe_phy_read_reg_miic(hw, PHY_PHYSP_CONTROL, &mii_reg);
+        mii_reg |= PHYSP_CTRL_ASSERT_CRS_TX;
+        pch_gbe_phy_write_reg_miic(hw, PHY_PHYSP_CONTROL, mii_reg);
+
+}
diff --git a/drivers/net/pch_gbe/pch_gbe_phy.h b/drivers/net/pch_gbe/pch_gbe_phy.h
new file mode 100644
index 000000000000..03264dc7b5ec
--- /dev/null
+++ b/drivers/net/pch_gbe/pch_gbe_phy.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 1999 - 2010 Intel Corporation.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This code was derived from the Intel e1000e Linux driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#ifndef _PCH_GBE_PHY_H_
+#define _PCH_GBE_PHY_H_
+
+#define PCH_GBE_PHY_REGS_LEN            32
+#define PCH_GBE_PHY_RESET_DELAY_US      10
+#define PCH_GBE_MAC_IFOP_RGMII
+
+s32 pch_gbe_phy_get_id(struct pch_gbe_hw *hw);
+s32 pch_gbe_phy_read_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 *data);
+s32 pch_gbe_phy_write_reg_miic(struct pch_gbe_hw *hw, u32 offset, u16 data);
+void pch_gbe_phy_sw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_phy_hw_reset(struct pch_gbe_hw *hw);
+void pch_gbe_phy_power_up(struct pch_gbe_hw *hw);
+void pch_gbe_phy_power_down(struct pch_gbe_hw *hw);
+void pch_gbe_phy_set_rgmii(struct pch_gbe_hw *hw);
+void pch_gbe_phy_init_setting(struct pch_gbe_hw *hw);
+
+#endif /* _PCH_GBE_PHY_H_ */
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index 56f3fc45dbaa..8dd03439d994 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -1125,7 +1125,7 @@ static int netdrv_open(struct net_device *dev)
         init_timer(&tp->timer);
         tp->timer.expires = jiffies + 3 * HZ;
         tp->timer.data = (unsigned long) dev;
-        tp->timer.function = &netdrv_timer;
+        tp->timer.function = netdrv_timer;
         add_timer(&tp->timer);
 
         DPRINTK("EXIT, returning 0\n");
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index c683f77c6f42..042f6777e6b9 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -69,6 +69,8 @@ earlier 3Com products.
 
 */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -83,7 +85,6 @@ earlier 3Com products.
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
 #include <linux/ioport.h>
-#include <linux/ethtool.h>
 #include <linux/bitops.h>
 #include <linux/mii.h>
 
@@ -238,7 +239,6 @@ static int el3_rx(struct net_device *dev, int worklimit);
 static int el3_close(struct net_device *dev);
 static void el3_tx_timeout(struct net_device *dev);
 static int el3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-static const struct ethtool_ops netdev_ethtool_ops;
 static void set_rx_mode(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
 
@@ -285,7 +285,6 @@ static int tc574_probe(struct pcmcia_device *link)
         link->conf.ConfigIndex = 1;
 
         dev->netdev_ops = &el3_netdev_ops;
-        SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
         dev->watchdog_timeo = TX_TIMEOUT;
 
         return tc574_config(link);
@@ -376,8 +375,8 @@ static int tc574_config(struct pcmcia_device *link)
                 for (i = 0; i < 3; i++)
                         phys_addr[i] = htons(read_eeprom(ioaddr, i + 10));
                 if (phys_addr[0] == htons(0x6060)) {
-                        printk(KERN_NOTICE "3c574_cs: IO port conflict at 0x%03lx"
-                                   "-0x%03lx\n", dev->base_addr, dev->base_addr+15);
+                        pr_notice("IO port conflict at 0x%03lx-0x%03lx\n",
+                                  dev->base_addr, dev->base_addr+15);
                         goto failed;
                 }
         }
@@ -391,7 +390,7 @@ static int tc574_config(struct pcmcia_device *link)
                 outw(2<<11, ioaddr + RunnerRdCtrl);
                 mcr = inb(ioaddr + 2);
                 outw(0<<11, ioaddr + RunnerRdCtrl);
-                printk(KERN_INFO "  ASIC rev %d,", mcr>>3);
+                pr_info("  ASIC rev %d,", mcr>>3);
                 EL3WINDOW(3);
                 config = inl(ioaddr + Wn3_Config);
                 lp->default_media = (config & Xcvr) >> Xcvr_shift;
@@ -428,7 +427,7 @@ static int tc574_config(struct pcmcia_device *link)
                         }
                 }
                 if (phy > 32) {
-                        printk(KERN_NOTICE "  No MII transceivers found!\n");
+                        pr_notice("  No MII transceivers found!\n");
                         goto failed;
                 }
                 i = mdio_read(ioaddr, lp->phys, 16) | 0x40;
@@ -444,18 +443,16 @@ static int tc574_config(struct pcmcia_device *link)
         SET_NETDEV_DEV(dev, &link->dev);
 
         if (register_netdev(dev) != 0) {
-                printk(KERN_NOTICE "3c574_cs: register_netdev() failed\n");
+                pr_notice("register_netdev() failed\n");
                 goto failed;
         }
 
-        printk(KERN_INFO "%s: %s at io %#3lx, irq %d, "
-               "hw_addr %pM.\n",
-               dev->name, cardname, dev->base_addr, dev->irq,
-               dev->dev_addr);
-        printk(" %dK FIFO split %s Rx:Tx, %sMII interface.\n",
-                   8 << config & Ram_size,
-                   ram_split[(config & Ram_split) >> Ram_split_shift],
-                   config & Autoselect ? "autoselect " : "");
+        netdev_info(dev, "%s at io %#3lx, irq %d, hw_addr %pM\n",
+                    cardname, dev->base_addr, dev->irq, dev->dev_addr);
+        netdev_info(dev, " %dK FIFO split %s Rx:Tx, %sMII interface.\n",
+                    8 << config & Ram_size,
+                    ram_split[(config & Ram_split) >> Ram_split_shift],
+                    config & Autoselect ? "autoselect " : "");
 
         return 0;
 
@@ -502,14 +499,14 @@ static void dump_status(struct net_device *dev)
 {
         unsigned int ioaddr = dev->base_addr;
         EL3WINDOW(1);
-        printk(KERN_INFO "  irq status %04x, rx status %04x, tx status "
-                   "%02x, tx free %04x\n", inw(ioaddr+EL3_STATUS),
-                   inw(ioaddr+RxStatus), inb(ioaddr+TxStatus),
-                   inw(ioaddr+TxFree));
+        netdev_info(dev, "  irq status %04x, rx status %04x, tx status %02x, tx free %04x\n",
+                    inw(ioaddr+EL3_STATUS),
+                    inw(ioaddr+RxStatus), inb(ioaddr+TxStatus),
+                    inw(ioaddr+TxFree));
         EL3WINDOW(4);
-        printk(KERN_INFO "  diagnostics: fifo %04x net %04x ethernet %04x"
-                   " media %04x\n", inw(ioaddr+0x04), inw(ioaddr+0x06),
-                   inw(ioaddr+0x08), inw(ioaddr+0x0a));
+        netdev_info(dev, "  diagnostics: fifo %04x net %04x ethernet %04x media %04x\n",
+                    inw(ioaddr+0x04), inw(ioaddr+0x06),
+                    inw(ioaddr+0x08), inw(ioaddr+0x0a));
         EL3WINDOW(1);
 }
 
@@ -523,7 +520,7 @@ static void tc574_wait_for_completion(struct net_device *dev, int cmd)
         while (--i > 0)
                 if (!(inw(dev->base_addr + EL3_STATUS) & 0x1000)) break;
         if (i == 0)
-                printk(KERN_NOTICE "%s: command 0x%04x did not complete!\n", dev->name, cmd);
+                netdev_notice(dev, "command 0x%04x did not complete!\n", cmd);
 }
 
 /* Read a word from the EEPROM using the regular EEPROM access register.
@@ -710,7 +707,7 @@ static int el3_open(struct net_device *dev)
         netif_start_queue(dev);
         
         tc574_reset(dev);
-        lp->media.function = &media_check;
+        lp->media.function = media_check;
         lp->media.data = (unsigned long) dev;
         lp->media.expires = jiffies + HZ;
         add_timer(&lp->media);
@@ -725,7 +722,7 @@ static void el3_tx_timeout(struct net_device *dev)
 {
         unsigned int ioaddr = dev->base_addr;
         
-        printk(KERN_NOTICE "%s: Transmit timed out!\n", dev->name);
+        netdev_notice(dev, "Transmit timed out!\n");
         dump_status(dev);
         dev->stats.tx_errors++;
         dev->trans_start = jiffies; /* prevent tx timeout */
@@ -848,8 +845,8 @@ static irqreturn_t el3_interrupt(int irq, void *dev_id)
                                 EL3WINDOW(4);
                                 fifo_diag = inw(ioaddr + Wn4_FIFODiag);
                                 EL3WINDOW(1);
-                                printk(KERN_NOTICE "%s: adapter failure, FIFO diagnostic"
-                                           " register %04x.\n", dev->name, fifo_diag);
+                                netdev_notice(dev, "adapter failure, FIFO diagnostic register %04x\n",
+                                              fifo_diag);
                                 if (fifo_diag & 0x0400) {
                                         /* Tx overrun */
                                         tc574_wait_for_completion(dev, TxReset);
@@ -903,7 +900,7 @@ static void media_check(unsigned long arg)
            this, we can limp along even if the interrupt is blocked */
         if ((inw(ioaddr + EL3_STATUS) & IntLatch) && (inb(ioaddr + Timer) == 0xff)) {
                 if (!lp->fast_poll)
-                        printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+                        netdev_info(dev, "interrupt(s) dropped!\n");
 
                 local_irq_save(flags);
                 el3_interrupt(dev->irq, dev);
@@ -926,23 +923,21 @@ static void media_check(unsigned long arg)
         
         if (media != lp->media_status) {
                 if ((media ^ lp->media_status) & 0x0004)
-                        printk(KERN_INFO "%s: %s link beat\n", dev->name,
-                                   (lp->media_status & 0x0004) ? "lost" : "found");
+                        netdev_info(dev, "%s link beat\n",
+                                    (lp->media_status & 0x0004) ? "lost" : "found");
                 if ((media ^ lp->media_status) & 0x0020) {
                         lp->partner = 0;
                         if (lp->media_status & 0x0020) {
-                                printk(KERN_INFO "%s: autonegotiation restarted\n",
-                                           dev->name);
+                                netdev_info(dev, "autonegotiation restarted\n");
                         } else if (partner) {
                                 partner &= lp->advertising;
                                 lp->partner = partner;
-                                printk(KERN_INFO "%s: autonegotiation complete: "
-                                           "%sbaseT-%cD selected\n", dev->name,
-                                           ((partner & 0x0180) ? "100" : "10"),
-                                           ((partner & 0x0140) ? 'F' : 'H'));
+                                netdev_info(dev, "autonegotiation complete: "
+                                            "%dbaseT-%cD selected\n",
+                                            (partner & 0x0180) ? 100 : 10,
+                                            (partner & 0x0140) ? 'F' : 'H');
                         } else {
-                                printk(KERN_INFO "%s: link partner did not autonegotiate\n",
-                                           dev->name);
+                                netdev_info(dev, "link partner did not autonegotiate\n");
                         }
 
                         EL3WINDOW(3);
@@ -952,10 +947,9 @@ static void media_check(unsigned long arg)
 
                 }
                 if (media & 0x0010)
-                        printk(KERN_INFO "%s: remote fault detected\n",
-                                   dev->name);
+                        netdev_info(dev, "remote fault detected\n");
                 if (media & 0x0002)
-                        printk(KERN_INFO "%s: jabber detected\n", dev->name);
+                        netdev_info(dev, "jabber detected\n");
                 lp->media_status = media;
         }
         spin_unlock_irqrestore(&lp->window_lock, flags);
@@ -1065,16 +1059,6 @@ static int el3_rx(struct net_device *dev, int worklimit)
         return worklimit;
 }
 
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, "3c574_cs");
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo            = netdev_get_drvinfo,
-};
-
 /* Provide ioctl() calls to examine the MII xcvr state. */
 static int el3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 61f9cf2100ff..35562a395770 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -19,6 +19,8 @@
 
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #define DRV_NAME        "3c589_cs"
 #define DRV_VERSION     "1.162-ac"
 
@@ -264,7 +266,7 @@ static int tc589_config(struct pcmcia_device *link)
     __be16 *phys_addr;
     int ret, i, j, multi = 0, fifo;
     unsigned int ioaddr;
-    char *ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
+    static const char * const ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
     u8 *buf;
     size_t len;
 
@@ -273,8 +275,7 @@ static int tc589_config(struct pcmcia_device *link)
     phys_addr = (__be16 *)dev->dev_addr;
     /* Is this a 3c562? */
     if (link->manf_id != MANFID_3COM)
-            printk(KERN_INFO "3c589_cs: hmmm, is this really a "
-                   "3Com card??\n");
+            dev_info(&link->dev, "hmmm, is this really a 3Com card??\n");
     multi = (link->card_id == PRODID_3COM_3C562);
 
     link->io_lines = 16;
@@ -315,8 +316,8 @@ static int tc589_config(struct pcmcia_device *link)
         for (i = 0; i < 3; i++)
             phys_addr[i] = htons(read_eeprom(ioaddr, i));
         if (phys_addr[0] == htons(0x6060)) {
-            printk(KERN_ERR "3c589_cs: IO port conflict at 0x%03lx"
-                   "-0x%03lx\n", dev->base_addr, dev->base_addr+15);
+            dev_err(&link->dev, "IO port conflict at 0x%03lx-0x%03lx\n",
+                    dev->base_addr, dev->base_addr+15);
             goto failed;
         }
     }
@@ -330,12 +331,12 @@ static int tc589_config(struct pcmcia_device *link)
     if ((if_port >= 0) && (if_port <= 3))
         dev->if_port = if_port;
     else
-        printk(KERN_ERR "3c589_cs: invalid if_port requested\n");
+        dev_err(&link->dev, "invalid if_port requested\n");
 
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
-        printk(KERN_ERR "3c589_cs: register_netdev() failed\n");
+            dev_err(&link->dev, "register_netdev() failed\n");
         goto failed;
     }
 
@@ -537,7 +538,7 @@ static int el3_open(struct net_device *dev)
 
     tc589_reset(dev);
     init_timer(&lp->media);
-    lp->media.function = &media_check;
+    lp->media.function = media_check;
     lp->media.data = (unsigned long) dev;
     lp->media.expires = jiffies + HZ;
     add_timer(&lp->media);
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 5f05ffb240cc..3f61fde70d73 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -24,6 +24,8 @@
 
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -32,7 +34,6 @@
 #include <linux/timer.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
-#include <linux/ethtool.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/crc32.h>
@@ -86,7 +87,6 @@ static netdev_tx_t axnet_start_xmit(struct sk_buff *skb,
 static struct net_device_stats *get_stats(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
 static void axnet_tx_timeout(struct net_device *dev);
-static const struct ethtool_ops netdev_ethtool_ops;
 static irqreturn_t ei_irq_wrapper(int irq, void *dev_id);
 static void ei_watchdog(u_long arg);
 static void axnet_reset_8390(struct net_device *dev);
@@ -171,7 +171,6 @@ static int axnet_probe(struct pcmcia_device *link)
 
     dev->netdev_ops = &axnet_netdev_ops;
 
-    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
     dev->watchdog_timeo = TX_TIMEOUT;
 
     return axnet_config(link);
@@ -347,8 +346,8 @@ static int axnet_config(struct pcmcia_device *link)
     dev->base_addr = link->resource[0]->start;
 
     if (!get_prom(link)) {
-        printk(KERN_NOTICE "axnet_cs: this is not an AX88190 card!\n");
-        printk(KERN_NOTICE "axnet_cs: use pcnet_cs instead.\n");
+        pr_notice("this is not an AX88190 card!\n");
+        pr_notice("use pcnet_cs instead.\n");
         goto failed;
     }
 
@@ -357,10 +356,10 @@ static int axnet_config(struct pcmcia_device *link)
     ei_status.tx_start_page = AXNET_START_PG;
     ei_status.rx_start_page = AXNET_START_PG + TX_PAGES;
     ei_status.stop_page = AXNET_STOP_PG;
-    ei_status.reset_8390 = &axnet_reset_8390;
-    ei_status.get_8390_hdr = &get_8390_hdr;
-    ei_status.block_input = &block_input;
-    ei_status.block_output = &block_output;
+    ei_status.reset_8390 = axnet_reset_8390;
+    ei_status.get_8390_hdr = get_8390_hdr;
+    ei_status.block_input = block_input;
+    ei_status.block_output = block_output;
 
     if (inb(dev->base_addr + AXNET_TEST) != 0)
         info->flags |= IS_AX88790;
@@ -393,19 +392,18 @@ static int axnet_config(struct pcmcia_device *link)
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
-        printk(KERN_NOTICE "axnet_cs: register_netdev() failed\n");
+        pr_notice("register_netdev() failed\n");
         goto failed;
     }
 
-    printk(KERN_INFO "%s: Asix AX88%d90: io %#3lx, irq %d, "
-           "hw_addr %pM\n",
-           dev->name, ((info->flags & IS_AX88790) ? 7 : 1),
-           dev->base_addr, dev->irq,
-           dev->dev_addr);
+    netdev_info(dev, "Asix AX88%d90: io %#3lx, irq %d, hw_addr %pM\n",
+                ((info->flags & IS_AX88790) ? 7 : 1),
+                dev->base_addr, dev->irq, dev->dev_addr);
     if (info->phy_id != -1) {
-        dev_dbg(&link->dev, "  MII transceiver at index %d, status %x.\n", info->phy_id, j);
+        netdev_dbg(dev, "  MII transceiver at index %d, status %x\n",
+                   info->phy_id, j);
     } else {
-        printk(KERN_NOTICE "  No MII transceivers found!\n");
+        netdev_notice(dev, "  No MII transceivers found!\n");
     }
     return 0;
 
@@ -532,7 +530,7 @@ static int axnet_open(struct net_device *dev)
 
     info->link_status = 0x00;
     init_timer(&info->watchdog);
-    info->watchdog.function = &ei_watchdog;
+    info->watchdog.function = ei_watchdog;
     info->watchdog.data = (u_long)dev;
     info->watchdog.expires = jiffies + HZ;
     add_timer(&info->watchdog);
@@ -585,8 +583,7 @@ static void axnet_reset_8390(struct net_device *dev)
     outb_p(ENISR_RESET, nic_base + EN0_ISR); /* Ack intr. */
     
     if (i == 100)
-        printk(KERN_ERR "%s: axnet_reset_8390() did not complete.\n",
-               dev->name);
+        netdev_err(dev, "axnet_reset_8390() did not complete\n");
     
 } /* axnet_reset_8390 */
 
@@ -613,7 +610,7 @@ static void ei_watchdog(u_long arg)
        this, we can limp along even if the interrupt is blocked */
     if (info->stale++ && (inb_p(nic_base + EN0_ISR) & ENISR_ALL)) {
         if (!info->fast_poll)
-            printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+            netdev_info(dev, "interrupt(s) dropped!\n");
         ei_irq_wrapper(dev->irq, dev);
         info->fast_poll = HZ;
     }
@@ -628,7 +625,7 @@ static void ei_watchdog(u_long arg)
         goto reschedule;
     link = mdio_read(mii_addr, info->phy_id, 1);
     if (!link || (link == 0xffff)) {
-        printk(KERN_INFO "%s: MII is missing!\n", dev->name);
+        netdev_info(dev, "MII is missing!\n");
         info->phy_id = -1;
         goto reschedule;
     }
@@ -636,18 +633,14 @@ static void ei_watchdog(u_long arg)
     link &= 0x0004;
     if (link != info->link_status) {
         u_short p = mdio_read(mii_addr, info->phy_id, 5);
-        printk(KERN_INFO "%s: %s link beat\n", dev->name,
-               (link) ? "found" : "lost");
+        netdev_info(dev, "%s link beat\n", link ? "found" : "lost");
         if (link) {
             info->duplex_flag = (p & 0x0140) ? 0x80 : 0x00;
             if (p)
-                printk(KERN_INFO "%s: autonegotiation complete: "
-                       "%sbaseT-%cD selected\n", dev->name,
-                       ((p & 0x0180) ? "100" : "10"),
-                       ((p & 0x0140) ? 'F' : 'H'));
+                netdev_info(dev, "autonegotiation complete: %dbaseT-%cD selected\n",
+                            (p & 0x0180) ? 100 : 10, (p & 0x0140) ? 'F' : 'H');
             else
-                printk(KERN_INFO "%s: link partner did not autonegotiate\n",
-                       dev->name);
+                netdev_info(dev, "link partner did not autonegotiate\n");
             AX88190_init(dev, 1);
         }
         info->link_status = link;
@@ -658,16 +651,6 @@ reschedule:
     add_timer(&info->watchdog);
 }
 
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, "axnet_cs");
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo            = netdev_get_drvinfo,
-};
-
 /*====================================================================*/
 
 static int axnet_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
@@ -855,9 +838,6 @@ module_exit(exit_axnet_cs);
 
   */
 
-static const char version_8390[] = KERN_INFO \
-    "8390.c:v1.10cvs 9/23/94 Donald Becker (becker@scyld.com)\n";
-
 #include <linux/bitops.h>
 #include <asm/irq.h>
 #include <linux/fcntl.h>
@@ -1004,9 +984,11 @@ static void axnet_tx_timeout(struct net_device *dev)
         isr = inb(e8390_base+EN0_ISR);
         spin_unlock_irqrestore(&ei_local->page_lock, flags);
 
-        printk(KERN_DEBUG "%s: Tx timed out, %s TSR=%#2x, ISR=%#2x, t=%d.\n",
-                dev->name, (txsr & ENTSR_ABT) ? "excess collisions." :
-                (isr) ? "lost interrupt?" : "cable problem?", txsr, isr, tickssofar);
+        netdev_printk(KERN_DEBUG, dev,
+                      "Tx timed out, %s TSR=%#2x, ISR=%#2x, t=%d.\n",
+                      (txsr & ENTSR_ABT) ? "excess collisions." :
+                      (isr) ? "lost interrupt?" : "cable problem?",
+                      txsr, isr, tickssofar);
 
         if (!isr && !dev->stats.tx_packets) 
         {
@@ -1076,22 +1058,28 @@ static netdev_tx_t axnet_start_xmit(struct sk_buff *skb,
                 output_page = ei_local->tx_start_page;
                 ei_local->tx1 = send_length;
                 if (ei_debug  &&  ei_local->tx2 > 0)
-                        printk(KERN_DEBUG "%s: idle transmitter tx2=%d, lasttx=%d, txing=%d.\n",
-                                dev->name, ei_local->tx2, ei_local->lasttx, ei_local->txing);
+                        netdev_printk(KERN_DEBUG, dev,
+                                      "idle transmitter tx2=%d, lasttx=%d, txing=%d\n",
+                                      ei_local->tx2, ei_local->lasttx,
+                                      ei_local->txing);
         }
         else if (ei_local->tx2 == 0) 
         {
                 output_page = ei_local->tx_start_page + TX_PAGES/2;
                 ei_local->tx2 = send_length;
                 if (ei_debug  &&  ei_local->tx1 > 0)
-                        printk(KERN_DEBUG "%s: idle transmitter, tx1=%d, lasttx=%d, txing=%d.\n",
-                                dev->name, ei_local->tx1, ei_local->lasttx, ei_local->txing);
+                        netdev_printk(KERN_DEBUG, dev,
+                                      "idle transmitter, tx1=%d, lasttx=%d, txing=%d\n",
+                                      ei_local->tx1, ei_local->lasttx,
+                                      ei_local->txing);
         }
         else
         {       /* We should never get here. */
                 if (ei_debug)
-                        printk(KERN_DEBUG "%s: No Tx buffers free! tx1=%d tx2=%d last=%d\n",
-                                dev->name, ei_local->tx1, ei_local->tx2, ei_local->lasttx);
+                        netdev_printk(KERN_DEBUG, dev,
+                                      "No Tx buffers free! tx1=%d tx2=%d last=%d\n",
+                                      ei_local->tx1, ei_local->tx2,
+                                      ei_local->lasttx);
                 ei_local->irqlock = 0;
                 netif_stop_queue(dev);
                 outb_p(ENISR_ALL, e8390_base + EN0_IMR);
@@ -1179,23 +1167,26 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
          
         spin_lock_irqsave(&ei_local->page_lock, flags);
 
-        if (ei_local->irqlock) 
-        {
+        if (ei_local->irqlock) {
 #if 1 /* This might just be an interrupt for a PCI device sharing this line */
+                const char *msg;
                 /* The "irqlock" check is only for testing. */
-                printk(ei_local->irqlock
-                           ? "%s: Interrupted while interrupts are masked! isr=%#2x imr=%#2x.\n"
-                           : "%s: Reentering the interrupt handler! isr=%#2x imr=%#2x.\n",
-                           dev->name, inb_p(e8390_base + EN0_ISR),
-                           inb_p(e8390_base + EN0_IMR));
+                if (ei_local->irqlock)
+                        msg = "Interrupted while interrupts are masked!";
+                else
+                        msg = "Reentering the interrupt handler!";
+                netdev_info(dev, "%s, isr=%#2x imr=%#2x\n",
+                            msg,
+                            inb_p(e8390_base + EN0_ISR),
+                            inb_p(e8390_base + EN0_IMR));
 #endif
                 spin_unlock_irqrestore(&ei_local->page_lock, flags);
                 return IRQ_NONE;
         }
     
         if (ei_debug > 3)
-                printk(KERN_DEBUG "%s: interrupt(isr=%#2.2x).\n", dev->name,
-                           inb_p(e8390_base + EN0_ISR));
+                netdev_printk(KERN_DEBUG, dev, "interrupt(isr=%#2.2x)\n",
+                              inb_p(e8390_base + EN0_ISR));
 
         outb_p(0x00, e8390_base + EN0_ISR);
         ei_local->irqlock = 1;
@@ -1206,7 +1197,8 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
         {
                 if (!netif_running(dev) || (interrupts == 0xff)) {
                         if (ei_debug > 1)
-                                printk(KERN_WARNING "%s: interrupt from stopped card\n", dev->name);
+                                netdev_warn(dev,
+                                            "interrupt from stopped card\n");
                         outb_p(interrupts, e8390_base + EN0_ISR);
                         interrupts = 0;
                         break;
@@ -1249,11 +1241,12 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
                 {
                         /* 0xFF is valid for a card removal */
                         if(interrupts!=0xFF)
-                                printk(KERN_WARNING "%s: Too much work at interrupt, status %#2.2x\n",
-                                   dev->name, interrupts);
+                                netdev_warn(dev, "Too much work at interrupt, status %#2.2x\n",
+                                            interrupts);
                         outb_p(ENISR_ALL, e8390_base + EN0_ISR); /* Ack. most intrs. */
                 } else {
-                        printk(KERN_WARNING "%s: unknown interrupt %#2x\n", dev->name, interrupts);
+                        netdev_warn(dev, "unknown interrupt %#2x\n",
+                                    interrupts);
                         outb_p(0xff, e8390_base + EN0_ISR); /* Ack. all intrs. */
                 }
         }
@@ -1287,18 +1280,19 @@ static void ei_tx_err(struct net_device *dev)
         unsigned char tx_was_aborted = txsr & (ENTSR_ABT+ENTSR_FU);
 
 #ifdef VERBOSE_ERROR_DUMP
-        printk(KERN_DEBUG "%s: transmitter error (%#2x): ", dev->name, txsr);
+        netdev_printk(KERN_DEBUG, dev,
+                      "transmitter error (%#2x):", txsr);
         if (txsr & ENTSR_ABT)
-                printk("excess-collisions ");
+                pr_cont(" excess-collisions");
         if (txsr & ENTSR_ND)
-                printk("non-deferral ");
+                pr_cont(" non-deferral");
         if (txsr & ENTSR_CRS)
-                printk("lost-carrier ");
+                pr_cont(" lost-carrier");
         if (txsr & ENTSR_FU)
-                printk("FIFO-underrun ");
+                pr_cont(" FIFO-underrun");
         if (txsr & ENTSR_CDH)
-                printk("lost-heartbeat ");
-        printk("\n");
+                pr_cont(" lost-heartbeat");
+        pr_cont("\n");
 #endif
 
         if (tx_was_aborted)
@@ -1335,8 +1329,9 @@ static void ei_tx_intr(struct net_device *dev)
         if (ei_local->tx1 < 0) 
         {
                 if (ei_local->lasttx != 1 && ei_local->lasttx != -1)
-                        printk(KERN_ERR "%s: bogus last_tx_buffer %d, tx1=%d.\n",
-                                ei_local->name, ei_local->lasttx, ei_local->tx1);
+                        netdev_err(dev, "%s: bogus last_tx_buffer %d, tx1=%d\n",
+                                   ei_local->name, ei_local->lasttx,
+                                   ei_local->tx1);
                 ei_local->tx1 = 0;
                 if (ei_local->tx2 > 0) 
                 {
@@ -1351,8 +1346,9 @@ static void ei_tx_intr(struct net_device *dev)
         else if (ei_local->tx2 < 0) 
         {
                 if (ei_local->lasttx != 2  &&  ei_local->lasttx != -2)
-                        printk("%s: bogus last_tx_buffer %d, tx2=%d.\n",
-                                ei_local->name, ei_local->lasttx, ei_local->tx2);
+                        netdev_info(dev, "%s: bogus last_tx_buffer %d, tx2=%d\n",
+                                    ei_local->name, ei_local->lasttx,
+                                    ei_local->tx2);
                 ei_local->tx2 = 0;
                 if (ei_local->tx1 > 0) 
                 {
@@ -1365,8 +1361,9 @@ static void ei_tx_intr(struct net_device *dev)
                 else
                         ei_local->lasttx = 10, ei_local->txing = 0;
         }
-//      else printk(KERN_WARNING "%s: unexpected TX-done interrupt, lasttx=%d.\n",
-//                      dev->name, ei_local->lasttx);
+//      else
+//              netdev_warn(dev, "unexpected TX-done interrupt, lasttx=%d\n",
+//                          ei_local->lasttx);
 
         /* Minimize Tx latency: update the statistics after we restart TXing. */
         if (status & ENTSR_COL)
@@ -1429,8 +1426,8 @@ static void ei_receive(struct net_device *dev)
                    is that some clones crash in roughly the same way.
                  */
                 if (ei_debug > 0  &&  this_frame != ei_local->current_page && (this_frame!=0x0 || rxing_page!=0xFF))
-                        printk(KERN_ERR "%s: mismatched read page pointers %2x vs %2x.\n",
-                                   dev->name, this_frame, ei_local->current_page);
+                    netdev_err(dev, "mismatched read page pointers %2x vs %2x\n",
+                               this_frame, ei_local->current_page);
                 
                 if (this_frame == rxing_page)   /* Read all the frames? */
                         break;                          /* Done for now */
@@ -1446,9 +1443,10 @@ static void ei_receive(struct net_device *dev)
                 if (pkt_len < 60  ||  pkt_len > 1518) 
                 {
                         if (ei_debug)
-                                printk(KERN_DEBUG "%s: bogus packet size: %d, status=%#2x nxpg=%#2x.\n",
-                                           dev->name, rx_frame.count, rx_frame.status,
-                                           rx_frame.next);
+                                netdev_printk(KERN_DEBUG, dev,
+                                              "bogus packet size: %d, status=%#2x nxpg=%#2x\n",
+                                              rx_frame.count, rx_frame.status,
+                                              rx_frame.next);
                         dev->stats.rx_errors++;
                         dev->stats.rx_length_errors++;
                 }
@@ -1460,8 +1458,9 @@ static void ei_receive(struct net_device *dev)
                         if (skb == NULL) 
                         {
                                 if (ei_debug > 1)
-                                        printk(KERN_DEBUG "%s: Couldn't allocate a sk_buff of size %d.\n",
-                                                   dev->name, pkt_len);
+                                        netdev_printk(KERN_DEBUG, dev,
+                                                      "Couldn't allocate a sk_buff of size %d\n",
+                                                      pkt_len);
                                 dev->stats.rx_dropped++;
                                 break;
                         }
@@ -1481,9 +1480,10 @@ static void ei_receive(struct net_device *dev)
                 else 
                 {
                         if (ei_debug)
-                                printk(KERN_DEBUG "%s: bogus packet: status=%#2x nxpg=%#2x size=%d\n",
-                                           dev->name, rx_frame.status, rx_frame.next,
-                                           rx_frame.count);
+                                netdev_printk(KERN_DEBUG, dev,
+                                              "bogus packet: status=%#2x nxpg=%#2x size=%d\n",
+                                              rx_frame.status, rx_frame.next,
+                                              rx_frame.count);
                         dev->stats.rx_errors++;
                         /* NB: The NIC counts CRC, frame and missed errors. */
                         if (pkt_stat & ENRSR_FO)
@@ -1493,8 +1493,8 @@ static void ei_receive(struct net_device *dev)
                 
                 /* This _should_ never happen: it's here for avoiding bad clones. */
                 if (next_frame >= ei_local->stop_page) {
-                        printk("%s: next frame inconsistency, %#2x\n", dev->name,
-                                   next_frame);
+                        netdev_info(dev, "next frame inconsistency, %#2x\n",
+                                    next_frame);
                         next_frame = ei_local->rx_start_page;
                 }
                 ei_local->current_page = next_frame;
@@ -1529,7 +1529,7 @@ static void ei_rx_overrun(struct net_device *dev)
         outb_p(E8390_NODMA+E8390_PAGE0+E8390_STOP, e8390_base+E8390_CMD);
     
         if (ei_debug > 1)
-                printk(KERN_DEBUG "%s: Receiver overrun.\n", dev->name);
+                netdev_printk(KERN_DEBUG, dev, "Receiver overrun\n");
         dev->stats.rx_over_errors++;
     
         /* 
@@ -1726,7 +1726,7 @@ static void AX88190_init(struct net_device *dev, int startp)
         {
                 outb_p(dev->dev_addr[i], e8390_base + EN1_PHYS_SHIFT(i));
                 if(inb_p(e8390_base + EN1_PHYS_SHIFT(i))!=dev->dev_addr[i])
-                        printk(KERN_ERR "Hw. address read/write mismap %d\n",i);
+                        netdev_err(dev, "Hw. address read/write mismap %d\n", i);
         }
 
         outb_p(ei_local->rx_start_page, e8390_base + EN1_CURPAG);
@@ -1763,8 +1763,7 @@ static void NS8390_trigger_send(struct net_device *dev, unsigned int length,
     
         if (inb_p(e8390_base) & E8390_TRANS) 
         {
-                printk(KERN_WARNING "%s: trigger_send() called with the transmitter busy.\n",
-                        dev->name);
+                netdev_warn(dev, "trigger_send() called with the transmitter busy\n");
                 return;
         }
         outb_p(length & 0xff, e8390_base + EN0_TCNTLO);
diff --git a/drivers/net/pcmcia/com20020_cs.c b/drivers/net/pcmcia/com20020_cs.c
index 3c400cfa82ae..f065c35cd4b7 100644
--- a/drivers/net/pcmcia/com20020_cs.c
+++ b/drivers/net/pcmcia/com20020_cs.c
@@ -52,23 +52,23 @@
 
 #define VERSION "arcnet: COM20020 PCMCIA support loaded.\n"
 
-#ifdef DEBUG
 
 static void regdump(struct net_device *dev)
 {
+#ifdef DEBUG
     int ioaddr = dev->base_addr;
     int count;
     
-    printk("com20020 register dump:\n");
+    netdev_dbg(dev, "register dump:\n");
     for (count = ioaddr; count < ioaddr + 16; count++)
     {
         if (!(count % 16))
-            printk("\n%04X: ", count);
-        printk("%02X ", inb(count));
+            pr_cont("%04X:", count);
+        pr_cont(" %02X", inb(count));
     }
-    printk("\n");
+    pr_cont("\n");
     
-    printk("buffer0 dump:\n");
+    netdev_dbg(dev, "buffer0 dump:\n");
         /* set up the address register */
         count = 0;
         outb((count >> 8) | RDDATAflag | AUTOINCflag, _ADDR_HI);
@@ -77,19 +77,15 @@ static void regdump(struct net_device *dev)
     for (count = 0; count < 256+32; count++)
     {
         if (!(count % 16))
-            printk("\n%04X: ", count);
+            pr_cont("%04X:", count);
         
         /* copy the data */
-        printk("%02X ", inb(_MEMDATA));
+        pr_cont(" %02X", inb(_MEMDATA));
     }
-    printk("\n");
+    pr_cont("\n");
+#endif
 }
 
-#else
-
-static inline void regdump(struct net_device *dev) { }
-
-#endif
 
 
 /*====================================================================*/
@@ -301,13 +297,13 @@ static int com20020_config(struct pcmcia_device *link)
     i = com20020_found(dev, 0); /* calls register_netdev */
     
     if (i != 0) {
-        dev_printk(KERN_NOTICE, &link->dev,
-                "com20020_cs: com20020_found() failed\n");
+        dev_notice(&link->dev,
+                   "com20020_found() failed\n");
         goto failed;
     }
 
-    dev_dbg(&link->dev,KERN_INFO "%s: port %#3lx, irq %d\n",
-           dev->name, dev->base_addr, dev->irq);
+    netdev_dbg(dev, "port %#3lx, irq %d\n",
+               dev->base_addr, dev->irq);
     return 0;
 
 failed:
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 98fffb03ecd7..8f26d548d1bb 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -28,6 +28,8 @@
    
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #define DRV_NAME        "fmvj18x_cs"
 #define DRV_VERSION     "2.9"
 
@@ -291,7 +293,7 @@ static int mfc_try_io_port(struct pcmcia_device *link)
         link->resource[1]->flags |= IO_DATA_PATH_WIDTH_8;
         if (link->resource[1]->start == 0) {
             link->resource[1]->end = 0;
-            printk(KERN_NOTICE "fmvj18x_cs: out of resource for serial\n");
+            pr_notice("out of resource for serial\n");
         }
         ret = pcmcia_request_io(link);
         if (ret == 0)
@@ -503,7 +505,7 @@ static int fmvj18x_config(struct pcmcia_device *link)
     case XXX10304:
         /* Read MACID from Buggy CIS */
         if (fmvj18x_get_hwinfo(link, buggybuf) == -1) {
-            printk(KERN_NOTICE "fmvj18x_cs: unable to read hardware net address.\n");
+            pr_notice("unable to read hardware net address\n");
             goto failed;
         }
         for (i = 0 ; i < 6; i++) {
@@ -524,15 +526,14 @@ static int fmvj18x_config(struct pcmcia_device *link)
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
-        printk(KERN_NOTICE "fmvj18x_cs: register_netdev() failed\n");
+        pr_notice("register_netdev() failed\n");
         goto failed;
     }
 
     /* print current configuration */
-    printk(KERN_INFO "%s: %s, sram %s, port %#3lx, irq %d, "
-           "hw_addr %pM\n",
-           dev->name, card_name, sram_config == 0 ? "4K TX*2" : "8K TX*2", 
-           dev->base_addr, dev->irq, dev->dev_addr);
+    netdev_info(dev, "%s, sram %s, port %#3lx, irq %d, hw_addr %pM\n",
+                card_name, sram_config == 0 ? "4K TX*2" : "8K TX*2",
+                dev->base_addr, dev->irq, dev->dev_addr);
 
     return 0;
     
@@ -606,7 +607,7 @@ static int fmvj18x_setup_mfc(struct pcmcia_device *link)
 
     lp->base = ioremap(req.Base, req.Size);
     if (lp->base == NULL) {
-        printk(KERN_NOTICE "fmvj18x_cs: ioremap failed\n");
+        netdev_notice(dev, "ioremap failed\n");
         return -1;
     }
 
@@ -800,17 +801,16 @@ static void fjn_tx_timeout(struct net_device *dev)
     struct local_info_t *lp = netdev_priv(dev);
     unsigned int ioaddr = dev->base_addr;
 
-    printk(KERN_NOTICE "%s: transmit timed out with status %04x, %s?\n",
-           dev->name, htons(inw(ioaddr + TX_STATUS)),
-           inb(ioaddr + TX_STATUS) & F_TMT_RDY
-           ? "IRQ conflict" : "network cable problem");
-    printk(KERN_NOTICE "%s: timeout registers: %04x %04x %04x "
-           "%04x %04x %04x %04x %04x.\n",
-           dev->name, htons(inw(ioaddr + 0)),
-           htons(inw(ioaddr + 2)), htons(inw(ioaddr + 4)),
-           htons(inw(ioaddr + 6)), htons(inw(ioaddr + 8)),
-           htons(inw(ioaddr +10)), htons(inw(ioaddr +12)),
-           htons(inw(ioaddr +14)));
+    netdev_notice(dev, "transmit timed out with status %04x, %s?\n",
+                  htons(inw(ioaddr + TX_STATUS)),
+                  inb(ioaddr + TX_STATUS) & F_TMT_RDY
+                  ? "IRQ conflict" : "network cable problem");
+    netdev_notice(dev, "timeout registers: %04x %04x %04x "
+                  "%04x %04x %04x %04x %04x.\n",
+                  htons(inw(ioaddr + 0)), htons(inw(ioaddr + 2)),
+                  htons(inw(ioaddr + 4)), htons(inw(ioaddr + 6)),
+                  htons(inw(ioaddr + 8)), htons(inw(ioaddr + 10)),
+                  htons(inw(ioaddr + 12)), htons(inw(ioaddr + 14)));
     dev->stats.tx_errors++;
     /* ToDo: We should try to restart the adaptor... */
     local_irq_disable();
@@ -845,13 +845,13 @@ static netdev_tx_t fjn_start_xmit(struct sk_buff *skb,
         unsigned char *buf = skb->data;
 
         if (length > ETH_FRAME_LEN) {
-            printk(KERN_NOTICE "%s: Attempting to send a large packet"
-                   " (%d bytes).\n", dev->name, length);
+            netdev_notice(dev, "Attempting to send a large packet (%d bytes)\n",
+                          length);
             return NETDEV_TX_BUSY;
         }
 
-        pr_debug("%s: Transmitting a packet of length %lu.\n",
-              dev->name, (unsigned long)skb->len);
+        netdev_dbg(dev, "Transmitting a packet of length %lu\n",
+                   (unsigned long)skb->len);
         dev->stats.tx_bytes += skb->len;
 
         /* Disable both interrupts. */
@@ -904,7 +904,7 @@ static void fjn_reset(struct net_device *dev)
     unsigned int ioaddr = dev->base_addr;
     int i;
 
-    pr_debug("fjn_reset(%s) called.\n",dev->name);
+    netdev_dbg(dev, "fjn_reset() called\n");
 
     /* Reset controller */
     if( sram_config == 0 ) 
@@ -988,8 +988,8 @@ static void fjn_rx(struct net_device *dev)
     while ((inb(ioaddr + RX_MODE) & F_BUF_EMP) == 0) {
         u_short status = inw(ioaddr + DATAPORT);
 
-        pr_debug("%s: Rxing packet mode %02x status %04x.\n",
-              dev->name, inb(ioaddr + RX_MODE), status);
+        netdev_dbg(dev, "Rxing packet mode %02x status %04x.\n",
+                   inb(ioaddr + RX_MODE), status);
 #ifndef final_version
         if (status == 0) {
             outb(F_SKP_PKT, ioaddr + RX_SKIP);
@@ -1008,16 +1008,16 @@ static void fjn_rx(struct net_device *dev)
             struct sk_buff *skb;
 
             if (pkt_len > 1550) {
-                printk(KERN_NOTICE "%s: The FMV-18x claimed a very "
-                       "large packet, size %d.\n", dev->name, pkt_len);
+                netdev_notice(dev, "The FMV-18x claimed a very large packet, size %d\n",
+                              pkt_len);
                 outb(F_SKP_PKT, ioaddr + RX_SKIP);
                 dev->stats.rx_errors++;
                 break;
             }
             skb = dev_alloc_skb(pkt_len+2);
             if (skb == NULL) {
-                printk(KERN_NOTICE "%s: Memory squeeze, dropping "
-                       "packet (len %d).\n", dev->name, pkt_len);
+                netdev_notice(dev, "Memory squeeze, dropping packet (len %d)\n",
+                              pkt_len);
                 outb(F_SKP_PKT, ioaddr + RX_SKIP);
                 dev->stats.rx_dropped++;
                 break;
diff --git a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
index b0d06a3d962f..dc85282193bf 100644
--- a/drivers/net/pcmcia/ibmtr_cs.c
+++ b/drivers/net/pcmcia/ibmtr_cs.c
@@ -45,6 +45,8 @@
 
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/ptrace.h>
@@ -52,7 +54,6 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/module.h>
-#include <linux/ethtool.h>
 #include <linux/netdevice.h>
 #include <linux/trdevice.h>
 #include <linux/ibmtr.h>
@@ -107,16 +108,6 @@ typedef struct ibmtr_dev_t {
     struct tok_info     *ti;
 } ibmtr_dev_t;
 
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, "ibmtr_cs");
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo            = netdev_get_drvinfo,
-};
-
 static irqreturn_t ibmtr_interrupt(int irq, void *dev_id) {
         ibmtr_dev_t *info = dev_id;
         struct net_device *dev = info->dev;
@@ -159,8 +150,6 @@ static int __devinit ibmtr_attach(struct pcmcia_device *link)
 
     info->dev = dev;
 
-    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
-
     return ibmtr_config(link);
 } /* ibmtr_attach */
 
@@ -285,15 +274,14 @@ static int __devinit ibmtr_config(struct pcmcia_device *link)
 
     i = ibmtr_probe_card(dev);
     if (i != 0) {
-        printk(KERN_NOTICE "ibmtr_cs: register_netdev() failed\n");
+        pr_notice("register_netdev() failed\n");
         goto failed;
     }
 
-    printk(KERN_INFO
-           "%s: port %#3lx, irq %d,  mmio %#5lx, sram %#5lx, hwaddr=%pM\n",
-           dev->name, dev->base_addr, dev->irq,
-           (u_long)ti->mmio, (u_long)(ti->sram_base << 12),
-           dev->dev_addr);
+    netdev_info(dev, "port %#3lx, irq %d, mmio %#5lx, sram %#5lx, hwaddr=%pM\n",
+                dev->base_addr, dev->irq,
+                (u_long)ti->mmio, (u_long)(ti->sram_base << 12),
+                dev->dev_addr);
     return 0;
 
 failed:
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 68f2deeb3ade..c1d8ce9e4a6c 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -111,6 +111,8 @@ Log: nmclan_cs.c,v
 
 ---------------------------------------------------------------------------- */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #define DRV_NAME        "nmclan_cs"
 #define DRV_VERSION     "0.16"
 
@@ -519,7 +521,7 @@ static int mace_read(mace_private *lp, unsigned int ioaddr, int reg)
       spin_unlock_irqrestore(&lp->bank_lock, flags);
       break;
   }
-  return (data & 0xFF);
+  return data & 0xFF;
 } /* mace_read */
 
 /* ----------------------------------------------------------------------------
@@ -563,7 +565,7 @@ static int mace_init(mace_private *lp, unsigned int ioaddr, char *enet_addr)
     /* Wait for reset bit to be cleared automatically after <= 200ns */;
     if(++ct > 500)
     {
-        printk(KERN_ERR "mace: reset failed, card removed ?\n");
+        pr_err("reset failed, card removed?\n");
         return -1;
     }
     udelay(1);
@@ -610,7 +612,7 @@ static int mace_init(mace_private *lp, unsigned int ioaddr, char *enet_addr)
   {
         if(++ ct > 500)
         {
-                printk(KERN_ERR "mace: ADDRCHG timeout, card removed ?\n");
+                pr_err("ADDRCHG timeout, card removed?\n");
                 return -1;
         }
   }
@@ -678,8 +680,8 @@ static int nmclan_config(struct pcmcia_device *link)
       dev_dbg(&link->dev, "nmclan_cs configured: mace id=%x %x\n",
             sig[0], sig[1]);
     } else {
-      printk(KERN_NOTICE "nmclan_cs: mace id not found: %x %x should"
-             " be 0x40 0x?9\n", sig[0], sig[1]);
+      pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+                sig[0], sig[1]);
       return -ENODEV;
     }
   }
@@ -691,20 +693,18 @@ static int nmclan_config(struct pcmcia_device *link)
   if (if_port <= 2)
     dev->if_port = if_port;
   else
-    printk(KERN_NOTICE "nmclan_cs: invalid if_port requested\n");
+    pr_notice("invalid if_port requested\n");
 
   SET_NETDEV_DEV(dev, &link->dev);
 
   i = register_netdev(dev);
   if (i != 0) {
-    printk(KERN_NOTICE "nmclan_cs: register_netdev() failed\n");
+    pr_notice("register_netdev() failed\n");
     goto failed;
   }
 
-  printk(KERN_INFO "%s: nmclan: port %#3lx, irq %d, %s port,"
-         " hw_addr %pM\n",
-         dev->name, dev->base_addr, dev->irq, if_names[dev->if_port],
-         dev->dev_addr);
+  netdev_info(dev, "nmclan: port %#3lx, irq %d, %s port, hw_addr %pM\n",
+              dev->base_addr, dev->irq, if_names[dev->if_port], dev->dev_addr);
   return 0;
 
 failed:
@@ -798,8 +798,7 @@ static int mace_config(struct net_device *dev, struct ifmap *map)
   if ((map->port != (u_char)(-1)) && (map->port != dev->if_port)) {
     if (map->port <= 2) {
       dev->if_port = map->port;
-      printk(KERN_INFO "%s: switched to %s port\n", dev->name,
-             if_names[dev->if_port]);
+      netdev_info(dev, "switched to %s port\n", if_names[dev->if_port]);
     } else
       return -EINVAL;
   }
@@ -878,12 +877,12 @@ static void mace_tx_timeout(struct net_device *dev)
   mace_private *lp = netdev_priv(dev);
   struct pcmcia_device *link = lp->p_dev;
 
-  printk(KERN_NOTICE "%s: transmit timed out -- ", dev->name);
+  netdev_notice(dev, "transmit timed out -- ");
 #if RESET_ON_TIMEOUT
-  printk("resetting card\n");
+  pr_cont("resetting card\n");
   pcmcia_reset_card(link->socket);
 #else /* #if RESET_ON_TIMEOUT */
-  printk("NOT resetting card\n");
+  pr_cont("NOT resetting card\n");
 #endif /* #if RESET_ON_TIMEOUT */
   dev->trans_start = jiffies; /* prevent tx timeout */
   netif_wake_queue(dev);
@@ -965,22 +964,21 @@ static irqreturn_t mace_interrupt(int irq, void *dev_id)
   ioaddr = dev->base_addr;
 
   if (lp->tx_irq_disabled) {
-    printk(
-      (lp->tx_irq_disabled?
-       KERN_NOTICE "%s: Interrupt with tx_irq_disabled "
-       "[isr=%02X, imr=%02X]\n": 
-       KERN_NOTICE "%s: Re-entering the interrupt handler "
-       "[isr=%02X, imr=%02X]\n"),
-      dev->name,
-      inb(ioaddr + AM2150_MACE_BASE + MACE_IR),
-      inb(ioaddr + AM2150_MACE_BASE + MACE_IMR)
-    );
+    const char *msg;
+    if (lp->tx_irq_disabled)
+      msg = "Interrupt with tx_irq_disabled";
+    else
+      msg = "Re-entering the interrupt handler";
+    netdev_notice(dev, "%s [isr=%02X, imr=%02X]\n",
+                  msg,
+                  inb(ioaddr + AM2150_MACE_BASE + MACE_IR),
+                  inb(ioaddr + AM2150_MACE_BASE + MACE_IMR));
     /* WARNING: MACE_IR has been read! */
     return IRQ_NONE;
   }
 
   if (!netif_device_present(dev)) {
-    pr_debug("%s: interrupt from dead card\n", dev->name);
+    netdev_dbg(dev, "interrupt from dead card\n");
     return IRQ_NONE;
   }
 
@@ -1378,8 +1376,8 @@ static void BuildLAF(int *ladrf, int *adr)
     printk(KERN_DEBUG "    adr =%pM\n", adr);
   printk(KERN_DEBUG "    hashcode = %d(decimal), ladrf[0:63] =", hashcode);
   for (i = 0; i < 8; i++)
-    printk(KERN_CONT " %02X", ladrf[i]);
-  printk(KERN_CONT "\n");
+    pr_cont(" %02X", ladrf[i]);
+  pr_cont("\n");
 #endif
 } /* BuildLAF */
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 49279b0ee526..e180832c278f 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -28,6 +28,8 @@
 
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -35,7 +37,6 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
-#include <linux/ethtool.h>
 #include <linux/netdevice.h>
 #include <linux/log2.h>
 #include <linux/etherdevice.h>
@@ -100,7 +101,6 @@ static void pcnet_release(struct pcmcia_device *link);
 static int pcnet_open(struct net_device *dev);
 static int pcnet_close(struct net_device *dev);
 static int ei_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-static const struct ethtool_ops netdev_ethtool_ops;
 static irqreturn_t ei_irq_wrapper(int irq, void *dev_id);
 static void ei_watchdog(u_long arg);
 static void pcnet_reset_8390(struct net_device *dev);
@@ -434,8 +434,6 @@ static hw_info_t *get_ax88190(struct pcmcia_device *link)
         dev->dev_addr[i] = j & 0xff;
         dev->dev_addr[i+1] = j >> 8;
     }
-    printk(KERN_NOTICE "pcnet_cs: this is an AX88190 card!\n");
-    printk(KERN_NOTICE "pcnet_cs: use axnet_cs instead.\n");
     return NULL;
 }
 
@@ -570,15 +568,15 @@ static int pcnet_config(struct pcmcia_device *link)
         if ((if_port == 1) || (if_port == 2))
             dev->if_port = if_port;
         else
-            printk(KERN_NOTICE "pcnet_cs: invalid if_port requested\n");
+            pr_notice("invalid if_port requested\n");
     } else {
         dev->if_port = 0;
     }
 
     if ((link->conf.ConfigBase == 0x03c0) &&
         (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
-        printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
-        printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
+        pr_notice("this is an AX88190 card!\n");
+        pr_notice("use axnet_cs instead.\n");
         goto failed;
     }
 
@@ -593,8 +591,8 @@ static int pcnet_config(struct pcmcia_device *link)
         local_hw_info = get_hwired(link);
 
     if (local_hw_info == NULL) {
-        printk(KERN_NOTICE "pcnet_cs: unable to read hardware net"
-               " address for io base %#3lx\n", dev->base_addr);
+        pr_notice("unable to read hardware net address for io base %#3lx\n",
+                  dev->base_addr);
         goto failed;
     }
 
@@ -626,9 +624,7 @@ static int pcnet_config(struct pcmcia_device *link)
 
     ei_status.name = "NE2000";
     ei_status.word16 = 1;
-    ei_status.reset_8390 = &pcnet_reset_8390;
-
-    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
+    ei_status.reset_8390 = pcnet_reset_8390;
 
     if (info->flags & (IS_DL10019|IS_DL10022))
         mii_phy_probe(dev);
@@ -636,25 +632,25 @@ static int pcnet_config(struct pcmcia_device *link)
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
-        printk(KERN_NOTICE "pcnet_cs: register_netdev() failed\n");
+        pr_notice("register_netdev() failed\n");
         goto failed;
     }
 
     if (info->flags & (IS_DL10019|IS_DL10022)) {
         u_char id = inb(dev->base_addr + 0x1a);
-        printk(KERN_INFO "%s: NE2000 (DL100%d rev %02x): ",
-               dev->name, ((info->flags & IS_DL10022) ? 22 : 19), id);
+        netdev_info(dev, "NE2000 (DL100%d rev %02x): ",
+               (info->flags & IS_DL10022) ? 22 : 19, id);
         if (info->pna_phy)
-            printk("PNA, ");
+            pr_cont("PNA, ");
     } else {
-        printk(KERN_INFO "%s: NE2000 Compatible: ", dev->name);
+        netdev_info(dev, "NE2000 Compatible: ");
     }
-    printk("io %#3lx, irq %d,", dev->base_addr, dev->irq);
+    pr_cont("io %#3lx, irq %d,", dev->base_addr, dev->irq);
     if (info->flags & USE_SHMEM)
-        printk (" mem %#5lx,", dev->mem_start);
+        pr_cont(" mem %#5lx,", dev->mem_start);
     if (info->flags & HAS_MISC_REG)
-        printk(" %s xcvr,", if_names[dev->if_port]);
-    printk(" hw_addr %pM\n", dev->dev_addr);
+        pr_cont(" %s xcvr,", if_names[dev->if_port]);
+    pr_cont(" hw_addr %pM\n", dev->dev_addr);
     return 0;
 
 failed:
@@ -928,7 +924,7 @@ static void mii_phy_probe(struct net_device *dev)
         phyid = tmp << 16;
         phyid |= mdio_read(mii_addr, i, MII_PHYID_REG2);
         phyid &= MII_PHYID_REV_MASK;
-        pr_debug("%s: MII at %d is 0x%08x\n", dev->name, i, phyid);
+        netdev_dbg(dev, "MII at %d is 0x%08x\n", i, phyid);
         if (phyid == AM79C9XX_HOME_PHY) {
             info->pna_phy = i;
         } else if (phyid != AM79C9XX_ETH_PHY) {
@@ -961,7 +957,7 @@ static int pcnet_open(struct net_device *dev)
     info->phy_id = info->eth_phy;
     info->link_status = 0x00;
     init_timer(&info->watchdog);
-    info->watchdog.function = &ei_watchdog;
+    info->watchdog.function = ei_watchdog;
     info->watchdog.data = (u_long)dev;
     info->watchdog.expires = jiffies + HZ;
     add_timer(&info->watchdog);
@@ -1014,8 +1010,8 @@ static void pcnet_reset_8390(struct net_device *dev)
     outb_p(ENISR_RESET, nic_base + EN0_ISR); /* Ack intr. */
 
     if (i == 100)
-        printk(KERN_ERR "%s: pcnet_reset_8390() did not complete.\n",
-               dev->name);
+        netdev_err(dev, "pcnet_reset_8390() did not complete.\n");
+
     set_misc_reg(dev);
 
 } /* pcnet_reset_8390 */
@@ -1031,8 +1027,7 @@ static int set_config(struct net_device *dev, struct ifmap *map)
         else if ((map->port < 1) || (map->port > 2))
             return -EINVAL;
         dev->if_port = map->port;
-        printk(KERN_INFO "%s: switched to %s port\n",
-               dev->name, if_names[dev->if_port]);
+        netdev_info(dev, "switched to %s port\n", if_names[dev->if_port]);
         NS8390_init(dev, 1);
     }
     return 0;
@@ -1067,7 +1062,7 @@ static void ei_watchdog(u_long arg)
        this, we can limp along even if the interrupt is blocked */
     if (info->stale++ && (inb_p(nic_base + EN0_ISR) & ENISR_ALL)) {
         if (!info->fast_poll)
-            printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+            netdev_info(dev, "interrupt(s) dropped!\n");
         ei_irq_wrapper(dev->irq, dev);
         info->fast_poll = HZ;
     }
@@ -1087,7 +1082,7 @@ static void ei_watchdog(u_long arg)
         if (info->eth_phy) {
             info->phy_id = info->eth_phy = 0;
         } else {
-            printk(KERN_INFO "%s: MII is missing!\n", dev->name);
+            netdev_info(dev, "MII is missing!\n");
             info->flags &= ~HAS_MII;
         }
         goto reschedule;
@@ -1096,8 +1091,7 @@ static void ei_watchdog(u_long arg)
     link &= 0x0004;
     if (link != info->link_status) {
         u_short p = mdio_read(mii_addr, info->phy_id, 5);
-        printk(KERN_INFO "%s: %s link beat\n", dev->name,
-               (link) ? "found" : "lost");
+        netdev_info(dev, "%s link beat\n", link ? "found" : "lost");
         if (link && (info->flags & IS_DL10022)) {
             /* Disable collision detection on full duplex links */
             outb((p & 0x0140) ? 4 : 0, nic_base + DLINK_DIAG);
@@ -1108,13 +1102,12 @@ static void ei_watchdog(u_long arg)
         if (link) {
             if (info->phy_id == info->eth_phy) {
                 if (p)
-                    printk(KERN_INFO "%s: autonegotiation complete: "
-                           "%sbaseT-%cD selected\n", dev->name,
+                    netdev_info(dev, "autonegotiation complete: "
+                           "%sbaseT-%cD selected\n",
                            ((p & 0x0180) ? "100" : "10"),
                            ((p & 0x0140) ? 'F' : 'H'));
                 else
-                    printk(KERN_INFO "%s: link partner did not "
-                           "autonegotiate\n", dev->name);
+                    netdev_info(dev, "link partner did not autonegotiate\n");
             }
             NS8390_init(dev, 1);
         }
@@ -1127,7 +1120,7 @@ static void ei_watchdog(u_long arg)
             /* isolate this MII and try flipping to the other one */
             mdio_write(mii_addr, info->phy_id, 0, 0x0400);
             info->phy_id ^= info->pna_phy ^ info->eth_phy;
-            printk(KERN_INFO "%s: switched to %s transceiver\n", dev->name,
+            netdev_info(dev, "switched to %s transceiver\n",
                    (info->phy_id == info->eth_phy) ? "ethernet" : "PNA");
             mdio_write(mii_addr, info->phy_id, 0,
                        (info->phy_id == info->eth_phy) ? 0x1000 : 0);
@@ -1143,18 +1136,6 @@ reschedule:
 
 /*====================================================================*/
 
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, "pcnet_cs");
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo            = netdev_get_drvinfo,
-};
-
-/*====================================================================*/
-
 
 static int ei_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
@@ -1187,9 +1168,9 @@ static void dma_get_8390_hdr(struct net_device *dev,
     unsigned int nic_base = dev->base_addr;
 
     if (ei_status.dmaing) {
-        printk(KERN_NOTICE "%s: DMAing conflict in dma_block_input."
+        netdev_notice(dev, "DMAing conflict in dma_block_input."
                "[DMAstat:%1x][irqlock:%1x]\n",
-               dev->name, ei_status.dmaing, ei_status.irqlock);
+               ei_status.dmaing, ei_status.irqlock);
         return;
     }
 
@@ -1220,11 +1201,11 @@ static void dma_block_input(struct net_device *dev, int count,
     char *buf = skb->data;
 
     if ((ei_debug > 4) && (count != 4))
-        pr_debug("%s: [bi=%d]\n", dev->name, count+4);
+        netdev_dbg(dev, "[bi=%d]\n", count+4);
     if (ei_status.dmaing) {
-        printk(KERN_NOTICE "%s: DMAing conflict in dma_block_input."
+        netdev_notice(dev, "DMAing conflict in dma_block_input."
                "[DMAstat:%1x][irqlock:%1x]\n",
-               dev->name, ei_status.dmaing, ei_status.irqlock);
+               ei_status.dmaing, ei_status.irqlock);
         return;
     }
     ei_status.dmaing |= 0x01;
@@ -1254,9 +1235,9 @@ static void dma_block_input(struct net_device *dev, int count,
                 break;
         } while (--tries > 0);
         if (tries <= 0)
-            printk(KERN_NOTICE "%s: RX transfer address mismatch,"
+            netdev_notice(dev, "RX transfer address mismatch,"
                    "%#4.4x (expected) vs. %#4.4x (actual).\n",
-                   dev->name, ring_offset + xfer_count, addr);
+                   ring_offset + xfer_count, addr);
     }
 #endif
     outb_p(ENISR_RDC, nic_base + EN0_ISR);      /* Ack intr. */
@@ -1277,7 +1258,7 @@ static void dma_block_output(struct net_device *dev, int count,
 
 #ifdef PCMCIA_DEBUG
     if (ei_debug > 4)
-        printk(KERN_DEBUG "%s: [bo=%d]\n", dev->name, count);
+        netdev_dbg(dev, "[bo=%d]\n", count);
 #endif
 
     /* Round the count up for word writes.  Do we need to do this?
@@ -1286,9 +1267,9 @@ static void dma_block_output(struct net_device *dev, int count,
     if (count & 0x01)
         count++;
     if (ei_status.dmaing) {
-        printk(KERN_NOTICE "%s: DMAing conflict in dma_block_output."
+        netdev_notice(dev, "DMAing conflict in dma_block_output."
                "[DMAstat:%1x][irqlock:%1x]\n",
-               dev->name, ei_status.dmaing, ei_status.irqlock);
+               ei_status.dmaing, ei_status.irqlock);
         return;
     }
     ei_status.dmaing |= 0x01;
@@ -1325,9 +1306,9 @@ static void dma_block_output(struct net_device *dev, int count,
                 break;
         } while (--tries > 0);
         if (tries <= 0) {
-            printk(KERN_NOTICE "%s: Tx packet transfer address mismatch,"
+            netdev_notice(dev, "Tx packet transfer address mismatch,"
                    "%#4.4x (expected) vs. %#4.4x (actual).\n",
-                   dev->name, (start_page << 8) + count, addr);
+                   (start_page << 8) + count, addr);
             if (retries++ == 0)
                 goto retry;
         }
@@ -1336,8 +1317,7 @@ static void dma_block_output(struct net_device *dev, int count,
 
     while ((inb_p(nic_base + EN0_ISR) & ENISR_RDC) == 0)
         if (time_after(jiffies, dma_start + PCNET_RDC_TIMEOUT)) {
-            printk(KERN_NOTICE "%s: timeout waiting for Tx RDC.\n",
-                   dev->name);
+            netdev_notice(dev, "timeout waiting for Tx RDC.\n");
             pcnet_reset_8390(dev);
             NS8390_init(dev, 1);
             break;
@@ -1361,9 +1341,9 @@ static int setup_dma_config(struct pcmcia_device *link, int start_pg,
     ei_status.stop_page = stop_pg;
 
     /* set up block i/o functions */
-    ei_status.get_8390_hdr = &dma_get_8390_hdr;
-    ei_status.block_input = &dma_block_input;
-    ei_status.block_output = &dma_block_output;
+    ei_status.get_8390_hdr = dma_get_8390_hdr;
+    ei_status.block_input = dma_block_input;
+    ei_status.block_output = dma_block_output;
 
     return 0;
 }
@@ -1509,9 +1489,9 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     ei_status.stop_page = start_pg + ((req.Size - offset) >> 8);
 
     /* set up block i/o functions */
-    ei_status.get_8390_hdr = &shmem_get_8390_hdr;
-    ei_status.block_input = &shmem_block_input;
-    ei_status.block_output = &shmem_block_output;
+    ei_status.get_8390_hdr = shmem_get_8390_hdr;
+    ei_status.block_input = shmem_block_input;
+    ei_status.block_output = shmem_block_output;
 
     info->flags |= USE_SHMEM;
     return 0;
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 377367d03b41..7204a4b5529b 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -25,6 +25,8 @@
 
 ======================================================================*/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -294,7 +296,7 @@ static const struct net_device_ops smc_netdev_ops = {
         .ndo_tx_timeout         = smc_tx_timeout,
         .ndo_set_config         = s9k_config,
         .ndo_set_multicast_list = set_rx_mode,
-        .ndo_do_ioctl           = &smc_ioctl,
+        .ndo_do_ioctl           = smc_ioctl,
         .ndo_change_mtu         = eth_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
@@ -813,14 +815,14 @@ static int check_sig(struct pcmcia_device *link)
         ((s >> 8) != (s & 0xff))) {
         SMC_SELECT_BANK(3);
         s = inw(ioaddr + REVISION);
-        return (s & 0xff);
+        return s & 0xff;
     }
 
     if (width) {
             modconf_t mod = {
                     .Attributes = CONF_IO_CHANGE_WIDTH,
             };
-            printk(KERN_INFO "smc91c92_cs: using 8-bit IO window.\n");
+            pr_info("using 8-bit IO window\n");
 
             smc91c92_suspend(link);
             pcmcia_modify_configuration(link, &mod);
@@ -881,7 +883,7 @@ static int smc91c92_config(struct pcmcia_device *link)
     if ((if_port >= 0) && (if_port <= 2))
         dev->if_port = if_port;
     else
-        printk(KERN_NOTICE "smc91c92_cs: invalid if_port requested\n");
+        dev_notice(&link->dev, "invalid if_port requested\n");
 
     switch (smc->manfid) {
     case MANFID_OSITECH:
@@ -899,7 +901,7 @@ static int smc91c92_config(struct pcmcia_device *link)
     }
 
     if (i != 0) {
-        printk(KERN_NOTICE "smc91c92_cs: Unable to find hardware address.\n");
+        dev_notice(&link->dev, "Unable to find hardware address.\n");
         goto config_failed;
     }
 
@@ -952,30 +954,28 @@ static int smc91c92_config(struct pcmcia_device *link)
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
-        printk(KERN_ERR "smc91c92_cs: register_netdev() failed\n");
+        dev_err(&link->dev, "register_netdev() failed\n");
         goto config_undo;
     }
 
-    printk(KERN_INFO "%s: smc91c%s rev %d: io %#3lx, irq %d, "
-           "hw_addr %pM\n",
-           dev->name, name, (rev & 0x0f), dev->base_addr, dev->irq,
-           dev->dev_addr);
+    netdev_info(dev, "smc91c%s rev %d: io %#3lx, irq %d, hw_addr %pM\n",
+                name, (rev & 0x0f), dev->base_addr, dev->irq, dev->dev_addr);
 
     if (rev > 0) {
         if (mir & 0x3ff)
-            printk(KERN_INFO "  %lu byte", mir);
+            netdev_info(dev, "  %lu byte", mir);
         else
-            printk(KERN_INFO "  %lu kb", mir>>10);
-        printk(" buffer, %s xcvr\n", (smc->cfg & CFG_MII_SELECT) ?
-               "MII" : if_names[dev->if_port]);
+            netdev_info(dev, "  %lu kb", mir>>10);
+        pr_cont(" buffer, %s xcvr\n",
+                (smc->cfg & CFG_MII_SELECT) ? "MII" : if_names[dev->if_port]);
     }
 
     if (smc->cfg & CFG_MII_SELECT) {
         if (smc->mii_if.phy_id != -1) {
-            dev_dbg(&link->dev, "  MII transceiver at index %d, status %x.\n",
-                  smc->mii_if.phy_id, j);
+            netdev_dbg(dev, "  MII transceiver at index %d, status %x\n",
+                       smc->mii_if.phy_id, j);
         } else {
-            printk(KERN_NOTICE "  No MII transceivers found!\n");
+            netdev_notice(dev, "  No MII transceivers found!\n");
         }
     }
     return 0;
@@ -1081,10 +1081,10 @@ static void smc_dump(struct net_device *dev)
     save = inw(ioaddr + BANK_SELECT);
     for (w = 0; w < 4; w++) {
         SMC_SELECT_BANK(w);
-        printk(KERN_DEBUG "bank %d: ", w);
+        netdev_printk(KERN_DEBUG, dev, "bank %d: ", w);
         for (i = 0; i < 14; i += 2)
-            printk(" %04x", inw(ioaddr + i));
-        printk("\n");
+            pr_cont(" %04x", inw(ioaddr + i));
+        pr_cont("\n");
     }
     outw(save, ioaddr + BANK_SELECT);
 }
@@ -1106,7 +1106,7 @@ static int smc_open(struct net_device *dev)
         return -ENODEV;
     /* Physical device present signature. */
     if (check_sig(link) < 0) {
-        printk("smc91c92_cs: Yikes!  Bad chip signature!\n");
+        netdev_info(dev, "Yikes!  Bad chip signature!\n");
         return -ENODEV;
     }
     link->open++;
@@ -1117,7 +1117,7 @@ static int smc_open(struct net_device *dev)
 
     smc_reset(dev);
     init_timer(&smc->media);
-    smc->media.function = &media_check;
+    smc->media.function = media_check;
     smc->media.data = (u_long) dev;
     smc->media.expires = jiffies + HZ;
     add_timer(&smc->media);
@@ -1172,7 +1172,7 @@ static void smc_hardware_send_packet(struct net_device * dev)
     u_char packet_no;
 
     if (!skb) {
-        printk(KERN_ERR "%s: In XMIT with no packet to send.\n", dev->name);
+        netdev_err(dev, "In XMIT with no packet to send\n");
         return;
     }
 
@@ -1180,8 +1180,8 @@ static void smc_hardware_send_packet(struct net_device * dev)
     packet_no = inw(ioaddr + PNR_ARR) >> 8;
     if (packet_no & 0x80) {
         /* If not, there is a hardware problem!  Likely an ejected card. */
-        printk(KERN_WARNING "%s: 91c92 hardware Tx buffer allocation"
-               " failed, status %#2.2x.\n", dev->name, packet_no);
+        netdev_warn(dev, "hardware Tx buffer allocation failed, status %#2.2x\n",
+                    packet_no);
         dev_kfree_skb_irq(skb);
         smc->saved_skb = NULL;
         netif_start_queue(dev);
@@ -1200,8 +1200,7 @@ static void smc_hardware_send_packet(struct net_device * dev)
         u_char *buf = skb->data;
         u_int length = skb->len; /* The chip will pad to ethernet min. */
 
-        pr_debug("%s: Trying to xmit packet of length %d.\n",
-              dev->name, length);
+        netdev_dbg(dev, "Trying to xmit packet of length %d\n", length);
         
         /* send the packet length: +6 for status word, length, and ctl */
         outw(0, ioaddr + DATA_1);
@@ -1233,9 +1232,8 @@ static void smc_tx_timeout(struct net_device *dev)
     struct smc_private *smc = netdev_priv(dev);
     unsigned int ioaddr = dev->base_addr;
 
-    printk(KERN_NOTICE "%s: SMC91c92 transmit timed out, "
-           "Tx_status %2.2x status %4.4x.\n",
-           dev->name, inw(ioaddr)&0xff, inw(ioaddr + 2));
+    netdev_notice(dev, "transmit timed out, Tx_status %2.2x status %4.4x.\n",
+                  inw(ioaddr)&0xff, inw(ioaddr + 2));
     dev->stats.tx_errors++;
     smc_reset(dev);
     dev->trans_start = jiffies; /* prevent tx timeout */
@@ -1254,14 +1252,14 @@ static netdev_tx_t smc_start_xmit(struct sk_buff *skb,
 
     netif_stop_queue(dev);
 
-    pr_debug("%s: smc_start_xmit(length = %d) called,"
-          " status %4.4x.\n", dev->name, skb->len, inw(ioaddr + 2));
+    netdev_dbg(dev, "smc_start_xmit(length = %d) called, status %04x\n",
+               skb->len, inw(ioaddr + 2));
 
     if (smc->saved_skb) {
         /* THIS SHOULD NEVER HAPPEN. */
         dev->stats.tx_aborted_errors++;
-        printk(KERN_DEBUG "%s: Internal error -- sent packet while busy.\n",
-               dev->name);
+        netdev_printk(KERN_DEBUG, dev,
+                      "Internal error -- sent packet while busy\n");
         return NETDEV_TX_BUSY;
     }
     smc->saved_skb = skb;
@@ -1269,7 +1267,7 @@ static netdev_tx_t smc_start_xmit(struct sk_buff *skb,
     num_pages = skb->len >> 8;
 
     if (num_pages > 7) {
-        printk(KERN_ERR "%s: Far too big packet error.\n", dev->name);
+        netdev_err(dev, "Far too big packet error: %d pages\n", num_pages);
         dev_kfree_skb (skb);
         smc->saved_skb = NULL;
         dev->stats.tx_dropped++;
@@ -1339,8 +1337,7 @@ static void smc_tx_err(struct net_device * dev)
     }
 
     if (tx_status & TS_SUCCESS) {
-        printk(KERN_NOTICE "%s: Successful packet caused error "
-               "interrupt?\n", dev->name);
+        netdev_notice(dev, "Successful packet caused error interrupt?\n");
     }
     /* re-enable transmit */
     SMC_SELECT_BANK(0);
@@ -1530,8 +1527,7 @@ static void smc_rx(struct net_device *dev)
     /* Assertion: we are in Window 2. */
 
     if (inw(ioaddr + FIFO_PORTS) & FP_RXEMPTY) {
-        printk(KERN_ERR "%s: smc_rx() with nothing on Rx FIFO.\n",
-               dev->name);
+        netdev_err(dev, "smc_rx() with nothing on Rx FIFO\n");
         return;
     }
 
@@ -1646,8 +1642,7 @@ static int s9k_config(struct net_device *dev, struct ifmap *map)
         else if (map->port > 2)
             return -EINVAL;
         dev->if_port = map->port;
-        printk(KERN_INFO "%s: switched to %s port\n",
-               dev->name, if_names[dev->if_port]);
+        netdev_info(dev, "switched to %s port\n", if_names[dev->if_port]);
         smc_reset(dev);
     }
     return 0;
@@ -1798,7 +1793,7 @@ static void media_check(u_long arg)
        this, we can limp along even if the interrupt is blocked */
     if (smc->watchdog++ && ((i>>8) & i)) {
         if (!smc->fast_poll)
-            printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+            netdev_info(dev, "interrupt(s) dropped!\n");
         local_irq_save(flags);
         smc_interrupt(dev->irq, dev);
         local_irq_restore(flags);
@@ -1822,7 +1817,7 @@ static void media_check(u_long arg)
         SMC_SELECT_BANK(3);
         link = mdio_read(dev, smc->mii_if.phy_id, 1);
         if (!link || (link == 0xffff)) {
-            printk(KERN_INFO "%s: MII is missing!\n", dev->name);
+            netdev_info(dev, "MII is missing!\n");
             smc->mii_if.phy_id = -1;
             goto reschedule;
         }
@@ -1830,15 +1825,13 @@ static void media_check(u_long arg)
         link &= 0x0004;
         if (link != smc->link_status) {
             u_short p = mdio_read(dev, smc->mii_if.phy_id, 5);
-            printk(KERN_INFO "%s: %s link beat\n", dev->name,
-                (link) ? "found" : "lost");
+            netdev_info(dev, "%s link beat\n", link ? "found" : "lost");
             smc->duplex = (((p & 0x0100) || ((p & 0x1c0) == 0x40))
                            ? TCR_FDUPLX : 0);
             if (link) {
-                printk(KERN_INFO "%s: autonegotiation complete: "
-                       "%sbaseT-%cD selected\n", dev->name,
-                       ((p & 0x0180) ? "100" : "10"),
-                       (smc->duplex ? 'F' : 'H'));
+                netdev_info(dev, "autonegotiation complete: "
+                            "%dbaseT-%cD selected\n",
+                            (p & 0x0180) ? 100 : 10, smc->duplex ? 'F' : 'H');
             }
             SMC_SELECT_BANK(0);
             outw(inw(ioaddr + TCR) | smc->duplex, ioaddr + TCR);
@@ -1857,25 +1850,23 @@ static void media_check(u_long arg)
     if (media != smc->media_status) {
         if ((media & smc->media_status & 1) &&
             ((smc->media_status ^ media) & EPH_LINK_OK))
-            printk(KERN_INFO "%s: %s link beat\n", dev->name,
-                   (smc->media_status & EPH_LINK_OK ? "lost" : "found"));
+            netdev_info(dev, "%s link beat\n",
+                        smc->media_status & EPH_LINK_OK ? "lost" : "found");
         else if ((media & smc->media_status & 2) &&
                  ((smc->media_status ^ media) & EPH_16COL))
-            printk(KERN_INFO "%s: coax cable %s\n", dev->name,
-                   (media & EPH_16COL ? "problem" : "ok"));
+            netdev_info(dev, "coax cable %s\n",
+                        media & EPH_16COL ? "problem" : "ok");
         if (dev->if_port == 0) {
             if (media & 1) {
                 if (media & EPH_LINK_OK)
-                    printk(KERN_INFO "%s: flipped to 10baseT\n",
-                           dev->name);
+                    netdev_info(dev, "flipped to 10baseT\n");
                 else
                     smc_set_xcvr(dev, 2);
             } else {
                 if (media & EPH_16COL)
                     smc_set_xcvr(dev, 1);
                 else
-                    printk(KERN_INFO "%s: flipped to 10base2\n",
-                           dev->name);
+                    netdev_info(dev, "flipped to 10base2\n");
             }
         }
         smc->media_status = media;
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index f5819526b5ee..d858b5e4c4a7 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -63,6 +63,8 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -210,13 +212,6 @@ enum xirc_cmd { 	    /* Commands */
 
 static const char *if_names[] = { "Auto", "10BaseT", "10Base2", "AUI", "100BaseT" };
 
-
-#define KDBG_XIRC KERN_DEBUG   "xirc2ps_cs: "
-#define KERR_XIRC KERN_ERR     "xirc2ps_cs: "
-#define KWRN_XIRC KERN_WARNING "xirc2ps_cs: "
-#define KNOT_XIRC KERN_NOTICE  "xirc2ps_cs: "
-#define KINF_XIRC KERN_INFO    "xirc2ps_cs: "
-
 /* card types */
 #define XIR_UNKNOWN  0  /* unknown: not supported */
 #define XIR_CE       1  /* (prodid 1) different hardware: not supported */
@@ -350,26 +345,26 @@ PrintRegisters(struct net_device *dev)
     if (pc_debug > 1) {
         int i, page;
 
-        printk(KDBG_XIRC "Register  common: ");
+        printk(KERN_DEBUG pr_fmt("Register  common: "));
         for (i = 0; i < 8; i++)
-            printk(" %2.2x", GetByte(i));
-        printk("\n");
+            pr_cont(" %2.2x", GetByte(i));
+        pr_cont("\n");
         for (page = 0; page <= 8; page++) {
-            printk(KDBG_XIRC "Register page %2x: ", page);
+            printk(KERN_DEBUG pr_fmt("Register page %2x: "), page);
             SelectPage(page);
             for (i = 8; i < 16; i++)
-                printk(" %2.2x", GetByte(i));
-            printk("\n");
+                pr_cont(" %2.2x", GetByte(i));
+            pr_cont("\n");
         }
         for (page=0x40 ; page <= 0x5f; page++) {
                 if (page == 0x43 || (page >= 0x46 && page <= 0x4f) ||
                     (page >= 0x51 && page <=0x5e))
                         continue;
-            printk(KDBG_XIRC "Register page %2x: ", page);
+            printk(KERN_DEBUG pr_fmt("Register page %2x: "), page);
             SelectPage(page);
             for (i = 8; i < 16; i++)
-                printk(" %2.2x", GetByte(i));
-            printk("\n");
+                pr_cont(" %2.2x", GetByte(i));
+            pr_cont("\n");
         }
     }
 }
@@ -608,11 +603,11 @@ set_card_type(struct pcmcia_device *link)
     local->modem = 0;
     local->card_type = XIR_UNKNOWN;
     if (!(prodid & 0x40)) {
-        printk(KNOT_XIRC "Ooops: Not a creditcard\n");
+        pr_notice("Oops: Not a creditcard\n");
         return 0;
     }
     if (!(mediaid & 0x01)) {
-        printk(KNOT_XIRC "Not an Ethernet card\n");
+        pr_notice("Not an Ethernet card\n");
         return 0;
     }
     if (mediaid & 0x10) {
@@ -643,12 +638,11 @@ set_card_type(struct pcmcia_device *link)
         }
     }
     if (local->card_type == XIR_CE || local->card_type == XIR_CEM) {
-        printk(KNOT_XIRC "Sorry, this is an old CE card\n");
+        pr_notice("Sorry, this is an old CE card\n");
         return 0;
     }
     if (local->card_type == XIR_UNKNOWN)
-        printk(KNOT_XIRC "unknown card (mediaid=%02x prodid=%02x)\n",
-               mediaid, prodid);
+        pr_notice("unknown card (mediaid=%02x prodid=%02x)\n", mediaid, prodid);
 
     return 1;
 }
@@ -748,7 +742,7 @@ xirc2ps_config(struct pcmcia_device * link)
 
     /* Is this a valid  card */
     if (link->has_manf_id == 0) {
-        printk(KNOT_XIRC "manfid not found in CIS\n");
+        pr_notice("manfid not found in CIS\n");
         goto failure;
     }
 
@@ -770,14 +764,14 @@ xirc2ps_config(struct pcmcia_device * link)
         local->manf_str = "Toshiba";
         break;
       default:
-        printk(KNOT_XIRC "Unknown Card Manufacturer ID: 0x%04x\n",
-               (unsigned)link->manf_id);
+        pr_notice("Unknown Card Manufacturer ID: 0x%04x\n",
+                  (unsigned)link->manf_id);
         goto failure;
     }
     dev_dbg(&link->dev, "found %s card\n", local->manf_str);
 
     if (!set_card_type(link)) {
-        printk(KNOT_XIRC "this card is not supported\n");
+        pr_notice("this card is not supported\n");
         goto failure;
     }
 
@@ -803,7 +797,7 @@ xirc2ps_config(struct pcmcia_device * link)
         err = pcmcia_loop_tuple(link, CISTPL_FUNCE, pcmcia_get_mac_ce, dev);
 
     if (err) {
-        printk(KNOT_XIRC "node-id not found in CIS\n");
+        pr_notice("node-id not found in CIS\n");
         goto failure;
     }
 
@@ -838,7 +832,7 @@ xirc2ps_config(struct pcmcia_device * link)
              * try to configure as Ethernet only.
              * .... */
         }
-        printk(KNOT_XIRC "no ports available\n");
+        pr_notice("no ports available\n");
     } else {
         link->resource[0]->end = 16;
         for (ioaddr = 0x300; ioaddr < 0x400; ioaddr += 0x10) {
@@ -911,24 +905,24 @@ xirc2ps_config(struct pcmcia_device * link)
       #if 0
         {
             u_char tmp;
-            printk(KERN_INFO "ECOR:");
+            pr_info("ECOR:");
             for (i=0; i < 7; i++) {
                 tmp = readb(local->dingo_ccr + i*2);
-                printk(" %02x", tmp);
+                pr_cont(" %02x", tmp);
             }
-            printk("\n");
-            printk(KERN_INFO "DCOR:");
+            pr_cont("\n");
+            pr_info("DCOR:");
             for (i=0; i < 4; i++) {
                 tmp = readb(local->dingo_ccr + 0x20 + i*2);
-                printk(" %02x", tmp);
+                pr_cont(" %02x", tmp);
             }
-            printk("\n");
-            printk(KERN_INFO "SCOR:");
+            pr_cont("\n");
+            pr_info("SCOR:");
             for (i=0; i < 10; i++) {
                 tmp = readb(local->dingo_ccr + 0x40 + i*2);
-                printk(" %02x", tmp);
+                pr_cont(" %02x", tmp);
             }
-            printk("\n");
+            pr_cont("\n");
         }
       #endif
 
@@ -947,7 +941,7 @@ xirc2ps_config(struct pcmcia_device * link)
                (local->mohawk && if_port==4))
         dev->if_port = if_port;
     else
-        printk(KNOT_XIRC "invalid if_port requested\n");
+        pr_notice("invalid if_port requested\n");
 
     /* we can now register the device with the net subsystem */
     dev->irq = link->irq;
@@ -959,14 +953,14 @@ xirc2ps_config(struct pcmcia_device * link)
     SET_NETDEV_DEV(dev, &link->dev);
 
     if ((err=register_netdev(dev))) {
-        printk(KNOT_XIRC "register_netdev() failed\n");
+        pr_notice("register_netdev() failed\n");
         goto config_error;
     }
 
     /* give some infos about the hardware */
-    printk(KERN_INFO "%s: %s: port %#3lx, irq %d, hwaddr %pM\n",
-           dev->name, local->manf_str,(u_long)dev->base_addr, (int)dev->irq,
-           dev->dev_addr);
+    netdev_info(dev, "%s: port %#3lx, irq %d, hwaddr %pM\n",
+                local->manf_str, (u_long)dev->base_addr, (int)dev->irq,
+                dev->dev_addr);
 
     return 0;
 
@@ -1098,8 +1092,7 @@ xirc2ps_interrupt(int irq, void *dev_id)
 
             skb = dev_alloc_skb(pktlen+3); /* 1 extra so we can use insw */
             if (!skb) {
-                printk(KNOT_XIRC "low memory, packet dropped (size=%u)\n",
-                       pktlen);
+                pr_notice("low memory, packet dropped (size=%u)\n", pktlen);
                 dev->stats.rx_dropped++;
             } else { /* okay get the packet */
                 skb_reserve(skb, 2);
@@ -1268,7 +1261,7 @@ xirc_tx_timeout(struct net_device *dev)
 {
     local_info_t *lp = netdev_priv(dev);
     dev->stats.tx_errors++;
-    printk(KERN_NOTICE "%s: transmit timed out\n", dev->name);
+    netdev_notice(dev, "transmit timed out\n");
     schedule_work(&lp->tx_timeout_task);
 }
 
@@ -1435,8 +1428,7 @@ do_config(struct net_device *dev, struct ifmap *map)
             local->probe_port = 0;
             dev->if_port = map->port;
         }
-        printk(KERN_INFO "%s: switching to %s port\n",
-               dev->name, if_names[dev->if_port]);
+        netdev_info(dev, "switching to %s port\n", if_names[dev->if_port]);
         do_reset(dev,1);  /* not the fine way :-) */
     }
     return 0;
@@ -1576,7 +1568,7 @@ do_reset(struct net_device *dev, int full)
     {
         SelectPage(0);
         value = GetByte(XIRCREG_ESR);    /* read the ESR */
-        printk(KERN_DEBUG "%s: ESR is: %#02x\n", dev->name, value);
+        pr_debug("%s: ESR is: %#02x\n", dev->name, value);
     }
   #endif
 
@@ -1626,13 +1618,12 @@ do_reset(struct net_device *dev, int full)
 
     if (full && local->mohawk && init_mii(dev)) {
         if (dev->if_port == 4 || local->dingo || local->new_mii) {
-            printk(KERN_INFO "%s: MII selected\n", dev->name);
+            netdev_info(dev, "MII selected\n");
             SelectPage(2);
             PutByte(XIRCREG2_MSR, GetByte(XIRCREG2_MSR) | 0x08);
             msleep(20);
         } else {
-            printk(KERN_INFO "%s: MII detected; using 10mbs\n",
-                   dev->name);
+            netdev_info(dev, "MII detected; using 10mbs\n");
             SelectPage(0x42);
             if (dev->if_port == 2) /* enable 10Base2 */
                 PutByte(XIRCREG42_SWC1, 0xC0);
@@ -1677,8 +1668,8 @@ do_reset(struct net_device *dev, int full)
     }
 
     if (full)
-        printk(KERN_INFO "%s: media %s, silicon revision %d\n",
-               dev->name, if_names[dev->if_port], local->silicon);
+        netdev_info(dev, "media %s, silicon revision %d\n",
+                    if_names[dev->if_port], local->silicon);
     /* We should switch back to page 0 to avoid a bug in revision 0
      * where regs with offset below 8 can't be read after an access
      * to the MAC registers */
@@ -1720,8 +1711,7 @@ init_mii(struct net_device *dev)
     control = mii_rd(ioaddr, 0, 0);
 
     if (control & 0x0400) {
-        printk(KERN_NOTICE "%s can't take PHY out of isolation mode\n",
-               dev->name);
+        netdev_notice(dev, "can't take PHY out of isolation mode\n");
         local->probe_port = 0;
         return 0;
     }
@@ -1739,8 +1729,7 @@ init_mii(struct net_device *dev)
         }
 
         if (!(status & 0x0020)) {
-            printk(KERN_INFO "%s: autonegotiation failed;"
-                   " using 10mbs\n", dev->name);
+            netdev_info(dev, "autonegotiation failed; using 10mbs\n");
             if (!local->new_mii) {
                 control = 0x0000;
                 mii_wr(ioaddr,  0, 0, control, 16);
@@ -1750,8 +1739,7 @@ init_mii(struct net_device *dev)
             }
         } else {
             linkpartner = mii_rd(ioaddr, 0, 5);
-            printk(KERN_INFO "%s: MII link partner: %04x\n",
-                   dev->name, linkpartner);
+            netdev_info(dev, "MII link partner: %04x\n", linkpartner);
             if (linkpartner & 0x0080) {
                 dev->if_port = 4;
             } else
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index c200c2821730..aee3bb0358bf 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -376,7 +376,7 @@ static void pcnet32_wio_reset(unsigned long addr)
 static int pcnet32_wio_check(unsigned long addr)
 {
         outw(88, addr + PCNET32_WIO_RAP);
-        return (inw(addr + PCNET32_WIO_RAP) == 88);
+        return inw(addr + PCNET32_WIO_RAP) == 88;
 }
 
 static struct pcnet32_access pcnet32_wio = {
@@ -431,7 +431,7 @@ static void pcnet32_dwio_reset(unsigned long addr)
 static int pcnet32_dwio_check(unsigned long addr)
 {
         outl(88, addr + PCNET32_DWIO_RAP);
-        return ((inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88);
+        return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
 }
 
 static struct pcnet32_access pcnet32_dwio = {
diff --git a/drivers/net/plip.c b/drivers/net/plip.c
index ec0349e84a8a..ca4df7f4cf21 100644
--- a/drivers/net/plip.c
+++ b/drivers/net/plip.c
@@ -995,8 +995,10 @@ plip_tx_packet(struct sk_buff *skb, struct net_device *dev)
 static void
 plip_rewrite_address(const struct net_device *dev, struct ethhdr *eth)
 {
-        const struct in_device *in_dev = dev->ip_ptr;
+        const struct in_device *in_dev;
 
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 /* Any address will do - we take the first */
                 const struct in_ifaddr *ifa = in_dev->ifa_list;
@@ -1006,6 +1008,7 @@ plip_rewrite_address(const struct net_device *dev, struct ethhdr *eth)
                         memcpy(eth->h_dest+2, &ifa->ifa_address, 4);
                 }
         }
+        rcu_read_unlock();
 }
 
 static int
@@ -1088,7 +1091,8 @@ plip_open(struct net_device *dev)
            when the device address isn't identical to the address of a
            received frame, the kernel incorrectly drops it).             */
 
-        if ((in_dev=dev->ip_ptr) != NULL) {
+        in_dev=__in_dev_get_rtnl(dev);
+        if (in_dev) {
                 /* Any address will do - we take the first. We already
                    have the first two bytes filled with 0xfc, from
                    plip_init_dev(). */
@@ -1279,7 +1283,6 @@ static void plip_attach (struct parport *port)
                 if (!nl->pardev) {
                         printk(KERN_ERR "%s: parport_register failed\n", name);
                         goto err_free_dev;
-                        return;
                 }
 
                 plip_init_netdev(dev);
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index c07de359dc07..d72fb0519a2a 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1124,7 +1124,7 @@ static const struct proto_ops pppoe_ops = {
         .ioctl          = pppox_ioctl,
 };
 
-static struct pppox_proto pppoe_proto = {
+static const struct pppox_proto pppoe_proto = {
         .create = pppoe_create,
         .ioctl  = pppoe_ioctl,
         .owner  = THIS_MODULE,
diff --git a/drivers/net/pppox.c b/drivers/net/pppox.c
index d4191ef9cad1..8c0d170dabcd 100644
--- a/drivers/net/pppox.c
+++ b/drivers/net/pppox.c
@@ -36,9 +36,9 @@
 
 #include <asm/uaccess.h>
 
-static struct pppox_proto *pppox_protos[PX_MAX_PROTO + 1];
+static const struct pppox_proto *pppox_protos[PX_MAX_PROTO + 1];
 
-int register_pppox_proto(int proto_num, struct pppox_proto *pp)
+int register_pppox_proto(int proto_num, const struct pppox_proto *pp)
 {
         if (proto_num < 0 || proto_num > PX_MAX_PROTO)
                 return -EINVAL;
diff --git a/drivers/net/pptp.c b/drivers/net/pptp.c
new file mode 100644
index 000000000000..ccbc91326bfa
--- /dev/null
+++ b/drivers/net/pptp.c
@@ -0,0 +1,726 @@
+/*
+ *  Point-to-Point Tunneling Protocol for Linux
+ *
+ *      Authors: Dmitry Kozlov <xeb@mail.ru>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/string.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/net.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <linux/init.h>
+#include <linux/ppp_channel.h>
+#include <linux/ppp_defs.h>
+#include <linux/if_pppox.h>
+#include <linux/if_ppp.h>
+#include <linux/notifier.h>
+#include <linux/file.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/version.h>
+#include <linux/rcupdate.h>
+#include <linux/spinlock.h>
+
+#include <net/sock.h>
+#include <net/protocol.h>
+#include <net/ip.h>
+#include <net/icmp.h>
+#include <net/route.h>
+#include <net/gre.h>
+
+#include <linux/uaccess.h>
+
+#define PPTP_DRIVER_VERSION "0.8.5"
+
+#define MAX_CALLID 65535
+
+static DECLARE_BITMAP(callid_bitmap, MAX_CALLID + 1);
+static struct pppox_sock **callid_sock;
+
+static DEFINE_SPINLOCK(chan_lock);
+
+static struct proto pptp_sk_proto __read_mostly;
+static const struct ppp_channel_ops pptp_chan_ops;
+static const struct proto_ops pptp_ops;
+
+#define PPP_LCP_ECHOREQ 0x09
+#define PPP_LCP_ECHOREP 0x0A
+#define SC_RCV_BITS     (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP)
+
+#define MISSING_WINDOW 20
+#define WRAPPED(curseq, lastseq)\
+        ((((curseq) & 0xffffff00) == 0) &&\
+        (((lastseq) & 0xffffff00) == 0xffffff00))
+
+#define PPTP_GRE_PROTO  0x880B
+#define PPTP_GRE_VER    0x1
+
+#define PPTP_GRE_FLAG_C 0x80
+#define PPTP_GRE_FLAG_R 0x40
+#define PPTP_GRE_FLAG_K 0x20
+#define PPTP_GRE_FLAG_S 0x10
+#define PPTP_GRE_FLAG_A 0x80
+
+#define PPTP_GRE_IS_C(f) ((f)&PPTP_GRE_FLAG_C)
+#define PPTP_GRE_IS_R(f) ((f)&PPTP_GRE_FLAG_R)
+#define PPTP_GRE_IS_K(f) ((f)&PPTP_GRE_FLAG_K)
+#define PPTP_GRE_IS_S(f) ((f)&PPTP_GRE_FLAG_S)
+#define PPTP_GRE_IS_A(f) ((f)&PPTP_GRE_FLAG_A)
+
+#define PPTP_HEADER_OVERHEAD (2+sizeof(struct pptp_gre_header))
+struct pptp_gre_header {
+        u8  flags;
+        u8  ver;
+        u16 protocol;
+        u16 payload_len;
+        u16 call_id;
+        u32 seq;
+        u32 ack;
+} __packed;
+
+static struct pppox_sock *lookup_chan(u16 call_id, __be32 s_addr)
+{
+        struct pppox_sock *sock;
+        struct pptp_opt *opt;
+
+        rcu_read_lock();
+        sock = rcu_dereference(callid_sock[call_id]);
+        if (sock) {
+                opt = &sock->proto.pptp;
+                if (opt->dst_addr.sin_addr.s_addr != s_addr)
+                        sock = NULL;
+                else
+                        sock_hold(sk_pppox(sock));
+        }
+        rcu_read_unlock();
+
+        return sock;
+}
+
+static int lookup_chan_dst(u16 call_id, __be32 d_addr)
+{
+        struct pppox_sock *sock;
+        struct pptp_opt *opt;
+        int i;
+
+        rcu_read_lock();
+        for (i = find_next_bit(callid_bitmap, MAX_CALLID, 1); i < MAX_CALLID;
+             i = find_next_bit(callid_bitmap, MAX_CALLID, i + 1)) {
+                sock = rcu_dereference(callid_sock[i]);
+                if (!sock)
+                        continue;
+                opt = &sock->proto.pptp;
+                if (opt->dst_addr.call_id == call_id &&
+                          opt->dst_addr.sin_addr.s_addr == d_addr)
+                        break;
+        }
+        rcu_read_unlock();
+
+        return i < MAX_CALLID;
+}
+
+static int add_chan(struct pppox_sock *sock)
+{
+        static int call_id;
+
+        spin_lock(&chan_lock);
+        if (!sock->proto.pptp.src_addr.call_id) {
+                call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, call_id + 1);
+                if (call_id == MAX_CALLID) {
+                        call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, 1);
+                        if (call_id == MAX_CALLID)
+                                goto out_err;
+                }
+                sock->proto.pptp.src_addr.call_id = call_id;
+        } else if (test_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap))
+                goto out_err;
+
+        set_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
+        rcu_assign_pointer(callid_sock[sock->proto.pptp.src_addr.call_id], sock);
+        spin_unlock(&chan_lock);
+
+        return 0;
+
+out_err:
+        spin_unlock(&chan_lock);
+        return -1;
+}
+
+static void del_chan(struct pppox_sock *sock)
+{
+        spin_lock(&chan_lock);
+        clear_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
+        rcu_assign_pointer(callid_sock[sock->proto.pptp.src_addr.call_id], NULL);
+        spin_unlock(&chan_lock);
+        synchronize_rcu();
+}
+
+static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+{
+        struct sock *sk = (struct sock *) chan->private;
+        struct pppox_sock *po = pppox_sk(sk);
+        struct pptp_opt *opt = &po->proto.pptp;
+        struct pptp_gre_header *hdr;
+        unsigned int header_len = sizeof(*hdr);
+        int err = 0;
+        int islcp;
+        int len;
+        unsigned char *data;
+        __u32 seq_recv;
+
+
+        struct rtable *rt;
+        struct net_device *tdev;
+        struct iphdr  *iph;
+        int    max_headroom;
+
+        if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+                goto tx_error;
+
+        {
+                struct flowi fl = { .oif = 0,
+                        .nl_u = {
+                                .ip4_u = {
+                                        .daddr = opt->dst_addr.sin_addr.s_addr,
+                                        .saddr = opt->src_addr.sin_addr.s_addr,
+                                        .tos = RT_TOS(0) } },
+                        .proto = IPPROTO_GRE };
+                err = ip_route_output_key(&init_net, &rt, &fl);
+                if (err)
+                        goto tx_error;
+        }
+        tdev = rt->dst.dev;
+
+        max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(*iph) + sizeof(*hdr) + 2;
+
+        if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
+                struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (!new_skb) {
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
+                if (skb->sk)
+                        skb_set_owner_w(new_skb, skb->sk);
+                kfree_skb(skb);
+                skb = new_skb;
+        }
+
+        data = skb->data;
+        islcp = ((data[0] << 8) + data[1]) == PPP_LCP && 1 <= data[2] && data[2] <= 7;
+
+        /* compress protocol field */
+        if ((opt->ppp_flags & SC_COMP_PROT) && data[0] == 0 && !islcp)
+                skb_pull(skb, 1);
+
+        /* Put in the address/control bytes if necessary */
+        if ((opt->ppp_flags & SC_COMP_AC) == 0 || islcp) {
+                data = skb_push(skb, 2);
+                data[0] = PPP_ALLSTATIONS;
+                data[1] = PPP_UI;
+        }
+
+        len = skb->len;
+
+        seq_recv = opt->seq_recv;
+
+        if (opt->ack_sent == seq_recv)
+                header_len -= sizeof(hdr->ack);
+
+        /* Push down and install GRE header */
+        skb_push(skb, header_len);
+        hdr = (struct pptp_gre_header *)(skb->data);
+
+        hdr->flags       = PPTP_GRE_FLAG_K;
+        hdr->ver         = PPTP_GRE_VER;
+        hdr->protocol    = htons(PPTP_GRE_PROTO);
+        hdr->call_id     = htons(opt->dst_addr.call_id);
+
+        hdr->flags      |= PPTP_GRE_FLAG_S;
+        hdr->seq         = htonl(++opt->seq_sent);
+        if (opt->ack_sent != seq_recv)  {
+                /* send ack with this message */
+                hdr->ver |= PPTP_GRE_FLAG_A;
+                hdr->ack  = htonl(seq_recv);
+                opt->ack_sent = seq_recv;
+        }
+        hdr->payload_len = htons(len);
+
+        /*      Push down and install the IP header. */
+
+        skb_reset_transport_header(skb);
+        skb_push(skb, sizeof(*iph));
+        skb_reset_network_header(skb);
+        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED);
+
+        iph =   ip_hdr(skb);
+        iph->version =  4;
+        iph->ihl =      sizeof(struct iphdr) >> 2;
+        if (ip_dont_fragment(sk, &rt->dst))
+                iph->frag_off   =       htons(IP_DF);
+        else
+                iph->frag_off   =       0;
+        iph->protocol = IPPROTO_GRE;
+        iph->tos      = 0;
+        iph->daddr    = rt->rt_dst;
+        iph->saddr    = rt->rt_src;
+        iph->ttl      = dst_metric(&rt->dst, RTAX_HOPLIMIT);
+        iph->tot_len  = htons(skb->len);
+
+        skb_dst_drop(skb);
+        skb_dst_set(skb, &rt->dst);
+
+        nf_reset(skb);
+
+        skb->ip_summed = CHECKSUM_NONE;
+        ip_select_ident(iph, &rt->dst, NULL);
+        ip_send_check(iph);
+
+        ip_local_out(skb);
+
+tx_error:
+        return 1;
+}
+
+static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
+{
+        struct pppox_sock *po = pppox_sk(sk);
+        struct pptp_opt *opt = &po->proto.pptp;
+        int headersize, payload_len, seq;
+        __u8 *payload;
+        struct pptp_gre_header *header;
+
+        if (!(sk->sk_state & PPPOX_CONNECTED)) {
+                if (sock_queue_rcv_skb(sk, skb))
+                        goto drop;
+                return NET_RX_SUCCESS;
+        }
+
+        header = (struct pptp_gre_header *)(skb->data);
+
+        /* test if acknowledgement present */
+        if (PPTP_GRE_IS_A(header->ver)) {
+                __u32 ack = (PPTP_GRE_IS_S(header->flags)) ?
+                                header->ack : header->seq; /* ack in different place if S = 0 */
+
+                ack = ntohl(ack);
+
+                if (ack > opt->ack_recv)
+                        opt->ack_recv = ack;
+                /* also handle sequence number wrap-around  */
+                if (WRAPPED(ack, opt->ack_recv))
+                        opt->ack_recv = ack;
+        }
+
+        /* test if payload present */
+        if (!PPTP_GRE_IS_S(header->flags))
+                goto drop;
+
+        headersize  = sizeof(*header);
+        payload_len = ntohs(header->payload_len);
+        seq         = ntohl(header->seq);
+
+        /* no ack present? */
+        if (!PPTP_GRE_IS_A(header->ver))
+                headersize -= sizeof(header->ack);
+        /* check for incomplete packet (length smaller than expected) */
+        if (skb->len - headersize < payload_len)
+                goto drop;
+
+        payload = skb->data + headersize;
+        /* check for expected sequence number */
+        if (seq < opt->seq_recv + 1 || WRAPPED(opt->seq_recv, seq)) {
+                if ((payload[0] == PPP_ALLSTATIONS) && (payload[1] == PPP_UI) &&
+                                (PPP_PROTOCOL(payload) == PPP_LCP) &&
+                                ((payload[4] == PPP_LCP_ECHOREQ) || (payload[4] == PPP_LCP_ECHOREP)))
+                        goto allow_packet;
+        } else {
+                opt->seq_recv = seq;
+allow_packet:
+                skb_pull(skb, headersize);
+
+                if (payload[0] == PPP_ALLSTATIONS && payload[1] == PPP_UI) {
+                        /* chop off address/control */
+                        if (skb->len < 3)
+                                goto drop;
+                        skb_pull(skb, 2);
+                }
+
+                if ((*skb->data) & 1) {
+                        /* protocol is compressed */
+                        skb_push(skb, 1)[0] = 0;
+                }
+
+                skb->ip_summed = CHECKSUM_NONE;
+                skb_set_network_header(skb, skb->head-skb->data);
+                ppp_input(&po->chan, skb);
+
+                return NET_RX_SUCCESS;
+        }
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static int pptp_rcv(struct sk_buff *skb)
+{
+        struct pppox_sock *po;
+        struct pptp_gre_header *header;
+        struct iphdr *iph;
+
+        if (skb->pkt_type != PACKET_HOST)
+                goto drop;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        iph = ip_hdr(skb);
+
+        header = (struct pptp_gre_header *)skb->data;
+
+        if (ntohs(header->protocol) != PPTP_GRE_PROTO || /* PPTP-GRE protocol for PPTP */
+                PPTP_GRE_IS_C(header->flags) ||                /* flag C should be clear */
+                PPTP_GRE_IS_R(header->flags) ||                /* flag R should be clear */
+                !PPTP_GRE_IS_K(header->flags) ||               /* flag K should be set */
+                (header->flags&0xF) != 0)                      /* routing and recursion ctrl = 0 */
+                /* if invalid, discard this packet */
+                goto drop;
+
+        po = lookup_chan(htons(header->call_id), iph->saddr);
+        if (po) {
+                skb_dst_drop(skb);
+                nf_reset(skb);
+                return sk_receive_skb(sk_pppox(po), skb, 0);
+        }
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
+        int sockaddr_len)
+{
+        struct sock *sk = sock->sk;
+        struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
+        struct pppox_sock *po = pppox_sk(sk);
+        struct pptp_opt *opt = &po->proto.pptp;
+        int error = 0;
+
+        lock_sock(sk);
+
+        opt->src_addr = sp->sa_addr.pptp;
+        if (add_chan(po)) {
+                release_sock(sk);
+                error = -EBUSY;
+        }
+
+        release_sock(sk);
+        return error;
+}
+
+static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+        int sockaddr_len, int flags)
+{
+        struct sock *sk = sock->sk;
+        struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
+        struct pppox_sock *po = pppox_sk(sk);
+        struct pptp_opt *opt = &po->proto.pptp;
+        struct rtable *rt;
+        int error = 0;
+
+        if (sp->sa_protocol != PX_PROTO_PPTP)
+                return -EINVAL;
+
+        if (lookup_chan_dst(sp->sa_addr.pptp.call_id, sp->sa_addr.pptp.sin_addr.s_addr))
+                return -EALREADY;
+
+        lock_sock(sk);
+        /* Check for already bound sockets */
+        if (sk->sk_state & PPPOX_CONNECTED) {
+                error = -EBUSY;
+                goto end;
+        }
+
+        /* Check for already disconnected sockets, on attempts to disconnect */
+        if (sk->sk_state & PPPOX_DEAD) {
+                error = -EALREADY;
+                goto end;
+        }
+
+        if (!opt->src_addr.sin_addr.s_addr || !sp->sa_addr.pptp.sin_addr.s_addr) {
+                error = -EINVAL;
+                goto end;
+        }
+
+        po->chan.private = sk;
+        po->chan.ops = &pptp_chan_ops;
+
+        {
+                struct flowi fl = {
+                        .nl_u = {
+                                .ip4_u = {
+                                        .daddr = opt->dst_addr.sin_addr.s_addr,
+                                        .saddr = opt->src_addr.sin_addr.s_addr,
+                                        .tos = RT_CONN_FLAGS(sk) } },
+                        .proto = IPPROTO_GRE };
+                security_sk_classify_flow(sk, &fl);
+                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                        error = -EHOSTUNREACH;
+                        goto end;
+                }
+                sk_setup_caps(sk, &rt->dst);
+        }
+        po->chan.mtu = dst_mtu(&rt->dst);
+        if (!po->chan.mtu)
+                po->chan.mtu = PPP_MTU;
+        ip_rt_put(rt);
+        po->chan.mtu -= PPTP_HEADER_OVERHEAD;
+
+        po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
+        error = ppp_register_channel(&po->chan);
+        if (error) {
+                pr_err("PPTP: failed to register PPP channel (%d)\n", error);
+                goto end;
+        }
+
+        opt->dst_addr = sp->sa_addr.pptp;
+        sk->sk_state = PPPOX_CONNECTED;
+
+ end:
+        release_sock(sk);
+        return error;
+}
+
+static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
+        int *usockaddr_len, int peer)
+{
+        int len = sizeof(struct sockaddr_pppox);
+        struct sockaddr_pppox sp;
+
+        sp.sa_family      = AF_PPPOX;
+        sp.sa_protocol  = PX_PROTO_PPTP;
+        sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
+
+        memcpy(uaddr, &sp, len);
+
+        *usockaddr_len = len;
+
+        return 0;
+}
+
+static int pptp_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        struct pppox_sock *po;
+        struct pptp_opt *opt;
+        int error = 0;
+
+        if (!sk)
+                return 0;
+
+        lock_sock(sk);
+
+        if (sock_flag(sk, SOCK_DEAD)) {
+                release_sock(sk);
+                return -EBADF;
+        }
+
+        po = pppox_sk(sk);
+        opt = &po->proto.pptp;
+        del_chan(po);
+
+        pppox_unbind_sock(sk);
+        sk->sk_state = PPPOX_DEAD;
+
+        sock_orphan(sk);
+        sock->sk = NULL;
+
+        release_sock(sk);
+        sock_put(sk);
+
+        return error;
+}
+
+static void pptp_sock_destruct(struct sock *sk)
+{
+        if (!(sk->sk_state & PPPOX_DEAD)) {
+                del_chan(pppox_sk(sk));
+                pppox_unbind_sock(sk);
+        }
+        skb_queue_purge(&sk->sk_receive_queue);
+}
+
+static int pptp_create(struct net *net, struct socket *sock)
+{
+        int error = -ENOMEM;
+        struct sock *sk;
+        struct pppox_sock *po;
+        struct pptp_opt *opt;
+
+        sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pptp_sk_proto);
+        if (!sk)
+                goto out;
+
+        sock_init_data(sock, sk);
+
+        sock->state = SS_UNCONNECTED;
+        sock->ops   = &pptp_ops;
+
+        sk->sk_backlog_rcv = pptp_rcv_core;
+        sk->sk_state       = PPPOX_NONE;
+        sk->sk_type        = SOCK_STREAM;
+        sk->sk_family      = PF_PPPOX;
+        sk->sk_protocol    = PX_PROTO_PPTP;
+        sk->sk_destruct    = pptp_sock_destruct;
+
+        po = pppox_sk(sk);
+        opt = &po->proto.pptp;
+
+        opt->seq_sent = 0; opt->seq_recv = 0;
+        opt->ack_recv = 0; opt->ack_sent = 0;
+
+        error = 0;
+out:
+        return error;
+}
+
+static int pptp_ppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
+        unsigned long arg)
+{
+        struct sock *sk = (struct sock *) chan->private;
+        struct pppox_sock *po = pppox_sk(sk);
+        struct pptp_opt *opt = &po->proto.pptp;
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int err, val;
+
+        err = -EFAULT;
+        switch (cmd) {
+        case PPPIOCGFLAGS:
+                val = opt->ppp_flags;
+                if (put_user(val, p))
+                        break;
+                err = 0;
+                break;
+        case PPPIOCSFLAGS:
+                if (get_user(val, p))
+                        break;
+                opt->ppp_flags = val & ~SC_RCV_BITS;
+                err = 0;
+                break;
+        default:
+                err = -ENOTTY;
+        }
+
+        return err;
+}
+
+static const struct ppp_channel_ops pptp_chan_ops = {
+        .start_xmit = pptp_xmit,
+        .ioctl      = pptp_ppp_ioctl,
+};
+
+static struct proto pptp_sk_proto __read_mostly = {
+        .name     = "PPTP",
+        .owner    = THIS_MODULE,
+        .obj_size = sizeof(struct pppox_sock),
+};
+
+static const struct proto_ops pptp_ops = {
+        .family     = AF_PPPOX,
+        .owner      = THIS_MODULE,
+        .release    = pptp_release,
+        .bind       = pptp_bind,
+        .connect    = pptp_connect,
+        .socketpair = sock_no_socketpair,
+        .accept     = sock_no_accept,
+        .getname    = pptp_getname,
+        .poll       = sock_no_poll,
+        .listen     = sock_no_listen,
+        .shutdown   = sock_no_shutdown,
+        .setsockopt = sock_no_setsockopt,
+        .getsockopt = sock_no_getsockopt,
+        .sendmsg    = sock_no_sendmsg,
+        .recvmsg    = sock_no_recvmsg,
+        .mmap       = sock_no_mmap,
+        .ioctl      = pppox_ioctl,
+};
+
+static const struct pppox_proto pppox_pptp_proto = {
+        .create = pptp_create,
+        .owner  = THIS_MODULE,
+};
+
+static const struct gre_protocol gre_pptp_protocol = {
+        .handler = pptp_rcv,
+};
+
+static int __init pptp_init_module(void)
+{
+        int err = 0;
+        pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
+
+        callid_sock = __vmalloc((MAX_CALLID + 1) * sizeof(void *),
+                GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+        if (!callid_sock) {
+                pr_err("PPTP: cann't allocate memory\n");
+                return -ENOMEM;
+        }
+
+        err = gre_add_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
+        if (err) {
+                pr_err("PPTP: can't add gre protocol\n");
+                goto out_mem_free;
+        }
+
+        err = proto_register(&pptp_sk_proto, 0);
+        if (err) {
+                pr_err("PPTP: can't register sk_proto\n");
+                goto out_gre_del_protocol;
+        }
+
+        err = register_pppox_proto(PX_PROTO_PPTP, &pppox_pptp_proto);
+        if (err) {
+                pr_err("PPTP: can't register pppox_proto\n");
+                goto out_unregister_sk_proto;
+        }
+
+        return 0;
+
+out_unregister_sk_proto:
+        proto_unregister(&pptp_sk_proto);
+out_gre_del_protocol:
+        gre_del_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
+out_mem_free:
+        vfree(callid_sock);
+
+        return err;
+}
+
+static void __exit pptp_exit_module(void)
+{
+        unregister_pppox_proto(PX_PROTO_PPTP);
+        proto_unregister(&pptp_sk_proto);
+        gre_del_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
+        vfree(callid_sock);
+}
+
+module_init(pptp_init_module);
+module_exit(pptp_exit_module);
+
+MODULE_DESCRIPTION("Point-to-Point Tunneling Protocol");
+MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ps3_gelic_net.c b/drivers/net/ps3_gelic_net.c
index 87d6b8f36304..5526ab4895e6 100644
--- a/drivers/net/ps3_gelic_net.c
+++ b/drivers/net/ps3_gelic_net.c
@@ -956,9 +956,9 @@ static void gelic_net_pass_skb_up(struct gelic_descr *descr,
                     (!(data_error & GELIC_DESCR_DATA_ERROR_CHK_MASK)))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         /* update netdevice statistics */
         netdev->stats.rx_packets++;
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index 43b8d7797f0a..4a624a29393f 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -85,12 +85,12 @@ static const int bitrate_list[] = {
  */
 static inline int wpa2_capable(void)
 {
-        return (0 <= ps3_compare_firmware_version(2, 0, 0));
+        return 0 <= ps3_compare_firmware_version(2, 0, 0);
 }
 
 static inline int precise_ie(void)
 {
-        return (0 <= ps3_compare_firmware_version(2, 2, 0));
+        return 0 <= ps3_compare_firmware_version(2, 2, 0);
 }
 /*
  * post_eurus_cmd helpers
@@ -506,7 +506,7 @@ static size_t gelic_wl_synthesize_ie(u8 *buf,
         start[1] = (buf - start - 2);
 
         pr_debug("%s: ->\n", __func__);
-        return (buf - start);
+        return buf - start;
 }
 
 struct ie_item {
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 85eddda276bd..75c2ff99d66d 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -42,8 +42,6 @@
 #include <linux/types.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
-#include <linux/delay.h>
-#include <linux/dma-mapping.h>
 #include <asm/cacheflush.h>
 #include <linux/pxa168_eth.h>
 
@@ -850,7 +848,6 @@ static int rxq_process(struct net_device *dev, int budget)
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_receive_skb(skb);
                 }
-                dev->last_rx = jiffies;
         }
         /* Fill RX ring with skb's */
         rxq_refill(dev);
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 6168a130f33f..7496ed2c34ab 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -2029,7 +2029,7 @@ static void ql_process_mac_rx_intr(struct ql3_adapter *qdev,
                          dma_unmap_len(lrg_buf_cb2, maplen),
                          PCI_DMA_FROMDEVICE);
         prefetch(skb->data);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
         skb->protocol = eth_type_trans(skb, qdev->ndev);
 
         netif_receive_skb(skb);
@@ -2076,7 +2076,7 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
                          PCI_DMA_FROMDEVICE);
         prefetch(skb2->data);
 
-        skb2->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb2);
         if (qdev->device_id == QL3022_DEVICE_ID) {
                 /*
                  * Copy the ethhdr from first buffer to second. This
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index 970389331bbc..714ddf461d73 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -51,9 +51,11 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 7
-#define QLCNIC_LINUX_VERSIONID  "5.0.7"
+#define _QLCNIC_LINUX_SUBVERSION 10
+#define QLCNIC_LINUX_VERSIONID  "5.0.10"
 #define QLCNIC_DRV_IDC_VER  0x01
+#define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
+                 (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
 
 #define QLCNIC_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
@@ -148,6 +150,7 @@
 
 #define DEFAULT_RCV_DESCRIPTORS_1G      2048
 #define DEFAULT_RCV_DESCRIPTORS_10G     4096
+#define MAX_RDS_RINGS                   2
 
 #define get_next_index(index, length)   \
         (((index) + 1) & ((length) - 1))
@@ -172,7 +175,7 @@
         ((_desc)->port_ctxid = ((_port) & 0xf) | (((_port) << 4) & 0xf0))
 
 #define qlcnic_set_tx_flags_opcode(_desc, _flags, _opcode) \
-        ((_desc)->flags_opcode = \
+        ((_desc)->flags_opcode |= \
         cpu_to_le16(((_flags) & 0x7f) | (((_opcode) & 0x3f) << 7)))
 
 #define qlcnic_set_tx_frags_len(_desc, _frags, _len) \
@@ -221,7 +224,8 @@ struct rcv_desc {
 #define QLCNIC_LRO_DESC         0x12
 
 /* for status field in status_desc */
-#define STATUS_CKSUM_OK         (2)
+#define STATUS_CKSUM_LOOP       0
+#define STATUS_CKSUM_OK         2
 
 /* owner bits of status_desc */
 #define STATUS_OWNER_HOST       (0x1ULL << 56)
@@ -555,6 +559,8 @@ struct qlcnic_recv_context {
 #define QLCNIC_CDRP_CMD_GET_ESWITCH_STATUS      0x00000026
 #define QLCNIC_CDRP_CMD_SET_PORTMIRRORING       0x00000027
 #define QLCNIC_CDRP_CMD_CONFIGURE_ESWITCH       0x00000028
+#define QLCNIC_CDRP_CMD_GET_ESWITCH_PORT_CONFIG 0x00000029
+#define QLCNIC_CDRP_CMD_GET_ESWITCH_STATS       0x0000002a
 
 #define QLCNIC_RCODE_SUCCESS            0
 #define QLCNIC_RCODE_TIMEOUT            17
@@ -717,6 +723,8 @@ struct qlcnic_cardrsp_tx_ctx {
 #define QLCNIC_MAC_NOOP 0
 #define QLCNIC_MAC_ADD  1
 #define QLCNIC_MAC_DEL  2
+#define QLCNIC_MAC_VLAN_ADD     3
+#define QLCNIC_MAC_VLAN_DEL     4
 
 struct qlcnic_mac_list_s {
         struct list_head list;
@@ -893,9 +901,14 @@ struct qlcnic_mac_req {
 #define QLCNIC_MSI_ENABLED              0x02
 #define QLCNIC_MSIX_ENABLED             0x04
 #define QLCNIC_LRO_ENABLED              0x08
+#define QLCNIC_LRO_DISABLED             0x00
 #define QLCNIC_BRIDGE_ENABLED           0X10
 #define QLCNIC_DIAG_ENABLED             0x20
 #define QLCNIC_ESWITCH_ENABLED          0x40
+#define QLCNIC_ADAPTER_INITIALIZED      0x80
+#define QLCNIC_TAGGING_ENABLED          0x100
+#define QLCNIC_MACSPOOF                 0x200
+#define QLCNIC_MAC_OVERRIDE_DISABLED    0x400
 #define QLCNIC_IS_MSI_FAMILY(adapter) \
         ((adapter)->flags & (QLCNIC_MSI_ENABLED | QLCNIC_MSIX_ENABLED))
 
@@ -916,6 +929,22 @@ struct qlcnic_mac_req {
 #define QLCNIC_INTERRUPT_TEST           1
 #define QLCNIC_LOOPBACK_TEST            2
 
+#define QLCNIC_FILTER_AGE       80
+#define QLCNIC_LB_MAX_FILTERS   64
+
+struct qlcnic_filter {
+        struct hlist_node fnode;
+        u8 faddr[ETH_ALEN];
+        u16 vlan_id;
+        unsigned long ftime;
+};
+
+struct qlcnic_filter_hash {
+        struct hlist_head *fhead;
+        u8 fnum;
+        u8 fmax;
+};
+
 struct qlcnic_adapter {
         struct qlcnic_hardware_context ahw;
 
@@ -924,6 +953,7 @@ struct qlcnic_adapter {
         struct list_head mac_list;
 
         spinlock_t tx_clean_lock;
+        spinlock_t mac_learn_lock;
 
         u16 num_txd;
         u16 num_rxd;
@@ -931,7 +961,6 @@ struct qlcnic_adapter {
 
         u8 max_rds_rings;
         u8 max_sds_rings;
-        u8 driver_mismatch;
         u8 msix_supported;
         u8 rx_csum;
         u8 portnum;
@@ -961,6 +990,7 @@ struct qlcnic_adapter {
         u16 max_tx_ques;
         u16 max_rx_ques;
         u16 max_mtu;
+        u16 pvid;
 
         u32 fw_hal_version;
         u32 capabilities;
@@ -969,7 +999,7 @@ struct qlcnic_adapter {
         u32 temp;
 
         u32 int_vec_bit;
-        u32 heartbit;
+        u32 heartbeat;
 
         u8 max_mac_filters;
         u8 dev_state;
@@ -983,6 +1013,7 @@ struct qlcnic_adapter {
 
         u64 dev_rst_time;
 
+        struct vlan_group *vlgrp;
         struct qlcnic_npar_info *npars;
         struct qlcnic_eswitch *eswitch;
         struct qlcnic_nic_template *nic_ops;
@@ -1003,6 +1034,8 @@ struct qlcnic_adapter {
 
         struct qlcnic_nic_intr_coalesce coal;
 
+        struct qlcnic_filter_hash fhash;
+
         unsigned long state;
         __le32 file_prd_off;    /*File fw product offset*/
         u32 fw_version;
@@ -1042,7 +1075,7 @@ struct qlcnic_pci_info {
 };
 
 struct qlcnic_npar_info {
-        u16     vlan_id;
+        u16     pvid;
         u16     min_bw;
         u16     max_bw;
         u8      phy_port;
@@ -1050,11 +1083,13 @@ struct qlcnic_npar_info {
         u8      active;
         u8      enable_pm;
         u8      dest_npar;
-        u8      host_vlan_tag;
-        u8      promisc_mode;
         u8      discard_tagged;
-        u8      mac_learning;
+        u8      mac_override;
+        u8      mac_anti_spoof;
+        u8      promisc_mode;
+        u8      offload_flags;
 };
+
 struct qlcnic_eswitch {
         u8      port;
         u8      active_vports;
@@ -1086,7 +1121,6 @@ struct qlcnic_eswitch {
 #define IS_VALID_BW(bw)         (bw >= MIN_BW && bw <= MAX_BW)
 #define IS_VALID_TX_QUEUES(que) (que > 0 && que <= MAX_TX_QUEUES)
 #define IS_VALID_RX_QUEUES(que) (que > 0 && que <= MAX_RX_QUEUES)
-#define IS_VALID_MODE(mode)     (mode == 0 || mode == 1)
 
 struct qlcnic_pci_func_cfg {
         u16     func_type;
@@ -1118,12 +1152,41 @@ struct qlcnic_pm_func_cfg {
 
 struct qlcnic_esw_func_cfg {
         u16     vlan_id;
+        u8      op_mode;
+        u8      op_type;
         u8      pci_func;
         u8      host_vlan_tag;
         u8      promisc_mode;
         u8      discard_tagged;
-        u8      mac_learning;
-        u8      reserved;
+        u8      mac_override;
+        u8      mac_anti_spoof;
+        u8      offload_flags;
+        u8      reserved[5];
+};
+
+#define QLCNIC_STATS_VERSION            1
+#define QLCNIC_STATS_PORT               1
+#define QLCNIC_STATS_ESWITCH            2
+#define QLCNIC_QUERY_RX_COUNTER         0
+#define QLCNIC_QUERY_TX_COUNTER         1
+struct __qlcnic_esw_statistics {
+        __le16 context_id;
+        __le16 version;
+        __le16 size;
+        __le16 unused;
+        __le64 unicast_frames;
+        __le64 multicast_frames;
+        __le64 broadcast_frames;
+        __le64 dropped_frames;
+        __le64 errors;
+        __le64 local_frames;
+        __le64 numbytes;
+        __le64 rsvd[3];
+};
+
+struct qlcnic_esw_statistics {
+        struct __qlcnic_esw_statistics rx;
+        struct __qlcnic_esw_statistics tx;
 };
 
 int qlcnic_fw_cmd_query_phy(struct qlcnic_adapter *adapter, u32 reg, u32 *val);
@@ -1171,6 +1234,8 @@ void qlcnic_pcie_sem_unlock(struct qlcnic_adapter *, int);
 int qlcnic_get_board_info(struct qlcnic_adapter *adapter);
 int qlcnic_wol_supported(struct qlcnic_adapter *adapter);
 int qlcnic_config_led(struct qlcnic_adapter *adapter, u32 state, u32 rate);
+void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter);
+void qlcnic_delete_lb_filters(struct qlcnic_adapter *adapter);
 
 /* Functions from qlcnic_init.c */
 int qlcnic_load_firmware(struct qlcnic_adapter *adapter);
@@ -1199,7 +1264,7 @@ void qlcnic_reset_rx_buffers_list(struct qlcnic_adapter *adapter);
 void qlcnic_release_rx_buffers(struct qlcnic_adapter *adapter);
 void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter);
 
-int qlcnic_init_firmware(struct qlcnic_adapter *adapter);
+int qlcnic_check_fw_status(struct qlcnic_adapter *adapter);
 void qlcnic_watchdog_task(struct work_struct *work);
 void qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
                 struct qlcnic_host_rds_ring *rds_ring);
@@ -1220,7 +1285,6 @@ int qlcnic_config_bridged_mode(struct qlcnic_adapter *adapter, u32 enable);
 int qlcnic_send_lro_cleanup(struct qlcnic_adapter *adapter);
 void qlcnic_update_cmd_producer(struct qlcnic_adapter *adapter,
                 struct qlcnic_host_tx_ring *tx_ring);
-int qlcnic_get_mac_addr(struct qlcnic_adapter *adapter, u8 *mac);
 void qlcnic_clear_ilb_mode(struct qlcnic_adapter *adapter);
 int qlcnic_set_ilb_mode(struct qlcnic_adapter *adapter);
 void qlcnic_fetch_mac(struct qlcnic_adapter *, u32, u32, u8, u8 *);
@@ -1249,9 +1313,16 @@ int qlcnic_get_eswitch_capabilities(struct qlcnic_adapter *, u8,
 int qlcnic_get_eswitch_status(struct qlcnic_adapter *, u8,
                                 struct qlcnic_eswitch *);
 int qlcnic_toggle_eswitch(struct qlcnic_adapter *, u8, u8);
-int qlcnic_config_switch_port(struct qlcnic_adapter *, u8, int, u8, u8,
-                        u8, u8, u16);
+int qlcnic_config_switch_port(struct qlcnic_adapter *,
+                                struct qlcnic_esw_func_cfg *);
+int qlcnic_get_eswitch_port_config(struct qlcnic_adapter *,
+                                struct qlcnic_esw_func_cfg *);
 int qlcnic_config_port_mirroring(struct qlcnic_adapter *, u8, u8, u8);
+int qlcnic_get_port_stats(struct qlcnic_adapter *, const u8, const u8,
+                                        struct __qlcnic_esw_statistics *);
+int qlcnic_get_eswitch_stats(struct qlcnic_adapter *, const u8, u8,
+                                        struct __qlcnic_esw_statistics *);
+int qlcnic_clear_esw_stats(struct qlcnic_adapter *adapter, u8, u8, u8);
 extern int qlcnic_config_tso;
 
 /*
@@ -1280,6 +1351,8 @@ static const struct qlcnic_brdinfo qlcnic_boards[] = {
                 "3200 Series Quad Port 1Gb Intelligent Ethernet Adapter"},
         {0x1077, 0x8020, 0x1077, 0x20f,
                 "3200 Series Single Port 10Gb Intelligent Ethernet Adapter"},
+        {0x1077, 0x8020, 0x103c, 0x3733,
+                "NC523SFP 10Gb 2-port Flex-10 Server Adapter"},
         {0x1077, 0x8020, 0x0, 0x0, "cLOM8214 1/10GbE Controller"},
 };
 
@@ -1298,7 +1371,6 @@ static inline u32 qlcnic_tx_avail(struct qlcnic_host_tx_ring *tx_ring)
 extern const struct ethtool_ops qlcnic_ethtool_ops;
 
 struct qlcnic_nic_template {
-        int (*get_mac_addr) (struct qlcnic_adapter *, u8*);
         int (*config_bridged_mode) (struct qlcnic_adapter *, u32);
         int (*config_led) (struct qlcnic_adapter *, u32, u32);
         int (*start_firmware) (struct qlcnic_adapter *);
diff --git a/drivers/net/qlcnic/qlcnic_ctx.c b/drivers/net/qlcnic/qlcnic_ctx.c
index cc5d861d9a12..95a821e0b66f 100644
--- a/drivers/net/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/qlcnic/qlcnic_ctx.c
@@ -813,9 +813,8 @@ int qlcnic_get_eswitch_capabilities(struct qlcnic_adapter *adapter, u8 port,
                 arg2 = QLCRD32(adapter, QLCNIC_ARG2_CRB_OFFSET);
 
                 eswitch->port = arg1 & 0xf;
-                eswitch->active_vports = LSB(arg2);
-                eswitch->max_ucast_filters = MSB(arg2);
-                eswitch->max_active_vlans = LSB(MSW(arg2));
+                eswitch->max_ucast_filters = LSW(arg2);
+                eswitch->max_active_vlans = MSW(arg2) & 0xfff;
                 if (arg1 & BIT_6)
                         eswitch->flags |= QLCNIC_SWITCH_VLAN_FILTERING;
                 if (arg1 & BIT_7)
@@ -943,43 +942,271 @@ int qlcnic_config_port_mirroring(struct qlcnic_adapter *adapter, u8 id,
         return err;
 }
 
-/* Configure eSwitch port */
-int qlcnic_config_switch_port(struct qlcnic_adapter *adapter, u8 id,
-                int vlan_tagging, u8 discard_tagged, u8 promsc_mode,
-                u8 mac_learn, u8 pci_func, u16 vlan_id)
+int qlcnic_get_port_stats(struct qlcnic_adapter *adapter, const u8 func,
+                const u8 rx_tx, struct __qlcnic_esw_statistics *esw_stats) {
+
+        size_t stats_size = sizeof(struct __qlcnic_esw_statistics);
+        struct __qlcnic_esw_statistics *stats;
+        dma_addr_t stats_dma_t;
+        void *stats_addr;
+        u32 arg1;
+        int err;
+
+        if (esw_stats == NULL)
+                return -ENOMEM;
+
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC &&
+            func != adapter->ahw.pci_func) {
+                dev_err(&adapter->pdev->dev,
+                        "Not privilege to query stats for func=%d", func);
+                return -EIO;
+        }
+
+        stats_addr = pci_alloc_consistent(adapter->pdev, stats_size,
+                        &stats_dma_t);
+        if (!stats_addr) {
+                dev_err(&adapter->pdev->dev, "Unable to allocate memory\n");
+                return -ENOMEM;
+        }
+        memset(stats_addr, 0, stats_size);
+
+        arg1 = func | QLCNIC_STATS_VERSION << 8 | QLCNIC_STATS_PORT << 12;
+        arg1 |= rx_tx << 15 | stats_size << 16;
+
+        err = qlcnic_issue_cmd(adapter,
+                        adapter->ahw.pci_func,
+                        adapter->fw_hal_version,
+                        arg1,
+                        MSD(stats_dma_t),
+                        LSD(stats_dma_t),
+                        QLCNIC_CDRP_CMD_GET_ESWITCH_STATS);
+
+        if (!err) {
+                stats = (struct __qlcnic_esw_statistics *)stats_addr;
+                esw_stats->context_id = le16_to_cpu(stats->context_id);
+                esw_stats->version = le16_to_cpu(stats->version);
+                esw_stats->size = le16_to_cpu(stats->size);
+                esw_stats->multicast_frames =
+                                le64_to_cpu(stats->multicast_frames);
+                esw_stats->broadcast_frames =
+                                le64_to_cpu(stats->broadcast_frames);
+                esw_stats->unicast_frames = le64_to_cpu(stats->unicast_frames);
+                esw_stats->dropped_frames = le64_to_cpu(stats->dropped_frames);
+                esw_stats->local_frames = le64_to_cpu(stats->local_frames);
+                esw_stats->errors = le64_to_cpu(stats->errors);
+                esw_stats->numbytes = le64_to_cpu(stats->numbytes);
+        }
+
+        pci_free_consistent(adapter->pdev, stats_size, stats_addr,
+                stats_dma_t);
+        return err;
+}
+
+int qlcnic_get_eswitch_stats(struct qlcnic_adapter *adapter, const u8 eswitch,
+                const u8 rx_tx, struct __qlcnic_esw_statistics *esw_stats) {
+
+        struct __qlcnic_esw_statistics port_stats;
+        u8 i;
+        int ret = -EIO;
+
+        if (esw_stats == NULL)
+                return -ENOMEM;
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
+                return -EIO;
+        if (adapter->npars == NULL)
+                return -EIO;
+
+        memset(esw_stats, 0, sizeof(struct __qlcnic_esw_statistics));
+        esw_stats->context_id = eswitch;
+
+        for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
+                if (adapter->npars[i].phy_port != eswitch)
+                        continue;
+
+                memset(&port_stats, 0, sizeof(struct __qlcnic_esw_statistics));
+                if (qlcnic_get_port_stats(adapter, i, rx_tx, &port_stats))
+                        continue;
+
+                esw_stats->size = port_stats.size;
+                esw_stats->version = port_stats.version;
+                esw_stats->unicast_frames += port_stats.unicast_frames;
+                esw_stats->multicast_frames += port_stats.multicast_frames;
+                esw_stats->broadcast_frames += port_stats.broadcast_frames;
+                esw_stats->dropped_frames += port_stats.dropped_frames;
+                esw_stats->errors += port_stats.errors;
+                esw_stats->local_frames += port_stats.local_frames;
+                esw_stats->numbytes += port_stats.numbytes;
+
+                ret = 0;
+        }
+        return ret;
+}
+
+int qlcnic_clear_esw_stats(struct qlcnic_adapter *adapter, const u8 func_esw,
+                const u8 port, const u8 rx_tx)
 {
-        int err = -EIO;
+
         u32 arg1;
-        struct qlcnic_eswitch *eswitch;
 
         if (adapter->op_mode != QLCNIC_MGMT_FUNC)
-                return err;
+                return -EIO;
 
-        eswitch = &adapter->eswitch[id];
-        if (!(eswitch->flags & QLCNIC_SWITCH_ENABLE))
+        if (func_esw == QLCNIC_STATS_PORT) {
+                if (port >= QLCNIC_MAX_PCI_FUNC)
+                        goto err_ret;
+        } else if (func_esw == QLCNIC_STATS_ESWITCH) {
+                if (port >= QLCNIC_NIU_MAX_XG_PORTS)
+                        goto err_ret;
+        } else {
+                goto err_ret;
+        }
+
+        if (rx_tx > QLCNIC_QUERY_TX_COUNTER)
+                goto err_ret;
+
+        arg1 = port | QLCNIC_STATS_VERSION << 8 | func_esw << 12;
+        arg1 |= BIT_14 | rx_tx << 15;
+
+        return qlcnic_issue_cmd(adapter,
+                        adapter->ahw.pci_func,
+                        adapter->fw_hal_version,
+                        arg1,
+                        0,
+                        0,
+                        QLCNIC_CDRP_CMD_GET_ESWITCH_STATS);
+
+err_ret:
+        dev_err(&adapter->pdev->dev, "Invalid argument func_esw=%d port=%d"
+                "rx_ctx=%d\n", func_esw, port, rx_tx);
+        return -EIO;
+}
+
+static int
+__qlcnic_get_eswitch_port_config(struct qlcnic_adapter *adapter,
+                                        u32 *arg1, u32 *arg2)
+{
+        int err = -EIO;
+        u8 pci_func;
+        pci_func = (*arg1 >> 8);
+        err = qlcnic_issue_cmd(adapter,
+                        adapter->ahw.pci_func,
+                        adapter->fw_hal_version,
+                        *arg1,
+                        0,
+                        0,
+                        QLCNIC_CDRP_CMD_GET_ESWITCH_PORT_CONFIG);
+
+        if (err == QLCNIC_RCODE_SUCCESS) {
+                *arg1 = QLCRD32(adapter, QLCNIC_ARG1_CRB_OFFSET);
+                *arg2 = QLCRD32(adapter, QLCNIC_ARG2_CRB_OFFSET);
+                dev_info(&adapter->pdev->dev,
+                        "eSwitch port config for pci func %d\n", pci_func);
+        } else {
+                dev_err(&adapter->pdev->dev,
+                        "Failed to get eswitch port config for pci func %d\n",
+                                                                pci_func);
+        }
+        return err;
+}
+/* Configure eSwitch port
+op_mode = 0 for setting default port behavior
+op_mode = 1 for setting  vlan id
+op_mode = 2 for deleting vlan id
+op_type = 0 for vlan_id
+op_type = 1 for port vlan_id
+*/
+int qlcnic_config_switch_port(struct qlcnic_adapter *adapter,
+                struct qlcnic_esw_func_cfg *esw_cfg)
+{
+        int err = -EIO;
+        u32 arg1, arg2 = 0;
+        u8 pci_func;
+
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
                 return err;
+        pci_func = esw_cfg->pci_func;
+        arg1 = (adapter->npars[pci_func].phy_port & BIT_0);
+        arg1 |= (pci_func << 8);
 
-        arg1 = eswitch->port | (discard_tagged ? BIT_4 : 0);
-        arg1 |= (promsc_mode ? BIT_6 : 0) | (mac_learn ? BIT_7 : 0);
-        arg1 |= pci_func << 8;
-        if (vlan_tagging)
-                arg1 |= BIT_5 | (vlan_id << 16);
+        if (__qlcnic_get_eswitch_port_config(adapter, &arg1, &arg2))
+                return err;
+        arg1 &= ~(0x0ff << 8);
+        arg1 |= (pci_func << 8);
+        arg1 &= ~(BIT_2 | BIT_3);
+        switch (esw_cfg->op_mode) {
+        case QLCNIC_PORT_DEFAULTS:
+                arg1 |= (BIT_4 | BIT_6 | BIT_7);
+                arg2 |= (BIT_0 | BIT_1);
+                if (adapter->capabilities & QLCNIC_FW_CAPABILITY_TSO)
+                        arg2 |= (BIT_2 | BIT_3);
+                if (!(esw_cfg->discard_tagged))
+                        arg1 &= ~BIT_4;
+                if (!(esw_cfg->promisc_mode))
+                        arg1 &= ~BIT_6;
+                if (!(esw_cfg->mac_override))
+                        arg1 &= ~BIT_7;
+                if (!(esw_cfg->mac_anti_spoof))
+                        arg2 &= ~BIT_0;
+                if (!(esw_cfg->offload_flags & BIT_0))
+                        arg2 &= ~(BIT_1 | BIT_2 | BIT_3);
+                if (!(esw_cfg->offload_flags & BIT_1))
+                        arg2 &= ~BIT_2;
+                if (!(esw_cfg->offload_flags & BIT_2))
+                        arg2 &= ~BIT_3;
+                break;
+        case QLCNIC_ADD_VLAN:
+                        arg1 |= (BIT_2 | BIT_5);
+                        arg1 |= (esw_cfg->vlan_id << 16);
+                        break;
+        case QLCNIC_DEL_VLAN:
+                        arg1 |= (BIT_3 | BIT_5);
+                        arg1 &= ~(0x0ffff << 16);
+                        break;
+        default:
+                return err;
+        }
 
         err = qlcnic_issue_cmd(adapter,
                         adapter->ahw.pci_func,
                         adapter->fw_hal_version,
                         arg1,
-                        0,
+                        arg2,
                         0,
                         QLCNIC_CDRP_CMD_CONFIGURE_ESWITCH);
 
         if (err != QLCNIC_RCODE_SUCCESS) {
                 dev_err(&adapter->pdev->dev,
-                        "Failed to configure eswitch port%d\n", eswitch->port);
+                        "Failed to configure eswitch pci func %d\n", pci_func);
         } else {
                 dev_info(&adapter->pdev->dev,
-                        "Configured eSwitch for port %d\n", eswitch->port);
+                        "Configured eSwitch for pci func %d\n", pci_func);
         }
 
         return err;
 }
+
+int
+qlcnic_get_eswitch_port_config(struct qlcnic_adapter *adapter,
+                        struct qlcnic_esw_func_cfg *esw_cfg)
+{
+        u32 arg1, arg2;
+        u8 phy_port;
+        if (adapter->op_mode == QLCNIC_MGMT_FUNC)
+                phy_port = adapter->npars[esw_cfg->pci_func].phy_port;
+        else
+                phy_port = adapter->physical_port;
+        arg1 = phy_port;
+        arg1 |= (esw_cfg->pci_func << 8);
+        if (__qlcnic_get_eswitch_port_config(adapter, &arg1, &arg2))
+                return -EIO;
+
+        esw_cfg->discard_tagged = !!(arg1 & BIT_4);
+        esw_cfg->host_vlan_tag = !!(arg1 & BIT_5);
+        esw_cfg->promisc_mode = !!(arg1 & BIT_6);
+        esw_cfg->mac_override = !!(arg1 & BIT_7);
+        esw_cfg->vlan_id = LSW(arg1 >> 16);
+        esw_cfg->mac_anti_spoof = (arg2 & 0x1);
+        esw_cfg->offload_flags = ((arg2 >> 1) & 0x7);
+
+        return 0;
+}
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index 9328d59e21e0..cb9463bd6b1e 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -99,7 +99,7 @@ static const u32 diag_registers[] = {
         CRB_XG_STATE_P3,
         CRB_FW_CAPABILITIES_1,
         ISR_INT_STATE_REG,
-        QLCNIC_CRB_DEV_REF_COUNT,
+        QLCNIC_CRB_DRV_ACTIVE,
         QLCNIC_CRB_DEV_STATE,
         QLCNIC_CRB_DRV_STATE,
         QLCNIC_CRB_DRV_SCRATCH,
@@ -115,9 +115,13 @@ static const u32 diag_registers[] = {
         -1
 };
 
+#define QLCNIC_MGMT_API_VERSION 2
+#define QLCNIC_DEV_INFO_SIZE    1
+#define QLCNIC_ETHTOOL_REGS_VER 2
 static int qlcnic_get_regs_len(struct net_device *dev)
 {
-        return sizeof(diag_registers) + QLCNIC_RING_REGS_LEN;
+        return sizeof(diag_registers) + QLCNIC_RING_REGS_LEN +
+                                QLCNIC_DEV_INFO_SIZE + 1;
 }
 
 static int qlcnic_get_eeprom_len(struct net_device *dev)
@@ -342,10 +346,13 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
         int ring, i = 0;
 
         memset(p, 0, qlcnic_get_regs_len(dev));
-        regs->version = (1 << 24) | (adapter->ahw.revision_id << 16) |
-            (adapter->pdev)->device;
+        regs->version = (QLCNIC_ETHTOOL_REGS_VER << 24) |
+                (adapter->ahw.revision_id << 16) | (adapter->pdev)->device;
 
-        for (i = 0; diag_registers[i] != -1; i++)
+        regs_buff[0] = (0xcafe0000 | (QLCNIC_DEV_INFO_SIZE & 0xffff));
+        regs_buff[1] = QLCNIC_MGMT_API_VERSION;
+
+        for (i = QLCNIC_DEV_INFO_SIZE + 1; diag_registers[i] != -1; i++)
                 regs_buff[i] = QLCRD32(adapter, diag_registers[i]);
 
         if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
@@ -747,6 +754,14 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
 {
         memset(data, 0, sizeof(u64) * QLCNIC_TEST_LEN);
 
+        data[0] = qlcnic_reg_test(dev);
+        if (data[0])
+                eth_test->flags |= ETH_TEST_FL_FAILED;
+
+        data[1] = (u64) qlcnic_test_link(dev);
+        if (data[1])
+                eth_test->flags |= ETH_TEST_FL_FAILED;
+
         if (eth_test->flags == ETH_TEST_FL_OFFLINE) {
                 data[2] = qlcnic_irq_test(dev);
                 if (data[2])
@@ -757,15 +772,6 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
         }
-
-        data[0] = qlcnic_reg_test(dev);
-        if (data[0])
-                eth_test->flags |= ETH_TEST_FL_FAILED;
-
-        /* link test */
-        data[1] = (u64) qlcnic_test_link(dev);
-        if (data[1])
-                eth_test->flags |= ETH_TEST_FL_FAILED;
 }
 
 static void
@@ -805,6 +811,20 @@ qlcnic_get_ethtool_stats(struct net_device *dev,
         }
 }
 
+static int qlcnic_set_tx_csum(struct net_device *dev, u32 data)
+{
+        struct qlcnic_adapter *adapter = netdev_priv(dev);
+
+        if ((adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return -EOPNOTSUPP;
+        if (data)
+                dev->features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
+        else
+                dev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
+
+        return 0;
+
+}
 static u32 qlcnic_get_tx_csum(struct net_device *dev)
 {
         return dev->features & NETIF_F_IP_CSUM;
@@ -819,7 +839,23 @@ static u32 qlcnic_get_rx_csum(struct net_device *dev)
 static int qlcnic_set_rx_csum(struct net_device *dev, u32 data)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
+
+        if ((adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return -EOPNOTSUPP;
+        if (!!data) {
+                adapter->rx_csum = !!data;
+                return 0;
+        }
+
+        if (adapter->flags & QLCNIC_LRO_ENABLED) {
+                if (qlcnic_config_hw_lro(adapter, QLCNIC_LRO_DISABLED))
+                        return -EIO;
+
+                dev->features &= ~NETIF_F_LRO;
+                qlcnic_send_lro_cleanup(adapter);
+        }
         adapter->rx_csum = !!data;
+        dev_info(&adapter->pdev->dev, "disabling LRO as rx_csum is off\n");
         return 0;
 }
 
@@ -1002,6 +1038,15 @@ static int qlcnic_set_flags(struct net_device *netdev, u32 data)
         if (!(adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO))
                 return -EINVAL;
 
+        if (!adapter->rx_csum) {
+                dev_info(&adapter->pdev->dev, "rx csum is off, "
+                        "cannot toggle lro\n");
+                return -EINVAL;
+        }
+
+        if ((data & ETH_FLAG_LRO) && (adapter->flags & QLCNIC_LRO_ENABLED))
+                return 0;
+
         if (data & ETH_FLAG_LRO) {
                 hw_lro = QLCNIC_LRO_ENABLED;
                 netdev->features |= NETIF_F_LRO;
@@ -1048,7 +1093,7 @@ const struct ethtool_ops qlcnic_ethtool_ops = {
         .get_pauseparam = qlcnic_get_pauseparam,
         .set_pauseparam = qlcnic_set_pauseparam,
         .get_tx_csum = qlcnic_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = qlcnic_set_tx_csum,
         .set_sg = ethtool_op_set_sg,
         .get_tso = qlcnic_get_tso,
         .set_tso = qlcnic_set_tso,
diff --git a/drivers/net/qlcnic/qlcnic_hdr.h b/drivers/net/qlcnic/qlcnic_hdr.h
index 15fc32070be3..716203e41dc7 100644
--- a/drivers/net/qlcnic/qlcnic_hdr.h
+++ b/drivers/net/qlcnic/qlcnic_hdr.h
@@ -698,7 +698,7 @@ enum {
 #define QLCNIC_PEG_ALIVE_COUNTER        (QLCNIC_CAM_RAM(0xb0))
 #define QLCNIC_PEG_HALT_STATUS1         (QLCNIC_CAM_RAM(0xa8))
 #define QLCNIC_PEG_HALT_STATUS2         (QLCNIC_CAM_RAM(0xac))
-#define QLCNIC_CRB_DEV_REF_COUNT        (QLCNIC_CAM_RAM(0x138))
+#define QLCNIC_CRB_DRV_ACTIVE   (QLCNIC_CAM_RAM(0x138))
 #define QLCNIC_CRB_DEV_STATE            (QLCNIC_CAM_RAM(0x140))
 
 #define QLCNIC_CRB_DRV_STATE            (QLCNIC_CAM_RAM(0x144))
@@ -718,8 +718,9 @@ enum {
 #define QLCNIC_DEV_FAILED               0x6
 #define QLCNIC_DEV_QUISCENT             0x7
 
-#define QLCNIC_DEV_NPAR_NOT_RDY 0
-#define QLCNIC_DEV_NPAR_RDY             1
+#define QLCNIC_DEV_NPAR_NON_OPER        0 /* NON Operational */
+#define QLCNIC_DEV_NPAR_OPER            1 /* NPAR Operational */
+#define QLCNIC_DEV_NPAR_OPER_TIMEO      30 /* Operational time out */
 
 #define QLC_DEV_CHECK_ACTIVE(VAL, FN)           ((VAL) &= (1 << (FN * 4)))
 #define QLC_DEV_SET_REF_CNT(VAL, FN)            ((VAL) |= (1 << (FN * 4)))
@@ -744,6 +745,15 @@ enum {
 #define FW_POLL_DELAY           (1 * HZ)
 #define FW_FAIL_THRESH          2
 
+#define QLCNIC_RESET_TIMEOUT_SECS       10
+#define QLCNIC_INIT_TIMEOUT_SECS        30
+#define QLCNIC_RCVPEG_CHECK_RETRY_COUNT 2000
+#define QLCNIC_RCVPEG_CHECK_DELAY       10
+#define QLCNIC_CMDPEG_CHECK_RETRY_COUNT 60
+#define QLCNIC_CMDPEG_CHECK_DELAY       500
+#define QLCNIC_HEARTBEAT_PERIOD_MSECS   200
+#define QLCNIC_HEARTBEAT_CHECK_RETRY_COUNT      45
+
 #define ISR_MSI_INT_TRIGGER(FUNC) (QLCNIC_PCIX_PS_REG(PCIX_MSI_F(FUNC)))
 #define ISR_LEGACY_INT_TRIGGERED(VAL)   (((VAL) & 0x300) == 0x200)
 
@@ -770,6 +780,7 @@ struct qlcnic_legacy_intr_set {
 #define QLCNIC_DRV_OP_MODE      0x1b2170
 #define QLCNIC_MSIX_BASE        0x132110
 #define QLCNIC_MAX_PCI_FUNC     8
+#define QLCNIC_MAX_VLAN_FILTERS 64
 
 /* PCI function operational mode */
 enum {
@@ -778,6 +789,12 @@ enum {
         QLCNIC_NON_PRIV_FUNC    = 2
 };
 
+enum {
+        QLCNIC_PORT_DEFAULTS    = 0,
+        QLCNIC_ADD_VLAN = 1,
+        QLCNIC_DEL_VLAN = 2
+};
+
 #define QLC_DEV_DRV_DEFAULT 0x11111111
 
 #define LSB(x)  ((uint8_t)(x))
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index e08c8b0556a4..c198df90ff3c 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -297,8 +297,8 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                         break;
                 if (++timeout >= QLCNIC_PCIE_SEM_TIMEOUT) {
                         dev_err(&adapter->pdev->dev,
-                                "Failed to acquire sem=%d lock;reg_id=%d\n",
-                                sem, id_reg);
+                                "Failed to acquire sem=%d lock; holdby=%d\n",
+                                sem, id_reg ? QLCRD32(adapter, id_reg) : -1);
                         return -EIO;
                 }
                 msleep(1);
@@ -375,7 +375,7 @@ qlcnic_send_cmd_descs(struct qlcnic_adapter *adapter,
 
 static int
 qlcnic_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
-                                unsigned op)
+                                u16 vlan_id, unsigned op)
 {
         struct qlcnic_nic_req req;
         struct qlcnic_mac_req *mac_req;
@@ -391,6 +391,8 @@ qlcnic_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
         mac_req->op = op;
         memcpy(mac_req->mac_addr, addr, 6);
 
+        req.words[1] = cpu_to_le64(vlan_id);
+
         return qlcnic_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
 }
 
@@ -415,7 +417,7 @@ static int qlcnic_nic_add_mac(struct qlcnic_adapter *adapter, u8 *addr)
         memcpy(cur->mac_addr, addr, ETH_ALEN);
 
         if (qlcnic_sre_macaddr_change(adapter,
-                                cur->mac_addr, QLCNIC_MAC_ADD)) {
+                                cur->mac_addr, 0, QLCNIC_MAC_ADD)) {
                 kfree(cur);
                 return -EIO;
         }
@@ -485,12 +487,63 @@ void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
         while (!list_empty(head)) {
                 cur = list_entry(head->next, struct qlcnic_mac_list_s, list);
                 qlcnic_sre_macaddr_change(adapter,
-                                cur->mac_addr, QLCNIC_MAC_DEL);
+                                cur->mac_addr, 0, QLCNIC_MAC_DEL);
                 list_del(&cur->list);
                 kfree(cur);
         }
 }
 
+void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_filter *tmp_fil;
+        struct hlist_node *tmp_hnode, *n;
+        struct hlist_head *head;
+        int i;
+
+        for (i = 0; i < adapter->fhash.fmax; i++) {
+                head = &(adapter->fhash.fhead[i]);
+
+                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode)
+                {
+                        if (jiffies >
+                                (QLCNIC_FILTER_AGE * HZ + tmp_fil->ftime)) {
+                                qlcnic_sre_macaddr_change(adapter,
+                                        tmp_fil->faddr, tmp_fil->vlan_id,
+                                        tmp_fil->vlan_id ? QLCNIC_MAC_VLAN_DEL :
+                                        QLCNIC_MAC_DEL);
+                                spin_lock_bh(&adapter->mac_learn_lock);
+                                adapter->fhash.fnum--;
+                                hlist_del(&tmp_fil->fnode);
+                                spin_unlock_bh(&adapter->mac_learn_lock);
+                                kfree(tmp_fil);
+                        }
+                }
+        }
+}
+
+void qlcnic_delete_lb_filters(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_filter *tmp_fil;
+        struct hlist_node *tmp_hnode, *n;
+        struct hlist_head *head;
+        int i;
+
+        for (i = 0; i < adapter->fhash.fmax; i++) {
+                head = &(adapter->fhash.fhead[i]);
+
+                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                        qlcnic_sre_macaddr_change(adapter, tmp_fil->faddr,
+                                tmp_fil->vlan_id, tmp_fil->vlan_id ?
+                                QLCNIC_MAC_VLAN_DEL :  QLCNIC_MAC_DEL);
+                        spin_lock_bh(&adapter->mac_learn_lock);
+                        adapter->fhash.fnum--;
+                        hlist_del(&tmp_fil->fnode);
+                        spin_unlock_bh(&adapter->mac_learn_lock);
+                        kfree(tmp_fil);
+                }
+        }
+}
+
 #define QLCNIC_CONFIG_INTR_COALESCE     3
 
 /*
@@ -715,19 +768,6 @@ int qlcnic_change_mtu(struct net_device *netdev, int mtu)
         return rc;
 }
 
-int qlcnic_get_mac_addr(struct qlcnic_adapter *adapter, u8 *mac)
-{
-        u32 crbaddr;
-        int pci_func = adapter->ahw.pci_func;
-
-        crbaddr = CRB_MAC_BLOCK_START +
-                (4 * ((pci_func/2) * 3)) + (4 * (pci_func & 1));
-
-        qlcnic_fetch_mac(adapter, crbaddr, crbaddr+4, pci_func & 1, mac);
-
-        return 0;
-}
-
 /*
  * Changes the CRB window to the specified window.
  */
@@ -1245,4 +1285,5 @@ void qlcnic_clear_ilb_mode(struct qlcnic_adapter *adapter)
                 mode = VPORT_MISS_MODE_ACCEPT_MULTI;
 
         qlcnic_nic_set_promisc(adapter, mode);
+        msleep(1000);
 }
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 2c7cf0b64811..5c33d15c874a 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -25,6 +25,7 @@
 #include <linux/netdevice.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/if_vlan.h>
 #include "qlcnic.h"
 
 struct crb_addr_pair {
@@ -45,6 +46,9 @@ static void
 qlcnic_post_rx_buffers_nodb(struct qlcnic_adapter *adapter,
                 struct qlcnic_host_rds_ring *rds_ring);
 
+static int
+qlcnic_check_fw_hearbeat(struct qlcnic_adapter *adapter);
+
 static void crb_addr_transform_setup(void)
 {
         crb_addr_transform(XDMA);
@@ -136,8 +140,6 @@ void qlcnic_reset_rx_buffers_list(struct qlcnic_adapter *adapter)
         for (ring = 0; ring < adapter->max_rds_rings; ring++) {
                 rds_ring = &recv_ctx->rds_rings[ring];
 
-                spin_lock(&rds_ring->lock);
-
                 INIT_LIST_HEAD(&rds_ring->free_list);
 
                 rx_buf = rds_ring->rx_buf_arr;
@@ -146,8 +148,6 @@ void qlcnic_reset_rx_buffers_list(struct qlcnic_adapter *adapter)
                                         &rds_ring->free_list);
                         rx_buf++;
                 }
-
-                spin_unlock(&rds_ring->lock);
         }
 }
 
@@ -439,11 +439,14 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
         u32 off;
         struct pci_dev *pdev = adapter->pdev;
 
-        /* resetall */
+        QLCWR32(adapter, CRB_CMDPEG_STATE, 0);
+        QLCWR32(adapter, CRB_RCVPEG_STATE, 0);
+
         qlcnic_rom_lock(adapter);
         QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff);
         qlcnic_rom_unlock(adapter);
 
+        /* Init HW CRB block */
         if (qlcnic_rom_fast_read(adapter, 0, &n) != 0 || (n != 0xcafecafe) ||
                         qlcnic_rom_fast_read(adapter, 4, &n) != 0) {
                 dev_err(&pdev->dev, "ERROR Reading crb_init area: val:%x\n", n);
@@ -524,13 +527,10 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
         }
         kfree(buf);
 
-        /* p2dn replyCount */
+        /* Initialize protocol process engine */
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_D + 0xec, 0x1e);
-        /* disable_peg_cache 0 & 1*/
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_D + 0x4c, 8);
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_I + 0x4c, 8);
-
-        /* peg_clr_all */
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_0 + 0x8, 0);
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_0 + 0xc, 0);
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_1 + 0x8, 0);
@@ -539,9 +539,87 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_2 + 0xc, 0);
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_3 + 0x8, 0);
         QLCWR32(adapter, QLCNIC_CRB_PEG_NET_3 + 0xc, 0);
+        QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x8, 0);
+        QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0xc, 0);
+        msleep(1);
+        QLCWR32(adapter, QLCNIC_PEG_HALT_STATUS1, 0);
+        QLCWR32(adapter, QLCNIC_PEG_HALT_STATUS2, 0);
         return 0;
 }
 
+static int qlcnic_cmd_peg_ready(struct qlcnic_adapter *adapter)
+{
+        u32 val;
+        int retries = QLCNIC_CMDPEG_CHECK_RETRY_COUNT;
+
+        do {
+                val = QLCRD32(adapter, CRB_CMDPEG_STATE);
+
+                switch (val) {
+                case PHAN_INITIALIZE_COMPLETE:
+                case PHAN_INITIALIZE_ACK:
+                        return 0;
+                case PHAN_INITIALIZE_FAILED:
+                        goto out_err;
+                default:
+                        break;
+                }
+
+                msleep(QLCNIC_CMDPEG_CHECK_DELAY);
+
+        } while (--retries);
+
+        QLCWR32(adapter, CRB_CMDPEG_STATE, PHAN_INITIALIZE_FAILED);
+
+out_err:
+        dev_err(&adapter->pdev->dev, "Command Peg initialization not "
+                      "complete, state: 0x%x.\n", val);
+        return -EIO;
+}
+
+static int
+qlcnic_receive_peg_ready(struct qlcnic_adapter *adapter)
+{
+        u32 val;
+        int retries = QLCNIC_RCVPEG_CHECK_RETRY_COUNT;
+
+        do {
+                val = QLCRD32(adapter, CRB_RCVPEG_STATE);
+
+                if (val == PHAN_PEG_RCV_INITIALIZED)
+                        return 0;
+
+                msleep(QLCNIC_RCVPEG_CHECK_DELAY);
+
+        } while (--retries);
+
+        if (!retries) {
+                dev_err(&adapter->pdev->dev, "Receive Peg initialization not "
+                              "complete, state: 0x%x.\n", val);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+int
+qlcnic_check_fw_status(struct qlcnic_adapter *adapter)
+{
+        int err;
+
+        err = qlcnic_cmd_peg_ready(adapter);
+        if (err)
+                return err;
+
+        err = qlcnic_receive_peg_ready(adapter);
+        if (err)
+                return err;
+
+        QLCWR32(adapter, CRB_CMDPEG_STATE, PHAN_INITIALIZE_ACK);
+
+        return err;
+}
+
 int
 qlcnic_setup_idc_param(struct qlcnic_adapter *adapter) {
 
@@ -557,12 +635,12 @@ qlcnic_setup_idc_param(struct qlcnic_adapter *adapter) {
         }
         adapter->physical_port = (val >> 2);
         if (qlcnic_rom_fast_read(adapter, QLCNIC_ROM_DEV_INIT_TIMEOUT, &timeo))
-                timeo = 30;
+                timeo = QLCNIC_INIT_TIMEOUT_SECS;
 
         adapter->dev_init_timeo = timeo;
 
         if (qlcnic_rom_fast_read(adapter, QLCNIC_ROM_DRV_RESET_TIMEOUT, &timeo))
-                timeo = 10;
+                timeo = QLCNIC_RESET_TIMEOUT_SECS;
 
         adapter->reset_ack_timeo = timeo;
 
@@ -906,54 +984,47 @@ qlcnic_get_bios_version(struct qlcnic_adapter *adapter)
         return (bios_ver << 16) + ((bios_ver >> 8) & 0xff00) + (bios_ver >> 24);
 }
 
-int
-qlcnic_need_fw_reset(struct qlcnic_adapter *adapter)
+static void qlcnic_rom_lock_recovery(struct qlcnic_adapter *adapter)
 {
-        u32 count, old_count;
-        u32 val, version, major, minor, build;
-        int i, timeout;
-
-        if (adapter->need_fw_reset)
-                return 1;
+        if (qlcnic_pcie_sem_lock(adapter, 2, QLCNIC_ROM_LOCK_ID))
+                dev_info(&adapter->pdev->dev, "Resetting rom_lock\n");
 
-        /* last attempt had failed */
-        if (QLCRD32(adapter, CRB_CMDPEG_STATE) == PHAN_INITIALIZE_FAILED)
-                return 1;
+        qlcnic_pcie_sem_unlock(adapter, 2);
+}
 
-        old_count = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
+static int
+qlcnic_check_fw_hearbeat(struct qlcnic_adapter *adapter)
+{
+        u32 heartbeat, ret = -EIO;
+        int retries = QLCNIC_HEARTBEAT_CHECK_RETRY_COUNT;
 
-        for (i = 0; i < 10; i++) {
+        adapter->heartbeat = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
 
-                timeout = msleep_interruptible(200);
-                if (timeout) {
-                        QLCWR32(adapter, CRB_CMDPEG_STATE,
-                                        PHAN_INITIALIZE_FAILED);
-                        return -EINTR;
+        do {
+                msleep(QLCNIC_HEARTBEAT_PERIOD_MSECS);
+                heartbeat = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
+                if (heartbeat != adapter->heartbeat) {
+                        ret = QLCNIC_RCODE_SUCCESS;
+                        break;
                 }
+        } while (--retries);
 
-                count = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
-                if (count != old_count)
-                        break;
-        }
+        return ret;
+}
 
-        /* firmware is dead */
-        if (count == old_count)
+int
+qlcnic_need_fw_reset(struct qlcnic_adapter *adapter)
+{
+        if (qlcnic_check_fw_hearbeat(adapter)) {
+                qlcnic_rom_lock_recovery(adapter);
                 return 1;
+        }
 
-        /* check if we have got newer or different file firmware */
-        if (adapter->fw) {
-
-                val = qlcnic_get_fw_version(adapter);
-
-                version = QLCNIC_DECODE_VERSION(val);
-
-                major = QLCRD32(adapter, QLCNIC_FW_VERSION_MAJOR);
-                minor = QLCRD32(adapter, QLCNIC_FW_VERSION_MINOR);
-                build = QLCRD32(adapter, QLCNIC_FW_VERSION_SUB);
+        if (adapter->need_fw_reset)
+                return 1;
 
-                if (version > QLCNIC_VERSION_CODE(major, minor, build))
-                        return 1;
-        }
+        if (adapter->fw)
+                return 1;
 
         return 0;
 }
@@ -1089,18 +1160,6 @@ qlcnic_validate_firmware(struct qlcnic_adapter *adapter)
                 return -EINVAL;
         }
 
-        /* check if flashed firmware is newer */
-        if (qlcnic_rom_fast_read(adapter,
-                        QLCNIC_FW_VERSION_OFFSET, (int *)&val))
-                return -EIO;
-
-        val = QLCNIC_DECODE_VERSION(val);
-        if (val > ver) {
-                dev_info(&pdev->dev, "%s: firmware is older than flash\n",
-                                fw_name[fw_type]);
-                return -EINVAL;
-        }
-
         QLCWR32(adapter, QLCNIC_CAM_RAM(0x1fc), QLCNIC_BDINFO_MAGIC);
         return 0;
 }
@@ -1162,78 +1221,6 @@ qlcnic_release_firmware(struct qlcnic_adapter *adapter)
         adapter->fw = NULL;
 }
 
-static int qlcnic_cmd_peg_ready(struct qlcnic_adapter *adapter)
-{
-        u32 val;
-        int retries = 60;
-
-        do {
-                val = QLCRD32(adapter, CRB_CMDPEG_STATE);
-
-                switch (val) {
-                case PHAN_INITIALIZE_COMPLETE:
-                case PHAN_INITIALIZE_ACK:
-                        return 0;
-                case PHAN_INITIALIZE_FAILED:
-                        goto out_err;
-                default:
-                        break;
-                }
-
-                msleep(500);
-
-        } while (--retries);
-
-        QLCWR32(adapter, CRB_CMDPEG_STATE, PHAN_INITIALIZE_FAILED);
-
-out_err:
-        dev_err(&adapter->pdev->dev, "Command Peg initialization not "
-                      "complete, state: 0x%x.\n", val);
-        return -EIO;
-}
-
-static int
-qlcnic_receive_peg_ready(struct qlcnic_adapter *adapter)
-{
-        u32 val;
-        int retries = 2000;
-
-        do {
-                val = QLCRD32(adapter, CRB_RCVPEG_STATE);
-
-                if (val == PHAN_PEG_RCV_INITIALIZED)
-                        return 0;
-
-                msleep(10);
-
-        } while (--retries);
-
-        if (!retries) {
-                dev_err(&adapter->pdev->dev, "Receive Peg initialization not "
-                              "complete, state: 0x%x.\n", val);
-                return -EIO;
-        }
-
-        return 0;
-}
-
-int qlcnic_init_firmware(struct qlcnic_adapter *adapter)
-{
-        int err;
-
-        err = qlcnic_cmd_peg_ready(adapter);
-        if (err)
-                return err;
-
-        err = qlcnic_receive_peg_ready(adapter);
-        if (err)
-                return err;
-
-        QLCWR32(adapter, CRB_CMDPEG_STATE, PHAN_INITIALIZE_ACK);
-
-        return err;
-}
-
 static void
 qlcnic_handle_linkevent(struct qlcnic_adapter *adapter,
                                 struct qlcnic_fw_msg *msg)
@@ -1351,11 +1338,12 @@ static struct sk_buff *qlcnic_process_rxbuf(struct qlcnic_adapter *adapter,
 
         skb = buffer->skb;
 
-        if (likely(adapter->rx_csum && cksum == STATUS_CKSUM_OK)) {
+        if (likely(adapter->rx_csum && (cksum == STATUS_CKSUM_OK ||
+                                                cksum == STATUS_CKSUM_LOOP))) {
                 adapter->stats.csummed++;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else {
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
         }
 
         skb->dev = adapter->netdev;
@@ -1365,6 +1353,31 @@ static struct sk_buff *qlcnic_process_rxbuf(struct qlcnic_adapter *adapter,
         return skb;
 }
 
+static int
+qlcnic_check_rx_tagging(struct qlcnic_adapter *adapter, struct sk_buff *skb,
+                        u16 *vlan_tag)
+{
+        struct ethhdr *eth_hdr;
+
+        if (!__vlan_get_tag(skb, vlan_tag)) {
+                eth_hdr = (struct ethhdr *) skb->data;
+                memmove(skb->data + VLAN_HLEN, eth_hdr, ETH_ALEN * 2);
+                skb_pull(skb, VLAN_HLEN);
+        }
+        if (!adapter->pvid)
+                return 0;
+
+        if (*vlan_tag == adapter->pvid) {
+                /* Outer vlan tag. Packet should follow non-vlan path */
+                *vlan_tag = 0xffff;
+                return 0;
+        }
+        if (adapter->flags & QLCNIC_TAGGING_ENABLED)
+                return 0;
+
+        return -EINVAL;
+}
+
 static struct qlcnic_rx_buffer *
 qlcnic_process_rcv(struct qlcnic_adapter *adapter,
                 struct qlcnic_host_sds_ring *sds_ring,
@@ -1376,6 +1389,7 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
         struct sk_buff *skb;
         struct qlcnic_host_rds_ring *rds_ring;
         int index, length, cksum, pkt_offset;
+        u16 vid = 0xffff;
 
         if (unlikely(ring >= adapter->max_rds_rings))
                 return NULL;
@@ -1404,9 +1418,18 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
+        if (unlikely(qlcnic_check_rx_tagging(adapter, skb, &vid))) {
+                adapter->stats.rxdropped++;
+                dev_kfree_skb(skb);
+                return buffer;
+        }
+
         skb->protocol = eth_type_trans(skb, netdev);
 
-        napi_gro_receive(&sds_ring->napi, skb);
+        if ((vid != 0xffff) && adapter->vlgrp)
+                vlan_gro_receive(&sds_ring->napi, adapter->vlgrp, vid, skb);
+        else
+                napi_gro_receive(&sds_ring->napi, skb);
 
         adapter->stats.rx_pkts++;
         adapter->stats.rxbytes += length;
@@ -1435,6 +1458,7 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
         int index;
         u16 lro_length, length, data_offset;
         u32 seq_number;
+        u16 vid = 0xffff;
 
         if (unlikely(ring > adapter->max_rds_rings))
                 return NULL;
@@ -1466,6 +1490,13 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
         skb_put(skb, lro_length + data_offset);
 
         skb_pull(skb, l2_hdr_offset);
+
+        if (unlikely(qlcnic_check_rx_tagging(adapter, skb, &vid))) {
+                adapter->stats.rxdropped++;
+                dev_kfree_skb(skb);
+                return buffer;
+        }
+
         skb->protocol = eth_type_trans(skb, netdev);
 
         iph = (struct iphdr *)skb->data;
@@ -1480,7 +1511,10 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
 
         length = skb->len;
 
-        netif_receive_skb(skb);
+        if ((vid != 0xffff) && adapter->vlgrp)
+                vlan_hwaccel_receive_skb(skb, adapter->vlgrp, vid);
+        else
+                netif_receive_skb(skb);
 
         adapter->stats.lro_pkts++;
         adapter->stats.lrobytes += length;
@@ -1584,8 +1618,6 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
         int producer, count = 0;
         struct list_head *head;
 
-        spin_lock(&rds_ring->lock);
-
         producer = rds_ring->producer;
 
         head = &rds_ring->free_list;
@@ -1615,7 +1647,6 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
                 writel((producer-1) & (rds_ring->num_desc-1),
                                 rds_ring->crb_rcv_producer);
         }
-        spin_unlock(&rds_ring->lock);
 }
 
 static void
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index 66eea5972020..a3d7705a2dda 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -50,6 +50,10 @@ static int port_mode = QLCNIC_PORT_MODE_AUTO_NEG;
 /* Default to restricted 1G auto-neg mode */
 static int wol_port_mode = 5;
 
+static int qlcnic_mac_learn;
+module_param(qlcnic_mac_learn, int, 0644);
+MODULE_PARM_DESC(qlcnic_mac_learn, "Mac Filter (0=disabled, 1=enabled)");
+
 static int use_msi = 1;
 module_param(use_msi, int, 0644);
 MODULE_PARM_DESC(use_msi, "MSI interrupt (0=disabled, 1=enabled");
@@ -94,7 +98,7 @@ static void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter);
 static void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter);
 
 static void qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding);
-static void qlcnic_clr_all_drv_state(struct qlcnic_adapter *adapter);
+static void qlcnic_clr_all_drv_state(struct qlcnic_adapter *adapter, u8);
 static int qlcnic_can_start_firmware(struct qlcnic_adapter *adapter);
 
 static irqreturn_t qlcnic_tmp_intr(int irq, void *data);
@@ -103,13 +107,17 @@ static irqreturn_t qlcnic_msi_intr(int irq, void *data);
 static irqreturn_t qlcnic_msix_intr(int irq, void *data);
 
 static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev);
-static void qlcnic_config_indev_addr(struct net_device *dev, unsigned long);
+static void qlcnic_restore_indev_addr(struct net_device *dev, unsigned long);
 static int qlcnic_start_firmware(struct qlcnic_adapter *);
 
+static void qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter);
+static void qlcnic_free_lb_filters_mem(struct qlcnic_adapter *adapter);
 static void qlcnic_dev_set_npar_ready(struct qlcnic_adapter *);
 static int qlcnicvf_config_led(struct qlcnic_adapter *, u32, u32);
 static int qlcnicvf_config_bridged_mode(struct qlcnic_adapter *, u32);
 static int qlcnicvf_start_firmware(struct qlcnic_adapter *);
+static void qlcnic_set_netdev_features(struct qlcnic_adapter *,
+                                struct qlcnic_esw_func_cfg *);
 /*  PCI Device ID Table  */
 #define ENTRY(device) \
         {PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, (device)), \
@@ -164,7 +172,7 @@ qlcnic_alloc_sds_rings(struct qlcnic_recv_context *recv_ctx, int count)
 
         recv_ctx->sds_rings = kzalloc(size, GFP_KERNEL);
 
-        return (recv_ctx->sds_rings == NULL);
+        return recv_ctx->sds_rings == NULL;
 }
 
 static void
@@ -320,7 +328,7 @@ qlcnic_read_mac_addr(struct qlcnic_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
 
-        if (adapter->nic_ops->get_mac_addr(adapter, mac_addr) != 0)
+        if (qlcnic_get_mac_address(adapter, mac_addr) != 0)
                 return -EIO;
 
         memcpy(netdev->dev_addr, mac_addr, ETH_ALEN);
@@ -341,6 +349,9 @@ static int qlcnic_set_mac(struct net_device *netdev, void *p)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct sockaddr *addr = p;
 
+        if ((adapter->flags & QLCNIC_MAC_OVERRIDE_DISABLED))
+                return -EOPNOTSUPP;
+
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EINVAL;
 
@@ -360,6 +371,13 @@ static int qlcnic_set_mac(struct net_device *netdev, void *p)
         return 0;
 }
 
+static void qlcnic_vlan_rx_register(struct net_device *netdev,
+                struct vlan_group *grp)
+{
+        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        adapter->vlgrp = grp;
+}
+
 static const struct net_device_ops qlcnic_netdev_ops = {
         .ndo_open          = qlcnic_open,
         .ndo_stop          = qlcnic_close,
@@ -370,20 +388,19 @@ static const struct net_device_ops qlcnic_netdev_ops = {
         .ndo_set_mac_address    = qlcnic_set_mac,
         .ndo_change_mtu    = qlcnic_change_mtu,
         .ndo_tx_timeout    = qlcnic_tx_timeout,
+        .ndo_vlan_rx_register = qlcnic_vlan_rx_register,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
 #endif
 };
 
 static struct qlcnic_nic_template qlcnic_ops = {
-        .get_mac_addr = qlcnic_get_mac_address,
         .config_bridged_mode = qlcnic_config_bridged_mode,
         .config_led = qlcnic_config_led,
         .start_firmware = qlcnic_start_firmware
 };
 
 static struct qlcnic_nic_template qlcnic_vf_ops = {
-        .get_mac_addr = qlcnic_get_mac_address,
         .config_bridged_mode = qlcnicvf_config_bridged_mode,
         .config_led = qlcnicvf_config_led,
         .start_firmware = qlcnicvf_start_firmware
@@ -474,7 +491,7 @@ static int
 qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_pci_info *pci_info;
-        int i, ret = 0, err;
+        int i, ret = 0;
         u8 pfn;
 
         pci_info = kcalloc(QLCNIC_MAX_PCI_FUNC, sizeof(*pci_info), GFP_KERNEL);
@@ -484,14 +501,14 @@ qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
         adapter->npars = kzalloc(sizeof(struct qlcnic_npar_info) *
                                 QLCNIC_MAX_PCI_FUNC, GFP_KERNEL);
         if (!adapter->npars) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_pci_info;
         }
 
         adapter->eswitch = kzalloc(sizeof(struct qlcnic_eswitch) *
                                 QLCNIC_NIU_MAX_XG_PORTS, GFP_KERNEL);
         if (!adapter->eswitch) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_npars;
         }
 
@@ -506,7 +523,6 @@ qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
                 adapter->npars[pfn].active = pci_info[i].active;
                 adapter->npars[pfn].type = pci_info[i].type;
                 adapter->npars[pfn].phy_port = pci_info[i].default_port;
-                adapter->npars[pfn].mac_learning = DEFAULT_MAC_LEARN;
                 adapter->npars[pfn].min_bw = pci_info[i].tx_min_bw;
                 adapter->npars[pfn].max_bw = pci_info[i].tx_max_bw;
         }
@@ -539,12 +555,10 @@ qlcnic_set_function_modes(struct qlcnic_adapter *adapter)
         void __iomem *priv_op = adapter->ahw.pci_base0 + QLCNIC_DRV_OP_MODE;
 
         /* If other drivers are not in use set their privilege level */
-        ref_count = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
+        ref_count = QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE);
         ret = qlcnic_api_lock(adapter);
         if (ret)
                 goto err_lock;
-        if (QLC_DEV_CLR_REF_CNT(ref_count, adapter->ahw.pci_func))
-                goto err_npar;
 
         if (qlcnic_config_npars) {
                 for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
@@ -562,18 +576,16 @@ qlcnic_set_function_modes(struct qlcnic_adapter *adapter)
                         adapter->ahw.pci_func));
         }
         writel(data, priv_op);
-err_npar:
         qlcnic_api_unlock(adapter);
 err_lock:
         return ret;
 }
 
-static u32
-qlcnic_get_driver_mode(struct qlcnic_adapter *adapter)
+static void
+qlcnic_check_vf(struct qlcnic_adapter *adapter)
 {
         void __iomem *msix_base_addr;
         void __iomem *priv_op;
-        struct qlcnic_info nic_info;
         u32 func;
         u32 msix_base;
         u32 op_mode, priv_level;
@@ -588,20 +600,6 @@ qlcnic_get_driver_mode(struct qlcnic_adapter *adapter)
         func = (func - msix_base)/QLCNIC_MSIX_TBL_PGSIZE;
         adapter->ahw.pci_func = func;
 
-        if (!qlcnic_get_nic_info(adapter, &nic_info, adapter->ahw.pci_func)) {
-                adapter->capabilities = nic_info.capabilities;
-
-                if (adapter->capabilities & BIT_6)
-                        adapter->flags |= QLCNIC_ESWITCH_ENABLED;
-                else
-                        adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
-        }
-
-        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED)) {
-                adapter->nic_ops = &qlcnic_ops;
-                return adapter->fw_hal_version;
-        }
-
         /* Determine function privilege level */
         priv_op = adapter->ahw.pci_base0 + QLCNIC_DRV_OP_MODE;
         op_mode = readl(priv_op);
@@ -610,37 +608,14 @@ qlcnic_get_driver_mode(struct qlcnic_adapter *adapter)
         else
                 priv_level = QLC_DEV_GET_DRV(op_mode, adapter->ahw.pci_func);
 
-        switch (priv_level) {
-        case QLCNIC_MGMT_FUNC:
-                adapter->op_mode = QLCNIC_MGMT_FUNC;
-                adapter->nic_ops = &qlcnic_ops;
-                qlcnic_init_pci_info(adapter);
-                /* Set privilege level for other functions */
-                qlcnic_set_function_modes(adapter);
-                dev_info(&adapter->pdev->dev,
-                        "HAL Version: %d, Management function\n",
-                        adapter->fw_hal_version);
-                break;
-        case QLCNIC_PRIV_FUNC:
-                adapter->op_mode = QLCNIC_PRIV_FUNC;
-                dev_info(&adapter->pdev->dev,
-                        "HAL Version: %d, Privileged function\n",
-                        adapter->fw_hal_version);
-                adapter->nic_ops = &qlcnic_ops;
-                break;
-        case QLCNIC_NON_PRIV_FUNC:
+        if (priv_level == QLCNIC_NON_PRIV_FUNC) {
                 adapter->op_mode = QLCNIC_NON_PRIV_FUNC;
                 dev_info(&adapter->pdev->dev,
                         "HAL Version: %d Non Privileged function\n",
                         adapter->fw_hal_version);
                 adapter->nic_ops = &qlcnic_vf_ops;
-                break;
-        default:
-                dev_info(&adapter->pdev->dev, "Unknown function mode: %d\n",
-                        priv_level);
-                return 0;
-        }
-        return adapter->fw_hal_version;
+        } else
+                adapter->nic_ops = &qlcnic_ops;
 }
 
 static int
@@ -673,10 +648,7 @@ qlcnic_setup_pci_map(struct qlcnic_adapter *adapter)
         adapter->ahw.pci_base0 = mem_ptr0;
         adapter->ahw.pci_len0 = pci_len0;
 
-        if (!qlcnic_get_driver_mode(adapter)) {
-                iounmap(adapter->ahw.pci_base0);
-                return -EIO;
-        }
+        qlcnic_check_vf(adapter);
 
         adapter->ahw.ocm_win_crb = qlcnic_get_ioaddr(adapter,
                 QLCNIC_PCIX_PS_REG(PCIX_OCM_WINDOW_REG(adapter->ahw.pci_func)));
@@ -711,25 +683,7 @@ static void
 qlcnic_check_options(struct qlcnic_adapter *adapter)
 {
         u32 fw_major, fw_minor, fw_build;
-        char brd_name[QLCNIC_MAX_BOARD_NAME_LEN];
-        char serial_num[32];
-        int i, offset, val;
-        int *ptr32;
         struct pci_dev *pdev = adapter->pdev;
-        struct qlcnic_info nic_info;
-        adapter->driver_mismatch = 0;
-
-        ptr32 = (int *)&serial_num;
-        offset = QLCNIC_FW_SERIAL_NUM_OFFSET;
-        for (i = 0; i < 8; i++) {
-                if (qlcnic_rom_fast_read(adapter, offset, &val) == -1) {
-                        dev_err(&pdev->dev, "error reading board info\n");
-                        adapter->driver_mismatch = 1;
-                        return;
-                }
-                ptr32[i] = cpu_to_le32(val);
-                offset += sizeof(u32);
-        }
 
         fw_major = QLCRD32(adapter, QLCNIC_FW_VERSION_MAJOR);
         fw_minor = QLCRD32(adapter, QLCNIC_FW_VERSION_MINOR);
@@ -737,14 +691,6 @@ qlcnic_check_options(struct qlcnic_adapter *adapter)
 
         adapter->fw_version = QLCNIC_VERSION_CODE(fw_major, fw_minor, fw_build);
 
-        if (adapter->portnum == 0) {
-                get_brd_name(adapter, brd_name);
-
-                pr_info("%s: %s Board Chip rev 0x%x\n",
-                                module_name(THIS_MODULE),
-                                brd_name, adapter->ahw.revision_id);
-        }
-
         dev_info(&pdev->dev, "firmware v%d.%d.%d\n",
                         fw_major, fw_minor, fw_build);
 
@@ -758,109 +704,333 @@ qlcnic_check_options(struct qlcnic_adapter *adapter)
                 adapter->num_jumbo_rxd = MAX_JUMBO_RCV_DESCRIPTORS_1G;
         }
 
-        if (!qlcnic_get_nic_info(adapter, &nic_info, adapter->ahw.pci_func)) {
-                adapter->physical_port = nic_info.phys_port;
-                adapter->switch_mode = nic_info.switch_mode;
-                adapter->max_tx_ques = nic_info.max_tx_ques;
-                adapter->max_rx_ques = nic_info.max_rx_ques;
-                adapter->capabilities = nic_info.capabilities;
-                adapter->max_mac_filters = nic_info.max_mac_filters;
-                adapter->max_mtu = nic_info.max_mtu;
-        }
-
         adapter->msix_supported = !!use_msi_x;
         adapter->rss_supported = !!use_msi_x;
 
         adapter->num_txd = MAX_CMD_DESCRIPTORS;
 
-        adapter->max_rds_rings = 2;
+        adapter->max_rds_rings = MAX_RDS_RINGS;
+}
+
+static int
+qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
+{
+        int err;
+        struct qlcnic_info nic_info;
+
+        err = qlcnic_get_nic_info(adapter, &nic_info, adapter->ahw.pci_func);
+        if (err)
+                return err;
+
+        adapter->physical_port = nic_info.phys_port;
+        adapter->switch_mode = nic_info.switch_mode;
+        adapter->max_tx_ques = nic_info.max_tx_ques;
+        adapter->max_rx_ques = nic_info.max_rx_ques;
+        adapter->capabilities = nic_info.capabilities;
+        adapter->max_mac_filters = nic_info.max_mac_filters;
+        adapter->max_mtu = nic_info.max_mtu;
+
+        if (adapter->capabilities & BIT_6)
+                adapter->flags |= QLCNIC_ESWITCH_ENABLED;
+        else
+                adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
+
+        return err;
+}
+
+static void
+qlcnic_set_vlan_config(struct qlcnic_adapter *adapter,
+                struct qlcnic_esw_func_cfg *esw_cfg)
+{
+        if (esw_cfg->discard_tagged)
+                adapter->flags &= ~QLCNIC_TAGGING_ENABLED;
+        else
+                adapter->flags |= QLCNIC_TAGGING_ENABLED;
+
+        if (esw_cfg->vlan_id)
+                adapter->pvid = esw_cfg->vlan_id;
+        else
+                adapter->pvid = 0;
+}
+
+static void
+qlcnic_set_eswitch_port_features(struct qlcnic_adapter *adapter,
+                struct qlcnic_esw_func_cfg *esw_cfg)
+{
+        adapter->flags &= ~QLCNIC_MACSPOOF;
+        adapter->flags &= ~QLCNIC_MAC_OVERRIDE_DISABLED;
+
+        if (esw_cfg->mac_anti_spoof)
+                adapter->flags |= QLCNIC_MACSPOOF;
+
+        if (!esw_cfg->mac_override)
+                adapter->flags |= QLCNIC_MAC_OVERRIDE_DISABLED;
+
+        qlcnic_set_netdev_features(adapter, esw_cfg);
+}
+
+static int
+qlcnic_set_eswitch_port_config(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_esw_func_cfg esw_cfg;
+
+        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return 0;
+
+        esw_cfg.pci_func = adapter->ahw.pci_func;
+        if (qlcnic_get_eswitch_port_config(adapter, &esw_cfg))
+                        return -EIO;
+        qlcnic_set_vlan_config(adapter, &esw_cfg);
+        qlcnic_set_eswitch_port_features(adapter, &esw_cfg);
+
+        return 0;
+}
+
+static void
+qlcnic_set_netdev_features(struct qlcnic_adapter *adapter,
+                struct qlcnic_esw_func_cfg *esw_cfg)
+{
+        struct net_device *netdev = adapter->netdev;
+        unsigned long features, vlan_features;
+
+        features = (NETIF_F_SG | NETIF_F_IP_CSUM |
+                        NETIF_F_IPV6_CSUM | NETIF_F_GRO);
+        vlan_features = (NETIF_F_SG | NETIF_F_IP_CSUM |
+                        NETIF_F_IPV6_CSUM);
+
+        if (adapter->capabilities & QLCNIC_FW_CAPABILITY_TSO) {
+                features |= (NETIF_F_TSO | NETIF_F_TSO6);
+                vlan_features |= (NETIF_F_TSO | NETIF_F_TSO6);
+        }
+        if (adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO)
+                features |= NETIF_F_LRO;
+
+        if (esw_cfg->offload_flags & BIT_0) {
+                netdev->features |= features;
+                adapter->rx_csum = 1;
+                if (!(esw_cfg->offload_flags & BIT_1))
+                        netdev->features &= ~NETIF_F_TSO;
+                if (!(esw_cfg->offload_flags & BIT_2))
+                        netdev->features &= ~NETIF_F_TSO6;
+        } else {
+                netdev->features &= ~features;
+                adapter->rx_csum = 0;
+        }
+
+        netdev->vlan_features = (features & vlan_features);
+}
+
+static int
+qlcnic_check_eswitch_mode(struct qlcnic_adapter *adapter)
+{
+        void __iomem *priv_op;
+        u32 op_mode, priv_level;
+        int err = 0;
+
+        err = qlcnic_initialize_nic(adapter);
+        if (err)
+                return err;
+
+        if (adapter->flags & QLCNIC_ADAPTER_INITIALIZED)
+                return 0;
+
+        priv_op = adapter->ahw.pci_base0 + QLCNIC_DRV_OP_MODE;
+        op_mode = readl(priv_op);
+        priv_level = QLC_DEV_GET_DRV(op_mode, adapter->ahw.pci_func);
+
+        if (op_mode == QLC_DEV_DRV_DEFAULT)
+                priv_level = QLCNIC_MGMT_FUNC;
+        else
+                priv_level = QLC_DEV_GET_DRV(op_mode, adapter->ahw.pci_func);
+
+        if (adapter->flags & QLCNIC_ESWITCH_ENABLED) {
+                if (priv_level == QLCNIC_MGMT_FUNC) {
+                        adapter->op_mode = QLCNIC_MGMT_FUNC;
+                        err = qlcnic_init_pci_info(adapter);
+                        if (err)
+                                return err;
+                        /* Set privilege level for other functions */
+                        qlcnic_set_function_modes(adapter);
+                        dev_info(&adapter->pdev->dev,
+                                "HAL Version: %d, Management function\n",
+                                adapter->fw_hal_version);
+                } else if (priv_level == QLCNIC_PRIV_FUNC) {
+                        adapter->op_mode = QLCNIC_PRIV_FUNC;
+                        dev_info(&adapter->pdev->dev,
+                                "HAL Version: %d, Privileged function\n",
+                                adapter->fw_hal_version);
+                }
+        }
+
+        adapter->flags |= QLCNIC_ADAPTER_INITIALIZED;
+
+        return err;
+}
+
+static int
+qlcnic_set_default_offload_settings(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_esw_func_cfg esw_cfg;
+        struct qlcnic_npar_info *npar;
+        u8 i;
+
+        if (adapter->need_fw_reset)
+                return 0;
+
+        for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
+                if (adapter->npars[i].type != QLCNIC_TYPE_NIC)
+                        continue;
+                memset(&esw_cfg, 0, sizeof(struct qlcnic_esw_func_cfg));
+                esw_cfg.pci_func = i;
+                esw_cfg.offload_flags = BIT_0;
+                esw_cfg.mac_override = BIT_0;
+                if (adapter->capabilities  & QLCNIC_FW_CAPABILITY_TSO)
+                        esw_cfg.offload_flags |= (BIT_1 | BIT_2);
+                if (qlcnic_config_switch_port(adapter, &esw_cfg))
+                        return -EIO;
+                npar = &adapter->npars[i];
+                npar->pvid = esw_cfg.vlan_id;
+                npar->mac_override = esw_cfg.mac_override;
+                npar->mac_anti_spoof = esw_cfg.mac_anti_spoof;
+                npar->discard_tagged = esw_cfg.discard_tagged;
+                npar->promisc_mode = esw_cfg.promisc_mode;
+                npar->offload_flags = esw_cfg.offload_flags;
+        }
+
+        return 0;
+}
+
+static int
+qlcnic_reset_eswitch_config(struct qlcnic_adapter *adapter,
+                        struct qlcnic_npar_info *npar, int pci_func)
+{
+        struct qlcnic_esw_func_cfg esw_cfg;
+        esw_cfg.op_mode = QLCNIC_PORT_DEFAULTS;
+        esw_cfg.pci_func = pci_func;
+        esw_cfg.vlan_id = npar->pvid;
+        esw_cfg.mac_override = npar->mac_override;
+        esw_cfg.discard_tagged = npar->discard_tagged;
+        esw_cfg.mac_anti_spoof = npar->mac_anti_spoof;
+        esw_cfg.offload_flags = npar->offload_flags;
+        esw_cfg.promisc_mode = npar->promisc_mode;
+        if (qlcnic_config_switch_port(adapter, &esw_cfg))
+                return -EIO;
+
+        esw_cfg.op_mode = QLCNIC_ADD_VLAN;
+        if (qlcnic_config_switch_port(adapter, &esw_cfg))
+                return -EIO;
+
+        return 0;
 }
 
 static int
 qlcnic_reset_npar_config(struct qlcnic_adapter *adapter)
 {
-        int i, err = 0;
+        int i, err;
         struct qlcnic_npar_info *npar;
         struct qlcnic_info nic_info;
 
-        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-            !adapter->need_fw_reset)
+        if (!adapter->need_fw_reset)
                 return 0;
 
-        if (adapter->op_mode == QLCNIC_MGMT_FUNC) {
-                /* Set the NPAR config data after FW reset */
-                for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
-                        npar = &adapter->npars[i];
-                        if (npar->type != QLCNIC_TYPE_NIC)
-                                continue;
-                        err = qlcnic_get_nic_info(adapter, &nic_info, i);
-                        if (err)
-                                goto err_out;
-                        nic_info.min_tx_bw = npar->min_bw;
-                        nic_info.max_tx_bw = npar->max_bw;
-                        err = qlcnic_set_nic_info(adapter, &nic_info);
+        /* Set the NPAR config data after FW reset */
+        for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
+                npar = &adapter->npars[i];
+                if (npar->type != QLCNIC_TYPE_NIC)
+                        continue;
+                err = qlcnic_get_nic_info(adapter, &nic_info, i);
+                if (err)
+                        return err;
+                nic_info.min_tx_bw = npar->min_bw;
+                nic_info.max_tx_bw = npar->max_bw;
+                err = qlcnic_set_nic_info(adapter, &nic_info);
+                if (err)
+                        return err;
+
+                if (npar->enable_pm) {
+                        err = qlcnic_config_port_mirroring(adapter,
+                                                        npar->dest_npar, 1, i);
                         if (err)
-                                goto err_out;
+                                return err;
+                }
+                err = qlcnic_reset_eswitch_config(adapter, npar, i);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
 
-                        if (npar->enable_pm) {
-                                err = qlcnic_config_port_mirroring(adapter,
-                                                npar->dest_npar, 1, i);
-                                if (err)
-                                        goto err_out;
+static int qlcnic_check_npar_opertional(struct qlcnic_adapter *adapter)
+{
+        u8 npar_opt_timeo = QLCNIC_DEV_NPAR_OPER_TIMEO;
+        u32 npar_state;
 
-                        }
-                        npar->mac_learning = DEFAULT_MAC_LEARN;
-                        npar->host_vlan_tag = 0;
-                        npar->promisc_mode = 0;
-                        npar->discard_tagged = 0;
-                        npar->vlan_id = 0;
-                }
+        if (adapter->op_mode == QLCNIC_MGMT_FUNC)
+                return 0;
+
+        npar_state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
+        while (npar_state != QLCNIC_DEV_NPAR_OPER && --npar_opt_timeo) {
+                msleep(1000);
+                npar_state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
         }
-err_out:
+        if (!npar_opt_timeo) {
+                dev_err(&adapter->pdev->dev,
+                        "Waiting for NPAR state to opertional timeout\n");
+                return -EIO;
+        }
+        return 0;
+}
+
+static int
+qlcnic_set_mgmt_operations(struct qlcnic_adapter *adapter)
+{
+        int err;
+
+        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
+                    adapter->op_mode != QLCNIC_MGMT_FUNC)
+                return 0;
+
+        err = qlcnic_set_default_offload_settings(adapter);
+        if (err)
+                return err;
+
+        err = qlcnic_reset_npar_config(adapter);
+        if (err)
+                return err;
+
+        qlcnic_dev_set_npar_ready(adapter);
+
         return err;
 }
 
 static int
 qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
-        int val, err, first_boot;
+        int err;
 
         err = qlcnic_can_start_firmware(adapter);
         if (err < 0)
                 return err;
         else if (!err)
-                goto wait_init;
-
-        first_boot = QLCRD32(adapter, QLCNIC_CAM_RAM(0x1fc));
-        if (first_boot == 0x55555555)
-                /* This is the first boot after power up */
-                QLCWR32(adapter, QLCNIC_CAM_RAM(0x1fc), QLCNIC_BDINFO_MAGIC);
+                goto check_fw_status;
 
         if (load_fw_file)
                 qlcnic_request_firmware(adapter);
         else {
-                if (qlcnic_check_flash_fw_ver(adapter))
+                err = qlcnic_check_flash_fw_ver(adapter);
+                if (err)
                         goto err_out;
 
                 adapter->fw_type = QLCNIC_FLASH_ROMIMAGE;
         }
 
         err = qlcnic_need_fw_reset(adapter);
-        if (err < 0)
-                goto err_out;
         if (err == 0)
-                goto wait_init;
-
-        if (first_boot != 0x55555555) {
-                QLCWR32(adapter, CRB_CMDPEG_STATE, 0);
-                QLCWR32(adapter, CRB_RCVPEG_STATE, 0);
-                qlcnic_pinit_from_rom(adapter);
-                msleep(1);
-        }
-
-        QLCWR32(adapter, QLCNIC_PEG_HALT_STATUS1, 0);
-        QLCWR32(adapter, QLCNIC_PEG_HALT_STATUS2, 0);
+                goto check_fw_status;
 
+        err = qlcnic_pinit_from_rom(adapter);
+        if (err)
+                goto err_out;
         qlcnic_set_port_mode(adapter);
 
         err = qlcnic_load_firmware(adapter);
@@ -868,26 +1038,27 @@ qlcnic_start_firmware(struct qlcnic_adapter *adapter)
                 goto err_out;
 
         qlcnic_release_firmware(adapter);
+        QLCWR32(adapter, CRB_DRIVER_VERSION, QLCNIC_DRIVER_VERSION);
 
-        val = (_QLCNIC_LINUX_MAJOR << 16)
-                | ((_QLCNIC_LINUX_MINOR << 8))
-                | (_QLCNIC_LINUX_SUBVERSION);
-        QLCWR32(adapter, CRB_DRIVER_VERSION, val);
-
-wait_init:
-        /* Handshake with the card before we register the devices. */
-        err = qlcnic_init_firmware(adapter);
+check_fw_status:
+        err = qlcnic_check_fw_status(adapter);
         if (err)
                 goto err_out;
 
         QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_READY);
         qlcnic_idc_debug_info(adapter, 1);
 
-        qlcnic_check_options(adapter);
-        if (qlcnic_reset_npar_config(adapter))
+        err = qlcnic_check_eswitch_mode(adapter);
+        if (err) {
+                dev_err(&adapter->pdev->dev,
+                        "Memory allocation failed for eswitch\n");
+                goto err_out;
+        }
+        err = qlcnic_set_mgmt_operations(adapter);
+        if (err)
                 goto err_out;
-        qlcnic_dev_set_npar_ready(adapter);
 
+        qlcnic_check_options(adapter);
         adapter->need_fw_reset = 0;
 
         qlcnic_release_firmware(adapter);
@@ -896,6 +1067,7 @@ wait_init:
 err_out:
         QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_FAILED);
         dev_err(&adapter->pdev->dev, "Device state set to failed\n");
+
         qlcnic_release_firmware(adapter);
         return err;
 }
@@ -979,6 +1151,8 @@ __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
 
         if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
                 return 0;
+        if (qlcnic_set_eswitch_port_config(adapter))
+                return -EIO;
 
         if (qlcnic_fw_create_ctx(adapter))
                 return -EIO;
@@ -998,7 +1172,7 @@ __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
 
         qlcnic_config_intr_coalesce(adapter);
 
-        if (adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO)
+        if (netdev->features & NETIF_F_LRO)
                 qlcnic_config_hw_lro(adapter, QLCNIC_LRO_ENABLED);
 
         qlcnic_napi_enable(adapter);
@@ -1041,6 +1215,9 @@ __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
 
         qlcnic_free_mac_list(adapter);
 
+        if (adapter->fhash.fnum)
+                qlcnic_delete_lb_filters(adapter);
+
         qlcnic_nic_set_promisc(adapter, QLCNIC_NIU_NON_PROMISC_MODE);
 
         qlcnic_napi_disable(adapter);
@@ -1277,7 +1454,7 @@ qlcnic_setup_netdev(struct qlcnic_adapter *adapter,
         SET_ETHTOOL_OPS(netdev, &qlcnic_ethtool_ops);
 
         netdev->features |= (NETIF_F_SG | NETIF_F_IP_CSUM |
-                NETIF_F_IPV6_CSUM | NETIF_F_GRO);
+                NETIF_F_IPV6_CSUM | NETIF_F_GRO | NETIF_F_HW_VLAN_RX);
         netdev->vlan_features |= (NETIF_F_SG | NETIF_F_IP_CSUM |
                 NETIF_F_IPV6_CSUM);
 
@@ -1296,12 +1473,8 @@ qlcnic_setup_netdev(struct qlcnic_adapter *adapter,
 
         if (adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO)
                 netdev->features |= NETIF_F_LRO;
-
         netdev->irq = adapter->msix_entries[0].vector;
 
-        if (qlcnic_read_mac_addr(adapter))
-                dev_warn(&pdev->dev, "failed to read mac addr\n");
-
         netif_carrier_off(netdev);
         netif_stop_queue(netdev);
 
@@ -1338,6 +1511,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int err;
         uint8_t revision_id;
         uint8_t pci_using_dac;
+        char brd_name[QLCNIC_MAX_BOARD_NAME_LEN];
 
         err = pci_enable_device(pdev);
         if (err)
@@ -1395,10 +1569,8 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_iounmap;
         }
 
-        if (qlcnic_read_mac_addr(adapter))
-                dev_warn(&pdev->dev, "failed to read mac addr\n");
-
-        if (qlcnic_setup_idc_param(adapter))
+        err = qlcnic_setup_idc_param(adapter);
+        if (err)
                 goto err_out_iounmap;
 
         err = adapter->nic_ops->start_firmware(adapter);
@@ -1407,6 +1579,17 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_decr_ref;
         }
 
+        if (qlcnic_read_mac_addr(adapter))
+                dev_warn(&pdev->dev, "failed to read mac addr\n");
+
+        if (adapter->portnum == 0) {
+                get_brd_name(adapter, brd_name);
+
+                pr_info("%s: %s Board Chip rev 0x%x\n",
+                                module_name(THIS_MODULE),
+                                brd_name, adapter->ahw.revision_id);
+        }
+
         qlcnic_clear_stats(adapter);
 
         qlcnic_setup_intr(adapter);
@@ -1430,6 +1613,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 break;
         }
 
+        qlcnic_alloc_lb_filters_mem(adapter);
         qlcnic_create_diag_entries(adapter);
 
         return 0;
@@ -1438,7 +1622,7 @@ err_out_disable_msi:
         qlcnic_teardown_intr(adapter);
 
 err_out_decr_ref:
-        qlcnic_clr_all_drv_state(adapter);
+        qlcnic_clr_all_drv_state(adapter, 0);
 
 err_out_iounmap:
         qlcnic_cleanup_pci_map(adapter);
@@ -1477,10 +1661,12 @@ static void __devexit qlcnic_remove(struct pci_dev *pdev)
         if (adapter->eswitch != NULL)
                 kfree(adapter->eswitch);
 
-        qlcnic_clr_all_drv_state(adapter);
+        qlcnic_clr_all_drv_state(adapter, 0);
 
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
 
+        qlcnic_free_lb_filters_mem(adapter);
+
         qlcnic_teardown_intr(adapter);
 
         qlcnic_remove_diag_entries(adapter);
@@ -1509,7 +1695,7 @@ static int __qlcnic_shutdown(struct pci_dev *pdev)
         if (netif_running(netdev))
                 qlcnic_down(adapter, netdev);
 
-        qlcnic_clr_all_drv_state(adapter);
+        qlcnic_clr_all_drv_state(adapter, 0);
 
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
 
@@ -1573,7 +1759,7 @@ qlcnic_resume(struct pci_dev *pdev)
                 if (err)
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
 done:
         netif_device_attach(netdev);
@@ -1587,9 +1773,6 @@ static int qlcnic_open(struct net_device *netdev)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int err;
 
-        if (adapter->driver_mismatch)
-                return -EIO;
-
         err = qlcnic_attach(adapter);
         if (err)
                 return err;
@@ -1619,6 +1802,119 @@ static int qlcnic_close(struct net_device *netdev)
 }
 
 static void
+qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter)
+{
+        void *head;
+        int i;
+
+        if (!qlcnic_mac_learn)
+                return;
+
+        spin_lock_init(&adapter->mac_learn_lock);
+
+        head = kcalloc(QLCNIC_LB_MAX_FILTERS, sizeof(struct hlist_head),
+                                                                GFP_KERNEL);
+        if (!head)
+                return;
+
+        adapter->fhash.fmax = QLCNIC_LB_MAX_FILTERS;
+        adapter->fhash.fhead = (struct hlist_head *)head;
+
+        for (i = 0; i < adapter->fhash.fmax; i++)
+                INIT_HLIST_HEAD(&adapter->fhash.fhead[i]);
+}
+
+static void qlcnic_free_lb_filters_mem(struct qlcnic_adapter *adapter)
+{
+        if (adapter->fhash.fmax && adapter->fhash.fhead)
+                kfree(adapter->fhash.fhead);
+
+        adapter->fhash.fhead = NULL;
+        adapter->fhash.fmax = 0;
+}
+
+static void qlcnic_change_filter(struct qlcnic_adapter *adapter,
+                u64 uaddr, u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring)
+{
+        struct cmd_desc_type0 *hwdesc;
+        struct qlcnic_nic_req *req;
+        struct qlcnic_mac_req *mac_req;
+        u32 producer;
+        u64 word;
+
+        producer = tx_ring->producer;
+        hwdesc = &tx_ring->desc_head[tx_ring->producer];
+
+        req = (struct qlcnic_nic_req *)hwdesc;
+        memset(req, 0, sizeof(struct qlcnic_nic_req));
+        req->qhdr = cpu_to_le64(QLCNIC_REQUEST << 23);
+
+        word = QLCNIC_MAC_EVENT | ((u64)(adapter->portnum) << 16);
+        req->req_hdr = cpu_to_le64(word);
+
+        mac_req = (struct qlcnic_mac_req *)&(req->words[0]);
+        mac_req->op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
+        memcpy(mac_req->mac_addr, &uaddr, ETH_ALEN);
+
+        req->words[1] = cpu_to_le64(vlan_id);
+
+        tx_ring->producer = get_next_index(producer, tx_ring->num_desc);
+}
+
+#define QLCNIC_MAC_HASH(MAC)\
+        ((((MAC) & 0x70000) >> 0x10) | (((MAC) & 0x70000000000ULL) >> 0x25))
+
+static void
+qlcnic_send_filter(struct qlcnic_adapter *adapter,
+                struct qlcnic_host_tx_ring *tx_ring,
+                struct cmd_desc_type0 *first_desc,
+                struct sk_buff *skb)
+{
+        struct ethhdr *phdr = (struct ethhdr *)(skb->data);
+        struct qlcnic_filter *fil, *tmp_fil;
+        struct hlist_node *tmp_hnode, *n;
+        struct hlist_head *head;
+        u64 src_addr = 0;
+        u16 vlan_id = 0;
+        u8 hindex;
+
+        if (!compare_ether_addr(phdr->h_source, adapter->mac_addr))
+                return;
+
+        if (adapter->fhash.fnum >= adapter->fhash.fmax)
+                return;
+
+        /* Only NPAR capable devices support vlan based learning*/
+        if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
+                vlan_id = first_desc->vlan_TCI;
+        memcpy(&src_addr, phdr->h_source, ETH_ALEN);
+        hindex = QLCNIC_MAC_HASH(src_addr) & (QLCNIC_LB_MAX_FILTERS - 1);
+        head = &(adapter->fhash.fhead[hindex]);
+
+        hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
+                            tmp_fil->vlan_id == vlan_id) {
+                        tmp_fil->ftime = jiffies;
+                        return;
+                }
+        }
+
+        fil = kzalloc(sizeof(struct qlcnic_filter), GFP_ATOMIC);
+        if (!fil)
+                return;
+
+        qlcnic_change_filter(adapter, src_addr, vlan_id, tx_ring);
+
+        fil->ftime = jiffies;
+        fil->vlan_id = vlan_id;
+        memcpy(fil->faddr, &src_addr, ETH_ALEN);
+        spin_lock(&adapter->mac_learn_lock);
+        hlist_add_head(&(fil->fnode), head);
+        adapter->fhash.fnum++;
+        spin_unlock(&adapter->mac_learn_lock);
+}
+
+static void
 qlcnic_tso_check(struct net_device *netdev,
                 struct qlcnic_host_tx_ring *tx_ring,
                 struct cmd_desc_type0 *first_desc,
@@ -1626,26 +1922,13 @@ qlcnic_tso_check(struct net_device *netdev,
 {
         u8 opcode = TX_ETHER_PKT;
         __be16 protocol = skb->protocol;
-        u16 flags = 0, vid = 0;
-        int copied, offset, copy_len, hdr_len = 0, tso = 0, vlan_oob = 0;
+        u16 flags = 0;
+        int copied, offset, copy_len, hdr_len = 0, tso = 0;
         struct cmd_desc_type0 *hwdesc;
         struct vlan_ethhdr *vh;
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         u32 producer = tx_ring->producer;
-
-        if (protocol == cpu_to_be16(ETH_P_8021Q)) {
-
-                vh = (struct vlan_ethhdr *)skb->data;
-                protocol = vh->h_vlan_encapsulated_proto;
-                flags = FLAGS_VLAN_TAGGED;
-
-        } else if (vlan_tx_tag_present(skb)) {
-
-                flags = FLAGS_VLAN_OOB;
-                vid = vlan_tx_tag_get(skb);
-                qlcnic_set_tx_vlan_tci(first_desc, vid);
-                vlan_oob = 1;
-        }
+        int vlan_oob = first_desc->flags_opcode & cpu_to_le16(FLAGS_VLAN_OOB);
 
         if (*(skb->data) & BIT_0) {
                 flags |= BIT_0;
@@ -1716,7 +1999,7 @@ qlcnic_tso_check(struct net_device *netdev,
                 vh = (struct vlan_ethhdr *)((char *)hwdesc + 2);
                 skb_copy_from_linear_data(skb, vh, 12);
                 vh->h_vlan_proto = htons(ETH_P_8021Q);
-                vh->h_vlan_TCI = htons(vid);
+                vh->h_vlan_TCI = htons(first_desc->vlan_TCI);
                 skb_copy_from_linear_data_offset(skb, 12,
                                 (char *)vh + 16, copy_len - 16);
 
@@ -1796,11 +2079,47 @@ out_err:
         return -ENOMEM;
 }
 
+static int
+qlcnic_check_tx_tagging(struct qlcnic_adapter *adapter,
+                        struct sk_buff *skb,
+                        struct cmd_desc_type0 *first_desc)
+{
+        u8 opcode = 0;
+        u16 flags = 0;
+        __be16 protocol = skb->protocol;
+        struct vlan_ethhdr *vh;
+
+        if (protocol == cpu_to_be16(ETH_P_8021Q)) {
+                vh = (struct vlan_ethhdr *)skb->data;
+                protocol = vh->h_vlan_encapsulated_proto;
+                flags = FLAGS_VLAN_TAGGED;
+                qlcnic_set_tx_vlan_tci(first_desc, ntohs(vh->h_vlan_TCI));
+        } else if (vlan_tx_tag_present(skb)) {
+                flags = FLAGS_VLAN_OOB;
+                qlcnic_set_tx_vlan_tci(first_desc, vlan_tx_tag_get(skb));
+        }
+        if (unlikely(adapter->pvid)) {
+                if (first_desc->vlan_TCI &&
+                                !(adapter->flags & QLCNIC_TAGGING_ENABLED))
+                        return -EIO;
+                if (first_desc->vlan_TCI &&
+                                (adapter->flags & QLCNIC_TAGGING_ENABLED))
+                        goto set_flags;
+
+                flags = FLAGS_VLAN_OOB;
+                qlcnic_set_tx_vlan_tci(first_desc, adapter->pvid);
+        }
+set_flags:
+        qlcnic_set_tx_flags_opcode(first_desc, flags, opcode);
+        return 0;
+}
+
 static inline void
 qlcnic_clear_cmddesc(u64 *desc)
 {
         desc[0] = 0ULL;
         desc[2] = 0ULL;
+        desc[7] = 0ULL;
 }
 
 netdev_tx_t
@@ -1812,6 +2131,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         struct qlcnic_skb_frag *buffrag;
         struct cmd_desc_type0 *hwdesc, *first_desc;
         struct pci_dev *pdev;
+        struct ethhdr *phdr;
         int i, k;
 
         u32 producer;
@@ -1823,6 +2143,13 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 return NETDEV_TX_BUSY;
         }
 
+        if (adapter->flags & QLCNIC_MACSPOOF) {
+                phdr = (struct ethhdr *)skb->data;
+                if (compare_ether_addr(phdr->h_source,
+                                        adapter->mac_addr))
+                        goto drop_packet;
+        }
+
         frag_count = skb_shinfo(skb)->nr_frags + 1;
 
         /* 4 fragments per cmd des */
@@ -1844,6 +2171,12 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         pdev = adapter->pdev;
 
+        first_desc = hwdesc = &tx_ring->desc_head[producer];
+        qlcnic_clear_cmddesc((u64 *)hwdesc);
+
+        if (qlcnic_check_tx_tagging(adapter, skb, first_desc))
+                goto drop_packet;
+
         if (qlcnic_map_tx_skb(pdev, skb, pbuf)) {
                 adapter->stats.tx_dma_map_error++;
                 goto drop_packet;
@@ -1852,9 +2185,6 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         pbuf->skb = skb;
         pbuf->frag_count = frag_count;
 
-        first_desc = hwdesc = &tx_ring->desc_head[producer];
-        qlcnic_clear_cmddesc((u64 *)hwdesc);
-
         qlcnic_set_tx_frags_len(first_desc, frag_count, skb->len);
         qlcnic_set_tx_port(first_desc, adapter->portnum);
 
@@ -1893,6 +2223,9 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         qlcnic_tso_check(netdev, tx_ring, first_desc, skb);
 
+        if (qlcnic_mac_learn)
+                qlcnic_send_filter(adapter, tx_ring, first_desc, skb);
+
         qlcnic_update_cmd_producer(adapter, tx_ring);
 
         adapter->stats.txbytes += skb->len;
@@ -1947,14 +2280,14 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
         struct net_device *netdev = adapter->netdev;
 
         if (adapter->ahw.linkup && !linkup) {
-                dev_info(&netdev->dev, "NIC Link is down\n");
+                netdev_info(netdev, "NIC Link is down\n");
                 adapter->ahw.linkup = 0;
                 if (netif_running(netdev)) {
                         netif_carrier_off(netdev);
                         netif_stop_queue(netdev);
                 }
         } else if (!adapter->ahw.linkup && linkup) {
-                dev_info(&netdev->dev, "NIC Link is up\n");
+                netdev_info(netdev, "NIC Link is up\n");
                 adapter->ahw.linkup = 1;
                 if (netif_running(netdev)) {
                         netif_carrier_on(netdev);
@@ -2258,18 +2591,22 @@ qlcnic_clr_drv_state(struct qlcnic_adapter *adapter)
 }
 
 static void
-qlcnic_clr_all_drv_state(struct qlcnic_adapter *adapter)
+qlcnic_clr_all_drv_state(struct qlcnic_adapter *adapter, u8 failed)
 {
         u32  val;
 
         if (qlcnic_api_lock(adapter))
                 goto err;
 
-        val = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
+        val = QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE);
         QLC_DEV_CLR_REF_CNT(val, adapter->portnum);
-        QLCWR32(adapter, QLCNIC_CRB_DEV_REF_COUNT, val);
+        QLCWR32(adapter, QLCNIC_CRB_DRV_ACTIVE, val);
 
-        if (!(val & 0x11111111))
+        if (failed) {
+                QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_FAILED);
+                dev_info(&adapter->pdev->dev,
+                                "Device state set to Failed. Please Reboot\n");
+        } else if (!(val & 0x11111111))
                 QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_COLD);
 
         val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
@@ -2290,7 +2627,7 @@ qlcnic_check_drv_state(struct qlcnic_adapter *adapter)
         int act, state;
 
         state = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-        act = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
+        act = QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE);
 
         if (((state & 0x11111111) == (act & 0x11111111)) ||
                         ((act & 0x11111111) == ((state >> 1) & 0x11111111)))
@@ -2325,10 +2662,10 @@ qlcnic_can_start_firmware(struct qlcnic_adapter *adapter)
         if (qlcnic_api_lock(adapter))
                 return -1;
 
-        val = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
+        val = QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE);
         if (!(val & (1 << (portnum * 4)))) {
                 QLC_DEV_SET_REF_CNT(val, portnum);
-                QLCWR32(adapter, QLCNIC_CRB_DEV_REF_COUNT, val);
+                QLCWR32(adapter, QLCNIC_CRB_DRV_ACTIVE, val);
         }
 
         prev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
@@ -2403,7 +2740,7 @@ qlcnic_fwinit_work(struct work_struct *work)
 {
         struct qlcnic_adapter *adapter = container_of(work,
                         struct qlcnic_adapter, fw_work.work);
-        u32 dev_state = 0xf, npar_state;
+        u32 dev_state = 0xf;
 
         if (qlcnic_api_lock(adapter))
                 goto err_ret;
@@ -2417,16 +2754,8 @@ qlcnic_fwinit_work(struct work_struct *work)
         }
 
         if (adapter->op_mode == QLCNIC_NON_PRIV_FUNC) {
-                npar_state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
-                if (npar_state == QLCNIC_DEV_NPAR_RDY) {
-                        qlcnic_api_unlock(adapter);
-                        goto wait_npar;
-                } else {
-                        qlcnic_schedule_work(adapter, qlcnic_fwinit_work,
-                                FW_POLL_DELAY);
-                        qlcnic_api_unlock(adapter);
-                        return;
-                }
+                qlcnic_api_unlock(adapter);
+                goto wait_npar;
         }
 
         if (adapter->fw_wait_cnt++ > adapter->reset_ack_timeo) {
@@ -2463,6 +2792,7 @@ skip_ack_check:
 
                 if (!adapter->nic_ops->start_firmware(adapter)) {
                         qlcnic_schedule_work(adapter, qlcnic_attach_work, 0);
+                        adapter->fw_wait_cnt = 0;
                         return;
                 }
                 goto err_ret;
@@ -2475,27 +2805,25 @@ wait_npar:
         QLCDB(adapter, HW, "Func waiting: Device state=%u\n", dev_state);
 
         switch (dev_state) {
-        case QLCNIC_DEV_QUISCENT:
-        case QLCNIC_DEV_NEED_QUISCENT:
-        case QLCNIC_DEV_NEED_RESET:
-                qlcnic_schedule_work(adapter,
-                        qlcnic_fwinit_work, FW_POLL_DELAY);
-                return;
-        case QLCNIC_DEV_FAILED:
-                break;
-
-        default:
+        case QLCNIC_DEV_READY:
                 if (!adapter->nic_ops->start_firmware(adapter)) {
                         qlcnic_schedule_work(adapter, qlcnic_attach_work, 0);
+                        adapter->fw_wait_cnt = 0;
                         return;
                 }
+        case QLCNIC_DEV_FAILED:
+                break;
+        default:
+                qlcnic_schedule_work(adapter,
+                        qlcnic_fwinit_work, FW_POLL_DELAY);
+                return;
         }
 
 err_ret:
         dev_err(&adapter->pdev->dev, "Fwinit work failed state=%u "
                 "fw_wait_cnt=%u\n", dev_state, adapter->fw_wait_cnt);
         netif_device_attach(adapter->netdev);
-        qlcnic_clr_all_drv_state(adapter);
+        qlcnic_clr_all_drv_state(adapter, 0);
 }
 
 static void
@@ -2531,8 +2859,23 @@ err_ret:
         dev_err(&adapter->pdev->dev, "detach failed; status=%d temp=%d\n",
                         status, adapter->temp);
         netif_device_attach(netdev);
-        qlcnic_clr_all_drv_state(adapter);
+        qlcnic_clr_all_drv_state(adapter, 1);
+}
+
+/*Transit NPAR state to NON Operational */
+static void
+qlcnic_set_npar_non_operational(struct qlcnic_adapter *adapter)
+{
+        u32 state;
+
+        state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
+        if (state == QLCNIC_DEV_NPAR_NON_OPER)
+                return;
 
+        if (qlcnic_api_lock(adapter))
+                return;
+        QLCWR32(adapter, QLCNIC_CRB_DEV_NPAR_STATE, QLCNIC_DEV_NPAR_NON_OPER);
+        qlcnic_api_unlock(adapter);
 }
 
 /*Transit to RESET state from READY state only */
@@ -2553,6 +2896,7 @@ qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
                 qlcnic_idc_debug_info(adapter, 0);
         }
 
+        QLCWR32(adapter, QLCNIC_CRB_DEV_NPAR_STATE, QLCNIC_DEV_NPAR_NON_OPER);
         qlcnic_api_unlock(adapter);
 }
 
@@ -2560,21 +2904,11 @@ qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
 static void
 qlcnic_dev_set_npar_ready(struct qlcnic_adapter *adapter)
 {
-        u32 state;
-
-        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                adapter->op_mode == QLCNIC_NON_PRIV_FUNC)
-                return;
         if (qlcnic_api_lock(adapter))
                 return;
 
-        state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
-
-        if (state != QLCNIC_DEV_NPAR_RDY) {
-                QLCWR32(adapter, QLCNIC_CRB_DEV_NPAR_STATE,
-                        QLCNIC_DEV_NPAR_RDY);
-                QLCDB(adapter, DRV, "NPAR READY state set\n");
-        }
+        QLCWR32(adapter, QLCNIC_CRB_DEV_NPAR_STATE, QLCNIC_DEV_NPAR_OPER);
+        QLCDB(adapter, DRV, "NPAR operational state set\n");
 
         qlcnic_api_unlock(adapter);
 }
@@ -2605,12 +2939,26 @@ qlcnic_attach_work(struct work_struct *work)
         struct qlcnic_adapter *adapter = container_of(work,
                                 struct qlcnic_adapter, fw_work.work);
         struct net_device *netdev = adapter->netdev;
+        u32 npar_state;
 
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC) {
+                npar_state = QLCRD32(adapter, QLCNIC_CRB_DEV_NPAR_STATE);
+                if (adapter->fw_wait_cnt++ > QLCNIC_DEV_NPAR_OPER_TIMEO)
+                        qlcnic_clr_all_drv_state(adapter, 0);
+                else if (npar_state != QLCNIC_DEV_NPAR_OPER)
+                        qlcnic_schedule_work(adapter, qlcnic_attach_work,
+                                                        FW_POLL_DELAY);
+                else
+                        goto attach;
+                QLCDB(adapter, DRV, "Waiting for NPAR state to operational\n");
+                return;
+        }
+attach:
         if (netif_running(netdev)) {
                 if (qlcnic_up(adapter, netdev))
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
 
 done:
@@ -2626,7 +2974,7 @@ done:
 static int
 qlcnic_check_health(struct qlcnic_adapter *adapter)
 {
-        u32 state = 0, heartbit;
+        u32 state = 0, heartbeat;
         struct net_device *netdev = adapter->netdev;
 
         if (qlcnic_check_temp(adapter))
@@ -2636,12 +2984,15 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
                 qlcnic_dev_request_reset(adapter);
 
         state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-        if (state == QLCNIC_DEV_NEED_RESET || state == QLCNIC_DEV_NEED_QUISCENT)
+        if (state == QLCNIC_DEV_NEED_RESET ||
+            state == QLCNIC_DEV_NEED_QUISCENT) {
+                qlcnic_set_npar_non_operational(adapter);
                 adapter->need_fw_reset = 1;
+        }
 
-        heartbit = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
-        if (heartbit != adapter->heartbit) {
-                adapter->heartbit = heartbit;
+        heartbeat = QLCRD32(adapter, QLCNIC_PEG_ALIVE_COUNTER);
+        if (heartbeat != adapter->heartbeat) {
+                adapter->heartbeat = heartbeat;
                 adapter->fw_fail_cnt = 0;
                 if (adapter->need_fw_reset)
                         goto detach;
@@ -2692,6 +3043,9 @@ qlcnic_fw_poll_work(struct work_struct *work)
         if (qlcnic_check_health(adapter))
                 return;
 
+        if (adapter->fhash.fnum)
+                qlcnic_prune_lb_filters(adapter);
+
 reschedule:
         qlcnic_schedule_work(adapter, qlcnic_fw_poll_work, FW_POLL_DELAY);
 }
@@ -2738,7 +3092,7 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
         if (qlcnic_api_lock(adapter))
                 return -EINVAL;
 
-        if (first_func) {
+        if (adapter->op_mode != QLCNIC_NON_PRIV_FUNC && first_func) {
                 adapter->need_fw_reset = 1;
                 set_bit(__QLCNIC_START_FW, &adapter->state);
                 QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_INITIALIZING);
@@ -2756,7 +3110,7 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
         if (netif_running(netdev)) {
                 err = qlcnic_attach(adapter);
                 if (err) {
-                        qlcnic_clr_all_drv_state(adapter);
+                        qlcnic_clr_all_drv_state(adapter, 1);
                         clear_bit(__QLCNIC_AER, &adapter->state);
                         netif_device_attach(netdev);
                         return err;
@@ -2766,7 +3120,7 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
                 if (err)
                         goto done;
 
-                qlcnic_config_indev_addr(netdev, NETDEV_UP);
+                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
         }
  done:
         netif_device_attach(netdev);
@@ -2822,7 +3176,6 @@ static void qlcnic_io_resume(struct pci_dev *pdev)
                                                 FW_POLL_DELAY);
 }
 
-
 static int
 qlcnicvf_start_firmware(struct qlcnic_adapter *adapter)
 {
@@ -2832,8 +3185,20 @@ qlcnicvf_start_firmware(struct qlcnic_adapter *adapter)
         if (err)
                 return err;
 
+        err = qlcnic_check_npar_opertional(adapter);
+        if (err)
+                return err;
+
+        err = qlcnic_initialize_nic(adapter);
+        if (err)
+                return err;
+
         qlcnic_check_options(adapter);
 
+        err = qlcnic_set_eswitch_port_config(adapter);
+        if (err)
+                return err;
+
         adapter->need_fw_reset = 0;
 
         return err;
@@ -3093,9 +3458,6 @@ validate_pm_config(struct qlcnic_adapter *adapter,
                 if (adapter->npars[dest_pci_func].type != QLCNIC_TYPE_NIC)
                         return QL_STATUS_INVALID_PARAM;
 
-                if (!IS_VALID_MODE(pm_cfg[i].action))
-                        return QL_STATUS_INVALID_PARAM;
-
                 s_esw_id = adapter->npars[src_pci_func].phy_port;
                 d_esw_id = adapter->npars[dest_pci_func].phy_port;
 
@@ -3129,7 +3491,7 @@ qlcnic_sysfs_write_pm_config(struct file *filp, struct kobject *kobj,
                 return ret;
         for (i = 0; i < count; i++) {
                 pci_func = pm_cfg[i].pci_func;
-                action = pm_cfg[i].action;
+                action = !!pm_cfg[i].action;
                 id = adapter->npars[pci_func].phy_port;
                 ret = qlcnic_config_port_mirroring(adapter, id,
                                                 action, pci_func);
@@ -3140,7 +3502,7 @@ qlcnic_sysfs_write_pm_config(struct file *filp, struct kobject *kobj,
         for (i = 0; i < count; i++) {
                 pci_func = pm_cfg[i].pci_func;
                 id = adapter->npars[pci_func].phy_port;
-                adapter->npars[pci_func].enable_pm = pm_cfg[i].action;
+                adapter->npars[pci_func].enable_pm = !!pm_cfg[i].action;
                 adapter->npars[pci_func].dest_npar = id;
         }
         return size;
@@ -3172,30 +3534,45 @@ qlcnic_sysfs_read_pm_config(struct file *filp, struct kobject *kobj,
 
 static int
 validate_esw_config(struct qlcnic_adapter *adapter,
-                        struct qlcnic_esw_func_cfg *esw_cfg, int count)
+        struct qlcnic_esw_func_cfg *esw_cfg, int count)
 {
+        u32 op_mode;
         u8 pci_func;
         int i;
 
+        op_mode = readl(adapter->ahw.pci_base0 + QLCNIC_DRV_OP_MODE);
+
         for (i = 0; i < count; i++) {
                 pci_func = esw_cfg[i].pci_func;
                 if (pci_func >= QLCNIC_MAX_PCI_FUNC)
                         return QL_STATUS_INVALID_PARAM;
 
-                if (adapter->npars[i].type != QLCNIC_TYPE_NIC)
-                        return QL_STATUS_INVALID_PARAM;
+                if (adapter->op_mode == QLCNIC_MGMT_FUNC)
+                        if (adapter->npars[pci_func].type != QLCNIC_TYPE_NIC)
+                                return QL_STATUS_INVALID_PARAM;
 
-                if (esw_cfg->host_vlan_tag == 1)
+                switch (esw_cfg[i].op_mode) {
+                case QLCNIC_PORT_DEFAULTS:
+                        if (QLC_DEV_GET_DRV(op_mode, pci_func) !=
+                                                QLCNIC_NON_PRIV_FUNC) {
+                                esw_cfg[i].mac_anti_spoof = 0;
+                                esw_cfg[i].mac_override = 1;
+                        }
+                        break;
+                case QLCNIC_ADD_VLAN:
                         if (!IS_VALID_VLAN(esw_cfg[i].vlan_id))
                                 return QL_STATUS_INVALID_PARAM;
-
-                if (!IS_VALID_MODE(esw_cfg[i].promisc_mode)
-                                || !IS_VALID_MODE(esw_cfg[i].host_vlan_tag)
-                                || !IS_VALID_MODE(esw_cfg[i].mac_learning)
-                                || !IS_VALID_MODE(esw_cfg[i].discard_tagged))
+                        if (!esw_cfg[i].op_type)
+                                return QL_STATUS_INVALID_PARAM;
+                        break;
+                case QLCNIC_DEL_VLAN:
+                        if (!esw_cfg[i].op_type)
+                                return QL_STATUS_INVALID_PARAM;
+                        break;
+                default:
                         return QL_STATUS_INVALID_PARAM;
+                }
         }
-
         return 0;
 }
 
@@ -3206,8 +3583,9 @@ qlcnic_sysfs_write_esw_config(struct file *file, struct kobject *kobj,
         struct device *dev = container_of(kobj, struct device, kobj);
         struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
         struct qlcnic_esw_func_cfg *esw_cfg;
+        struct qlcnic_npar_info *npar;
         int count, rem, i, ret;
-        u8 id, pci_func;
+        u8 pci_func, op_mode = 0;
 
         count   = size / sizeof(struct qlcnic_esw_func_cfg);
         rem     = size % sizeof(struct qlcnic_esw_func_cfg);
@@ -3220,30 +3598,55 @@ qlcnic_sysfs_write_esw_config(struct file *file, struct kobject *kobj,
                 return ret;
 
         for (i = 0; i < count; i++) {
-                pci_func = esw_cfg[i].pci_func;
-                id = adapter->npars[pci_func].phy_port;
-                ret = qlcnic_config_switch_port(adapter, id,
-                                                esw_cfg[i].host_vlan_tag,
-                                                esw_cfg[i].discard_tagged,
-                                                esw_cfg[i].promisc_mode,
-                                                esw_cfg[i].mac_learning,
-                                                esw_cfg[i].pci_func,
-                                                esw_cfg[i].vlan_id);
-                if (ret)
-                        return ret;
+                if (adapter->op_mode == QLCNIC_MGMT_FUNC)
+                        if (qlcnic_config_switch_port(adapter, &esw_cfg[i]))
+                                return QL_STATUS_INVALID_PARAM;
+
+                if (adapter->ahw.pci_func != esw_cfg[i].pci_func)
+                        continue;
+
+                op_mode = esw_cfg[i].op_mode;
+                qlcnic_get_eswitch_port_config(adapter, &esw_cfg[i]);
+                esw_cfg[i].op_mode = op_mode;
+                esw_cfg[i].pci_func = adapter->ahw.pci_func;
+
+                switch (esw_cfg[i].op_mode) {
+                case QLCNIC_PORT_DEFAULTS:
+                        qlcnic_set_eswitch_port_features(adapter, &esw_cfg[i]);
+                        break;
+                case QLCNIC_ADD_VLAN:
+                        qlcnic_set_vlan_config(adapter, &esw_cfg[i]);
+                        break;
+                case QLCNIC_DEL_VLAN:
+                        esw_cfg[i].vlan_id = 0;
+                        qlcnic_set_vlan_config(adapter, &esw_cfg[i]);
+                        break;
+                }
         }
 
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
+                goto out;
+
         for (i = 0; i < count; i++) {
                 pci_func = esw_cfg[i].pci_func;
-                adapter->npars[pci_func].promisc_mode = esw_cfg[i].promisc_mode;
-                adapter->npars[pci_func].mac_learning = esw_cfg[i].mac_learning;
-                adapter->npars[pci_func].vlan_id = esw_cfg[i].vlan_id;
-                adapter->npars[pci_func].discard_tagged =
-                                                esw_cfg[i].discard_tagged;
-                adapter->npars[pci_func].host_vlan_tag =
-                                                esw_cfg[i].host_vlan_tag;
+                npar = &adapter->npars[pci_func];
+                switch (esw_cfg[i].op_mode) {
+                case QLCNIC_PORT_DEFAULTS:
+                        npar->promisc_mode = esw_cfg[i].promisc_mode;
+                        npar->mac_override = esw_cfg[i].mac_override;
+                        npar->offload_flags = esw_cfg[i].offload_flags;
+                        npar->mac_anti_spoof = esw_cfg[i].mac_anti_spoof;
+                        npar->discard_tagged = esw_cfg[i].discard_tagged;
+                        break;
+                case QLCNIC_ADD_VLAN:
+                        npar->pvid = esw_cfg[i].vlan_id;
+                        break;
+                case QLCNIC_DEL_VLAN:
+                        npar->pvid = 0;
+                        break;
+                }
         }
-
+out:
         return size;
 }
 
@@ -3254,7 +3657,7 @@ qlcnic_sysfs_read_esw_config(struct file *file, struct kobject *kobj,
         struct device *dev = container_of(kobj, struct device, kobj);
         struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
         struct qlcnic_esw_func_cfg esw_cfg[QLCNIC_MAX_PCI_FUNC];
-        int i;
+        u8 i;
 
         if (size != sizeof(esw_cfg))
                 return QL_STATUS_INVALID_PARAM;
@@ -3262,12 +3665,9 @@ qlcnic_sysfs_read_esw_config(struct file *file, struct kobject *kobj,
         for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
                 if (adapter->npars[i].type != QLCNIC_TYPE_NIC)
                         continue;
-
-                esw_cfg[i].host_vlan_tag = adapter->npars[i].host_vlan_tag;
-                esw_cfg[i].promisc_mode = adapter->npars[i].promisc_mode;
-                esw_cfg[i].discard_tagged = adapter->npars[i].discard_tagged;
-                esw_cfg[i].vlan_id = adapter->npars[i].vlan_id;
-                esw_cfg[i].mac_learning = adapter->npars[i].mac_learning;
+                esw_cfg[i].pci_func = i;
+                if (qlcnic_get_eswitch_port_config(adapter, &esw_cfg[i]))
+                        return QL_STATUS_INVALID_PARAM;
         }
         memcpy(buf, &esw_cfg, size);
 
@@ -3370,6 +3770,115 @@ qlcnic_sysfs_read_npar_config(struct file *file, struct kobject *kobj,
 }
 
 static ssize_t
+qlcnic_sysfs_get_port_stats(struct file *file, struct kobject *kobj,
+        struct bin_attribute *attr, char *buf, loff_t offset, size_t size)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+        struct qlcnic_esw_statistics port_stats;
+        int ret;
+
+        if (size != sizeof(struct qlcnic_esw_statistics))
+                return QL_STATUS_INVALID_PARAM;
+
+        if (offset >= QLCNIC_MAX_PCI_FUNC)
+                return QL_STATUS_INVALID_PARAM;
+
+        memset(&port_stats, 0, size);
+        ret = qlcnic_get_port_stats(adapter, offset, QLCNIC_QUERY_RX_COUNTER,
+                                                                &port_stats.rx);
+        if (ret)
+                return ret;
+
+        ret = qlcnic_get_port_stats(adapter, offset, QLCNIC_QUERY_TX_COUNTER,
+                                                                &port_stats.tx);
+        if (ret)
+                return ret;
+
+        memcpy(buf, &port_stats, size);
+        return size;
+}
+
+static ssize_t
+qlcnic_sysfs_get_esw_stats(struct file *file, struct kobject *kobj,
+        struct bin_attribute *attr, char *buf, loff_t offset, size_t size)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+        struct qlcnic_esw_statistics esw_stats;
+        int ret;
+
+        if (size != sizeof(struct qlcnic_esw_statistics))
+                return QL_STATUS_INVALID_PARAM;
+
+        if (offset >= QLCNIC_NIU_MAX_XG_PORTS)
+                return QL_STATUS_INVALID_PARAM;
+
+        memset(&esw_stats, 0, size);
+        ret = qlcnic_get_eswitch_stats(adapter, offset, QLCNIC_QUERY_RX_COUNTER,
+                                                                &esw_stats.rx);
+        if (ret)
+                return ret;
+
+        ret = qlcnic_get_eswitch_stats(adapter, offset, QLCNIC_QUERY_TX_COUNTER,
+                                                                &esw_stats.tx);
+        if (ret)
+                return ret;
+
+        memcpy(buf, &esw_stats, size);
+        return size;
+}
+
+static ssize_t
+qlcnic_sysfs_clear_esw_stats(struct file *file, struct kobject *kobj,
+        struct bin_attribute *attr, char *buf, loff_t offset, size_t size)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+        int ret;
+
+        if (offset >= QLCNIC_NIU_MAX_XG_PORTS)
+                return QL_STATUS_INVALID_PARAM;
+
+        ret = qlcnic_clear_esw_stats(adapter, QLCNIC_STATS_ESWITCH, offset,
+                                                QLCNIC_QUERY_RX_COUNTER);
+        if (ret)
+                return ret;
+
+        ret = qlcnic_clear_esw_stats(adapter, QLCNIC_STATS_ESWITCH, offset,
+                                                QLCNIC_QUERY_TX_COUNTER);
+        if (ret)
+                return ret;
+
+        return size;
+}
+
+static ssize_t
+qlcnic_sysfs_clear_port_stats(struct file *file, struct kobject *kobj,
+        struct bin_attribute *attr, char *buf, loff_t offset, size_t size)
+{
+
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+        int ret;
+
+        if (offset >= QLCNIC_MAX_PCI_FUNC)
+                return QL_STATUS_INVALID_PARAM;
+
+        ret = qlcnic_clear_esw_stats(adapter, QLCNIC_STATS_PORT, offset,
+                                                QLCNIC_QUERY_RX_COUNTER);
+        if (ret)
+                return ret;
+
+        ret = qlcnic_clear_esw_stats(adapter, QLCNIC_STATS_PORT, offset,
+                                                QLCNIC_QUERY_TX_COUNTER);
+        if (ret)
+                return ret;
+
+        return size;
+}
+
+static ssize_t
 qlcnic_sysfs_read_pci_config(struct file *file, struct kobject *kobj,
         struct bin_attribute *attr, char *buf, loff_t offset, size_t size)
 {
@@ -3418,6 +3927,20 @@ static struct bin_attribute bin_attr_pci_config = {
         .write = NULL,
 };
 
+static struct bin_attribute bin_attr_port_stats = {
+        .attr = {.name = "port_stats", .mode = (S_IRUGO | S_IWUSR)},
+        .size = 0,
+        .read = qlcnic_sysfs_get_port_stats,
+        .write = qlcnic_sysfs_clear_port_stats,
+};
+
+static struct bin_attribute bin_attr_esw_stats = {
+        .attr = {.name = "esw_stats", .mode = (S_IRUGO | S_IWUSR)},
+        .size = 0,
+        .read = qlcnic_sysfs_get_esw_stats,
+        .write = qlcnic_sysfs_clear_esw_stats,
+};
+
 static struct bin_attribute bin_attr_esw_config = {
         .attr = {.name = "esw_config", .mode = (S_IRUGO | S_IWUSR)},
         .size = 0,
@@ -3457,6 +3980,9 @@ qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 {
         struct device *dev = &adapter->pdev->dev;
 
+        if (device_create_bin_file(dev, &bin_attr_port_stats))
+                dev_info(dev, "failed to create port stats sysfs entry");
+
         if (adapter->op_mode == QLCNIC_NON_PRIV_FUNC)
                 return;
         if (device_create_file(dev, &dev_attr_diag_mode))
@@ -3465,18 +3991,20 @@ qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
                 dev_info(dev, "failed to create crb sysfs entry\n");
         if (device_create_bin_file(dev, &bin_attr_mem))
                 dev_info(dev, "failed to create mem sysfs entry\n");
-        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                        adapter->op_mode != QLCNIC_MGMT_FUNC)
+        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return;
+        if (device_create_bin_file(dev, &bin_attr_esw_config))
+                dev_info(dev, "failed to create esw config sysfs entry");
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
                 return;
         if (device_create_bin_file(dev, &bin_attr_pci_config))
                 dev_info(dev, "failed to create pci config sysfs entry");
         if (device_create_bin_file(dev, &bin_attr_npar_config))
                 dev_info(dev, "failed to create npar config sysfs entry");
-        if (device_create_bin_file(dev, &bin_attr_esw_config))
-                dev_info(dev, "failed to create esw config sysfs entry");
         if (device_create_bin_file(dev, &bin_attr_pm_config))
                 dev_info(dev, "failed to create pm config sysfs entry");
-
+        if (device_create_bin_file(dev, &bin_attr_esw_stats))
+                dev_info(dev, "failed to create eswitch stats sysfs entry");
 }
 
 static void
@@ -3484,18 +4012,22 @@ qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 {
         struct device *dev = &adapter->pdev->dev;
 
+        device_remove_bin_file(dev, &bin_attr_port_stats);
+
         if (adapter->op_mode == QLCNIC_NON_PRIV_FUNC)
                 return;
         device_remove_file(dev, &dev_attr_diag_mode);
         device_remove_bin_file(dev, &bin_attr_crb);
         device_remove_bin_file(dev, &bin_attr_mem);
-        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                        adapter->op_mode != QLCNIC_MGMT_FUNC)
+        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
+                return;
+        device_remove_bin_file(dev, &bin_attr_esw_config);
+        if (adapter->op_mode != QLCNIC_MGMT_FUNC)
                 return;
         device_remove_bin_file(dev, &bin_attr_pci_config);
         device_remove_bin_file(dev, &bin_attr_npar_config);
-        device_remove_bin_file(dev, &bin_attr_esw_config);
         device_remove_bin_file(dev, &bin_attr_pm_config);
+        device_remove_bin_file(dev, &bin_attr_esw_stats);
 }
 
 #ifdef CONFIG_INET
@@ -3503,10 +4035,10 @@ qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 #define is_qlcnic_netdev(dev) (dev->netdev_ops == &qlcnic_netdev_ops)
 
 static void
-qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
+qlcnic_config_indev_addr(struct qlcnic_adapter *adapter,
+                        struct net_device *dev, unsigned long event)
 {
         struct in_device *indev;
-        struct qlcnic_adapter *adapter = netdev_priv(dev);
 
         indev = in_dev_get(dev);
         if (!indev)
@@ -3530,6 +4062,27 @@ qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
         in_dev_put(indev);
 }
 
+static void
+qlcnic_restore_indev_addr(struct net_device *netdev, unsigned long event)
+{
+        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        struct net_device *dev;
+        u16 vid;
+
+        qlcnic_config_indev_addr(adapter, netdev, event);
+
+        if (!adapter->vlgrp)
+                return;
+
+        for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
+                dev = vlan_group_get_device(adapter->vlgrp, vid);
+                if (!dev)
+                        continue;
+
+                qlcnic_config_indev_addr(adapter, dev, event);
+        }
+}
+
 static int qlcnic_netdev_event(struct notifier_block *this,
                                  unsigned long event, void *ptr)
 {
@@ -3556,7 +4109,7 @@ recheck:
         if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
                 goto done;
 
-        qlcnic_config_indev_addr(dev, event);
+        qlcnic_config_indev_addr(adapter, dev, event);
 done:
         return NOTIFY_DONE;
 }
@@ -3573,7 +4126,7 @@ qlcnic_inetaddr_event(struct notifier_block *this,
         dev = ifa->ifa_dev ? ifa->ifa_dev->dev : NULL;
 
 recheck:
-        if (dev == NULL || !netif_running(dev))
+        if (dev == NULL)
                 goto done;
 
         if (dev->priv_flags & IFF_802_1Q_VLAN) {
@@ -3616,7 +4169,7 @@ static struct notifier_block qlcnic_inetaddr_cb = {
 };
 #else
 static void
-qlcnic_config_indev_addr(struct net_device *dev, unsigned long event)
+qlcnic_restore_indev_addr(struct net_device *dev, unsigned long event)
 { }
 #endif
 static struct pci_error_handlers qlcnic_err_handler = {
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 5f89e83501f4..4ffebe83d883 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -1566,7 +1566,7 @@ static void ql_process_mac_rx_page(struct ql_adapter *qdev,
         rx_ring->rx_packets++;
         rx_ring->rx_bytes += skb->len;
         skb->protocol = eth_type_trans(skb, ndev);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         if (qdev->rx_csum &&
                 !(ib_mac_rsp->flags1 & IB_MAC_CSUM_ERR_MASK)) {
@@ -1676,7 +1676,7 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev,
         rx_ring->rx_packets++;
         rx_ring->rx_bytes += skb->len;
         skb->protocol = eth_type_trans(skb, ndev);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* If rx checksum is on, and there are no
          * csum or frame errors.
@@ -1996,7 +1996,7 @@ static void ql_process_mac_split_rx_intr(struct ql_adapter *qdev,
         }
 
         skb->protocol = eth_type_trans(skb, ndev);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* If rx checksum is on, and there are no
          * csum or frame errors.
@@ -2222,10 +2222,11 @@ static int ql_clean_outbound_rx_ring(struct rx_ring *rx_ring)
                 ql_update_cq(rx_ring);
                 prod = ql_read_sh_reg(rx_ring->prod_idx_sh_reg);
         }
+        if (!net_rsp)
+                return 0;
         ql_write_cq_idx(rx_ring);
         tx_ring = &qdev->tx_ring[net_rsp->txq_idx];
-        if (__netif_subqueue_stopped(qdev->ndev, tx_ring->wq_id) &&
-                                        net_rsp != NULL) {
+        if (__netif_subqueue_stopped(qdev->ndev, tx_ring->wq_id)) {
                 if (atomic_read(&tx_ring->queue_stopped) &&
                     (atomic_read(&tx_ring->tx_count) > (tx_ring->wq_len / 4)))
                         /*
@@ -3888,11 +3889,8 @@ int ql_wol(struct ql_adapter *qdev)
         return status;
 }
 
-static int ql_adapter_down(struct ql_adapter *qdev)
+static void ql_cancel_all_work_sync(struct ql_adapter *qdev)
 {
-        int i, status = 0;
-
-        ql_link_off(qdev);
 
         /* Don't kill the reset worker thread if we
          * are in the process of recovery.
@@ -3904,6 +3902,15 @@ static int ql_adapter_down(struct ql_adapter *qdev)
         cancel_delayed_work_sync(&qdev->mpi_idc_work);
         cancel_delayed_work_sync(&qdev->mpi_core_to_log);
         cancel_delayed_work_sync(&qdev->mpi_port_cfg_work);
+}
+
+static int ql_adapter_down(struct ql_adapter *qdev)
+{
+        int i, status = 0;
+
+        ql_link_off(qdev);
+
+        ql_cancel_all_work_sync(qdev);
 
         for (i = 0; i < qdev->rss_ring_count; i++)
                 napi_disable(&qdev->rx_ring[i].napi);
@@ -4726,6 +4733,7 @@ static void __devexit qlge_remove(struct pci_dev *pdev)
         struct net_device *ndev = pci_get_drvdata(pdev);
         struct ql_adapter *qdev = netdev_priv(ndev);
         del_timer_sync(&qdev->timer);
+        ql_cancel_all_work_sync(qdev);
         unregister_netdev(ndev);
         ql_release_all(pdev);
         pci_disable_device(pdev);
@@ -4745,13 +4753,7 @@ static void ql_eeh_close(struct net_device *ndev)
 
         /* Disabling the timer */
         del_timer_sync(&qdev->timer);
-        if (test_bit(QL_ADAPTER_UP, &qdev->flags))
-                cancel_delayed_work_sync(&qdev->asic_reset_work);
-        cancel_delayed_work_sync(&qdev->mpi_reset_work);
-        cancel_delayed_work_sync(&qdev->mpi_work);
-        cancel_delayed_work_sync(&qdev->mpi_idc_work);
-        cancel_delayed_work_sync(&qdev->mpi_core_to_log);
-        cancel_delayed_work_sync(&qdev->mpi_port_cfg_work);
+        ql_cancel_all_work_sync(qdev);
 
         for (i = 0; i < qdev->rss_ring_count; i++)
                 netif_napi_del(&qdev->rx_ring[i].napi);
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 142c381e1d73..68a84198eb05 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -200,7 +200,7 @@ struct r6040_private {
         int old_duplex;
 };
 
-static char version[] __devinitdata = KERN_INFO DRV_NAME
+static char version[] __devinitdata = DRV_NAME
         ": RDC R6040 NAPI net driver,"
         "version "DRV_VERSION " (" DRV_RELDATE ")";
 
@@ -224,7 +224,8 @@ static int r6040_phy_read(void __iomem *ioaddr, int phy_addr, int reg)
 }
 
 /* Write a word data from PHY Chip */
-static void r6040_phy_write(void __iomem *ioaddr, int phy_addr, int reg, u16 val)
+static void r6040_phy_write(void __iomem *ioaddr,
+                                        int phy_addr, int reg, u16 val)
 {
         int limit = 2048;
         u16 cmd;
@@ -348,8 +349,8 @@ static int r6040_alloc_rxbufs(struct net_device *dev)
                 }
                 desc->skb_ptr = skb;
                 desc->buf = cpu_to_le32(pci_map_single(lp->pdev,
-                                                desc->skb_ptr->data,
-                                                MAX_BUF_SIZE, PCI_DMA_FROMDEVICE));
+                                        desc->skb_ptr->data,
+                                        MAX_BUF_SIZE, PCI_DMA_FROMDEVICE));
                 desc->status = DSC_OWNER_MAC;
                 desc = desc->vndescp;
         } while (desc != lp->rx_ring);
@@ -491,12 +492,14 @@ static int r6040_close(struct net_device *dev)
 
         /* Free Descriptor memory */
         if (lp->rx_ring) {
-                pci_free_consistent(pdev, RX_DESC_SIZE, lp->rx_ring, lp->rx_ring_dma);
+                pci_free_consistent(pdev,
+                                RX_DESC_SIZE, lp->rx_ring, lp->rx_ring_dma);
                 lp->rx_ring = NULL;
         }
 
         if (lp->tx_ring) {
-                pci_free_consistent(pdev, TX_DESC_SIZE, lp->tx_ring, lp->tx_ring_dma);
+                pci_free_consistent(pdev,
+                                TX_DESC_SIZE, lp->tx_ring, lp->tx_ring_dma);
                 lp->tx_ring = NULL;
         }
 
@@ -547,7 +550,7 @@ static int r6040_rx(struct net_device *dev, int limit)
                         }
                         goto next_descr;
                 }
-                
+
                 /* Packet successfully received */
                 new_skb = netdev_alloc_skb(dev, MAX_BUF_SIZE);
                 if (!new_skb) {
@@ -556,13 +559,13 @@ static int r6040_rx(struct net_device *dev, int limit)
                 }
                 skb_ptr = descptr->skb_ptr;
                 skb_ptr->dev = priv->dev;
-                
+
                 /* Do not count the CRC */
                 skb_put(skb_ptr, descptr->len - 4);
                 pci_unmap_single(priv->pdev, le32_to_cpu(descptr->buf),
                                         MAX_BUF_SIZE, PCI_DMA_FROMDEVICE);
                 skb_ptr->protocol = eth_type_trans(skb_ptr, priv->dev);
-                
+
                 /* Send to upper layer */
                 netif_receive_skb(skb_ptr);
                 dev->stats.rx_packets++;
@@ -710,8 +713,10 @@ static int r6040_up(struct net_device *dev)
                 return ret;
 
         /* improve performance (by RDC guys) */
-        r6040_phy_write(ioaddr, 30, 17, (r6040_phy_read(ioaddr, 30, 17) | 0x4000));
-        r6040_phy_write(ioaddr, 30, 17, ~((~r6040_phy_read(ioaddr, 30, 17)) | 0x2000));
+        r6040_phy_write(ioaddr, 30, 17,
+                        (r6040_phy_read(ioaddr, 30, 17) | 0x4000));
+        r6040_phy_write(ioaddr, 30, 17,
+                        ~((~r6040_phy_read(ioaddr, 30, 17)) | 0x2000));
         r6040_phy_write(ioaddr, 0, 19, 0x0000);
         r6040_phy_write(ioaddr, 0, 30, 0x01F0);
 
@@ -740,6 +745,9 @@ static void r6040_mac_address(struct net_device *dev)
         iowrite16(adrp[0], ioaddr + MID_0L);
         iowrite16(adrp[1], ioaddr + MID_0M);
         iowrite16(adrp[2], ioaddr + MID_0H);
+
+        /* Store MAC Address in perm_addr */
+        memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
 }
 
 static int r6040_open(struct net_device *dev)
@@ -751,7 +759,7 @@ static int r6040_open(struct net_device *dev)
         ret = request_irq(dev->irq, r6040_interrupt,
                 IRQF_SHARED, dev->name, dev);
         if (ret)
-                return ret;
+                goto out;
 
         /* Set MAC address */
         r6040_mac_address(dev);
@@ -759,30 +767,37 @@ static int r6040_open(struct net_device *dev)
         /* Allocate Descriptor memory */
         lp->rx_ring =
                 pci_alloc_consistent(lp->pdev, RX_DESC_SIZE, &lp->rx_ring_dma);
-        if (!lp->rx_ring)
-                return -ENOMEM;
+        if (!lp->rx_ring) {
+                ret = -ENOMEM;
+                goto err_free_irq;
+        }
 
         lp->tx_ring =
                 pci_alloc_consistent(lp->pdev, TX_DESC_SIZE, &lp->tx_ring_dma);
         if (!lp->tx_ring) {
-                pci_free_consistent(lp->pdev, RX_DESC_SIZE, lp->rx_ring,
-                                     lp->rx_ring_dma);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_free_rx_ring;
         }
 
         ret = r6040_up(dev);
-        if (ret) {
-                pci_free_consistent(lp->pdev, TX_DESC_SIZE, lp->tx_ring,
-                                                        lp->tx_ring_dma);
-                pci_free_consistent(lp->pdev, RX_DESC_SIZE, lp->rx_ring,
-                                                        lp->rx_ring_dma);
-                return ret;
-        }
+        if (ret)
+                goto err_free_tx_ring;
 
         napi_enable(&lp->napi);
         netif_start_queue(dev);
 
         return 0;
+
+err_free_tx_ring:
+        pci_free_consistent(lp->pdev, TX_DESC_SIZE, lp->tx_ring,
+                        lp->tx_ring_dma);
+err_free_rx_ring:
+        pci_free_consistent(lp->pdev, RX_DESC_SIZE, lp->rx_ring,
+                        lp->rx_ring_dma);
+err_free_irq:
+        free_irq(dev->irq, dev);
+out:
+        return ret;
 }
 
 static netdev_tx_t r6040_start_xmit(struct sk_buff *skb,
@@ -946,7 +961,7 @@ static const struct net_device_ops r6040_netdev_ops = {
         .ndo_set_multicast_list = r6040_multicast_list,
         .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_do_ioctl           = r6040_ioctl,
         .ndo_tx_timeout         = r6040_tx_timeout,
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1039,7 +1054,7 @@ static int __devinit r6040_init_one(struct pci_dev *pdev,
         u16 *adrp;
         int i;
 
-        printk("%s\n", version);
+        pr_info("%s\n", version);
 
         err = pci_enable_device(pdev);
         if (err)
@@ -1113,7 +1128,8 @@ static int __devinit r6040_init_one(struct pci_dev *pdev,
         /* Some bootloader/BIOSes do not initialize
          * MAC address, warn about that */
         if (!(adrp[0] || adrp[1] || adrp[2])) {
-                netdev_warn(dev, "MAC address not initialized, generating random\n");
+                netdev_warn(dev, "MAC address not initialized, "
+                                        "generating random\n");
                 random_ether_addr(dev->dev_addr);
         }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index a0da4a17b025..fe3b7622fba0 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1076,7 +1076,12 @@ static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
         int ret;
 
         if (vlgrp && (opts2 & RxVlanTag)) {
-                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
+                u16 vtag = swab16(opts2 & 0xffff);
+
+                if (likely(polling))
+                        vlan_gro_receive(&tp->napi, vlgrp, vtag, skb);
+                else
+                        __vlan_hwaccel_rx(skb, vlgrp, vtag, polling);
                 ret = 0;
         } else
                 ret = -1;
@@ -3186,6 +3191,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 #ifdef CONFIG_R8169_VLAN
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 #endif
+        dev->features |= NETIF_F_GRO;
 
         tp->intr_mask = 0xffff;
         tp->align = cfg->align;
@@ -4450,9 +4456,8 @@ static inline int rtl8169_fragmented_frame(u32 status)
         return (status & (FirstFrag | LastFrag)) != (FirstFrag | LastFrag);
 }
 
-static inline void rtl8169_rx_csum(struct sk_buff *skb, struct RxDesc *desc)
+static inline void rtl8169_rx_csum(struct sk_buff *skb, u32 opts1)
 {
-        u32 opts1 = le32_to_cpu(desc->opts1);
         u32 status = opts1 & RxProtoMask;
 
         if (((status == RxProtoTCP) && !(opts1 & TCPFail)) ||
@@ -4460,7 +4465,7 @@ static inline void rtl8169_rx_csum(struct sk_buff *skb, struct RxDesc *desc)
             ((status == RxProtoIP) && !(opts1 & IPFail)))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 }
 
 static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
@@ -4546,8 +4551,6 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 continue;
                         }
 
-                        rtl8169_rx_csum(skb, desc);
-
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
                                 pci_dma_sync_single_for_device(pdev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
@@ -4558,12 +4561,13 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 tp->Rx_skbuff[entry] = NULL;
                         }
 
+                        rtl8169_rx_csum(skb, status);
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
                         if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
                                 if (likely(polling))
-                                        netif_receive_skb(skb);
+                                        napi_gro_receive(&tp->napi, skb);
                                 else
                                         netif_rx(skb);
                         }
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index e26e107f93e0..e68c941926f1 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1245,7 +1245,7 @@ static int rr_open(struct net_device *dev)
         init_timer(&rrpriv->timer);
         rrpriv->timer.expires = RUN_AT(5*HZ);           /* 5 sec. watchdog */
         rrpriv->timer.data = (unsigned long)dev;
-        rrpriv->timer.function = &rr_timer;               /* timer handler */
+        rrpriv->timer.function = rr_timer;               /* timer handler */
         add_timer(&rrpriv->timer);
 
         netif_start_queue(dev);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 18bc5b718bbb..c70ad515383a 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -38,8 +38,6 @@
  * Tx descriptors that can be associated with each corresponding FIFO.
  * intr_type: This defines the type of interrupt. The values can be 0(INTA),
  *     2(MSI_X). Default value is '2(MSI_X)'
- * lro: Specifies whether to enable Large Receive Offload (LRO) or not.
- *     Possible values '1' for enable '0' for disable. Default is '0'
  * lro_max_pkts: This parameter defines maximum number of packets can be
  *     aggregated as a single large packet
  * napi: This parameter used to enable/disable NAPI (polling Rx)
@@ -90,7 +88,7 @@
 #include "s2io.h"
 #include "s2io-regs.h"
 
-#define DRV_VERSION "2.0.26.26"
+#define DRV_VERSION "2.0.26.27"
 
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -496,8 +494,6 @@ S2IO_PARM_INT(rxsync_frequency, 3);
 /* Interrupt type. Values can be 0(INTA), 2(MSI_X) */
 S2IO_PARM_INT(intr_type, 2);
 /* Large receive offload feature */
-static unsigned int lro_enable = 1;
-module_param_named(lro, lro_enable, uint, 0);
 
 /* Max pkts to be aggregated by LRO at one time. If not specified,
  * aggregation happens until we hit max IP pkt size(64K)
@@ -5124,8 +5120,6 @@ static void s2io_set_multicast(struct net_device *dev)
                 /* Create the new Rx filter list and update the same in H/W. */
                 i = 0;
                 netdev_for_each_mc_addr(ha, dev) {
-                        memcpy(sp->usr_addrs[i].addr, ha->addr,
-                               ETH_ALEN);
                         mac_addr = 0;
                         for (j = 0; j < ETH_ALEN; j++) {
                                 mac_addr |= ha->addr[j];
@@ -6735,13 +6729,10 @@ static int s2io_ethtool_set_flags(struct net_device *dev, u32 data)
                 return -EINVAL;
 
         if (data & ETH_FLAG_LRO) {
-                if (lro_enable) {
-                        if (!(dev->features & NETIF_F_LRO)) {
-                                dev->features |= NETIF_F_LRO;
-                                changed = 1;
-                        }
-                } else
-                        rc = -EINVAL;
+                if (!(dev->features & NETIF_F_LRO)) {
+                        dev->features |= NETIF_F_LRO;
+                        changed = 1;
+                }
         } else if (dev->features & NETIF_F_LRO) {
                 dev->features &= ~NETIF_F_LRO;
                 changed = 1;
@@ -6750,7 +6741,6 @@ static int s2io_ethtool_set_flags(struct net_device *dev, u32 data)
         if (changed && netif_running(dev)) {
                 s2io_stop_all_tx_queue(sp);
                 s2io_card_down(sp);
-                sp->lro = !!(dev->features & NETIF_F_LRO);
                 rc = s2io_card_up(sp);
                 if (rc)
                         s2io_reset(sp);
@@ -7307,7 +7297,7 @@ static int s2io_card_up(struct s2io_nic *sp)
                 struct ring_info *ring = &mac_control->rings[i];
 
                 ring->mtu = dev->mtu;
-                ring->lro = sp->lro;
+                ring->lro = !!(dev->features & NETIF_F_LRO);
                 ret = fill_rx_buffers(sp, ring, 1);
                 if (ret) {
                         DBG_PRINT(ERR_DBG, "%s: Out of memory in Open\n",
@@ -7341,7 +7331,7 @@ static int s2io_card_up(struct s2io_nic *sp)
         /* Setting its receive mode */
         s2io_set_multicast(dev);
 
-        if (sp->lro) {
+        if (dev->features & NETIF_F_LRO) {
                 /* Initialize max aggregatable pkts per session based on MTU */
                 sp->lro_max_aggr_per_sess = ((1<<16) - 1) / dev->mtu;
                 /* Check if we can use (if specified) user provided value */
@@ -7613,10 +7603,10 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
                          * Packet with erroneous checksum, let the
                          * upper layers deal with it.
                          */
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
                 }
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         swstats->mem_freed += skb->truesize;
 send_up:
@@ -7911,7 +7901,6 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         else
                 sp->device_type = XFRAME_I_DEVICE;
 
-        sp->lro = lro_enable;
 
         /* Initialize some PCI/PCI-X fields of the NIC. */
         s2io_init_pci(sp);
@@ -8047,8 +8036,7 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         dev->netdev_ops = &s2io_netdev_ops;
         SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-        if (lro_enable)
-                dev->features |= NETIF_F_LRO;
+        dev->features |= NETIF_F_LRO;
         dev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
         if (sp->high_dma_flag == true)
                 dev->features |= NETIF_F_HIGHDMA;
@@ -8283,9 +8271,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                           dev->name);
         }
 
-        if (sp->lro)
-                DBG_PRINT(ERR_DBG, "%s: Large receive offload enabled\n",
-                          dev->name);
+        DBG_PRINT(ERR_DBG, "%s: Large receive offload enabled\n",
+                  dev->name);
         if (ufo)
                 DBG_PRINT(ERR_DBG,
                           "%s: UDP Fragmentation Offload(UFO) enabled\n",
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 0af033533905..00b8614efe48 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -816,12 +816,6 @@ struct mac_info {
         struct stat_block *stats_info;  /* Logical address of the stat block */
 };
 
-/* structure representing the user defined MAC addresses */
-struct usr_addr {
-        char addr[ETH_ALEN];
-        int usage_cnt;
-};
-
 /* Default Tunable parameters of the NIC. */
 #define DEFAULT_FIFO_0_LEN 4096
 #define DEFAULT_FIFO_1_7_LEN 512
@@ -894,9 +888,7 @@ struct s2io_nic {
 #define ALL_MULTI   2
 
 #define MAX_ADDRS_SUPPORTED 64
-        u16 usr_addr_count;
         u16 mc_addr_count;
-        struct usr_addr usr_addrs[256];
 
         u16 m_cast_flg;
         u16 all_multi_pos;
@@ -971,7 +963,6 @@ struct s2io_nic {
 
         unsigned long   clubbed_frms_cnt;
         unsigned long   sending_both;
-        u8              lro;
         u16             lro_max_aggr_per_sess;
         volatile unsigned long state;
         u64             general_int_mask;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 8e6bd45b9f31..d8249d7653c6 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -1170,7 +1170,7 @@ again:
                                                 sb->ip_summed = CHECKSUM_UNNECESSARY;
                                                 /* don't need to set sb->csum */
                                         } else {
-                                                sb->ip_summed = CHECKSUM_NONE;
+                                                skb_checksum_none_assert(sb);
                                         }
                                 }
                                 prefetch(sb->data);
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 8c4067af32b0..31b92f5f32cb 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1251,16 +1251,6 @@ static int sc92031_ethtool_set_settings(struct net_device *dev,
         return 0;
 }
 
-static void sc92031_ethtool_get_drvinfo(struct net_device *dev,
-                struct ethtool_drvinfo *drvinfo)
-{
-        struct sc92031_priv *priv = netdev_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-
-        strcpy(drvinfo->driver, SC92031_NAME);
-        strcpy(drvinfo->bus_info, pci_name(pdev));
-}
-
 static void sc92031_ethtool_get_wol(struct net_device *dev,
                 struct ethtool_wolinfo *wolinfo)
 {
@@ -1382,7 +1372,6 @@ static void sc92031_ethtool_get_ethtool_stats(struct net_device *dev,
 static const struct ethtool_ops sc92031_ethtool_ops = {
         .get_settings           = sc92031_ethtool_get_settings,
         .set_settings           = sc92031_ethtool_set_settings,
-        .get_drvinfo            = sc92031_ethtool_get_drvinfo,
         .get_wol                = sc92031_ethtool_get_wol,
         .set_wol                = sc92031_ethtool_set_wol,
         .nway_reset             = sc92031_ethtool_nway_reset,
diff --git a/drivers/net/sfc/Makefile b/drivers/net/sfc/Makefile
index 1047b19c60a5..ab31c7124db1 100644
--- a/drivers/net/sfc/Makefile
+++ b/drivers/net/sfc/Makefile
@@ -1,7 +1,8 @@
-sfc-y                   += efx.o nic.o falcon.o siena.o tx.o rx.o \
-                           falcon_gmac.o falcon_xmac.o mcdi_mac.o \
+sfc-y                   += efx.o nic.o falcon.o siena.o tx.o rx.o filter.o \
+                           falcon_xmac.o mcdi_mac.o \
                            selftest.o ethtool.o qt202x_phy.o mdio_10g.o \
-                           tenxpress.o falcon_boards.o mcdi.o mcdi_phy.o
+                           tenxpress.o txc43128_phy.o falcon_boards.o \
+                           mcdi.o mcdi_phy.o
 sfc-$(CONFIG_SFC_MTD)   += mtd.o
 
 obj-$(CONFIG_SFC)       += sfc.o
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index ba674c5ca29e..5be71f49a205 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -114,7 +114,7 @@ static struct workqueue_struct *reset_workqueue;
  * This is only used in MSI-X interrupt mode
  */
 static unsigned int separate_tx_channels;
-module_param(separate_tx_channels, uint, 0644);
+module_param(separate_tx_channels, uint, 0444);
 MODULE_PARM_DESC(separate_tx_channels,
                  "Use separate channels for TX and RX");
 
@@ -124,8 +124,9 @@ MODULE_PARM_DESC(separate_tx_channels,
 static int napi_weight = 64;
 
 /* This is the time (in jiffies) between invocations of the hardware
- * monitor, which checks for known hardware bugs and resets the
- * hardware and driver as necessary.
+ * monitor.  On Falcon-based NICs, this will:
+ * - Check the on-board hardware monitor;
+ * - Poll the link state and reconfigure the hardware as necessary.
  */
 unsigned int efx_monitor_interval = 1 * HZ;
 
@@ -201,10 +202,13 @@ MODULE_PARM_DESC(debug, "Bitmapped debugging message enable value");
  * Utility functions and prototypes
  *
  *************************************************************************/
-static void efx_remove_channel(struct efx_channel *channel);
+
+static void efx_remove_channels(struct efx_nic *efx);
 static void efx_remove_port(struct efx_nic *efx);
 static void efx_fini_napi(struct efx_nic *efx);
-static void efx_fini_channels(struct efx_nic *efx);
+static void efx_fini_struct(struct efx_nic *efx);
+static void efx_start_all(struct efx_nic *efx);
+static void efx_stop_all(struct efx_nic *efx);
 
 #define EFX_ASSERT_RESET_SERIALISED(efx)                \
         do {                                            \
@@ -248,7 +252,7 @@ static int efx_process_channel(struct efx_channel *channel, int budget)
 
         efx_rx_strategy(channel);
 
-        efx_fast_push_rx_descriptors(&efx->rx_queue[channel->channel]);
+        efx_fast_push_rx_descriptors(efx_channel_get_rx_queue(channel));
 
         return spent;
 }
@@ -334,6 +338,7 @@ void efx_process_channel_now(struct efx_channel *channel)
 {
         struct efx_nic *efx = channel->efx;
 
+        BUG_ON(channel->channel >= efx->n_channels);
         BUG_ON(!channel->enabled);
 
         /* Disable interrupts and wait for ISRs to complete */
@@ -347,7 +352,7 @@ void efx_process_channel_now(struct efx_channel *channel)
         napi_disable(&channel->napi_str);
 
         /* Poll the channel */
-        efx_process_channel(channel, EFX_EVQ_SIZE);
+        efx_process_channel(channel, channel->eventq_mask + 1);
 
         /* Ack the eventq. This may cause an interrupt to be generated
          * when they are reenabled */
@@ -364,9 +369,18 @@ void efx_process_channel_now(struct efx_channel *channel)
  */
 static int efx_probe_eventq(struct efx_channel *channel)
 {
+        struct efx_nic *efx = channel->efx;
+        unsigned long entries;
+
         netif_dbg(channel->efx, probe, channel->efx->net_dev,
                   "chan %d create event queue\n", channel->channel);
 
+        /* Build an event queue with room for one event per tx and rx buffer,
+         * plus some extra for link state events and MCDI completions. */
+        entries = roundup_pow_of_two(efx->rxq_entries + efx->txq_entries + 128);
+        EFX_BUG_ON_PARANOID(entries > EFX_MAX_EVQ_SIZE);
+        channel->eventq_mask = max(entries, EFX_MIN_EVQ_SIZE) - 1;
+
         return efx_nic_probe_eventq(channel);
 }
 
@@ -403,6 +417,63 @@ static void efx_remove_eventq(struct efx_channel *channel)
  *
  *************************************************************************/
 
+/* Allocate and initialise a channel structure, optionally copying
+ * parameters (but not resources) from an old channel structure. */
+static struct efx_channel *
+efx_alloc_channel(struct efx_nic *efx, int i, struct efx_channel *old_channel)
+{
+        struct efx_channel *channel;
+        struct efx_rx_queue *rx_queue;
+        struct efx_tx_queue *tx_queue;
+        int j;
+
+        if (old_channel) {
+                channel = kmalloc(sizeof(*channel), GFP_KERNEL);
+                if (!channel)
+                        return NULL;
+
+                *channel = *old_channel;
+
+                memset(&channel->eventq, 0, sizeof(channel->eventq));
+
+                rx_queue = &channel->rx_queue;
+                rx_queue->buffer = NULL;
+                memset(&rx_queue->rxd, 0, sizeof(rx_queue->rxd));
+
+                for (j = 0; j < EFX_TXQ_TYPES; j++) {
+                        tx_queue = &channel->tx_queue[j];
+                        if (tx_queue->channel)
+                                tx_queue->channel = channel;
+                        tx_queue->buffer = NULL;
+                        memset(&tx_queue->txd, 0, sizeof(tx_queue->txd));
+                }
+        } else {
+                channel = kzalloc(sizeof(*channel), GFP_KERNEL);
+                if (!channel)
+                        return NULL;
+
+                channel->efx = efx;
+                channel->channel = i;
+
+                for (j = 0; j < EFX_TXQ_TYPES; j++) {
+                        tx_queue = &channel->tx_queue[j];
+                        tx_queue->efx = efx;
+                        tx_queue->queue = i * EFX_TXQ_TYPES + j;
+                        tx_queue->channel = channel;
+                }
+        }
+
+        spin_lock_init(&channel->tx_stop_lock);
+        atomic_set(&channel->tx_stop_count, 1);
+
+        rx_queue = &channel->rx_queue;
+        rx_queue->efx = efx;
+        setup_timer(&rx_queue->slow_fill, efx_rx_slow_fill,
+                    (unsigned long)rx_queue);
+
+        return channel;
+}
+
 static int efx_probe_channel(struct efx_channel *channel)
 {
         struct efx_tx_queue *tx_queue;
@@ -459,11 +530,38 @@ static void efx_set_channel_names(struct efx_nic *efx)
                                 number -= efx->n_rx_channels;
                         }
                 }
-                snprintf(channel->name, sizeof(channel->name),
+                snprintf(efx->channel_name[channel->channel],
+                         sizeof(efx->channel_name[0]),
                          "%s%s-%d", efx->name, type, number);
         }
 }
 
+static int efx_probe_channels(struct efx_nic *efx)
+{
+        struct efx_channel *channel;
+        int rc;
+
+        /* Restart special buffer allocation */
+        efx->next_buffer_table = 0;
+
+        efx_for_each_channel(channel, efx) {
+                rc = efx_probe_channel(channel);
+                if (rc) {
+                        netif_err(efx, probe, efx->net_dev,
+                                  "failed to create channel %d\n",
+                                  channel->channel);
+                        goto fail;
+                }
+        }
+        efx_set_channel_names(efx);
+
+        return 0;
+
+fail:
+        efx_remove_channels(efx);
+        return rc;
+}
+
 /* Channels are shutdown and reinitialised whilst the NIC is running
  * to propagate configuration changes (mtu, checksum offload), or
  * to clear hardware error conditions
@@ -601,6 +699,75 @@ static void efx_remove_channel(struct efx_channel *channel)
         efx_remove_eventq(channel);
 }
 
+static void efx_remove_channels(struct efx_nic *efx)
+{
+        struct efx_channel *channel;
+
+        efx_for_each_channel(channel, efx)
+                efx_remove_channel(channel);
+}
+
+int
+efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
+{
+        struct efx_channel *other_channel[EFX_MAX_CHANNELS], *channel;
+        u32 old_rxq_entries, old_txq_entries;
+        unsigned i;
+        int rc;
+
+        efx_stop_all(efx);
+        efx_fini_channels(efx);
+
+        /* Clone channels */
+        memset(other_channel, 0, sizeof(other_channel));
+        for (i = 0; i < efx->n_channels; i++) {
+                channel = efx_alloc_channel(efx, i, efx->channel[i]);
+                if (!channel) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
+                other_channel[i] = channel;
+        }
+
+        /* Swap entry counts and channel pointers */
+        old_rxq_entries = efx->rxq_entries;
+        old_txq_entries = efx->txq_entries;
+        efx->rxq_entries = rxq_entries;
+        efx->txq_entries = txq_entries;
+        for (i = 0; i < efx->n_channels; i++) {
+                channel = efx->channel[i];
+                efx->channel[i] = other_channel[i];
+                other_channel[i] = channel;
+        }
+
+        rc = efx_probe_channels(efx);
+        if (rc)
+                goto rollback;
+
+        /* Destroy old channels */
+        for (i = 0; i < efx->n_channels; i++)
+                efx_remove_channel(other_channel[i]);
+out:
+        /* Free unused channel structures */
+        for (i = 0; i < efx->n_channels; i++)
+                kfree(other_channel[i]);
+
+        efx_init_channels(efx);
+        efx_start_all(efx);
+        return rc;
+
+rollback:
+        /* Swap back */
+        efx->rxq_entries = old_rxq_entries;
+        efx->txq_entries = old_txq_entries;
+        for (i = 0; i < efx->n_channels; i++) {
+                channel = efx->channel[i];
+                efx->channel[i] = other_channel[i];
+                other_channel[i] = channel;
+        }
+        goto out;
+}
+
 void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue)
 {
         mod_timer(&rx_queue->slow_fill, jiffies + msecs_to_jiffies(100));
@@ -761,7 +928,7 @@ static int efx_probe_port(struct efx_nic *efx)
         /* Connect up MAC/PHY operations table */
         rc = efx->type->probe_port(efx);
         if (rc)
-                goto err;
+                return rc;
 
         /* Sanity check MAC address */
         if (is_valid_ether_addr(efx->mac_address)) {
@@ -782,7 +949,7 @@ static int efx_probe_port(struct efx_nic *efx)
         return 0;
 
  err:
-        efx_remove_port(efx);
+        efx->type->remove_port(efx);
         return rc;
 }
 
@@ -1050,7 +1217,8 @@ static void efx_probe_interrupts(struct efx_nic *efx)
                                 efx->n_rx_channels = efx->n_channels;
                         }
                         for (i = 0; i < n_channels; i++)
-                                efx->channel[i].irq = xentries[i].vector;
+                                efx_get_channel(efx, i)->irq =
+                                        xentries[i].vector;
                 } else {
                         /* Fall back to single channel MSI */
                         efx->interrupt_mode = EFX_INT_MODE_MSI;
@@ -1066,7 +1234,7 @@ static void efx_probe_interrupts(struct efx_nic *efx)
                 efx->n_tx_channels = 1;
                 rc = pci_enable_msi(efx->pci_dev);
                 if (rc == 0) {
-                        efx->channel[0].irq = efx->pci_dev->irq;
+                        efx_get_channel(efx, 0)->irq = efx->pci_dev->irq;
                 } else {
                         netif_err(efx, drv, efx->net_dev,
                                   "could not enable MSI\n");
@@ -1097,26 +1265,32 @@ static void efx_remove_interrupts(struct efx_nic *efx)
         efx->legacy_irq = 0;
 }
 
+struct efx_tx_queue *
+efx_get_tx_queue(struct efx_nic *efx, unsigned index, unsigned type)
+{
+        unsigned tx_channel_offset =
+                separate_tx_channels ? efx->n_channels - efx->n_tx_channels : 0;
+        EFX_BUG_ON_PARANOID(index >= efx->n_tx_channels ||
+                            type >= EFX_TXQ_TYPES);
+        return &efx->channel[tx_channel_offset + index]->tx_queue[type];
+}
+
 static void efx_set_channels(struct efx_nic *efx)
 {
         struct efx_channel *channel;
         struct efx_tx_queue *tx_queue;
-        struct efx_rx_queue *rx_queue;
         unsigned tx_channel_offset =
                 separate_tx_channels ? efx->n_channels - efx->n_tx_channels : 0;
 
+        /* Channel pointers were set in efx_init_struct() but we now
+         * need to clear them for TX queues in any RX-only channels. */
         efx_for_each_channel(channel, efx) {
-                if (channel->channel - tx_channel_offset < efx->n_tx_channels) {
-                        channel->tx_queue = &efx->tx_queue[
-                                (channel->channel - tx_channel_offset) *
-                                EFX_TXQ_TYPES];
+                if (channel->channel - tx_channel_offset >=
+                    efx->n_tx_channels) {
                         efx_for_each_channel_tx_queue(tx_queue, channel)
-                                tx_queue->channel = channel;
+                                tx_queue->channel = NULL;
                 }
         }
-
-        efx_for_each_rx_queue(rx_queue, efx)
-                rx_queue->channel = &efx->channel[rx_queue->queue];
 }
 
 static int efx_probe_nic(struct efx_nic *efx)
@@ -1165,40 +1339,37 @@ static void efx_remove_nic(struct efx_nic *efx)
 
 static int efx_probe_all(struct efx_nic *efx)
 {
-        struct efx_channel *channel;
         int rc;
 
-        /* Create NIC */
         rc = efx_probe_nic(efx);
         if (rc) {
                 netif_err(efx, probe, efx->net_dev, "failed to create NIC\n");
                 goto fail1;
         }
 
-        /* Create port */
         rc = efx_probe_port(efx);
         if (rc) {
                 netif_err(efx, probe, efx->net_dev, "failed to create port\n");
                 goto fail2;
         }
 
-        /* Create channels */
-        efx_for_each_channel(channel, efx) {
-                rc = efx_probe_channel(channel);
-                if (rc) {
-                        netif_err(efx, probe, efx->net_dev,
-                                  "failed to create channel %d\n",
-                                  channel->channel);
-                        goto fail3;
-                }
+        efx->rxq_entries = efx->txq_entries = EFX_DEFAULT_DMAQ_SIZE;
+        rc = efx_probe_channels(efx);
+        if (rc)
+                goto fail3;
+
+        rc = efx_probe_filters(efx);
+        if (rc) {
+                netif_err(efx, probe, efx->net_dev,
+                          "failed to create filter tables\n");
+                goto fail4;
         }
-        efx_set_channel_names(efx);
 
         return 0;
 
+ fail4:
+        efx_remove_channels(efx);
  fail3:
-        efx_for_each_channel(channel, efx)
-                efx_remove_channel(channel);
         efx_remove_port(efx);
  fail2:
         efx_remove_nic(efx);
@@ -1328,10 +1499,8 @@ static void efx_stop_all(struct efx_nic *efx)
 
 static void efx_remove_all(struct efx_nic *efx)
 {
-        struct efx_channel *channel;
-
-        efx_for_each_channel(channel, efx)
-                efx_remove_channel(channel);
+        efx_remove_filters(efx);
+        efx_remove_channels(efx);
         efx_remove_port(efx);
         efx_remove_nic(efx);
 }
@@ -1355,20 +1524,20 @@ static unsigned irq_mod_ticks(int usecs, int resolution)
 void efx_init_irq_moderation(struct efx_nic *efx, int tx_usecs, int rx_usecs,
                              bool rx_adaptive)
 {
-        struct efx_tx_queue *tx_queue;
-        struct efx_rx_queue *rx_queue;
+        struct efx_channel *channel;
         unsigned tx_ticks = irq_mod_ticks(tx_usecs, EFX_IRQ_MOD_RESOLUTION);
         unsigned rx_ticks = irq_mod_ticks(rx_usecs, EFX_IRQ_MOD_RESOLUTION);
 
         EFX_ASSERT_RESET_SERIALISED(efx);
 
-        efx_for_each_tx_queue(tx_queue, efx)
-                tx_queue->channel->irq_moderation = tx_ticks;
-
         efx->irq_rx_adaptive = rx_adaptive;
         efx->irq_rx_moderation = rx_ticks;
-        efx_for_each_rx_queue(rx_queue, efx)
-                rx_queue->channel->irq_moderation = rx_ticks;
+        efx_for_each_channel(channel, efx) {
+                if (efx_channel_get_rx_queue(channel))
+                        channel->irq_moderation = rx_ticks;
+                else if (efx_channel_get_tx_queue(channel, 0))
+                        channel->irq_moderation = tx_ticks;
+        }
 }
 
 /**************************************************************************
@@ -1377,8 +1546,7 @@ void efx_init_irq_moderation(struct efx_nic *efx, int tx_usecs, int rx_usecs,
  *
  **************************************************************************/
 
-/* Run periodically off the general workqueue. Serialised against
- * efx_reconfigure_port via the mac_lock */
+/* Run periodically off the general workqueue */
 static void efx_monitor(struct work_struct *data)
 {
         struct efx_nic *efx = container_of(data, struct efx_nic,
@@ -1391,16 +1559,13 @@ static void efx_monitor(struct work_struct *data)
 
         /* If the mac_lock is already held then it is likely a port
          * reconfiguration is already in place, which will likely do
-         * most of the work of check_hw() anyway. */
-        if (!mutex_trylock(&efx->mac_lock))
-                goto out_requeue;
-        if (!efx->port_enabled)
-                goto out_unlock;
-        efx->type->monitor(efx);
+         * most of the work of monitor() anyway. */
+        if (mutex_trylock(&efx->mac_lock)) {
+                if (efx->port_enabled)
+                        efx->type->monitor(efx);
+                mutex_unlock(&efx->mac_lock);
+        }
 
-out_unlock:
-        mutex_unlock(&efx->mac_lock);
-out_requeue:
         queue_delayed_work(efx->workqueue, &efx->monitor_work,
                            efx_monitor_interval);
 }
@@ -1546,11 +1711,11 @@ static struct rtnl_link_stats64 *efx_net_stats(struct net_device *net_dev, struc
         stats->tx_packets = mac_stats->tx_packets;
         stats->rx_bytes = mac_stats->rx_bytes;
         stats->tx_bytes = mac_stats->tx_bytes;
+        stats->rx_dropped = efx->n_rx_nodesc_drop_cnt;
         stats->multicast = mac_stats->rx_multicast;
         stats->collisions = mac_stats->tx_collision;
         stats->rx_length_errors = (mac_stats->rx_gtjumbo +
                                    mac_stats->rx_length_error);
-        stats->rx_over_errors = efx->n_rx_nodesc_drop_cnt;
         stats->rx_crc_errors = mac_stats->rx_bad;
         stats->rx_frame_errors = mac_stats->rx_align_error;
         stats->rx_fifo_errors = mac_stats->rx_overflow;
@@ -1767,6 +1932,7 @@ fail_registered:
 
 static void efx_unregister_netdev(struct efx_nic *efx)
 {
+        struct efx_channel *channel;
         struct efx_tx_queue *tx_queue;
 
         if (!efx->net_dev)
@@ -1777,8 +1943,10 @@ static void efx_unregister_netdev(struct efx_nic *efx)
         /* Free up any skbs still remaining. This has to happen before
          * we try to unregister the netdev as running their destructors
          * may be needed to get the device ref. count to 0. */
-        efx_for_each_tx_queue(tx_queue, efx)
-                efx_release_tx_buffers(tx_queue);
+        efx_for_each_channel(channel, efx) {
+                efx_for_each_channel_tx_queue(tx_queue, channel)
+                        efx_release_tx_buffers(tx_queue);
+        }
 
         if (efx_dev_registered(efx)) {
                 strlcpy(efx->name, pci_name(efx->pci_dev), sizeof(efx->name));
@@ -1841,6 +2009,7 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
         efx->mac_op->reconfigure(efx);
 
         efx_init_channels(efx);
+        efx_restore_filters(efx);
 
         mutex_unlock(&efx->spi_lock);
         mutex_unlock(&efx->mac_lock);
@@ -2037,9 +2206,6 @@ static struct efx_phy_operations efx_dummy_phy_operations = {
 static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
                            struct pci_dev *pci_dev, struct net_device *net_dev)
 {
-        struct efx_channel *channel;
-        struct efx_tx_queue *tx_queue;
-        struct efx_rx_queue *rx_queue;
         int i;
 
         /* Initialise common structures */
@@ -2068,36 +2234,13 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
         INIT_WORK(&efx->mac_work, efx_mac_work);
 
         for (i = 0; i < EFX_MAX_CHANNELS; i++) {
-                channel = &efx->channel[i];
-                channel->efx = efx;
-                channel->channel = i;
-                channel->work_pending = false;
-                spin_lock_init(&channel->tx_stop_lock);
-                atomic_set(&channel->tx_stop_count, 1);
-        }
-        for (i = 0; i < EFX_MAX_TX_QUEUES; i++) {
-                tx_queue = &efx->tx_queue[i];
-                tx_queue->efx = efx;
-                tx_queue->queue = i;
-                tx_queue->buffer = NULL;
-                tx_queue->channel = &efx->channel[0]; /* for safety */
-                tx_queue->tso_headers_free = NULL;
-        }
-        for (i = 0; i < EFX_MAX_RX_QUEUES; i++) {
-                rx_queue = &efx->rx_queue[i];
-                rx_queue->efx = efx;
-                rx_queue->queue = i;
-                rx_queue->channel = &efx->channel[0]; /* for safety */
-                rx_queue->buffer = NULL;
-                setup_timer(&rx_queue->slow_fill, efx_rx_slow_fill,
-                            (unsigned long)rx_queue);
+                efx->channel[i] = efx_alloc_channel(efx, i, NULL);
+                if (!efx->channel[i])
+                        goto fail;
         }
 
         efx->type = type;
 
-        /* As close as we can get to guaranteeing that we don't overflow */
-        BUILD_BUG_ON(EFX_EVQ_SIZE < EFX_TXQ_SIZE + EFX_RXQ_SIZE);
-
         EFX_BUG_ON_PARANOID(efx->type->phys_addr_channels > EFX_MAX_CHANNELS);
 
         /* Higher numbered interrupt modes are less capable! */
@@ -2109,13 +2252,22 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
                  pci_name(pci_dev));
         efx->workqueue = create_singlethread_workqueue(efx->workqueue_name);
         if (!efx->workqueue)
-                return -ENOMEM;
+                goto fail;
 
         return 0;
+
+fail:
+        efx_fini_struct(efx);
+        return -ENOMEM;
 }
 
 static void efx_fini_struct(struct efx_nic *efx)
 {
+        int i;
+
+        for (i = 0; i < EFX_MAX_CHANNELS; i++)
+                kfree(efx->channel[i]);
+
         if (efx->workqueue) {
                 destroy_workqueue(efx->workqueue);
                 efx->workqueue = NULL;
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index 060dc952a0fd..f502b14eb22c 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -12,6 +12,7 @@
 #define EFX_EFX_H
 
 #include "net_driver.h"
+#include "filter.h"
 
 /* PCI IDs */
 #define EFX_VENDID_SFC          0x1924
@@ -37,8 +38,6 @@ efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
 extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
 extern void efx_stop_queue(struct efx_channel *channel);
 extern void efx_wake_queue(struct efx_channel *channel);
-#define EFX_TXQ_SIZE 1024
-#define EFX_TXQ_MASK (EFX_TXQ_SIZE - 1)
 
 /* RX */
 extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
@@ -53,13 +52,36 @@ extern void __efx_rx_packet(struct efx_channel *channel,
 extern void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
                           unsigned int len, bool checksummed, bool discard);
 extern void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
-#define EFX_RXQ_SIZE 1024
-#define EFX_RXQ_MASK (EFX_RXQ_SIZE - 1)
+
+#define EFX_MAX_DMAQ_SIZE 4096UL
+#define EFX_DEFAULT_DMAQ_SIZE 1024UL
+#define EFX_MIN_DMAQ_SIZE 512UL
+
+#define EFX_MAX_EVQ_SIZE 16384UL
+#define EFX_MIN_EVQ_SIZE 512UL
+
+/* The smallest [rt]xq_entries that the driver supports. Callers of
+ * efx_wake_queue() assume that they can subsequently send at least one
+ * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
+#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
+
+/* Filters */
+extern int efx_probe_filters(struct efx_nic *efx);
+extern void efx_restore_filters(struct efx_nic *efx);
+extern void efx_remove_filters(struct efx_nic *efx);
+extern int efx_filter_insert_filter(struct efx_nic *efx,
+                                    struct efx_filter_spec *spec,
+                                    bool replace);
+extern int efx_filter_remove_filter(struct efx_nic *efx,
+                                    struct efx_filter_spec *spec);
+extern void efx_filter_table_clear(struct efx_nic *efx,
+                                   enum efx_filter_table_id table_id,
+                                   enum efx_filter_priority priority);
 
 /* Channels */
 extern void efx_process_channel_now(struct efx_channel *channel);
-#define EFX_EVQ_SIZE 4096
-#define EFX_EVQ_MASK (EFX_EVQ_SIZE - 1)
+extern int
+efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries);
 
 /* Ports */
 extern int efx_reconfigure_port(struct efx_nic *efx);
@@ -81,8 +103,6 @@ extern int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok);
 extern void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
 extern void efx_init_irq_moderation(struct efx_nic *efx, int tx_usecs,
                                     int rx_usecs, bool rx_adaptive);
-extern int efx_request_power(struct efx_nic *efx, int mw, const char *name);
-extern void efx_hex_dump(const u8 *, unsigned int, const char *);
 
 /* Dummy PHY ops for PHY drivers */
 extern int efx_port_dummy_op_int(struct efx_nic *efx);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index fd19d6ab97a2..c95328fa3ee8 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -15,6 +15,7 @@
 #include "workarounds.h"
 #include "selftest.h"
 #include "efx.h"
+#include "filter.h"
 #include "nic.h"
 #include "spi.h"
 #include "mdio_10g.h"
@@ -328,9 +329,10 @@ static int efx_fill_loopback_test(struct efx_nic *efx,
                                   unsigned int test_index,
                                   struct ethtool_string *strings, u64 *data)
 {
+        struct efx_channel *channel = efx_get_channel(efx, 0);
         struct efx_tx_queue *tx_queue;
 
-        efx_for_each_channel_tx_queue(tx_queue, &efx->channel[0]) {
+        efx_for_each_channel_tx_queue(tx_queue, channel) {
                 efx_fill_test(test_index++, strings, data,
                               &lb_tests->tx_sent[tx_queue->queue],
                               EFX_TX_QUEUE_NAME(tx_queue),
@@ -550,9 +552,22 @@ static u32 efx_ethtool_get_rx_csum(struct net_device *net_dev)
 static int efx_ethtool_set_flags(struct net_device *net_dev, u32 data)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
-        u32 supported = efx->type->offload_features & ETH_FLAG_RXHASH;
+        u32 supported = (efx->type->offload_features &
+                         (ETH_FLAG_RXHASH | ETH_FLAG_NTUPLE));
+        int rc;
+
+        rc = ethtool_op_set_flags(net_dev, data, supported);
+        if (rc)
+                return rc;
 
-        return ethtool_op_set_flags(net_dev, data, supported);
+        if (!(data & ETH_FLAG_NTUPLE)) {
+                efx_filter_table_clear(efx, EFX_FILTER_TABLE_RX_IP,
+                                       EFX_FILTER_PRI_MANUAL);
+                efx_filter_table_clear(efx, EFX_FILTER_TABLE_RX_MAC,
+                                       EFX_FILTER_PRI_MANUAL);
+        }
+
+        return 0;
 }
 
 static void efx_ethtool_self_test(struct net_device *net_dev,
@@ -673,15 +688,15 @@ static int efx_ethtool_get_coalesce(struct net_device *net_dev,
                                     struct ethtool_coalesce *coalesce)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_tx_queue *tx_queue;
         struct efx_channel *channel;
 
         memset(coalesce, 0, sizeof(*coalesce));
 
         /* Find lowest IRQ moderation across all used TX queues */
         coalesce->tx_coalesce_usecs_irq = ~((u32) 0);
-        efx_for_each_tx_queue(tx_queue, efx) {
-                channel = tx_queue->channel;
+        efx_for_each_channel(channel, efx) {
+                if (!efx_channel_get_tx_queue(channel, 0))
+                        continue;
                 if (channel->irq_moderation < coalesce->tx_coalesce_usecs_irq) {
                         if (channel->channel < efx->n_rx_channels)
                                 coalesce->tx_coalesce_usecs_irq =
@@ -708,7 +723,6 @@ static int efx_ethtool_set_coalesce(struct net_device *net_dev,
 {
         struct efx_nic *efx = netdev_priv(net_dev);
         struct efx_channel *channel;
-        struct efx_tx_queue *tx_queue;
         unsigned tx_usecs, rx_usecs, adaptive;
 
         if (coalesce->use_adaptive_tx_coalesce)
@@ -725,8 +739,9 @@ static int efx_ethtool_set_coalesce(struct net_device *net_dev,
         adaptive = coalesce->use_adaptive_rx_coalesce;
 
         /* If the channel is shared only allow RX parameters to be set */
-        efx_for_each_tx_queue(tx_queue, efx) {
-                if ((tx_queue->channel->channel < efx->n_rx_channels) &&
+        efx_for_each_channel(channel, efx) {
+                if (efx_channel_get_rx_queue(channel) &&
+                    efx_channel_get_tx_queue(channel, 0) &&
                     tx_usecs) {
                         netif_err(efx, drv, efx->net_dev, "Channel is shared. "
                                   "Only RX coalescing may be set\n");
@@ -741,6 +756,42 @@ static int efx_ethtool_set_coalesce(struct net_device *net_dev,
         return 0;
 }
 
+static void efx_ethtool_get_ringparam(struct net_device *net_dev,
+                                      struct ethtool_ringparam *ring)
+{
+        struct efx_nic *efx = netdev_priv(net_dev);
+
+        ring->rx_max_pending = EFX_MAX_DMAQ_SIZE;
+        ring->tx_max_pending = EFX_MAX_DMAQ_SIZE;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->rx_pending = efx->rxq_entries;
+        ring->tx_pending = efx->txq_entries;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+}
+
+static int efx_ethtool_set_ringparam(struct net_device *net_dev,
+                                     struct ethtool_ringparam *ring)
+{
+        struct efx_nic *efx = netdev_priv(net_dev);
+
+        if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
+            ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
+            ring->tx_pending > EFX_MAX_DMAQ_SIZE)
+                return -EINVAL;
+
+        if (ring->rx_pending < EFX_MIN_RING_SIZE ||
+            ring->tx_pending < EFX_MIN_RING_SIZE) {
+                netif_err(efx, drv, efx->net_dev,
+                          "TX and RX queues cannot be smaller than %ld\n",
+                          EFX_MIN_RING_SIZE);
+                return -EINVAL;
+        }
+
+        return efx_realloc_channels(efx, ring->rx_pending, ring->tx_pending);
+}
+
 static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
                                       struct ethtool_pauseparam *pause)
 {
@@ -918,6 +969,105 @@ efx_ethtool_get_rxnfc(struct net_device *net_dev,
         }
 }
 
+static int efx_ethtool_set_rx_ntuple(struct net_device *net_dev,
+                                     struct ethtool_rx_ntuple *ntuple)
+{
+        struct efx_nic *efx = netdev_priv(net_dev);
+        struct ethtool_tcpip4_spec *ip_entry = &ntuple->fs.h_u.tcp_ip4_spec;
+        struct ethtool_tcpip4_spec *ip_mask = &ntuple->fs.m_u.tcp_ip4_spec;
+        struct ethhdr *mac_entry = &ntuple->fs.h_u.ether_spec;
+        struct ethhdr *mac_mask = &ntuple->fs.m_u.ether_spec;
+        struct efx_filter_spec filter;
+
+        /* Range-check action */
+        if (ntuple->fs.action < ETHTOOL_RXNTUPLE_ACTION_CLEAR ||
+            ntuple->fs.action >= (s32)efx->n_rx_channels)
+                return -EINVAL;
+
+        if (~ntuple->fs.data_mask)
+                return -EINVAL;
+
+        switch (ntuple->fs.flow_type) {
+        case TCP_V4_FLOW:
+        case UDP_V4_FLOW:
+                /* Must match all of destination, */
+                if (ip_mask->ip4dst | ip_mask->pdst)
+                        return -EINVAL;
+                /* all or none of source, */
+                if ((ip_mask->ip4src | ip_mask->psrc) &&
+                    ((__force u32)~ip_mask->ip4src |
+                     (__force u16)~ip_mask->psrc))
+                        return -EINVAL;
+                /* and nothing else */
+                if ((u8)~ip_mask->tos | (u16)~ntuple->fs.vlan_tag_mask)
+                        return -EINVAL;
+                break;
+        case ETHER_FLOW:
+                /* Must match all of destination, */
+                if (!is_zero_ether_addr(mac_mask->h_dest))
+                        return -EINVAL;
+                /* all or none of VID, */
+                if (ntuple->fs.vlan_tag_mask != 0xf000 &&
+                    ntuple->fs.vlan_tag_mask != 0xffff)
+                        return -EINVAL;
+                /* and nothing else */
+                if (!is_broadcast_ether_addr(mac_mask->h_source) ||
+                    mac_mask->h_proto != htons(0xffff))
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        filter.priority = EFX_FILTER_PRI_MANUAL;
+        filter.flags = 0;
+
+        switch (ntuple->fs.flow_type) {
+        case TCP_V4_FLOW:
+                if (!ip_mask->ip4src)
+                        efx_filter_set_rx_tcp_full(&filter,
+                                                   htonl(ip_entry->ip4src),
+                                                   htons(ip_entry->psrc),
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                else
+                        efx_filter_set_rx_tcp_wild(&filter,
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                break;
+        case UDP_V4_FLOW:
+                if (!ip_mask->ip4src)
+                        efx_filter_set_rx_udp_full(&filter,
+                                                   htonl(ip_entry->ip4src),
+                                                   htons(ip_entry->psrc),
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                else
+                        efx_filter_set_rx_udp_wild(&filter,
+                                                   htonl(ip_entry->ip4dst),
+                                                   htons(ip_entry->pdst));
+                break;
+        case ETHER_FLOW:
+                if (ntuple->fs.vlan_tag_mask == 0xf000)
+                        efx_filter_set_rx_mac_full(&filter,
+                                                   ntuple->fs.vlan_tag & 0xfff,
+                                                   mac_entry->h_dest);
+                else
+                        efx_filter_set_rx_mac_wild(&filter, mac_entry->h_dest);
+                break;
+        }
+
+        if (ntuple->fs.action == ETHTOOL_RXNTUPLE_ACTION_CLEAR) {
+                return efx_filter_remove_filter(efx, &filter);
+        } else {
+                if (ntuple->fs.action == ETHTOOL_RXNTUPLE_ACTION_DROP)
+                        filter.dmaq_id = 0xfff;
+                else
+                        filter.dmaq_id = ntuple->fs.action;
+                return efx_filter_insert_filter(efx, &filter, true);
+        }
+}
+
 static int efx_ethtool_get_rxfh_indir(struct net_device *net_dev,
                                       struct ethtool_rxfh_indir *indir)
 {
@@ -971,6 +1121,8 @@ const struct ethtool_ops efx_ethtool_ops = {
         .set_eeprom             = efx_ethtool_set_eeprom,
         .get_coalesce           = efx_ethtool_get_coalesce,
         .set_coalesce           = efx_ethtool_set_coalesce,
+        .get_ringparam          = efx_ethtool_get_ringparam,
+        .set_ringparam          = efx_ethtool_set_ringparam,
         .get_pauseparam         = efx_ethtool_get_pauseparam,
         .set_pauseparam         = efx_ethtool_set_pauseparam,
         .get_rx_csum            = efx_ethtool_get_rx_csum,
@@ -994,6 +1146,7 @@ const struct ethtool_ops efx_ethtool_ops = {
         .set_wol                = efx_ethtool_set_wol,
         .reset                  = efx_ethtool_reset,
         .get_rxnfc              = efx_ethtool_get_rxnfc,
+        .set_rx_ntuple          = efx_ethtool_set_rx_ntuple,
         .get_rxfh_indir         = efx_ethtool_get_rxfh_indir,
         .set_rxfh_indir         = efx_ethtool_set_rxfh_indir,
 };
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 4f9d33f3cca1..267019bb2b15 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -159,7 +159,6 @@ irqreturn_t falcon_legacy_interrupt_a1(int irq, void *dev_id)
 {
         struct efx_nic *efx = dev_id;
         efx_oword_t *int_ker = efx->irq_status.addr;
-        struct efx_channel *channel;
         int syserr;
         int queues;
 
@@ -194,15 +193,10 @@ irqreturn_t falcon_legacy_interrupt_a1(int irq, void *dev_id)
         wmb(); /* Ensure the vector is cleared before interrupt ack */
         falcon_irq_ack_a1(efx);
 
-        /* Schedule processing of any interrupting queues */
-        channel = &efx->channel[0];
-        while (queues) {
-                if (queues & 0x01)
-                        efx_schedule_channel(channel);
-                channel++;
-                queues >>= 1;
-        }
-
+        if (queues & 1)
+                efx_schedule_channel(efx_get_channel(efx, 0));
+        if (queues & 2)
+                efx_schedule_channel(efx_get_channel(efx, 1));
         return IRQ_HANDLED;
 }
 /**************************************************************************
@@ -452,30 +446,19 @@ static void falcon_reset_macs(struct efx_nic *efx)
                 /* It's not safe to use GLB_CTL_REG to reset the
                  * macs, so instead use the internal MAC resets
                  */
-                if (!EFX_IS10G(efx)) {
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_SW_RST, 1);
-                        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-                        udelay(1000);
-
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_SW_RST, 0);
-                        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-                        udelay(1000);
-                        return;
-                } else {
-                        EFX_POPULATE_OWORD_1(reg, FRF_AB_XM_CORE_RST, 1);
-                        efx_writeo(efx, &reg, FR_AB_XM_GLB_CFG);
-
-                        for (count = 0; count < 10000; count++) {
-                                efx_reado(efx, &reg, FR_AB_XM_GLB_CFG);
-                                if (EFX_OWORD_FIELD(reg, FRF_AB_XM_CORE_RST) ==
-                                    0)
-                                        return;
-                                udelay(10);
-                        }
-
-                        netif_err(efx, hw, efx->net_dev,
-                                  "timed out waiting for XMAC core reset\n");
+                EFX_POPULATE_OWORD_1(reg, FRF_AB_XM_CORE_RST, 1);
+                efx_writeo(efx, &reg, FR_AB_XM_GLB_CFG);
+
+                for (count = 0; count < 10000; count++) {
+                        efx_reado(efx, &reg, FR_AB_XM_GLB_CFG);
+                        if (EFX_OWORD_FIELD(reg, FRF_AB_XM_CORE_RST) ==
+                            0)
+                                return;
+                        udelay(10);
                 }
+
+                netif_err(efx, hw, efx->net_dev,
+                          "timed out waiting for XMAC core reset\n");
         }
 
         /* Mac stats will fail whist the TX fifo is draining */
@@ -514,7 +497,6 @@ static void falcon_reset_macs(struct efx_nic *efx)
          * are re-enabled by the caller */
         efx_writeo(efx, &mac_ctrl, FR_AB_MAC_CTRL);
 
-        /* This can run even when the GMAC is selected */
         falcon_setup_xaui(efx);
 }
 
@@ -652,8 +634,6 @@ static void falcon_stats_timer_func(unsigned long context)
         spin_unlock(&efx->stats_lock);
 }
 
-static void falcon_switch_mac(struct efx_nic *efx);
-
 static bool falcon_loopback_link_poll(struct efx_nic *efx)
 {
         struct efx_link_state old_state = efx->link_state;
@@ -664,11 +644,7 @@ static bool falcon_loopback_link_poll(struct efx_nic *efx)
         efx->link_state.fd = true;
         efx->link_state.fc = efx->wanted_fc;
         efx->link_state.up = true;
-
-        if (efx->loopback_mode == LOOPBACK_GMAC)
-                efx->link_state.speed = 1000;
-        else
-                efx->link_state.speed = 10000;
+        efx->link_state.speed = 10000;
 
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
@@ -691,7 +667,7 @@ static int falcon_reconfigure_port(struct efx_nic *efx)
         falcon_stop_nic_stats(efx);
         falcon_deconfigure_mac_wrapper(efx);
 
-        falcon_switch_mac(efx);
+        falcon_reset_macs(efx);
 
         efx->phy_op->reconfigure(efx);
         rc = efx->mac_op->reconfigure(efx);
@@ -841,73 +817,23 @@ out:
         return rc;
 }
 
-static void falcon_clock_mac(struct efx_nic *efx)
-{
-        unsigned strap_val;
-        efx_oword_t nic_stat;
-
-        /* Configure the NIC generated MAC clock correctly */
-        efx_reado(efx, &nic_stat, FR_AB_NIC_STAT);
-        strap_val = EFX_IS10G(efx) ? 5 : 3;
-        if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0) {
-                EFX_SET_OWORD_FIELD(nic_stat, FRF_BB_EE_STRAP_EN, 1);
-                EFX_SET_OWORD_FIELD(nic_stat, FRF_BB_EE_STRAP, strap_val);
-                efx_writeo(efx, &nic_stat, FR_AB_NIC_STAT);
-        } else {
-                /* Falcon A1 does not support 1G/10G speed switching
-                 * and must not be used with a PHY that does. */
-                BUG_ON(EFX_OWORD_FIELD(nic_stat, FRF_AB_STRAP_PINS) !=
-                       strap_val);
-        }
-}
-
-static void falcon_switch_mac(struct efx_nic *efx)
-{
-        struct efx_mac_operations *old_mac_op = efx->mac_op;
-        struct falcon_nic_data *nic_data = efx->nic_data;
-        unsigned int stats_done_offset;
-
-        WARN_ON(!mutex_is_locked(&efx->mac_lock));
-        WARN_ON(nic_data->stats_disable_count == 0);
-
-        efx->mac_op = (EFX_IS10G(efx) ?
-                       &falcon_xmac_operations : &falcon_gmac_operations);
-
-        if (EFX_IS10G(efx))
-                stats_done_offset = XgDmaDone_offset;
-        else
-                stats_done_offset = GDmaDone_offset;
-        nic_data->stats_dma_done = efx->stats_buffer.addr + stats_done_offset;
-
-        if (old_mac_op == efx->mac_op)
-                return;
-
-        falcon_clock_mac(efx);
-
-        netif_dbg(efx, hw, efx->net_dev, "selected %cMAC\n",
-                  EFX_IS10G(efx) ? 'X' : 'G');
-        /* Not all macs support a mac-level link state */
-        efx->xmac_poll_required = false;
-        falcon_reset_macs(efx);
-}
-
 /* This call is responsible for hooking in the MAC and PHY operations */
 static int falcon_probe_port(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
         switch (efx->phy_type) {
         case PHY_TYPE_SFX7101:
                 efx->phy_op = &falcon_sfx7101_phy_ops;
                 break;
-        case PHY_TYPE_SFT9001A:
-        case PHY_TYPE_SFT9001B:
-                efx->phy_op = &falcon_sft9001_phy_ops;
-                break;
         case PHY_TYPE_QT2022C2:
         case PHY_TYPE_QT2025C:
                 efx->phy_op = &falcon_qt202x_phy_ops;
                 break;
+        case PHY_TYPE_TXC43128:
+                efx->phy_op = &falcon_txc_phy_ops;
+                break;
         default:
                 netif_err(efx, probe, efx->net_dev, "Unknown PHY type %d\n",
                           efx->phy_type);
@@ -943,6 +869,7 @@ static int falcon_probe_port(struct efx_nic *efx)
                   (u64)efx->stats_buffer.dma_addr,
                   efx->stats_buffer.addr,
                   (u64)virt_to_phys(efx->stats_buffer.addr));
+        nic_data->stats_dma_done = efx->stats_buffer.addr + XgDmaDone_offset;
 
         return 0;
 }
@@ -1207,7 +1134,7 @@ static void falcon_monitor(struct efx_nic *efx)
                 falcon_stop_nic_stats(efx);
                 falcon_deconfigure_mac_wrapper(efx);
 
-                falcon_switch_mac(efx);
+                falcon_reset_macs(efx);
                 rc = efx->mac_op->reconfigure(efx);
                 BUG_ON(rc);
 
@@ -1216,8 +1143,7 @@ static void falcon_monitor(struct efx_nic *efx)
                 efx_link_status_changed(efx);
         }
 
-        if (EFX_IS10G(efx))
-                falcon_poll_xmac(efx);
+        falcon_poll_xmac(efx);
 }
 
 /* Zeroes out the SRAM contents.  This routine must be called in
@@ -1610,16 +1536,6 @@ static int falcon_init_nic(struct efx_nic *efx)
         EFX_SET_OWORD_FIELD(temp, FRF_AB_ONCHIP_SRAM, 1);
         efx_writeo(efx, &temp, FR_AB_NIC_STAT);
 
-        /* Set the source of the GMAC clock */
-        if (efx_nic_rev(efx) == EFX_REV_FALCON_B0) {
-                efx_reado(efx, &temp, FR_AB_GPIO_CTL);
-                EFX_SET_OWORD_FIELD(temp, FRF_AB_USE_NIC_CLK, true);
-                efx_writeo(efx, &temp, FR_AB_GPIO_CTL);
-        }
-
-        /* Select the correct MAC */
-        falcon_clock_mac(efx);
-
         rc = falcon_reset_sram(efx);
         if (rc)
                 return rc;
@@ -1880,7 +1796,7 @@ struct efx_nic_type falcon_b0_nic_type = {
                                    * channels */
         .tx_dc_base = 0x130000,
         .rx_dc_base = 0x100000,
-        .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH,
+        .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE,
         .reset_world_flags = ETH_RESET_IRQ,
 };
 
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 3d950c2cf205..cfc6a5b5a477 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -26,7 +26,7 @@
 /* Board types */
 #define FALCON_BOARD_SFE4001 0x01
 #define FALCON_BOARD_SFE4002 0x02
-#define FALCON_BOARD_SFN4111T 0x51
+#define FALCON_BOARD_SFE4003 0x03
 #define FALCON_BOARD_SFN4112F 0x52
 
 /* Board temperature is about 15°C above ambient when air flow is
@@ -142,17 +142,17 @@ static inline int efx_check_lm87(struct efx_nic *efx, unsigned mask)
 #endif /* CONFIG_SENSORS_LM87 */
 
 /*****************************************************************************
- * Support for the SFE4001 and SFN4111T NICs.
+ * Support for the SFE4001 NIC.
  *
  * The SFE4001 does not power-up fully at reset due to its high power
  * consumption.  We control its power via a PCA9539 I/O expander.
- * Both boards have a MAX6647 temperature monitor which we expose to
+ * It also has a MAX6647 temperature monitor which we expose to
  * the lm90 driver.
  *
  * This also provides minimal support for reflashing the PHY, which is
  * initiated by resetting it with the FLASH_CFG_1 pin pulled down.
  * On SFE4001 rev A2 and later this is connected to the 3V3X output of
- * the IO-expander; on the SFN4111T it is connected to Falcon's GPIO3.
+ * the IO-expander.
  * We represent reflash mode as PHY_MODE_SPECIAL and make it mutually
  * exclusive with the network device being open.
  */
@@ -304,34 +304,6 @@ fail_on:
         return rc;
 }
 
-static int sfn4111t_reset(struct efx_nic *efx)
-{
-        struct falcon_board *board = falcon_board(efx);
-        efx_oword_t reg;
-
-        /* GPIO 3 and the GPIO register are shared with I2C, so block that */
-        i2c_lock_adapter(&board->i2c_adap);
-
-        /* Pull RST_N (GPIO 2) low then let it up again, setting the
-         * FLASH_CFG_1 strap (GPIO 3) appropriately.  Only change the
-         * output enables; the output levels should always be 0 (low)
-         * and we rely on external pull-ups. */
-        efx_reado(efx, &reg, FR_AB_GPIO_CTL);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO2_OEN, true);
-        efx_writeo(efx, &reg, FR_AB_GPIO_CTL);
-        msleep(1000);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO2_OEN, false);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GPIO3_OEN,
-                            !!(efx->phy_mode & PHY_MODE_SPECIAL));
-        efx_writeo(efx, &reg, FR_AB_GPIO_CTL);
-        msleep(1);
-
-        i2c_unlock_adapter(&board->i2c_adap);
-
-        ssleep(1);
-        return 0;
-}
-
 static ssize_t show_phy_flash_cfg(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
@@ -363,10 +335,7 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
                 efx->phy_mode = new_mode;
                 if (new_mode & PHY_MODE_SPECIAL)
                         falcon_stop_nic_stats(efx);
-                if (falcon_board(efx)->type->id == FALCON_BOARD_SFE4001)
-                        err = sfe4001_poweron(efx);
-                else
-                        err = sfn4111t_reset(efx);
+                err = sfe4001_poweron(efx);
                 if (!err)
                         err = efx_reconfigure_port(efx);
                 if (!(new_mode & PHY_MODE_SPECIAL))
@@ -479,83 +448,6 @@ fail_hwmon:
         return rc;
 }
 
-static int sfn4111t_check_hw(struct efx_nic *efx)
-{
-        s32 status;
-
-        /* If XAUI link is up then do not monitor */
-        if (EFX_WORKAROUND_7884(efx) && !efx->xmac_poll_required)
-                return 0;
-
-        /* Test LHIGH, RHIGH, FAULT, EOT and IOT alarms */
-        status = i2c_smbus_read_byte_data(falcon_board(efx)->hwmon_client,
-                                          MAX664X_REG_RSL);
-        if (status < 0)
-                return -EIO;
-        if (status & 0x57)
-                return -ERANGE;
-        return 0;
-}
-
-static void sfn4111t_fini(struct efx_nic *efx)
-{
-        netif_info(efx, drv, efx->net_dev, "%s\n", __func__);
-
-        device_remove_file(&efx->pci_dev->dev, &dev_attr_phy_flash_cfg);
-        i2c_unregister_device(falcon_board(efx)->hwmon_client);
-}
-
-static struct i2c_board_info sfn4111t_a0_hwmon_info = {
-        I2C_BOARD_INFO("max6647", 0x4e),
-};
-
-static struct i2c_board_info sfn4111t_r5_hwmon_info = {
-        I2C_BOARD_INFO("max6646", 0x4d),
-};
-
-static void sfn4111t_init_phy(struct efx_nic *efx)
-{
-        if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
-                if (sft9001_wait_boot(efx) != -EINVAL)
-                        return;
-
-                efx->phy_mode = PHY_MODE_SPECIAL;
-                falcon_stop_nic_stats(efx);
-        }
-
-        sfn4111t_reset(efx);
-        sft9001_wait_boot(efx);
-}
-
-static int sfn4111t_init(struct efx_nic *efx)
-{
-        struct falcon_board *board = falcon_board(efx);
-        int rc;
-
-        board->hwmon_client =
-                i2c_new_device(&board->i2c_adap,
-                               (board->minor < 5) ?
-                               &sfn4111t_a0_hwmon_info :
-                               &sfn4111t_r5_hwmon_info);
-        if (!board->hwmon_client)
-                return -EIO;
-
-        rc = device_create_file(&efx->pci_dev->dev, &dev_attr_phy_flash_cfg);
-        if (rc)
-                goto fail_hwmon;
-
-        if (efx->phy_mode & PHY_MODE_SPECIAL)
-                /* PHY may not generate a 156.25 MHz clock and MAC
-                 * stats fetch will fail. */
-                falcon_stop_nic_stats(efx);
-
-        return 0;
-
-fail_hwmon:
-        i2c_unregister_device(board->hwmon_client);
-        return rc;
-}
-
 /*****************************************************************************
  * Support for the SFE4002
  *
@@ -691,6 +583,75 @@ static int sfn4112f_init(struct efx_nic *efx)
         return efx_init_lm87(efx, &sfn4112f_hwmon_info, sfn4112f_lm87_regs);
 }
 
+/*****************************************************************************
+ * Support for the SFE4003
+ *
+ */
+static u8 sfe4003_lm87_channel = 0x03; /* use AIN not FAN inputs */
+
+static const u8 sfe4003_lm87_regs[] = {
+        LM87_IN_LIMITS(0, 0x67, 0x7f),          /* 2.5V:  1.5V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 70 + FALCON_BOARD_TEMP_BIAS),
+        0
+};
+
+static struct i2c_board_info sfe4003_hwmon_info = {
+        I2C_BOARD_INFO("lm87", 0x2e),
+        .platform_data  = &sfe4003_lm87_channel,
+};
+
+/* Board-specific LED info. */
+#define SFE4003_RED_LED_GPIO    11
+#define SFE4003_LED_ON          1
+#define SFE4003_LED_OFF         0
+
+static void sfe4003_set_id_led(struct efx_nic *efx, enum efx_led_mode mode)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* The LEDs were not wired to GPIOs before A3 */
+        if (board->minor < 3 && board->major == 0)
+                return;
+
+        falcon_txc_set_gpio_val(
+                efx, SFE4003_RED_LED_GPIO,
+                (mode == EFX_LED_ON) ? SFE4003_LED_ON : SFE4003_LED_OFF);
+}
+
+static void sfe4003_init_phy(struct efx_nic *efx)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* The LEDs were not wired to GPIOs before A3 */
+        if (board->minor < 3 && board->major == 0)
+                return;
+
+        falcon_txc_set_gpio_dir(efx, SFE4003_RED_LED_GPIO, TXC_GPIO_DIR_OUTPUT);
+        falcon_txc_set_gpio_val(efx, SFE4003_RED_LED_GPIO, SFE4003_LED_OFF);
+}
+
+static int sfe4003_check_hw(struct efx_nic *efx)
+{
+        struct falcon_board *board = falcon_board(efx);
+
+        /* A0/A1/A2 board rev. 4003s  report a temperature fault the whole time
+         * (bad sensor) so we mask it out. */
+        unsigned alarm_mask =
+                (board->major == 0 && board->minor <= 2) ?
+                ~LM87_ALARM_TEMP_EXT1 : ~0;
+
+        return efx_check_lm87(efx, alarm_mask);
+}
+
+static int sfe4003_init(struct efx_nic *efx)
+{
+        return efx_init_lm87(efx, &sfe4003_hwmon_info, sfe4003_lm87_regs);
+}
+
 static const struct falcon_board_type board_types[] = {
         {
                 .id             = FALCON_BOARD_SFE4001,
@@ -713,14 +674,14 @@ static const struct falcon_board_type board_types[] = {
                 .monitor        = sfe4002_check_hw,
         },
         {
-                .id             = FALCON_BOARD_SFN4111T,
-                .ref_model      = "SFN4111T",
-                .gen_type       = "100/1000/10GBASE-T adapter",
-                .init           = sfn4111t_init,
-                .init_phy       = sfn4111t_init_phy,
-                .fini           = sfn4111t_fini,
-                .set_id_led     = tenxpress_set_id_led,
-                .monitor        = sfn4111t_check_hw,
+                .id             = FALCON_BOARD_SFE4003,
+                .ref_model      = "SFE4003",
+                .gen_type       = "10GBASE-CX4 adapter",
+                .init           = sfe4003_init,
+                .init_phy       = sfe4003_init_phy,
+                .fini           = efx_fini_lm87,
+                .set_id_led     = sfe4003_set_id_led,
+                .monitor        = sfe4003_check_hw,
         },
         {
                 .id             = FALCON_BOARD_SFN4112F,
diff --git a/drivers/net/sfc/falcon_gmac.c b/drivers/net/sfc/falcon_gmac.c
deleted file mode 100644
index 7dadfcbd6ce7..000000000000
--- a/drivers/net/sfc/falcon_gmac.c
+++ /dev/null
@@ -1,230 +0,0 @@
-/****************************************************************************
- * Driver for Solarflare Solarstorm network controllers and boards
- * Copyright 2005-2006 Fen Systems Ltd.
- * Copyright 2006-2009 Solarflare Communications Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published
- * by the Free Software Foundation, incorporated herein by reference.
- */
-
-#include <linux/delay.h>
-#include "net_driver.h"
-#include "efx.h"
-#include "nic.h"
-#include "mac.h"
-#include "regs.h"
-#include "io.h"
-
-/**************************************************************************
- *
- * MAC operations
- *
- *************************************************************************/
-
-static int falcon_reconfigure_gmac(struct efx_nic *efx)
-{
-        struct efx_link_state *link_state = &efx->link_state;
-        bool loopback, tx_fc, rx_fc, bytemode;
-        int if_mode;
-        unsigned int max_frame_len;
-        efx_oword_t reg;
-
-        /* Configuration register 1 */
-        tx_fc = (link_state->fc & EFX_FC_TX) || !link_state->fd;
-        rx_fc = !!(link_state->fc & EFX_FC_RX);
-        loopback = (efx->loopback_mode == LOOPBACK_GMAC);
-        bytemode = (link_state->speed == 1000);
-
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GM_LOOP, loopback,
-                             FRF_AB_GM_TX_EN, 1,
-                             FRF_AB_GM_TX_FC_EN, tx_fc,
-                             FRF_AB_GM_RX_EN, 1,
-                             FRF_AB_GM_RX_FC_EN, rx_fc);
-        efx_writeo(efx, &reg, FR_AB_GM_CFG1);
-        udelay(10);
-
-        /* Configuration register 2 */
-        if_mode = (bytemode) ? 2 : 1;
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GM_IF_MODE, if_mode,
-                             FRF_AB_GM_PAD_CRC_EN, 1,
-                             FRF_AB_GM_LEN_CHK, 1,
-                             FRF_AB_GM_FD, link_state->fd,
-                             FRF_AB_GM_PAMBL_LEN, 0x7/*datasheet recommended */);
-
-        efx_writeo(efx, &reg, FR_AB_GM_CFG2);
-        udelay(10);
-
-        /* Max frame len register */
-        max_frame_len = EFX_MAX_FRAME_LEN(efx->net_dev->mtu);
-        EFX_POPULATE_OWORD_1(reg, FRF_AB_GM_MAX_FLEN, max_frame_len);
-        efx_writeo(efx, &reg, FR_AB_GM_MAX_FLEN);
-        udelay(10);
-
-        /* FIFO configuration register 0 */
-        EFX_POPULATE_OWORD_5(reg,
-                             FRF_AB_GMF_FTFENREQ, 1,
-                             FRF_AB_GMF_STFENREQ, 1,
-                             FRF_AB_GMF_FRFENREQ, 1,
-                             FRF_AB_GMF_SRFENREQ, 1,
-                             FRF_AB_GMF_WTMENREQ, 1);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG0);
-        udelay(10);
-
-        /* FIFO configuration register 1 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGFRTH, 0x12,
-                             FRF_AB_GMF_CFGXOFFRTX, 0xffff);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG1);
-        udelay(10);
-
-        /* FIFO configuration register 2 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGHWM, 0x3f,
-                             FRF_AB_GMF_CFGLWM, 0xa);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG2);
-        udelay(10);
-
-        /* FIFO configuration register 3 */
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GMF_CFGHWMFT, 0x1c,
-                             FRF_AB_GMF_CFGFTTH, 0x08);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG3);
-        udelay(10);
-
-        /* FIFO configuration register 4 */
-        EFX_POPULATE_OWORD_1(reg, FRF_AB_GMF_HSTFLTRFRM_PAUSE, 1);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG4);
-        udelay(10);
-
-        /* FIFO configuration register 5 */
-        efx_reado(efx, &reg, FR_AB_GMF_CFG5);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_CFGBYTMODE, bytemode);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_CFGHDPLX, !link_state->fd);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_HSTDRPLT64, !link_state->fd);
-        EFX_SET_OWORD_FIELD(reg, FRF_AB_GMF_HSTFLTRFRMDC_PAUSE, 0);
-        efx_writeo(efx, &reg, FR_AB_GMF_CFG5);
-        udelay(10);
-
-        /* MAC address */
-        EFX_POPULATE_OWORD_4(reg,
-                             FRF_AB_GM_ADR_B0, efx->net_dev->dev_addr[5],
-                             FRF_AB_GM_ADR_B1, efx->net_dev->dev_addr[4],
-                             FRF_AB_GM_ADR_B2, efx->net_dev->dev_addr[3],
-                             FRF_AB_GM_ADR_B3, efx->net_dev->dev_addr[2]);
-        efx_writeo(efx, &reg, FR_AB_GM_ADR1);
-        udelay(10);
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_GM_ADR_B4, efx->net_dev->dev_addr[1],
-                             FRF_AB_GM_ADR_B5, efx->net_dev->dev_addr[0]);
-        efx_writeo(efx, &reg, FR_AB_GM_ADR2);
-        udelay(10);
-
-        falcon_reconfigure_mac_wrapper(efx);
-
-        return 0;
-}
-
-static void falcon_update_stats_gmac(struct efx_nic *efx)
-{
-        struct efx_mac_stats *mac_stats = &efx->mac_stats;
-        unsigned long old_rx_pause, old_tx_pause;
-        unsigned long new_rx_pause, new_tx_pause;
-
-        /* Pause frames are erroneously counted as errors (SFC bug 3269) */
-        old_rx_pause = mac_stats->rx_pause;
-        old_tx_pause = mac_stats->tx_pause;
-
-        /* Update MAC stats from DMAed values */
-        FALCON_STAT(efx, GRxGoodOct, rx_good_bytes);
-        FALCON_STAT(efx, GRxBadOct, rx_bad_bytes);
-        FALCON_STAT(efx, GRxMissPkt, rx_missed);
-        FALCON_STAT(efx, GRxFalseCRS, rx_false_carrier);
-        FALCON_STAT(efx, GRxPausePkt, rx_pause);
-        FALCON_STAT(efx, GRxBadPkt, rx_bad);
-        FALCON_STAT(efx, GRxUcastPkt, rx_unicast);
-        FALCON_STAT(efx, GRxMcastPkt, rx_multicast);
-        FALCON_STAT(efx, GRxBcastPkt, rx_broadcast);
-        FALCON_STAT(efx, GRxGoodLt64Pkt, rx_good_lt64);
-        FALCON_STAT(efx, GRxBadLt64Pkt, rx_bad_lt64);
-        FALCON_STAT(efx, GRx64Pkt, rx_64);
-        FALCON_STAT(efx, GRx65to127Pkt, rx_65_to_127);
-        FALCON_STAT(efx, GRx128to255Pkt, rx_128_to_255);
-        FALCON_STAT(efx, GRx256to511Pkt, rx_256_to_511);
-        FALCON_STAT(efx, GRx512to1023Pkt, rx_512_to_1023);
-        FALCON_STAT(efx, GRx1024to15xxPkt, rx_1024_to_15xx);
-        FALCON_STAT(efx, GRx15xxtoJumboPkt, rx_15xx_to_jumbo);
-        FALCON_STAT(efx, GRxGtJumboPkt, rx_gtjumbo);
-        FALCON_STAT(efx, GRxFcsErr64to15xxPkt, rx_bad_64_to_15xx);
-        FALCON_STAT(efx, GRxFcsErr15xxtoJumboPkt, rx_bad_15xx_to_jumbo);
-        FALCON_STAT(efx, GRxFcsErrGtJumboPkt, rx_bad_gtjumbo);
-        FALCON_STAT(efx, GTxGoodBadOct, tx_bytes);
-        FALCON_STAT(efx, GTxGoodOct, tx_good_bytes);
-        FALCON_STAT(efx, GTxSglColPkt, tx_single_collision);
-        FALCON_STAT(efx, GTxMultColPkt, tx_multiple_collision);
-        FALCON_STAT(efx, GTxExColPkt, tx_excessive_collision);
-        FALCON_STAT(efx, GTxDefPkt, tx_deferred);
-        FALCON_STAT(efx, GTxLateCol, tx_late_collision);
-        FALCON_STAT(efx, GTxExDefPkt, tx_excessive_deferred);
-        FALCON_STAT(efx, GTxPausePkt, tx_pause);
-        FALCON_STAT(efx, GTxBadPkt, tx_bad);
-        FALCON_STAT(efx, GTxUcastPkt, tx_unicast);
-        FALCON_STAT(efx, GTxMcastPkt, tx_multicast);
-        FALCON_STAT(efx, GTxBcastPkt, tx_broadcast);
-        FALCON_STAT(efx, GTxLt64Pkt, tx_lt64);
-        FALCON_STAT(efx, GTx64Pkt, tx_64);
-        FALCON_STAT(efx, GTx65to127Pkt, tx_65_to_127);
-        FALCON_STAT(efx, GTx128to255Pkt, tx_128_to_255);
-        FALCON_STAT(efx, GTx256to511Pkt, tx_256_to_511);
-        FALCON_STAT(efx, GTx512to1023Pkt, tx_512_to_1023);
-        FALCON_STAT(efx, GTx1024to15xxPkt, tx_1024_to_15xx);
-        FALCON_STAT(efx, GTx15xxtoJumboPkt, tx_15xx_to_jumbo);
-        FALCON_STAT(efx, GTxGtJumboPkt, tx_gtjumbo);
-        FALCON_STAT(efx, GTxNonTcpUdpPkt, tx_non_tcpudp);
-        FALCON_STAT(efx, GTxMacSrcErrPkt, tx_mac_src_error);
-        FALCON_STAT(efx, GTxIpSrcErrPkt, tx_ip_src_error);
-
-        /* Pause frames are erroneously counted as errors (SFC bug 3269) */
-        new_rx_pause = mac_stats->rx_pause;
-        new_tx_pause = mac_stats->tx_pause;
-        mac_stats->rx_bad -= (new_rx_pause - old_rx_pause);
-        mac_stats->tx_bad -= (new_tx_pause - old_tx_pause);
-
-        /* Derive stats that the MAC doesn't provide directly */
-        mac_stats->tx_bad_bytes =
-                mac_stats->tx_bytes - mac_stats->tx_good_bytes;
-        mac_stats->tx_packets =
-                mac_stats->tx_lt64 + mac_stats->tx_64 +
-                mac_stats->tx_65_to_127 + mac_stats->tx_128_to_255 +
-                mac_stats->tx_256_to_511 + mac_stats->tx_512_to_1023 +
-                mac_stats->tx_1024_to_15xx + mac_stats->tx_15xx_to_jumbo +
-                mac_stats->tx_gtjumbo;
-        mac_stats->tx_collision =
-                mac_stats->tx_single_collision +
-                mac_stats->tx_multiple_collision +
-                mac_stats->tx_excessive_collision +
-                mac_stats->tx_late_collision;
-        mac_stats->rx_bytes =
-                mac_stats->rx_good_bytes + mac_stats->rx_bad_bytes;
-        mac_stats->rx_packets =
-                mac_stats->rx_good_lt64 + mac_stats->rx_bad_lt64 +
-                mac_stats->rx_64 + mac_stats->rx_65_to_127 +
-                mac_stats->rx_128_to_255 + mac_stats->rx_256_to_511 +
-                mac_stats->rx_512_to_1023 + mac_stats->rx_1024_to_15xx +
-                mac_stats->rx_15xx_to_jumbo + mac_stats->rx_gtjumbo;
-        mac_stats->rx_good = mac_stats->rx_packets - mac_stats->rx_bad;
-        mac_stats->rx_lt64 = mac_stats->rx_good_lt64 + mac_stats->rx_bad_lt64;
-}
-
-static bool falcon_gmac_check_fault(struct efx_nic *efx)
-{
-        return false;
-}
-
-struct efx_mac_operations falcon_gmac_operations = {
-        .reconfigure    = falcon_reconfigure_gmac,
-        .update_stats   = falcon_update_stats_gmac,
-        .check_fault    = falcon_gmac_check_fault,
-};
diff --git a/drivers/net/sfc/filter.c b/drivers/net/sfc/filter.c
new file mode 100644
index 000000000000..abc884d09d57
--- /dev/null
+++ b/drivers/net/sfc/filter.c
@@ -0,0 +1,445 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2005-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#include "efx.h"
+#include "filter.h"
+#include "io.h"
+#include "nic.h"
+#include "regs.h"
+
+/* "Fudge factors" - difference between programmed value and actual depth.
+ * Due to pipelined implementation we need to program H/W with a value that
+ * is larger than the hop limit we want.
+ */
+#define FILTER_CTL_SRCH_FUDGE_WILD 3
+#define FILTER_CTL_SRCH_FUDGE_FULL 1
+
+struct efx_filter_table {
+        u32             offset;         /* address of table relative to BAR */
+        unsigned        size;           /* number of entries */
+        unsigned        step;           /* step between entries */
+        unsigned        used;           /* number currently used */
+        unsigned long   *used_bitmap;
+        struct efx_filter_spec *spec;
+};
+
+struct efx_filter_state {
+        spinlock_t      lock;
+        struct efx_filter_table table[EFX_FILTER_TABLE_COUNT];
+        unsigned        search_depth[EFX_FILTER_TYPE_COUNT];
+};
+
+/* The filter hash function is LFSR polynomial x^16 + x^3 + 1 of a 32-bit
+ * key derived from the n-tuple.  The initial LFSR state is 0xffff. */
+static u16 efx_filter_hash(u32 key)
+{
+        u16 tmp;
+
+        /* First 16 rounds */
+        tmp = 0x1fff ^ key >> 16;
+        tmp = tmp ^ tmp >> 3 ^ tmp >> 6;
+        tmp = tmp ^ tmp >> 9;
+        /* Last 16 rounds */
+        tmp = tmp ^ tmp << 13 ^ key;
+        tmp = tmp ^ tmp >> 3 ^ tmp >> 6;
+        return tmp ^ tmp >> 9;
+}
+
+/* To allow for hash collisions, filter search continues at these
+ * increments from the first possible entry selected by the hash. */
+static u16 efx_filter_increment(u32 key)
+{
+        return key * 2 - 1;
+}
+
+static enum efx_filter_table_id
+efx_filter_type_table_id(enum efx_filter_type type)
+{
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_TCP_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_TCP_WILD >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_UDP_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_IP != (EFX_FILTER_RX_UDP_WILD >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_MAC != (EFX_FILTER_RX_MAC_FULL >> 2));
+        BUILD_BUG_ON(EFX_FILTER_TABLE_RX_MAC != (EFX_FILTER_RX_MAC_WILD >> 2));
+        return type >> 2;
+}
+
+static void
+efx_filter_table_reset_search_depth(struct efx_filter_state *state,
+                                    enum efx_filter_table_id table_id)
+{
+        memset(state->search_depth + (table_id << 2), 0,
+               sizeof(state->search_depth[0]) << 2);
+}
+
+static void efx_filter_push_rx_limits(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        efx_oword_t filter_ctl;
+
+        efx_reado(efx, &filter_ctl, FR_BZ_RX_FILTER_CTL);
+
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_TCP_FULL_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_TCP_FULL] +
+                            FILTER_CTL_SRCH_FUDGE_FULL);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_TCP_WILD_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_TCP_WILD] +
+                            FILTER_CTL_SRCH_FUDGE_WILD);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_UDP_FULL_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_UDP_FULL] +
+                            FILTER_CTL_SRCH_FUDGE_FULL);
+        EFX_SET_OWORD_FIELD(filter_ctl, FRF_BZ_UDP_WILD_SRCH_LIMIT,
+                            state->search_depth[EFX_FILTER_RX_UDP_WILD] +
+                            FILTER_CTL_SRCH_FUDGE_WILD);
+
+        if (state->table[EFX_FILTER_TABLE_RX_MAC].size) {
+                EFX_SET_OWORD_FIELD(
+                        filter_ctl, FRF_CZ_ETHERNET_FULL_SEARCH_LIMIT,
+                        state->search_depth[EFX_FILTER_RX_MAC_FULL] +
+                        FILTER_CTL_SRCH_FUDGE_FULL);
+                EFX_SET_OWORD_FIELD(
+                        filter_ctl, FRF_CZ_ETHERNET_WILDCARD_SEARCH_LIMIT,
+                        state->search_depth[EFX_FILTER_RX_MAC_WILD] +
+                        FILTER_CTL_SRCH_FUDGE_WILD);
+        }
+
+        efx_writeo(efx, &filter_ctl, FR_BZ_RX_FILTER_CTL);
+}
+
+/* Build a filter entry and return its n-tuple key. */
+static u32 efx_filter_build(efx_oword_t *filter, struct efx_filter_spec *spec)
+{
+        u32 data3;
+
+        switch (efx_filter_type_table_id(spec->type)) {
+        case EFX_FILTER_TABLE_RX_IP: {
+                bool is_udp = (spec->type == EFX_FILTER_RX_UDP_FULL ||
+                               spec->type == EFX_FILTER_RX_UDP_WILD);
+                EFX_POPULATE_OWORD_7(
+                        *filter,
+                        FRF_BZ_RSS_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_RSS),
+                        FRF_BZ_SCATTER_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_SCATTER),
+                        FRF_BZ_TCP_UDP, is_udp,
+                        FRF_BZ_RXQ_ID, spec->dmaq_id,
+                        EFX_DWORD_2, spec->data[2],
+                        EFX_DWORD_1, spec->data[1],
+                        EFX_DWORD_0, spec->data[0]);
+                data3 = is_udp;
+                break;
+        }
+
+        case EFX_FILTER_TABLE_RX_MAC: {
+                bool is_wild = spec->type == EFX_FILTER_RX_MAC_WILD;
+                EFX_POPULATE_OWORD_8(
+                        *filter,
+                        FRF_CZ_RMFT_RSS_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_RSS),
+                        FRF_CZ_RMFT_SCATTER_EN,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_SCATTER),
+                        FRF_CZ_RMFT_IP_OVERRIDE,
+                        !!(spec->flags & EFX_FILTER_FLAG_RX_OVERRIDE_IP),
+                        FRF_CZ_RMFT_RXQ_ID, spec->dmaq_id,
+                        FRF_CZ_RMFT_WILDCARD_MATCH, is_wild,
+                        FRF_CZ_RMFT_DEST_MAC_HI, spec->data[2],
+                        FRF_CZ_RMFT_DEST_MAC_LO, spec->data[1],
+                        FRF_CZ_RMFT_VLAN_ID, spec->data[0]);
+                data3 = is_wild;
+                break;
+        }
+
+        default:
+                BUG();
+        }
+
+        return spec->data[0] ^ spec->data[1] ^ spec->data[2] ^ data3;
+}
+
+static bool efx_filter_equal(const struct efx_filter_spec *left,
+                             const struct efx_filter_spec *right)
+{
+        if (left->type != right->type ||
+            memcmp(left->data, right->data, sizeof(left->data)))
+                return false;
+
+        return true;
+}
+
+static int efx_filter_search(struct efx_filter_table *table,
+                             struct efx_filter_spec *spec, u32 key,
+                             bool for_insert, int *depth_required)
+{
+        unsigned hash, incr, filter_idx, depth;
+        struct efx_filter_spec *cmp;
+
+        hash = efx_filter_hash(key);
+        incr = efx_filter_increment(key);
+
+        for (depth = 1, filter_idx = hash & (table->size - 1);
+             test_bit(filter_idx, table->used_bitmap);
+             ++depth) {
+                cmp = &table->spec[filter_idx];
+                if (efx_filter_equal(spec, cmp))
+                        goto found;
+                filter_idx = (filter_idx + incr) & (table->size - 1);
+        }
+        if (!for_insert)
+                return -ENOENT;
+found:
+        *depth_required = depth;
+        return filter_idx;
+}
+
+/**
+ * efx_filter_insert_filter - add or replace a filter
+ * @efx: NIC in which to insert the filter
+ * @spec: Specification for the filter
+ * @replace: Flag for whether the specified filter may replace a filter
+ *      with an identical match expression and equal or lower priority
+ *
+ * On success, return the filter index within its table.
+ * On failure, return a negative error code.
+ */
+int efx_filter_insert_filter(struct efx_nic *efx, struct efx_filter_spec *spec,
+                             bool replace)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id =
+                efx_filter_type_table_id(spec->type);
+        struct efx_filter_table *table = &state->table[table_id];
+        struct efx_filter_spec *saved_spec;
+        efx_oword_t filter;
+        int filter_idx, depth;
+        u32 key;
+        int rc;
+
+        if (table->size == 0)
+                return -EINVAL;
+
+        key = efx_filter_build(&filter, spec);
+
+        netif_vdbg(efx, hw, efx->net_dev,
+                   "%s: type %d search_depth=%d", __func__, spec->type,
+                   state->search_depth[spec->type]);
+
+        spin_lock_bh(&state->lock);
+
+        rc = efx_filter_search(table, spec, key, true, &depth);
+        if (rc < 0)
+                goto out;
+        filter_idx = rc;
+        BUG_ON(filter_idx >= table->size);
+        saved_spec = &table->spec[filter_idx];
+
+        if (test_bit(filter_idx, table->used_bitmap)) {
+                /* Should we replace the existing filter? */
+                if (!replace) {
+                        rc = -EEXIST;
+                        goto out;
+                }
+                if (spec->priority < saved_spec->priority) {
+                        rc = -EPERM;
+                        goto out;
+                }
+        } else {
+                __set_bit(filter_idx, table->used_bitmap);
+                ++table->used;
+        }
+        *saved_spec = *spec;
+
+        if (state->search_depth[spec->type] < depth) {
+                state->search_depth[spec->type] = depth;
+                efx_filter_push_rx_limits(efx);
+        }
+
+        efx_writeo(efx, &filter, table->offset + table->step * filter_idx);
+
+        netif_vdbg(efx, hw, efx->net_dev,
+                   "%s: filter type %d index %d rxq %u set",
+                   __func__, spec->type, filter_idx, spec->dmaq_id);
+
+out:
+        spin_unlock_bh(&state->lock);
+        return rc;
+}
+
+static void efx_filter_table_clear_entry(struct efx_nic *efx,
+                                         struct efx_filter_table *table,
+                                         int filter_idx)
+{
+        static efx_oword_t filter;
+
+        if (test_bit(filter_idx, table->used_bitmap)) {
+                __clear_bit(filter_idx, table->used_bitmap);
+                --table->used;
+                memset(&table->spec[filter_idx], 0, sizeof(table->spec[0]));
+
+                efx_writeo(efx, &filter,
+                           table->offset + table->step * filter_idx);
+        }
+}
+
+/**
+ * efx_filter_remove_filter - remove a filter by specification
+ * @efx: NIC from which to remove the filter
+ * @spec: Specification for the filter
+ *
+ * On success, return zero.
+ * On failure, return a negative error code.
+ */
+int efx_filter_remove_filter(struct efx_nic *efx, struct efx_filter_spec *spec)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id =
+                efx_filter_type_table_id(spec->type);
+        struct efx_filter_table *table = &state->table[table_id];
+        struct efx_filter_spec *saved_spec;
+        efx_oword_t filter;
+        int filter_idx, depth;
+        u32 key;
+        int rc;
+
+        key = efx_filter_build(&filter, spec);
+
+        spin_lock_bh(&state->lock);
+
+        rc = efx_filter_search(table, spec, key, false, &depth);
+        if (rc < 0)
+                goto out;
+        filter_idx = rc;
+        saved_spec = &table->spec[filter_idx];
+
+        if (spec->priority < saved_spec->priority) {
+                rc = -EPERM;
+                goto out;
+        }
+
+        efx_filter_table_clear_entry(efx, table, filter_idx);
+        if (table->used == 0)
+                efx_filter_table_reset_search_depth(state, table_id);
+        rc = 0;
+
+out:
+        spin_unlock_bh(&state->lock);
+        return rc;
+}
+
+/**
+ * efx_filter_table_clear - remove filters from a table by priority
+ * @efx: NIC from which to remove the filters
+ * @table_id: Table from which to remove the filters
+ * @priority: Maximum priority to remove
+ */
+void efx_filter_table_clear(struct efx_nic *efx,
+                            enum efx_filter_table_id table_id,
+                            enum efx_filter_priority priority)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        struct efx_filter_table *table = &state->table[table_id];
+        int filter_idx;
+
+        spin_lock_bh(&state->lock);
+
+        for (filter_idx = 0; filter_idx < table->size; ++filter_idx)
+                if (table->spec[filter_idx].priority <= priority)
+                        efx_filter_table_clear_entry(efx, table, filter_idx);
+        if (table->used == 0)
+                efx_filter_table_reset_search_depth(state, table_id);
+
+        spin_unlock_bh(&state->lock);
+}
+
+/* Restore filter stater after reset */
+void efx_restore_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id;
+        struct efx_filter_table *table;
+        efx_oword_t filter;
+        int filter_idx;
+
+        spin_lock_bh(&state->lock);
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                table = &state->table[table_id];
+                for (filter_idx = 0; filter_idx < table->size; filter_idx++) {
+                        if (!test_bit(filter_idx, table->used_bitmap))
+                                continue;
+                        efx_filter_build(&filter, &table->spec[filter_idx]);
+                        efx_writeo(efx, &filter,
+                                   table->offset + table->step * filter_idx);
+                }
+        }
+
+        efx_filter_push_rx_limits(efx);
+
+        spin_unlock_bh(&state->lock);
+}
+
+int efx_probe_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state;
+        struct efx_filter_table *table;
+        unsigned table_id;
+
+        state = kzalloc(sizeof(*efx->filter_state), GFP_KERNEL);
+        if (!state)
+                return -ENOMEM;
+        efx->filter_state = state;
+
+        spin_lock_init(&state->lock);
+
+        if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0) {
+                table = &state->table[EFX_FILTER_TABLE_RX_IP];
+                table->offset = FR_BZ_RX_FILTER_TBL0;
+                table->size = FR_BZ_RX_FILTER_TBL0_ROWS;
+                table->step = FR_BZ_RX_FILTER_TBL0_STEP;
+        }
+
+        if (efx_nic_rev(efx) >= EFX_REV_SIENA_A0) {
+                table = &state->table[EFX_FILTER_TABLE_RX_MAC];
+                table->offset = FR_CZ_RX_MAC_FILTER_TBL0;
+                table->size = FR_CZ_RX_MAC_FILTER_TBL0_ROWS;
+                table->step = FR_CZ_RX_MAC_FILTER_TBL0_STEP;
+        }
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                table = &state->table[table_id];
+                if (table->size == 0)
+                        continue;
+                table->used_bitmap = kcalloc(BITS_TO_LONGS(table->size),
+                                             sizeof(unsigned long),
+                                             GFP_KERNEL);
+                if (!table->used_bitmap)
+                        goto fail;
+                table->spec = vmalloc(table->size * sizeof(*table->spec));
+                if (!table->spec)
+                        goto fail;
+                memset(table->spec, 0, table->size * sizeof(*table->spec));
+        }
+
+        return 0;
+
+fail:
+        efx_remove_filters(efx);
+        return -ENOMEM;
+}
+
+void efx_remove_filters(struct efx_nic *efx)
+{
+        struct efx_filter_state *state = efx->filter_state;
+        enum efx_filter_table_id table_id;
+
+        for (table_id = 0; table_id < EFX_FILTER_TABLE_COUNT; table_id++) {
+                kfree(state->table[table_id].used_bitmap);
+                vfree(state->table[table_id].spec);
+        }
+        kfree(state);
+}
diff --git a/drivers/net/sfc/filter.h b/drivers/net/sfc/filter.h
new file mode 100644
index 000000000000..a53319ded79c
--- /dev/null
+++ b/drivers/net/sfc/filter.h
@@ -0,0 +1,189 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2005-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#ifndef EFX_FILTER_H
+#define EFX_FILTER_H
+
+#include <linux/types.h>
+
+enum efx_filter_table_id {
+        EFX_FILTER_TABLE_RX_IP = 0,
+        EFX_FILTER_TABLE_RX_MAC,
+        EFX_FILTER_TABLE_COUNT,
+};
+
+/**
+ * enum efx_filter_type - type of hardware filter
+ * @EFX_FILTER_RX_TCP_FULL: RX, matching TCP/IPv4 4-tuple
+ * @EFX_FILTER_RX_TCP_WILD: RX, matching TCP/IPv4 destination (host, port)
+ * @EFX_FILTER_RX_UDP_FULL: RX, matching UDP/IPv4 4-tuple
+ * @EFX_FILTER_RX_UDP_WILD: RX, matching UDP/IPv4 destination (host, port)
+ * @EFX_FILTER_RX_MAC_FULL: RX, matching Ethernet destination MAC address, VID
+ * @EFX_FILTER_RX_MAC_WILD: RX, matching Ethernet destination MAC address
+ *
+ * Falcon NICs only support the RX TCP/IPv4 and UDP/IPv4 filter types.
+ */
+enum efx_filter_type {
+        EFX_FILTER_RX_TCP_FULL = 0,
+        EFX_FILTER_RX_TCP_WILD,
+        EFX_FILTER_RX_UDP_FULL,
+        EFX_FILTER_RX_UDP_WILD,
+        EFX_FILTER_RX_MAC_FULL = 4,
+        EFX_FILTER_RX_MAC_WILD,
+        EFX_FILTER_TYPE_COUNT,
+};
+
+/**
+ * enum efx_filter_priority - priority of a hardware filter specification
+ * @EFX_FILTER_PRI_HINT: Performance hint
+ * @EFX_FILTER_PRI_MANUAL: Manually configured filter
+ * @EFX_FILTER_PRI_REQUIRED: Required for correct behaviour
+ */
+enum efx_filter_priority {
+        EFX_FILTER_PRI_HINT = 0,
+        EFX_FILTER_PRI_MANUAL,
+        EFX_FILTER_PRI_REQUIRED,
+};
+
+/**
+ * enum efx_filter_flags - flags for hardware filter specifications
+ * @EFX_FILTER_FLAG_RX_RSS: Use RSS to spread across multiple queues.
+ *      By default, matching packets will be delivered only to the
+ *      specified queue. If this flag is set, they will be delivered
+ *      to a range of queues offset from the specified queue number
+ *      according to the indirection table.
+ * @EFX_FILTER_FLAG_RX_SCATTER: Enable DMA scatter on the receiving
+ *      queue.
+ * @EFX_FILTER_FLAG_RX_OVERRIDE_IP: Enables a MAC filter to override
+ *      any IP filter that matches the same packet.  By default, IP
+ *      filters take precedence.
+ *
+ * Currently, no flags are defined for TX filters.
+ */
+enum efx_filter_flags {
+        EFX_FILTER_FLAG_RX_RSS = 0x01,
+        EFX_FILTER_FLAG_RX_SCATTER = 0x02,
+        EFX_FILTER_FLAG_RX_OVERRIDE_IP = 0x04,
+};
+
+/**
+ * struct efx_filter_spec - specification for a hardware filter
+ * @type: Type of match to be performed, from &enum efx_filter_type
+ * @priority: Priority of the filter, from &enum efx_filter_priority
+ * @flags: Miscellaneous flags, from &enum efx_filter_flags
+ * @dmaq_id: Source/target queue index
+ * @data: Match data (type-dependent)
+ *
+ * Use the efx_filter_set_*() functions to initialise the @type and
+ * @data fields.
+ */
+struct efx_filter_spec {
+        u8      type:4;
+        u8      priority:4;
+        u8      flags;
+        u16     dmaq_id;
+        u32     data[3];
+};
+
+/**
+ * efx_filter_set_rx_tcp_full - specify RX filter with TCP/IPv4 full match
+ * @spec: Specification to initialise
+ * @shost: Source host address (host byte order)
+ * @sport: Source port (host byte order)
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_tcp_full(struct efx_filter_spec *spec,
+                           u32 shost, u16 sport, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_TCP_FULL;
+        spec->data[0] = sport | shost << 16;
+        spec->data[1] = dport << 16 | shost >> 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_tcp_wild - specify RX filter with TCP/IPv4 wildcard match
+ * @spec: Specification to initialise
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_tcp_wild(struct efx_filter_spec *spec, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_TCP_WILD;
+        spec->data[0] = 0;
+        spec->data[1] = dport << 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_udp_full - specify RX filter with UDP/IPv4 full match
+ * @spec: Specification to initialise
+ * @shost: Source host address (host byte order)
+ * @sport: Source port (host byte order)
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_udp_full(struct efx_filter_spec *spec,
+                           u32 shost, u16 sport, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_UDP_FULL;
+        spec->data[0] = sport | shost << 16;
+        spec->data[1] = dport << 16 | shost >> 16;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_udp_wild - specify RX filter with UDP/IPv4 wildcard match
+ * @spec: Specification to initialise
+ * @dhost: Destination host address (host byte order)
+ * @dport: Destination port (host byte order)
+ */
+static inline void
+efx_filter_set_rx_udp_wild(struct efx_filter_spec *spec, u32 dhost, u16 dport)
+{
+        spec->type = EFX_FILTER_RX_UDP_WILD;
+        spec->data[0] = dport;
+        spec->data[1] = 0;
+        spec->data[2] = dhost;
+}
+
+/**
+ * efx_filter_set_rx_mac_full - specify RX filter with MAC full match
+ * @spec: Specification to initialise
+ * @vid: VLAN ID
+ * @addr: Destination MAC address
+ */
+static inline void efx_filter_set_rx_mac_full(struct efx_filter_spec *spec,
+                                              u16 vid, const u8 *addr)
+{
+        spec->type = EFX_FILTER_RX_MAC_FULL;
+        spec->data[0] = vid;
+        spec->data[1] = addr[2] << 24 | addr[3] << 16 | addr[4] << 8 | addr[5];
+        spec->data[2] = addr[0] << 8 | addr[1];
+}
+
+/**
+ * efx_filter_set_rx_mac_full - specify RX filter with MAC wildcard match
+ * @spec: Specification to initialise
+ * @addr: Destination MAC address
+ */
+static inline void efx_filter_set_rx_mac_wild(struct efx_filter_spec *spec,
+                                              const u8 *addr)
+{
+        spec->type = EFX_FILTER_RX_MAC_WILD;
+        spec->data[0] = 0;
+        spec->data[1] = addr[2] << 24 | addr[3] << 16 | addr[4] << 8 | addr[5];
+        spec->data[2] = addr[0] << 8 | addr[1];
+}
+
+#endif /* EFX_FILTER_H */
diff --git a/drivers/net/sfc/mac.h b/drivers/net/sfc/mac.h
index f1aa5f374890..7a6e5ca0290e 100644
--- a/drivers/net/sfc/mac.h
+++ b/drivers/net/sfc/mac.h
@@ -13,7 +13,6 @@
 
 #include "net_driver.h"
 
-extern struct efx_mac_operations falcon_gmac_operations;
 extern struct efx_mac_operations falcon_xmac_operations;
 extern struct efx_mac_operations efx_mcdi_mac_operations;
 extern void falcon_reconfigure_xmac_core(struct efx_nic *efx);
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index eeaf0bd64bd3..98d946020429 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -286,46 +286,24 @@ int efx_mdio_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
  */
 void efx_mdio_an_reconfigure(struct efx_nic *efx)
 {
-        bool xnp = (efx->link_advertising & ADVERTISED_10000baseT_Full
-                    || EFX_WORKAROUND_13204(efx));
         int reg;
 
         WARN_ON(!(efx->mdio.mmds & MDIO_DEVS_AN));
 
         /* Set up the base page */
-        reg = ADVERTISE_CSMA;
-        if (efx->link_advertising & ADVERTISED_10baseT_Half)
-                reg |= ADVERTISE_10HALF;
-        if (efx->link_advertising & ADVERTISED_10baseT_Full)
-                reg |= ADVERTISE_10FULL;
-        if (efx->link_advertising & ADVERTISED_100baseT_Half)
-                reg |= ADVERTISE_100HALF;
-        if (efx->link_advertising & ADVERTISED_100baseT_Full)
-                reg |= ADVERTISE_100FULL;
-        if (xnp)
-                reg |= ADVERTISE_RESV;
-        else if (efx->link_advertising & (ADVERTISED_1000baseT_Half |
-                                          ADVERTISED_1000baseT_Full))
-                reg |= ADVERTISE_NPAGE;
+        reg = ADVERTISE_CSMA | ADVERTISE_RESV;
         if (efx->link_advertising & ADVERTISED_Pause)
                 reg |= ADVERTISE_PAUSE_CAP;
         if (efx->link_advertising & ADVERTISED_Asym_Pause)
                 reg |= ADVERTISE_PAUSE_ASYM;
         efx_mdio_write(efx, MDIO_MMD_AN, MDIO_AN_ADVERTISE, reg);
 
-        /* Set up the (extended) next page if necessary */
-        if (efx->phy_op->set_npage_adv)
-                efx->phy_op->set_npage_adv(efx, efx->link_advertising);
+        /* Set up the (extended) next page */
+        efx->phy_op->set_npage_adv(efx, efx->link_advertising);
 
         /* Enable and restart AN */
         reg = efx_mdio_read(efx, MDIO_MMD_AN, MDIO_CTRL1);
-        reg |= MDIO_AN_CTRL1_ENABLE;
-        if (!(EFX_WORKAROUND_15195(efx) && LOOPBACK_EXTERNAL(efx)))
-                reg |= MDIO_AN_CTRL1_RESTART;
-        if (xnp)
-                reg |= MDIO_AN_CTRL1_XNP;
-        else
-                reg &= ~MDIO_AN_CTRL1_XNP;
+        reg |= MDIO_AN_CTRL1_ENABLE | MDIO_AN_CTRL1_RESTART | MDIO_AN_CTRL1_XNP;
         efx_mdio_write(efx, MDIO_MMD_AN, MDIO_CTRL1, reg);
 }
 
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 64e7caa4bbb5..44f4d58a39a6 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -29,6 +29,7 @@
 #include <linux/device.h>
 #include <linux/highmem.h>
 #include <linux/workqueue.h>
+#include <linux/vmalloc.h>
 #include <linux/i2c.h>
 
 #include "enum.h"
@@ -137,6 +138,7 @@ struct efx_tx_buffer {
  * @channel: The associated channel
  * @buffer: The software buffer ring
  * @txd: The hardware descriptor ring
+ * @ptr_mask: The size of the ring minus 1.
  * @flushed: Used when handling queue flushing
  * @read_count: Current read pointer.
  *      This is the number of buffers that have been removed from both rings.
@@ -170,6 +172,7 @@ struct efx_tx_queue {
         struct efx_nic *nic;
         struct efx_tx_buffer *buffer;
         struct efx_special_buffer txd;
+        unsigned int ptr_mask;
         enum efx_flush_state flushed;
 
         /* Members used mainly on the completion path */
@@ -225,10 +228,9 @@ struct efx_rx_page_state {
 /**
  * struct efx_rx_queue - An Efx RX queue
  * @efx: The associated Efx NIC
- * @queue: DMA queue number
- * @channel: The associated channel
  * @buffer: The software buffer ring
  * @rxd: The hardware descriptor ring
+ * @ptr_mask: The size of the ring minus 1.
  * @added_count: Number of buffers added to the receive queue.
  * @notified_count: Number of buffers given to NIC (<= @added_count).
  * @removed_count: Number of buffers removed from the receive queue.
@@ -240,9 +242,6 @@ struct efx_rx_page_state {
  * @min_fill: RX descriptor minimum non-zero fill level.
  *      This records the minimum fill level observed when a ring
  *      refill was triggered.
- * @min_overfill: RX descriptor minimum overflow fill level.
- *      This records the minimum fill level at which RX queue
- *      overflow was observed.  It should never be set.
  * @alloc_page_count: RX allocation strategy counter.
  * @alloc_skb_count: RX allocation strategy counter.
  * @slow_fill: Timer used to defer efx_nic_generate_fill_event().
@@ -250,10 +249,9 @@ struct efx_rx_page_state {
  */
 struct efx_rx_queue {
         struct efx_nic *efx;
-        int queue;
-        struct efx_channel *channel;
         struct efx_rx_buffer *buffer;
         struct efx_special_buffer rxd;
+        unsigned int ptr_mask;
 
         int added_count;
         int notified_count;
@@ -302,7 +300,6 @@ enum efx_rx_alloc_method {
  *
  * @efx: Associated Efx NIC
  * @channel: Channel instance number
- * @name: Name for channel and IRQ
  * @enabled: Channel enabled indicator
  * @irq: IRQ number (MSI and MSI-X only)
  * @irq_moderation: IRQ moderation value (in hardware ticks)
@@ -311,6 +308,7 @@ enum efx_rx_alloc_method {
  * @reset_work: Scheduled reset work thread
  * @work_pending: Is work pending via NAPI?
  * @eventq: Event queue buffer
+ * @eventq_mask: Event queue pointer mask
  * @eventq_read_ptr: Event queue read pointer
  * @last_eventq_read_ptr: Last event queue read pointer value.
  * @magic_count: Event queue test event count
@@ -327,14 +325,14 @@ enum efx_rx_alloc_method {
  * @n_rx_frm_trunc: Count of RX_FRM_TRUNC errors
  * @n_rx_overlength: Count of RX_OVERLENGTH errors
  * @n_skbuff_leaks: Count of skbuffs leaked due to RX overrun
- * @tx_queue: Pointer to first TX queue, or %NULL if not used for TX
+ * @rx_queue: RX queue for this channel
  * @tx_stop_count: Core TX queue stop count
  * @tx_stop_lock: Core TX queue stop lock
+ * @tx_queue: TX queues for this channel
  */
 struct efx_channel {
         struct efx_nic *efx;
         int channel;
-        char name[IFNAMSIZ + 6];
         bool enabled;
         int irq;
         unsigned int irq_moderation;
@@ -342,6 +340,7 @@ struct efx_channel {
         struct napi_struct napi_str;
         bool work_pending;
         struct efx_special_buffer eventq;
+        unsigned int eventq_mask;
         unsigned int eventq_read_ptr;
         unsigned int last_eventq_read_ptr;
         unsigned int magic_count;
@@ -366,9 +365,12 @@ struct efx_channel {
         struct efx_rx_buffer *rx_pkt;
         bool rx_pkt_csummed;
 
-        struct efx_tx_queue *tx_queue;
+        struct efx_rx_queue rx_queue;
+
         atomic_t tx_stop_count;
         spinlock_t tx_stop_lock;
+
+        struct efx_tx_queue tx_queue[2];
 };
 
 enum efx_led_mode {
@@ -404,8 +406,6 @@ enum efx_int_mode {
 };
 #define EFX_INT_MODE_USE_MSI(x) (((x)->interrupt_mode) <= EFX_INT_MODE_MSI)
 
-#define EFX_IS10G(efx) ((efx)->link_state.speed == 10000)
-
 enum nic_state {
         STATE_INIT = 0,
         STATE_RUNNING = 1,
@@ -618,6 +618,8 @@ union efx_multicast_hash {
         efx_oword_t oword[EFX_MCAST_HASH_ENTRIES / sizeof(efx_oword_t) / 8];
 };
 
+struct efx_filter_state;
+
 /**
  * struct efx_nic - an Efx NIC
  * @name: Device name (net device name or bus id before net device registered)
@@ -641,6 +643,9 @@ union efx_multicast_hash {
  * @tx_queue: TX DMA queues
  * @rx_queue: RX DMA queues
  * @channel: Channels
+ * @channel_name: Names for channels and their IRQs
+ * @rxq_entries: Size of receive queues requested by user.
+ * @txq_entries: Size of transmit queues requested by user.
  * @next_buffer_table: First available buffer table id
  * @n_channels: Number of channels in use
  * @n_rx_channels: Number of channels used for RX (= number of RX queues)
@@ -724,10 +729,11 @@ struct efx_nic {
         enum nic_state state;
         enum reset_type reset_pending;
 
-        struct efx_tx_queue tx_queue[EFX_MAX_TX_QUEUES];
-        struct efx_rx_queue rx_queue[EFX_MAX_RX_QUEUES];
-        struct efx_channel channel[EFX_MAX_CHANNELS];
+        struct efx_channel *channel[EFX_MAX_CHANNELS];
+        char channel_name[EFX_MAX_CHANNELS][IFNAMSIZ + 6];
 
+        unsigned rxq_entries;
+        unsigned txq_entries;
         unsigned next_buffer_table;
         unsigned n_channels;
         unsigned n_rx_channels;
@@ -794,6 +800,8 @@ struct efx_nic {
         u64 loopback_modes;
 
         void *loopback_selftest;
+
+        struct efx_filter_state *filter_state;
 };
 
 static inline int efx_dev_registered(struct efx_nic *efx)
@@ -909,39 +917,67 @@ struct efx_nic_type {
  *
  *************************************************************************/
 
+static inline struct efx_channel *
+efx_get_channel(struct efx_nic *efx, unsigned index)
+{
+        EFX_BUG_ON_PARANOID(index >= efx->n_channels);
+        return efx->channel[index];
+}
+
 /* Iterate over all used channels */
 #define efx_for_each_channel(_channel, _efx)                            \
-        for (_channel = &((_efx)->channel[0]);                          \
-             _channel < &((_efx)->channel[(efx)->n_channels]);          \
-             _channel++)
-
-/* Iterate over all used TX queues */
-#define efx_for_each_tx_queue(_tx_queue, _efx)                          \
-        for (_tx_queue = &((_efx)->tx_queue[0]);                        \
-             _tx_queue < &((_efx)->tx_queue[EFX_TXQ_TYPES *             \
-                                            (_efx)->n_tx_channels]);    \
-             _tx_queue++)
+        for (_channel = (_efx)->channel[0];                             \
+             _channel;                                                  \
+             _channel = (_channel->channel + 1 < (_efx)->n_channels) ?  \
+                     (_efx)->channel[_channel->channel + 1] : NULL)
+
+extern struct efx_tx_queue *
+efx_get_tx_queue(struct efx_nic *efx, unsigned index, unsigned type);
+
+static inline struct efx_tx_queue *
+efx_channel_get_tx_queue(struct efx_channel *channel, unsigned type)
+{
+        struct efx_tx_queue *tx_queue = channel->tx_queue;
+        EFX_BUG_ON_PARANOID(type >= EFX_TXQ_TYPES);
+        return tx_queue->channel ? tx_queue + type : NULL;
+}
 
 /* Iterate over all TX queues belonging to a channel */
 #define efx_for_each_channel_tx_queue(_tx_queue, _channel)              \
-        for (_tx_queue = (_channel)->tx_queue;                          \
+        for (_tx_queue = efx_channel_get_tx_queue(channel, 0);          \
              _tx_queue && _tx_queue < (_channel)->tx_queue + EFX_TXQ_TYPES; \
              _tx_queue++)
 
-/* Iterate over all used RX queues */
-#define efx_for_each_rx_queue(_rx_queue, _efx)                          \
-        for (_rx_queue = &((_efx)->rx_queue[0]);                        \
-             _rx_queue < &((_efx)->rx_queue[(_efx)->n_rx_channels]);    \
-             _rx_queue++)
+static inline struct efx_rx_queue *
+efx_get_rx_queue(struct efx_nic *efx, unsigned index)
+{
+        EFX_BUG_ON_PARANOID(index >= efx->n_rx_channels);
+        return &efx->channel[index]->rx_queue;
+}
+
+static inline struct efx_rx_queue *
+efx_channel_get_rx_queue(struct efx_channel *channel)
+{
+        return channel->channel < channel->efx->n_rx_channels ?
+                &channel->rx_queue : NULL;
+}
 
 /* Iterate over all RX queues belonging to a channel */
 #define efx_for_each_channel_rx_queue(_rx_queue, _channel)              \
-        for (_rx_queue = &((_channel)->efx->rx_queue[(_channel)->channel]); \
+        for (_rx_queue = efx_channel_get_rx_queue(channel);             \
              _rx_queue;                                                 \
-             _rx_queue = NULL)                                          \
-                if (_rx_queue->channel != (_channel))                   \
-                        continue;                                       \
-                else
+             _rx_queue = NULL)
+
+static inline struct efx_channel *
+efx_rx_queue_channel(struct efx_rx_queue *rx_queue)
+{
+        return container_of(rx_queue, struct efx_channel, rx_queue);
+}
+
+static inline int efx_rx_queue_index(struct efx_rx_queue *rx_queue)
+{
+        return efx_rx_queue_channel(rx_queue)->channel;
+}
 
 /* Returns a pointer to the specified receive buffer in the RX
  * descriptor queue.
@@ -949,7 +985,7 @@ struct efx_nic_type {
 static inline struct efx_rx_buffer *efx_rx_buffer(struct efx_rx_queue *rx_queue,
                                                   unsigned int index)
 {
-        return (&rx_queue->buffer[index]);
+        return &rx_queue->buffer[index];
 }
 
 /* Set bit in a little-endian bitfield */
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index f595d920c7c4..394dd929fee7 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -104,7 +104,7 @@ static inline void efx_write_buf_tbl(struct efx_nic *efx, efx_qword_t *value,
 static inline efx_qword_t *efx_event(struct efx_channel *channel,
                                      unsigned int index)
 {
-        return (((efx_qword_t *) (channel->eventq.addr)) + index);
+        return ((efx_qword_t *) (channel->eventq.addr)) + index;
 }
 
 /* See if an event is present
@@ -119,8 +119,8 @@ static inline efx_qword_t *efx_event(struct efx_channel *channel,
  */
 static inline int efx_event_present(efx_qword_t *event)
 {
-        return (!(EFX_DWORD_IS_ALL_ONES(event->dword[0]) |
-                  EFX_DWORD_IS_ALL_ONES(event->dword[1])));
+        return !(EFX_DWORD_IS_ALL_ONES(event->dword[0]) |
+                  EFX_DWORD_IS_ALL_ONES(event->dword[1]));
 }
 
 static bool efx_masked_compare_oword(const efx_oword_t *a, const efx_oword_t *b,
@@ -263,8 +263,8 @@ static int efx_alloc_special_buffer(struct efx_nic *efx,
 {
         len = ALIGN(len, EFX_BUF_SIZE);
 
-        buffer->addr = pci_alloc_consistent(efx->pci_dev, len,
-                                            &buffer->dma_addr);
+        buffer->addr = dma_alloc_coherent(&efx->pci_dev->dev, len,
+                                          &buffer->dma_addr, GFP_KERNEL);
         if (!buffer->addr)
                 return -ENOMEM;
         buffer->len = len;
@@ -301,8 +301,8 @@ efx_free_special_buffer(struct efx_nic *efx, struct efx_special_buffer *buffer)
                   (u64)buffer->dma_addr, buffer->len,
                   buffer->addr, (u64)virt_to_phys(buffer->addr));
 
-        pci_free_consistent(efx->pci_dev, buffer->len, buffer->addr,
-                            buffer->dma_addr);
+        dma_free_coherent(&efx->pci_dev->dev, buffer->len, buffer->addr,
+                          buffer->dma_addr);
         buffer->addr = NULL;
         buffer->entries = 0;
 }
@@ -347,7 +347,7 @@ void efx_nic_free_buffer(struct efx_nic *efx, struct efx_buffer *buffer)
 static inline efx_qword_t *
 efx_tx_desc(struct efx_tx_queue *tx_queue, unsigned int index)
 {
-        return (((efx_qword_t *) (tx_queue->txd.addr)) + index);
+        return ((efx_qword_t *) (tx_queue->txd.addr)) + index;
 }
 
 /* This writes to the TX_DESC_WPTR; write pointer for TX descriptor ring */
@@ -356,7 +356,7 @@ static inline void efx_notify_tx_desc(struct efx_tx_queue *tx_queue)
         unsigned write_ptr;
         efx_dword_t reg;
 
-        write_ptr = tx_queue->write_count & EFX_TXQ_MASK;
+        write_ptr = tx_queue->write_count & tx_queue->ptr_mask;
         EFX_POPULATE_DWORD_1(reg, FRF_AZ_TX_DESC_WPTR_DWORD, write_ptr);
         efx_writed_page(tx_queue->efx, &reg,
                         FR_AZ_TX_DESC_UPD_DWORD_P0, tx_queue->queue);
@@ -377,7 +377,7 @@ void efx_nic_push_buffers(struct efx_tx_queue *tx_queue)
         BUG_ON(tx_queue->write_count == tx_queue->insert_count);
 
         do {
-                write_ptr = tx_queue->write_count & EFX_TXQ_MASK;
+                write_ptr = tx_queue->write_count & tx_queue->ptr_mask;
                 buffer = &tx_queue->buffer[write_ptr];
                 txd = efx_tx_desc(tx_queue, write_ptr);
                 ++tx_queue->write_count;
@@ -398,10 +398,11 @@ void efx_nic_push_buffers(struct efx_tx_queue *tx_queue)
 int efx_nic_probe_tx(struct efx_tx_queue *tx_queue)
 {
         struct efx_nic *efx = tx_queue->efx;
-        BUILD_BUG_ON(EFX_TXQ_SIZE < 512 || EFX_TXQ_SIZE > 4096 ||
-                     EFX_TXQ_SIZE & EFX_TXQ_MASK);
+        unsigned entries;
+
+        entries = tx_queue->ptr_mask + 1;
         return efx_alloc_special_buffer(efx, &tx_queue->txd,
-                                        EFX_TXQ_SIZE * sizeof(efx_qword_t));
+                                        entries * sizeof(efx_qword_t));
 }
 
 void efx_nic_init_tx(struct efx_tx_queue *tx_queue)
@@ -501,7 +502,7 @@ void efx_nic_remove_tx(struct efx_tx_queue *tx_queue)
 static inline efx_qword_t *
 efx_rx_desc(struct efx_rx_queue *rx_queue, unsigned int index)
 {
-        return (((efx_qword_t *) (rx_queue->rxd.addr)) + index);
+        return ((efx_qword_t *) (rx_queue->rxd.addr)) + index;
 }
 
 /* This creates an entry in the RX descriptor queue */
@@ -526,30 +527,32 @@ efx_build_rx_desc(struct efx_rx_queue *rx_queue, unsigned index)
  */
 void efx_nic_notify_rx_desc(struct efx_rx_queue *rx_queue)
 {
+        struct efx_nic *efx = rx_queue->efx;
         efx_dword_t reg;
         unsigned write_ptr;
 
         while (rx_queue->notified_count != rx_queue->added_count) {
-                efx_build_rx_desc(rx_queue,
-                                  rx_queue->notified_count &
-                                  EFX_RXQ_MASK);
+                efx_build_rx_desc(
+                        rx_queue,
+                        rx_queue->notified_count & rx_queue->ptr_mask);
                 ++rx_queue->notified_count;
         }
 
         wmb();
-        write_ptr = rx_queue->added_count & EFX_RXQ_MASK;
+        write_ptr = rx_queue->added_count & rx_queue->ptr_mask;
         EFX_POPULATE_DWORD_1(reg, FRF_AZ_RX_DESC_WPTR_DWORD, write_ptr);
-        efx_writed_page(rx_queue->efx, &reg,
-                        FR_AZ_RX_DESC_UPD_DWORD_P0, rx_queue->queue);
+        efx_writed_page(efx, &reg, FR_AZ_RX_DESC_UPD_DWORD_P0,
+                        efx_rx_queue_index(rx_queue));
 }
 
 int efx_nic_probe_rx(struct efx_rx_queue *rx_queue)
 {
         struct efx_nic *efx = rx_queue->efx;
-        BUILD_BUG_ON(EFX_RXQ_SIZE < 512 || EFX_RXQ_SIZE > 4096 ||
-                     EFX_RXQ_SIZE & EFX_RXQ_MASK);
+        unsigned entries;
+
+        entries = rx_queue->ptr_mask + 1;
         return efx_alloc_special_buffer(efx, &rx_queue->rxd,
-                                        EFX_RXQ_SIZE * sizeof(efx_qword_t));
+                                        entries * sizeof(efx_qword_t));
 }
 
 void efx_nic_init_rx(struct efx_rx_queue *rx_queue)
@@ -561,7 +564,7 @@ void efx_nic_init_rx(struct efx_rx_queue *rx_queue)
 
         netif_dbg(efx, hw, efx->net_dev,
                   "RX queue %d ring in special buffers %d-%d\n",
-                  rx_queue->queue, rx_queue->rxd.index,
+                  efx_rx_queue_index(rx_queue), rx_queue->rxd.index,
                   rx_queue->rxd.index + rx_queue->rxd.entries - 1);
 
         rx_queue->flushed = FLUSH_NONE;
@@ -575,9 +578,10 @@ void efx_nic_init_rx(struct efx_rx_queue *rx_queue)
                               FRF_AZ_RX_ISCSI_HDIG_EN, iscsi_digest_en,
                               FRF_AZ_RX_DESCQ_BUF_BASE_ID, rx_queue->rxd.index,
                               FRF_AZ_RX_DESCQ_EVQ_ID,
-                              rx_queue->channel->channel,
+                              efx_rx_queue_channel(rx_queue)->channel,
                               FRF_AZ_RX_DESCQ_OWNER_ID, 0,
-                              FRF_AZ_RX_DESCQ_LABEL, rx_queue->queue,
+                              FRF_AZ_RX_DESCQ_LABEL,
+                              efx_rx_queue_index(rx_queue),
                               FRF_AZ_RX_DESCQ_SIZE,
                               __ffs(rx_queue->rxd.entries),
                               FRF_AZ_RX_DESCQ_TYPE, 0 /* kernel queue */ ,
@@ -585,7 +589,7 @@ void efx_nic_init_rx(struct efx_rx_queue *rx_queue)
                               FRF_AZ_RX_DESCQ_JUMBO, !is_b0,
                               FRF_AZ_RX_DESCQ_EN, 1);
         efx_writeo_table(efx, &rx_desc_ptr, efx->type->rxd_ptr_tbl_base,
-                         rx_queue->queue);
+                         efx_rx_queue_index(rx_queue));
 }
 
 static void efx_flush_rx_queue(struct efx_rx_queue *rx_queue)
@@ -598,7 +602,8 @@ static void efx_flush_rx_queue(struct efx_rx_queue *rx_queue)
         /* Post a flush command */
         EFX_POPULATE_OWORD_2(rx_flush_descq,
                              FRF_AZ_RX_FLUSH_DESCQ_CMD, 1,
-                             FRF_AZ_RX_FLUSH_DESCQ, rx_queue->queue);
+                             FRF_AZ_RX_FLUSH_DESCQ,
+                             efx_rx_queue_index(rx_queue));
         efx_writeo(efx, &rx_flush_descq, FR_AZ_RX_FLUSH_DESCQ);
 }
 
@@ -613,7 +618,7 @@ void efx_nic_fini_rx(struct efx_rx_queue *rx_queue)
         /* Remove RX descriptor ring from card */
         EFX_ZERO_OWORD(rx_desc_ptr);
         efx_writeo_table(efx, &rx_desc_ptr, efx->type->rxd_ptr_tbl_base,
-                         rx_queue->queue);
+                         efx_rx_queue_index(rx_queue));
 
         /* Unpin RX descriptor ring */
         efx_fini_special_buffer(efx, &rx_queue->rxd);
@@ -680,15 +685,17 @@ efx_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)
                 /* Transmit completion */
                 tx_ev_desc_ptr = EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_DESC_PTR);
                 tx_ev_q_label = EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_Q_LABEL);
-                tx_queue = &efx->tx_queue[tx_ev_q_label];
+                tx_queue = efx_channel_get_tx_queue(
+                        channel, tx_ev_q_label % EFX_TXQ_TYPES);
                 tx_packets = ((tx_ev_desc_ptr - tx_queue->read_count) &
-                              EFX_TXQ_MASK);
+                              tx_queue->ptr_mask);
                 channel->irq_mod_score += tx_packets;
                 efx_xmit_done(tx_queue, tx_ev_desc_ptr);
         } else if (EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_WQ_FF_FULL)) {
                 /* Rewrite the FIFO write pointer */
                 tx_ev_q_label = EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_Q_LABEL);
-                tx_queue = &efx->tx_queue[tx_ev_q_label];
+                tx_queue = efx_channel_get_tx_queue(
+                        channel, tx_ev_q_label % EFX_TXQ_TYPES);
 
                 if (efx_dev_registered(efx))
                         netif_tx_lock(efx->net_dev);
@@ -714,6 +721,7 @@ static void efx_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                                  bool *rx_ev_pkt_ok,
                                  bool *discard)
 {
+        struct efx_channel *channel = efx_rx_queue_channel(rx_queue);
         struct efx_nic *efx = rx_queue->efx;
         bool rx_ev_buf_owner_id_err, rx_ev_ip_hdr_chksum_err;
         bool rx_ev_tcp_udp_chksum_err, rx_ev_eth_crc_err;
@@ -746,14 +754,14 @@ static void efx_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
         /* Count errors that are not in MAC stats.  Ignore expected
          * checksum errors during self-test. */
         if (rx_ev_frm_trunc)
-                ++rx_queue->channel->n_rx_frm_trunc;
+                ++channel->n_rx_frm_trunc;
         else if (rx_ev_tobe_disc)
-                ++rx_queue->channel->n_rx_tobe_disc;
+                ++channel->n_rx_tobe_disc;
         else if (!efx->loopback_selftest) {
                 if (rx_ev_ip_hdr_chksum_err)
-                        ++rx_queue->channel->n_rx_ip_hdr_chksum_err;
+                        ++channel->n_rx_ip_hdr_chksum_err;
                 else if (rx_ev_tcp_udp_chksum_err)
-                        ++rx_queue->channel->n_rx_tcp_udp_chksum_err;
+                        ++channel->n_rx_tcp_udp_chksum_err;
         }
 
         /* The frame must be discarded if any of these are true. */
@@ -769,7 +777,7 @@ static void efx_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                 netif_dbg(efx, rx_err, efx->net_dev,
                           " RX queue %d unexpected RX event "
                           EFX_QWORD_FMT "%s%s%s%s%s%s%s%s\n",
-                          rx_queue->queue, EFX_QWORD_VAL(*event),
+                          efx_rx_queue_index(rx_queue), EFX_QWORD_VAL(*event),
                           rx_ev_buf_owner_id_err ? " [OWNER_ID_ERR]" : "",
                           rx_ev_ip_hdr_chksum_err ?
                           " [IP_HDR_CHKSUM_ERR]" : "",
@@ -791,8 +799,8 @@ efx_handle_rx_bad_index(struct efx_rx_queue *rx_queue, unsigned index)
         struct efx_nic *efx = rx_queue->efx;
         unsigned expected, dropped;
 
-        expected = rx_queue->removed_count & EFX_RXQ_MASK;
-        dropped = (index - expected) & EFX_RXQ_MASK;
+        expected = rx_queue->removed_count & rx_queue->ptr_mask;
+        dropped = (index - expected) & rx_queue->ptr_mask;
         netif_info(efx, rx_err, efx->net_dev,
                    "dropped %d events (index=%d expected=%d)\n",
                    dropped, index, expected);
@@ -827,10 +835,10 @@ efx_handle_rx_event(struct efx_channel *channel, const efx_qword_t *event)
         WARN_ON(EFX_QWORD_FIELD(*event, FSF_AZ_RX_EV_Q_LABEL) !=
                 channel->channel);
 
-        rx_queue = &efx->rx_queue[channel->channel];
+        rx_queue = efx_channel_get_rx_queue(channel);
 
         rx_ev_desc_ptr = EFX_QWORD_FIELD(*event, FSF_AZ_RX_EV_DESC_PTR);
-        expected_ptr = rx_queue->removed_count & EFX_RXQ_MASK;
+        expected_ptr = rx_queue->removed_count & rx_queue->ptr_mask;
         if (unlikely(rx_ev_desc_ptr != expected_ptr))
                 efx_handle_rx_bad_index(rx_queue, rx_ev_desc_ptr);
 
@@ -879,7 +887,7 @@ efx_handle_generated_event(struct efx_channel *channel, efx_qword_t *event)
                 /* The queue must be empty, so we won't receive any rx
                  * events, so efx_process_channel() won't refill the
                  * queue. Refill it here */
-                efx_fast_push_rx_descriptors(&efx->rx_queue[channel->channel]);
+                efx_fast_push_rx_descriptors(efx_channel_get_rx_queue(channel));
         else
                 netif_dbg(efx, hw, efx->net_dev, "channel %d received "
                           "generated event "EFX_QWORD_FMT"\n",
@@ -997,6 +1005,7 @@ efx_handle_driver_event(struct efx_channel *channel, efx_qword_t *event)
 
 int efx_nic_process_eventq(struct efx_channel *channel, int budget)
 {
+        struct efx_nic *efx = channel->efx;
         unsigned int read_ptr;
         efx_qword_t event, *p_event;
         int ev_code;
@@ -1021,7 +1030,7 @@ int efx_nic_process_eventq(struct efx_channel *channel, int budget)
                 EFX_SET_QWORD(*p_event);
 
                 /* Increment read pointer */
-                read_ptr = (read_ptr + 1) & EFX_EVQ_MASK;
+                read_ptr = (read_ptr + 1) & channel->eventq_mask;
 
                 ev_code = EFX_QWORD_FIELD(event, FSF_AZ_EV_CODE);
 
@@ -1033,7 +1042,7 @@ int efx_nic_process_eventq(struct efx_channel *channel, int budget)
                         break;
                 case FSE_AZ_EV_CODE_TX_EV:
                         tx_packets += efx_handle_tx_event(channel, &event);
-                        if (tx_packets >= EFX_TXQ_SIZE) {
+                        if (tx_packets > efx->txq_entries) {
                                 spent = budget;
                                 goto out;
                         }
@@ -1068,10 +1077,11 @@ out:
 int efx_nic_probe_eventq(struct efx_channel *channel)
 {
         struct efx_nic *efx = channel->efx;
-        BUILD_BUG_ON(EFX_EVQ_SIZE < 512 || EFX_EVQ_SIZE > 32768 ||
-                     EFX_EVQ_SIZE & EFX_EVQ_MASK);
+        unsigned entries;
+
+        entries = channel->eventq_mask + 1;
         return efx_alloc_special_buffer(efx, &channel->eventq,
-                                        EFX_EVQ_SIZE * sizeof(efx_qword_t));
+                                        entries * sizeof(efx_qword_t));
 }
 
 void efx_nic_init_eventq(struct efx_channel *channel)
@@ -1163,11 +1173,11 @@ void efx_nic_generate_fill_event(struct efx_channel *channel)
 
 static void efx_poll_flush_events(struct efx_nic *efx)
 {
-        struct efx_channel *channel = &efx->channel[0];
+        struct efx_channel *channel = efx_get_channel(efx, 0);
         struct efx_tx_queue *tx_queue;
         struct efx_rx_queue *rx_queue;
         unsigned int read_ptr = channel->eventq_read_ptr;
-        unsigned int end_ptr = (read_ptr - 1) & EFX_EVQ_MASK;
+        unsigned int end_ptr = (read_ptr - 1) & channel->eventq_mask;
 
         do {
                 efx_qword_t *event = efx_event(channel, read_ptr);
@@ -1185,7 +1195,9 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                         ev_queue = EFX_QWORD_FIELD(*event,
                                                    FSF_AZ_DRIVER_EV_SUBDATA);
                         if (ev_queue < EFX_TXQ_TYPES * efx->n_tx_channels) {
-                                tx_queue = efx->tx_queue + ev_queue;
+                                tx_queue = efx_get_tx_queue(
+                                        efx, ev_queue / EFX_TXQ_TYPES,
+                                        ev_queue % EFX_TXQ_TYPES);
                                 tx_queue->flushed = FLUSH_DONE;
                         }
                 } else if (ev_code == FSE_AZ_EV_CODE_DRIVER_EV &&
@@ -1195,7 +1207,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                         ev_failed = EFX_QWORD_FIELD(
                                 *event, FSF_AZ_DRIVER_EV_RX_FLUSH_FAIL);
                         if (ev_queue < efx->n_rx_channels) {
-                                rx_queue = efx->rx_queue + ev_queue;
+                                rx_queue = efx_get_rx_queue(efx, ev_queue);
                                 rx_queue->flushed =
                                         ev_failed ? FLUSH_FAILED : FLUSH_DONE;
                         }
@@ -1205,7 +1217,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                  * it's ok to throw away every non-flush event */
                 EFX_SET_QWORD(*event);
 
-                read_ptr = (read_ptr + 1) & EFX_EVQ_MASK;
+                read_ptr = (read_ptr + 1) & channel->eventq_mask;
         } while (read_ptr != end_ptr);
 
         channel->eventq_read_ptr = read_ptr;
@@ -1216,6 +1228,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
  * serialise them */
 int efx_nic_flush_queues(struct efx_nic *efx)
 {
+        struct efx_channel *channel;
         struct efx_rx_queue *rx_queue;
         struct efx_tx_queue *tx_queue;
         int i, tx_pending, rx_pending;
@@ -1224,29 +1237,35 @@ int efx_nic_flush_queues(struct efx_nic *efx)
         efx->type->prepare_flush(efx);
 
         /* Flush all tx queues in parallel */
-        efx_for_each_tx_queue(tx_queue, efx)
-                efx_flush_tx_queue(tx_queue);
+        efx_for_each_channel(channel, efx) {
+                efx_for_each_channel_tx_queue(tx_queue, channel)
+                        efx_flush_tx_queue(tx_queue);
+        }
 
         /* The hardware supports four concurrent rx flushes, each of which may
          * need to be retried if there is an outstanding descriptor fetch */
         for (i = 0; i < EFX_FLUSH_POLL_COUNT; ++i) {
                 rx_pending = tx_pending = 0;
-                efx_for_each_rx_queue(rx_queue, efx) {
-                        if (rx_queue->flushed == FLUSH_PENDING)
-                                ++rx_pending;
-                }
-                efx_for_each_rx_queue(rx_queue, efx) {
-                        if (rx_pending == EFX_RX_FLUSH_COUNT)
-                                break;
-                        if (rx_queue->flushed == FLUSH_FAILED ||
-                            rx_queue->flushed == FLUSH_NONE) {
-                                efx_flush_rx_queue(rx_queue);
-                                ++rx_pending;
+                efx_for_each_channel(channel, efx) {
+                        efx_for_each_channel_rx_queue(rx_queue, channel) {
+                                if (rx_queue->flushed == FLUSH_PENDING)
+                                        ++rx_pending;
                         }
                 }
-                efx_for_each_tx_queue(tx_queue, efx) {
-                        if (tx_queue->flushed != FLUSH_DONE)
-                                ++tx_pending;
+                efx_for_each_channel(channel, efx) {
+                        efx_for_each_channel_rx_queue(rx_queue, channel) {
+                                if (rx_pending == EFX_RX_FLUSH_COUNT)
+                                        break;
+                                if (rx_queue->flushed == FLUSH_FAILED ||
+                                    rx_queue->flushed == FLUSH_NONE) {
+                                        efx_flush_rx_queue(rx_queue);
+                                        ++rx_pending;
+                                }
+                        }
+                        efx_for_each_channel_tx_queue(tx_queue, channel) {
+                                if (tx_queue->flushed != FLUSH_DONE)
+                                        ++tx_pending;
+                        }
                 }
 
                 if (rx_pending == 0 && tx_pending == 0)
@@ -1258,19 +1277,21 @@ int efx_nic_flush_queues(struct efx_nic *efx)
 
         /* Mark the queues as all flushed. We're going to return failure
          * leading to a reset, or fake up success anyway */
-        efx_for_each_tx_queue(tx_queue, efx) {
-                if (tx_queue->flushed != FLUSH_DONE)
-                        netif_err(efx, hw, efx->net_dev,
-                                  "tx queue %d flush command timed out\n",
-                                  tx_queue->queue);
-                tx_queue->flushed = FLUSH_DONE;
-        }
-        efx_for_each_rx_queue(rx_queue, efx) {
-                if (rx_queue->flushed != FLUSH_DONE)
-                        netif_err(efx, hw, efx->net_dev,
-                                  "rx queue %d flush command timed out\n",
-                                  rx_queue->queue);
-                rx_queue->flushed = FLUSH_DONE;
+        efx_for_each_channel(channel, efx) {
+                efx_for_each_channel_tx_queue(tx_queue, channel) {
+                        if (tx_queue->flushed != FLUSH_DONE)
+                                netif_err(efx, hw, efx->net_dev,
+                                          "tx queue %d flush command timed out\n",
+                                          tx_queue->queue);
+                        tx_queue->flushed = FLUSH_DONE;
+                }
+                efx_for_each_channel_rx_queue(rx_queue, channel) {
+                        if (rx_queue->flushed != FLUSH_DONE)
+                                netif_err(efx, hw, efx->net_dev,
+                                          "rx queue %d flush command timed out\n",
+                                          efx_rx_queue_index(rx_queue));
+                        rx_queue->flushed = FLUSH_DONE;
+                }
         }
 
         return -ETIMEDOUT;
@@ -1457,7 +1478,7 @@ static irqreturn_t efx_legacy_interrupt(int irq, void *dev_id)
  */
 static irqreturn_t efx_msi_interrupt(int irq, void *dev_id)
 {
-        struct efx_channel *channel = dev_id;
+        struct efx_channel *channel = *(struct efx_channel **)dev_id;
         struct efx_nic *efx = channel->efx;
         efx_oword_t *int_ker = efx->irq_status.addr;
         int syserr;
@@ -1532,7 +1553,8 @@ int efx_nic_init_interrupt(struct efx_nic *efx)
         efx_for_each_channel(channel, efx) {
                 rc = request_irq(channel->irq, efx_msi_interrupt,
                                  IRQF_PROBE_SHARED, /* Not shared */
-                                 channel->name, channel);
+                                 efx->channel_name[channel->channel],
+                                 &efx->channel[channel->channel]);
                 if (rc) {
                         netif_err(efx, drv, efx->net_dev,
                                   "failed to hook IRQ %d\n", channel->irq);
@@ -1544,7 +1566,7 @@ int efx_nic_init_interrupt(struct efx_nic *efx)
 
  fail2:
         efx_for_each_channel(channel, efx)
-                free_irq(channel->irq, channel);
+                free_irq(channel->irq, &efx->channel[channel->channel]);
  fail1:
         return rc;
 }
@@ -1557,7 +1579,7 @@ void efx_nic_fini_interrupt(struct efx_nic *efx)
         /* Disable MSI/MSI-X interrupts */
         efx_for_each_channel(channel, efx) {
                 if (channel->irq)
-                        free_irq(channel->irq, channel);
+                        free_irq(channel->irq, &efx->channel[channel->channel]);
         }
 
         /* ACK legacy interrupt */
@@ -1827,8 +1849,7 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         REGISTER_TABLE_BB_CZ(TX_DESC_PTR_TBL),
         REGISTER_TABLE_AA(EVQ_PTR_TBL_KER),
         REGISTER_TABLE_BB_CZ(EVQ_PTR_TBL),
-        /* The register buffer is allocated with slab, so we can't
-         * reasonably read all of the buffer table (up to 8MB!).
+        /* We can't reasonably read all of the buffer table (up to 8MB!).
          * However this driver will only use a few entries.  Reading
          * 1K entries allows for some expansion of queue count and
          * size before we need to change the version. */
@@ -1836,7 +1857,6 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
                                   A, A, 8, 1024),
         REGISTER_TABLE_DIMENSIONS(BUF_FULL_TBL, FR_BZ_BUF_FULL_TBL,
                                   B, Z, 8, 1024),
-        /* RX_FILTER_TBL{0,1} is huge and not used by this driver */
         REGISTER_TABLE_CZ(RX_MAC_FILTER_TBL0),
         REGISTER_TABLE_BB_CZ(TIMER_TBL),
         REGISTER_TABLE_BB_CZ(TX_PACE_TBL),
@@ -1846,6 +1866,7 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         REGISTER_TABLE_CZ(MC_TREG_SMEM),
         /* MSIX_PBA_TABLE is not mapped */
         /* SRM_DBG is not mapped (and is redundant with BUF_FLL_TBL) */
+        REGISTER_TABLE_BZ(RX_FILTER_TBL0),
 };
 
 size_t efx_nic_get_regs_len(struct efx_nic *efx)
diff --git a/drivers/net/sfc/phy.h b/drivers/net/sfc/phy.h
index 5bc26137257b..1dab609757fb 100644
--- a/drivers/net/sfc/phy.h
+++ b/drivers/net/sfc/phy.h
@@ -11,17 +11,12 @@
 #define EFX_PHY_H
 
 /****************************************************************************
- * 10Xpress (SFX7101 and SFT9001) PHYs
+ * 10Xpress (SFX7101) PHY
  */
 extern struct efx_phy_operations falcon_sfx7101_phy_ops;
-extern struct efx_phy_operations falcon_sft9001_phy_ops;
 
 extern void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
 
-/* Wait for the PHY to boot. Return 0 on success, -EINVAL if the PHY failed
- * to boot due to corrupt flash, or some other negative error code. */
-extern int sft9001_wait_boot(struct efx_nic *efx);
-
 /****************************************************************************
  * AMCC/Quake QT202x PHYs
  */
@@ -42,6 +37,17 @@ extern struct efx_phy_operations falcon_qt202x_phy_ops;
 extern void falcon_qt202x_set_led(struct efx_nic *p, int led, int state);
 
 /****************************************************************************
+* Transwitch CX4 retimer
+*/
+extern struct efx_phy_operations falcon_txc_phy_ops;
+
+#define TXC_GPIO_DIR_INPUT      0
+#define TXC_GPIO_DIR_OUTPUT     1
+
+extern void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir);
+extern void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int val);
+
+/****************************************************************************
  * Siena managed PHYs
  */
 extern struct efx_phy_operations efx_mcdi_phy_ops;
diff --git a/drivers/net/sfc/regs.h b/drivers/net/sfc/regs.h
index 18a3be428348..96430ed81c36 100644
--- a/drivers/net/sfc/regs.h
+++ b/drivers/net/sfc/regs.h
@@ -2893,6 +2893,20 @@
 #define FRF_AB_XX_FORCE_SIG_WIDTH 8
 #define FFE_AB_XX_FORCE_SIG_ALL_LANES 0xff
 
+/* RX_MAC_FILTER_TBL0 */
+/* RMFT_DEST_MAC is wider than 32 bits */
+#define FRF_CZ_RMFT_DEST_MAC_LO_LBN 12
+#define FRF_CZ_RMFT_DEST_MAC_LO_WIDTH 32
+#define FRF_CZ_RMFT_DEST_MAC_HI_LBN 44
+#define FRF_CZ_RMFT_DEST_MAC_HI_WIDTH 16
+
+/* TX_MAC_FILTER_TBL0 */
+/* TMFT_SRC_MAC is wider than 32 bits */
+#define FRF_CZ_TMFT_SRC_MAC_LO_LBN 12
+#define FRF_CZ_TMFT_SRC_MAC_LO_WIDTH 32
+#define FRF_CZ_TMFT_SRC_MAC_HI_LBN 44
+#define FRF_CZ_TMFT_SRC_MAC_HI_WIDTH 16
+
 /* DRIVER_EV */
 /* Sub-fields of an RX flush completion event */
 #define FSF_AZ_DRIVER_EV_RX_FLUSH_FAIL_LBN 12
diff --git a/drivers/net/sfc/rx.c b/drivers/net/sfc/rx.c
index 799c461ce7b8..6d0959b5158e 100644
--- a/drivers/net/sfc/rx.c
+++ b/drivers/net/sfc/rx.c
@@ -133,7 +133,7 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
         unsigned index, count;
 
         for (count = 0; count < EFX_RX_BATCH; ++count) {
-                index = rx_queue->added_count & EFX_RXQ_MASK;
+                index = rx_queue->added_count & rx_queue->ptr_mask;
                 rx_buf = efx_rx_buffer(rx_queue, index);
 
                 rx_buf->skb = netdev_alloc_skb(net_dev, skb_len);
@@ -208,7 +208,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                 dma_addr += sizeof(struct efx_rx_page_state);
 
         split:
-                index = rx_queue->added_count & EFX_RXQ_MASK;
+                index = rx_queue->added_count & rx_queue->ptr_mask;
                 rx_buf = efx_rx_buffer(rx_queue, index);
                 rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
                 rx_buf->skb = NULL;
@@ -285,7 +285,7 @@ static void efx_resurrect_rx_buffer(struct efx_rx_queue *rx_queue,
          * we'd like to insert an additional descriptor whilst leaving
          * EFX_RXD_HEAD_ROOM for the non-recycle path */
         fill_level = (rx_queue->added_count - rx_queue->removed_count + 2);
-        if (unlikely(fill_level >= EFX_RXQ_SIZE - EFX_RXD_HEAD_ROOM)) {
+        if (unlikely(fill_level > rx_queue->max_fill)) {
                 /* We could place "state" on a list, and drain the list in
                  * efx_fast_push_rx_descriptors(). For now, this will do. */
                 return;
@@ -294,7 +294,7 @@ static void efx_resurrect_rx_buffer(struct efx_rx_queue *rx_queue,
         ++state->refcnt;
         get_page(rx_buf->page);
 
-        index = rx_queue->added_count & EFX_RXQ_MASK;
+        index = rx_queue->added_count & rx_queue->ptr_mask;
         new_buf = efx_rx_buffer(rx_queue, index);
         new_buf->dma_addr = rx_buf->dma_addr ^ (PAGE_SIZE >> 1);
         new_buf->skb = NULL;
@@ -311,7 +311,7 @@ static void efx_recycle_rx_buffer(struct efx_channel *channel,
                                   struct efx_rx_buffer *rx_buf)
 {
         struct efx_nic *efx = channel->efx;
-        struct efx_rx_queue *rx_queue = &efx->rx_queue[channel->channel];
+        struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel);
         struct efx_rx_buffer *new_buf;
         unsigned index;
 
@@ -319,7 +319,7 @@ static void efx_recycle_rx_buffer(struct efx_channel *channel,
             page_count(rx_buf->page) == 1)
                 efx_resurrect_rx_buffer(rx_queue, rx_buf);
 
-        index = rx_queue->added_count & EFX_RXQ_MASK;
+        index = rx_queue->added_count & rx_queue->ptr_mask;
         new_buf = efx_rx_buffer(rx_queue, index);
 
         memcpy(new_buf, rx_buf, sizeof(*new_buf));
@@ -341,13 +341,13 @@ static void efx_recycle_rx_buffer(struct efx_channel *channel,
  */
 void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue)
 {
-        struct efx_channel *channel = rx_queue->channel;
+        struct efx_channel *channel = efx_rx_queue_channel(rx_queue);
         unsigned fill_level;
         int space, rc = 0;
 
         /* Calculate current fill level, and exit if we don't need to fill */
         fill_level = (rx_queue->added_count - rx_queue->removed_count);
-        EFX_BUG_ON_PARANOID(fill_level > EFX_RXQ_SIZE);
+        EFX_BUG_ON_PARANOID(fill_level > rx_queue->efx->rxq_entries);
         if (fill_level >= rx_queue->fast_fill_trigger)
                 goto out;
 
@@ -364,7 +364,8 @@ void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue)
         netif_vdbg(rx_queue->efx, rx_status, rx_queue->efx->net_dev,
                    "RX queue %d fast-filling descriptor ring from"
                    " level %d to level %d using %s allocation\n",
-                   rx_queue->queue, fill_level, rx_queue->fast_fill_limit,
+                   efx_rx_queue_index(rx_queue), fill_level,
+                   rx_queue->fast_fill_limit,
                    channel->rx_alloc_push_pages ? "page" : "skb");
 
         do {
@@ -382,7 +383,7 @@ void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue)
 
         netif_vdbg(rx_queue->efx, rx_status, rx_queue->efx->net_dev,
                    "RX queue %d fast-filled descriptor ring "
-                   "to level %d\n", rx_queue->queue,
+                   "to level %d\n", efx_rx_queue_index(rx_queue),
                    rx_queue->added_count - rx_queue->removed_count);
 
  out:
@@ -393,7 +394,7 @@ void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue)
 void efx_rx_slow_fill(unsigned long context)
 {
         struct efx_rx_queue *rx_queue = (struct efx_rx_queue *)context;
-        struct efx_channel *channel = rx_queue->channel;
+        struct efx_channel *channel = efx_rx_queue_channel(rx_queue);
 
         /* Post an event to cause NAPI to run and refill the queue */
         efx_nic_generate_fill_event(channel);
@@ -421,7 +422,7 @@ static void efx_rx_packet__check_len(struct efx_rx_queue *rx_queue,
                         netif_err(efx, rx_err, efx->net_dev,
                                   " RX queue %d seriously overlength "
                                   "RX event (0x%x > 0x%x+0x%x). Leaking\n",
-                                  rx_queue->queue, len, max_len,
+                                  efx_rx_queue_index(rx_queue), len, max_len,
                                   efx->type->rx_buffer_padding);
                 /* If this buffer was skb-allocated, then the meta
                  * data at the end of the skb will be trashed. So
@@ -434,10 +435,10 @@ static void efx_rx_packet__check_len(struct efx_rx_queue *rx_queue,
                         netif_err(efx, rx_err, efx->net_dev,
                                   " RX queue %d overlength RX event "
                                   "(0x%x > 0x%x)\n",
-                                  rx_queue->queue, len, max_len);
+                                  efx_rx_queue_index(rx_queue), len, max_len);
         }
 
-        rx_queue->channel->n_rx_overlength++;
+        efx_rx_queue_channel(rx_queue)->n_rx_overlength++;
 }
 
 /* Pass a received packet up through the generic LRO stack
@@ -507,7 +508,7 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
                    unsigned int len, bool checksummed, bool discard)
 {
         struct efx_nic *efx = rx_queue->efx;
-        struct efx_channel *channel = rx_queue->channel;
+        struct efx_channel *channel = efx_rx_queue_channel(rx_queue);
         struct efx_rx_buffer *rx_buf;
         bool leak_packet = false;
 
@@ -528,7 +529,7 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
 
         netif_vdbg(efx, rx_status, efx->net_dev,
                    "RX queue %d received id %x at %llx+%x %s%s\n",
-                   rx_queue->queue, index,
+                   efx_rx_queue_index(rx_queue), index,
                    (unsigned long long)rx_buf->dma_addr, len,
                    (checksummed ? " [SUMMED]" : ""),
                    (discard ? " [DISCARD]" : ""));
@@ -560,12 +561,11 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
          */
         rx_buf->len = len;
 out:
-        if (rx_queue->channel->rx_pkt)
-                __efx_rx_packet(rx_queue->channel,
-                                rx_queue->channel->rx_pkt,
-                                rx_queue->channel->rx_pkt_csummed);
-        rx_queue->channel->rx_pkt = rx_buf;
-        rx_queue->channel->rx_pkt_csummed = checksummed;
+        if (channel->rx_pkt)
+                __efx_rx_packet(channel,
+                                channel->rx_pkt, channel->rx_pkt_csummed);
+        channel->rx_pkt = rx_buf;
+        channel->rx_pkt_csummed = checksummed;
 }
 
 /* Handle a received packet.  Second half: Touches packet payload. */
@@ -615,7 +615,7 @@ void __efx_rx_packet(struct efx_channel *channel,
         EFX_BUG_ON_PARANOID(!skb);
 
         /* Set the SKB flags */
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         /* Pass the packet up */
         netif_receive_skb(skb);
@@ -650,15 +650,22 @@ void efx_rx_strategy(struct efx_channel *channel)
 int efx_probe_rx_queue(struct efx_rx_queue *rx_queue)
 {
         struct efx_nic *efx = rx_queue->efx;
-        unsigned int rxq_size;
+        unsigned int entries;
         int rc;
 
+        /* Create the smallest power-of-two aligned ring */
+        entries = max(roundup_pow_of_two(efx->rxq_entries), EFX_MIN_DMAQ_SIZE);
+        EFX_BUG_ON_PARANOID(entries > EFX_MAX_DMAQ_SIZE);
+        rx_queue->ptr_mask = entries - 1;
+
         netif_dbg(efx, probe, efx->net_dev,
-                  "creating RX queue %d\n", rx_queue->queue);
+                  "creating RX queue %d size %#x mask %#x\n",
+                  efx_rx_queue_index(rx_queue), efx->rxq_entries,
+                  rx_queue->ptr_mask);
 
         /* Allocate RX buffers */
-        rxq_size = EFX_RXQ_SIZE * sizeof(*rx_queue->buffer);
-        rx_queue->buffer = kzalloc(rxq_size, GFP_KERNEL);
+        rx_queue->buffer = kzalloc(entries * sizeof(*rx_queue->buffer),
+                                   GFP_KERNEL);
         if (!rx_queue->buffer)
                 return -ENOMEM;
 
@@ -672,20 +679,20 @@ int efx_probe_rx_queue(struct efx_rx_queue *rx_queue)
 
 void efx_init_rx_queue(struct efx_rx_queue *rx_queue)
 {
+        struct efx_nic *efx = rx_queue->efx;
         unsigned int max_fill, trigger, limit;
 
         netif_dbg(rx_queue->efx, drv, rx_queue->efx->net_dev,
-                  "initialising RX queue %d\n", rx_queue->queue);
+                  "initialising RX queue %d\n", efx_rx_queue_index(rx_queue));
 
         /* Initialise ptr fields */
         rx_queue->added_count = 0;
         rx_queue->notified_count = 0;
         rx_queue->removed_count = 0;
         rx_queue->min_fill = -1U;
-        rx_queue->min_overfill = -1U;
 
         /* Initialise limit fields */
-        max_fill = EFX_RXQ_SIZE - EFX_RXD_HEAD_ROOM;
+        max_fill = efx->rxq_entries - EFX_RXD_HEAD_ROOM;
         trigger = max_fill * min(rx_refill_threshold, 100U) / 100U;
         limit = max_fill * min(rx_refill_limit, 100U) / 100U;
 
@@ -703,14 +710,14 @@ void efx_fini_rx_queue(struct efx_rx_queue *rx_queue)
         struct efx_rx_buffer *rx_buf;
 
         netif_dbg(rx_queue->efx, drv, rx_queue->efx->net_dev,
-                  "shutting down RX queue %d\n", rx_queue->queue);
+                  "shutting down RX queue %d\n", efx_rx_queue_index(rx_queue));
 
         del_timer_sync(&rx_queue->slow_fill);
         efx_nic_fini_rx(rx_queue);
 
         /* Release RX buffers NB start at index 0 not current HW ptr */
         if (rx_queue->buffer) {
-                for (i = 0; i <= EFX_RXQ_MASK; i++) {
+                for (i = 0; i <= rx_queue->ptr_mask; i++) {
                         rx_buf = efx_rx_buffer(rx_queue, i);
                         efx_fini_rx_buffer(rx_queue, rx_buf);
                 }
@@ -720,7 +727,7 @@ void efx_fini_rx_queue(struct efx_rx_queue *rx_queue)
 void efx_remove_rx_queue(struct efx_rx_queue *rx_queue)
 {
         netif_dbg(rx_queue->efx, drv, rx_queue->efx->net_dev,
-                  "destroying RX queue %d\n", rx_queue->queue);
+                  "destroying RX queue %d\n", efx_rx_queue_index(rx_queue));
 
         efx_nic_remove_rx(rx_queue);
 
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index 85f015f005d5..da4473b71058 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -506,7 +506,7 @@ efx_test_loopback(struct efx_tx_queue *tx_queue,
 
         for (i = 0; i < 3; i++) {
                 /* Determine how many packets to send */
-                state->packet_count = EFX_TXQ_SIZE / 3;
+                state->packet_count = efx->txq_entries / 3;
                 state->packet_count = min(1 << (i << 2), state->packet_count);
                 state->skbs = kzalloc(sizeof(state->skbs[0]) *
                                       state->packet_count, GFP_KERNEL);
@@ -567,7 +567,7 @@ static int efx_wait_for_link(struct efx_nic *efx)
                         efx->type->monitor(efx);
                         mutex_unlock(&efx->mac_lock);
                 } else {
-                        struct efx_channel *channel = &efx->channel[0];
+                        struct efx_channel *channel = efx_get_channel(efx, 0);
                         if (channel->work_pending)
                                 efx_process_channel_now(channel);
                 }
@@ -594,6 +594,7 @@ static int efx_test_loopbacks(struct efx_nic *efx, struct efx_self_tests *tests,
 {
         enum efx_loopback_mode mode;
         struct efx_loopback_state *state;
+        struct efx_channel *channel = efx_get_channel(efx, 0);
         struct efx_tx_queue *tx_queue;
         int rc = 0;
 
@@ -634,7 +635,7 @@ static int efx_test_loopbacks(struct efx_nic *efx, struct efx_self_tests *tests,
                 }
 
                 /* Test both types of TX queue */
-                efx_for_each_channel_tx_queue(tx_queue, &efx->channel[0]) {
+                efx_for_each_channel_tx_queue(tx_queue, channel) {
                         state->offload_csum = (tx_queue->queue &
                                                EFX_TXQ_TYPE_OFFLOAD);
                         rc = efx_test_loopback(tx_queue,
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 3fab030f8ab5..2115f95ddc88 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -450,7 +450,7 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
                                     mac_stats->rx_bad_bytes);
         MAC_STAT(rx_packets, RX_PKTS);
         MAC_STAT(rx_good, RX_GOOD_PKTS);
-        mac_stats->rx_bad = mac_stats->rx_packets - mac_stats->rx_good;
+        MAC_STAT(rx_bad, RX_BAD_FCS_PKTS);
         MAC_STAT(rx_pause, RX_PAUSE_PKTS);
         MAC_STAT(rx_control, RX_CONTROL_PKTS);
         MAC_STAT(rx_unicast, RX_UNICAST_PKTS);
@@ -651,6 +651,6 @@ struct efx_nic_type siena_a0_nic_type = {
         .tx_dc_base = 0x88000,
         .rx_dc_base = 0x68000,
         .offload_features = (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                             NETIF_F_RXHASH),
+                             NETIF_F_RXHASH | NETIF_F_NTUPLE),
         .reset_world_flags = ETH_RESET_MGMT << ETH_RESET_SHARED_SHIFT,
 };
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 6791be90c2fe..1bc6c48c96ee 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -19,10 +19,7 @@
 #include "workarounds.h"
 #include "selftest.h"
 
-/* We expect these MMDs to be in the package.  SFT9001 also has a
- * clause 22 extension MMD, but since it doesn't have all the generic
- * MMD registers it is pointless to include it here.
- */
+/* We expect these MMDs to be in the package. */
 #define TENXPRESS_REQUIRED_DEVS (MDIO_DEVS_PMAPMD       | \
                                  MDIO_DEVS_PCS          | \
                                  MDIO_DEVS_PHYXS        | \
@@ -33,12 +30,6 @@
                            (1 << LOOPBACK_PMAPMD) |     \
                            (1 << LOOPBACK_PHYXS_WS))
 
-#define SFT9001_LOOPBACKS ((1 << LOOPBACK_GPHY) |       \
-                           (1 << LOOPBACK_PHYXS) |      \
-                           (1 << LOOPBACK_PCS) |        \
-                           (1 << LOOPBACK_PMAPMD) |     \
-                           (1 << LOOPBACK_PHYXS_WS))
-
 /* We complain if we fail to see the link partner as 10G capable this many
  * times in a row (must be > 1 as sampling the autoneg. registers is racy)
  */
@@ -50,9 +41,8 @@
 #define PMA_PMD_EXT_GMII_EN_WIDTH 1
 #define PMA_PMD_EXT_CLK_OUT_LBN 2
 #define PMA_PMD_EXT_CLK_OUT_WIDTH 1
-#define PMA_PMD_LNPGA_POWERDOWN_LBN 8   /* SFX7101 only */
+#define PMA_PMD_LNPGA_POWERDOWN_LBN 8
 #define PMA_PMD_LNPGA_POWERDOWN_WIDTH 1
-#define PMA_PMD_EXT_CLK312_LBN  8       /* SFT9001 only */
 #define PMA_PMD_EXT_CLK312_WIDTH 1
 #define PMA_PMD_EXT_LPOWER_LBN  12
 #define PMA_PMD_EXT_LPOWER_WIDTH 1
@@ -84,7 +74,6 @@
 #define PMA_PMD_LED_FLASH       (3)
 #define PMA_PMD_LED_MASK        3
 /* All LEDs under hardware control */
-#define SFT9001_PMA_PMD_LED_DEFAULT 0
 /* Green and Amber under hardware control, Red off */
 #define SFX7101_PMA_PMD_LED_DEFAULT (PMA_PMD_LED_OFF << PMA_PMD_LED_RX_LBN)
 
@@ -98,31 +87,7 @@
 #define PMA_PMD_SPEED_LBN        4
 #define PMA_PMD_SPEED_WIDTH      4
 
-/* Cable diagnostics - SFT9001 only */
-#define PMA_PMD_CDIAG_CTRL_REG  49213
-#define CDIAG_CTRL_IMMED_LBN    15
-#define CDIAG_CTRL_BRK_LINK_LBN 12
-#define CDIAG_CTRL_IN_PROG_LBN  11
-#define CDIAG_CTRL_LEN_UNIT_LBN 10
-#define CDIAG_CTRL_LEN_METRES   1
-#define PMA_PMD_CDIAG_RES_REG   49174
-#define CDIAG_RES_A_LBN         12
-#define CDIAG_RES_B_LBN         8
-#define CDIAG_RES_C_LBN         4
-#define CDIAG_RES_D_LBN         0
-#define CDIAG_RES_WIDTH         4
-#define CDIAG_RES_OPEN          2
-#define CDIAG_RES_OK            1
-#define CDIAG_RES_INVALID       0
-/* Set of 4 registers for pairs A-D */
-#define PMA_PMD_CDIAG_LEN_REG   49175
-
-/* Serdes control registers - SFT9001 only */
-#define PMA_PMD_CSERDES_CTRL_REG 64258
-/* Set the 156.25 MHz output to 312.5 MHz to drive Falcon's XMAC */
-#define PMA_PMD_CSERDES_DEFAULT 0x000f
-
-/* Misc register defines - SFX7101 only */
+/* Misc register defines */
 #define PCS_CLOCK_CTRL_REG      55297
 #define PLL312_RST_N_LBN 2
 
@@ -185,121 +150,17 @@ struct tenxpress_phy_data {
         int bad_lp_tries;
 };
 
-static ssize_t show_phy_short_reach(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
-{
-        struct efx_nic *efx = pci_get_drvdata(to_pci_dev(dev));
-        int reg;
-
-        reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR);
-        return sprintf(buf, "%d\n", !!(reg & MDIO_PMA_10GBT_TXPWR_SHORT));
-}
-
-static ssize_t set_phy_short_reach(struct device *dev,
-                                   struct device_attribute *attr,
-                                   const char *buf, size_t count)
-{
-        struct efx_nic *efx = pci_get_drvdata(to_pci_dev(dev));
-        int rc;
-
-        rtnl_lock();
-        if (efx->state != STATE_RUNNING) {
-                rc = -EBUSY;
-        } else {
-                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
-                                  MDIO_PMA_10GBT_TXPWR_SHORT,
-                                  count != 0 && *buf != '0');
-                rc = efx_reconfigure_port(efx);
-        }
-        rtnl_unlock();
-
-        return rc < 0 ? rc : (ssize_t)count;
-}
-
-static DEVICE_ATTR(phy_short_reach, 0644, show_phy_short_reach,
-                   set_phy_short_reach);
-
-int sft9001_wait_boot(struct efx_nic *efx)
-{
-        unsigned long timeout = jiffies + HZ + 1;
-        int boot_stat;
-
-        for (;;) {
-                boot_stat = efx_mdio_read(efx, MDIO_MMD_PCS,
-                                          PCS_BOOT_STATUS_REG);
-                if (boot_stat >= 0) {
-                        netif_dbg(efx, hw, efx->net_dev,
-                                  "PHY boot status = %#x\n", boot_stat);
-                        switch (boot_stat &
-                                ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                                 (3 << PCS_BOOT_PROGRESS_LBN) |
-                                 (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN) |
-                                 (1 << PCS_BOOT_CODE_STARTED_LBN))) {
-                        case ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                              (PCS_BOOT_PROGRESS_CHECKSUM <<
-                               PCS_BOOT_PROGRESS_LBN)):
-                        case ((1 << PCS_BOOT_FATAL_ERROR_LBN) |
-                              (PCS_BOOT_PROGRESS_INIT <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN)):
-                                return -EINVAL;
-                        case ((PCS_BOOT_PROGRESS_WAIT_MDIO <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN)):
-                                return (efx->phy_mode & PHY_MODE_SPECIAL) ?
-                                        0 : -EIO;
-                        case ((PCS_BOOT_PROGRESS_JUMP <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_CODE_STARTED_LBN)):
-                        case ((PCS_BOOT_PROGRESS_JUMP <<
-                               PCS_BOOT_PROGRESS_LBN) |
-                              (1 << PCS_BOOT_DOWNLOAD_WAIT_LBN) |
-                              (1 << PCS_BOOT_CODE_STARTED_LBN)):
-                                return (efx->phy_mode & PHY_MODE_SPECIAL) ?
-                                        -EIO : 0;
-                        default:
-                                if (boot_stat & (1 << PCS_BOOT_FATAL_ERROR_LBN))
-                                        return -EIO;
-                                break;
-                        }
-                }
-
-                if (time_after_eq(jiffies, timeout))
-                        return -ETIMEDOUT;
-
-                msleep(50);
-        }
-}
-
 static int tenxpress_init(struct efx_nic *efx)
 {
-        int reg;
-
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                /* Enable 312.5 MHz clock */
-                efx_mdio_write(efx, MDIO_MMD_PCS, PCS_TEST_SELECT_REG,
-                               1 << CLK312_EN_LBN);
-        } else {
-                /* Enable 312.5 MHz clock and GMII */
-                reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG);
-                reg |= ((1 << PMA_PMD_EXT_GMII_EN_LBN) |
-                        (1 << PMA_PMD_EXT_CLK_OUT_LBN) |
-                        (1 << PMA_PMD_EXT_CLK312_LBN) |
-                        (1 << PMA_PMD_EXT_ROBUST_LBN));
-
-                efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
-                efx_mdio_set_flag(efx, MDIO_MMD_C22EXT,
-                              GPHY_XCONTROL_REG, 1 << GPHY_ISOLATE_LBN,
-                              false);
-        }
+        /* Enable 312.5 MHz clock */
+        efx_mdio_write(efx, MDIO_MMD_PCS, PCS_TEST_SELECT_REG,
+                       1 << CLK312_EN_LBN);
 
         /* Set the LEDs up as: Green = Link, Amber = Link/Act, Red = Off */
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_CTRL_REG,
-                                  1 << PMA_PMA_LED_ACTIVITY_LBN, true);
-                efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_OVERR_REG,
-                               SFX7101_PMA_PMD_LED_DEFAULT);
-        }
+        efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_CTRL_REG,
+                          1 << PMA_PMA_LED_ACTIVITY_LBN, true);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_LED_OVERR_REG,
+                       SFX7101_PMA_PMD_LED_DEFAULT);
 
         return 0;
 }
@@ -307,7 +168,6 @@ static int tenxpress_init(struct efx_nic *efx)
 static int tenxpress_phy_probe(struct efx_nic *efx)
 {
         struct tenxpress_phy_data *phy_data;
-        int rc;
 
         /* Allocate phy private storage */
         phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
@@ -316,42 +176,15 @@ static int tenxpress_phy_probe(struct efx_nic *efx)
         efx->phy_data = phy_data;
         phy_data->phy_mode = efx->phy_mode;
 
-        /* Create any special files */
-        if (efx->phy_type == PHY_TYPE_SFT9001B) {
-                rc = device_create_file(&efx->pci_dev->dev,
-                                        &dev_attr_phy_short_reach);
-                if (rc)
-                        goto fail;
-        }
-
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-                efx->mdio.mode_support = MDIO_SUPPORTS_C45;
-
-                efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+        efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+        efx->mdio.mode_support = MDIO_SUPPORTS_C45;
 
-                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-                                         ADVERTISED_10000baseT_Full);
-        } else {
-                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-                efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+        efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
 
-                efx->loopback_modes = (SFT9001_LOOPBACKS |
-                                       FALCON_XMAC_LOOPBACKS | 
-                                       FALCON_GMAC_LOOPBACKS);
-
-                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-                                         ADVERTISED_10000baseT_Full |
-                                         ADVERTISED_1000baseT_Full |
-                                         ADVERTISED_100baseT_Full);
-        }
+        efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+                                 ADVERTISED_10000baseT_Full);
 
         return 0;
-
-fail:
-        kfree(efx->phy_data);
-        efx->phy_data = NULL;
-        return rc;
 }
 
 static int tenxpress_phy_init(struct efx_nic *efx)
@@ -361,16 +194,6 @@ static int tenxpress_phy_init(struct efx_nic *efx)
         falcon_board(efx)->type->init_phy(efx);
 
         if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
-                if (efx->phy_type == PHY_TYPE_SFT9001A) {
-                        int reg;
-                        reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                            PMA_PMD_XCONTROL_REG);
-                        reg |= (1 << PMA_PMD_EXT_SSR_LBN);
-                        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
-                                       PMA_PMD_XCONTROL_REG, reg);
-                        mdelay(200);
-                }
-
                 rc = efx_mdio_wait_reset_mmds(efx, TENXPRESS_REQUIRED_DEVS);
                 if (rc < 0)
                         return rc;
@@ -403,7 +226,7 @@ static int tenxpress_special_reset(struct efx_nic *efx)
 {
         int rc, reg;
 
-        /* The XGMAC clock is driven from the SFC7101/SFT9001 312MHz clock, so
+        /* The XGMAC clock is driven from the SFX7101 312MHz clock, so
          * a special software reset can glitch the XGMAC sufficiently for stats
          * requests to fail. */
         falcon_stop_nic_stats(efx);
@@ -484,53 +307,18 @@ static bool sfx7101_link_ok(struct efx_nic *efx)
                                  MDIO_DEVS_PHYXS);
 }
 
-static bool sft9001_link_ok(struct efx_nic *efx, struct ethtool_cmd *ecmd)
-{
-        u32 reg;
-
-        if (efx_phy_mode_disabled(efx->phy_mode))
-                return false;
-        else if (efx->loopback_mode == LOOPBACK_GPHY)
-                return true;
-        else if (efx->loopback_mode)
-                return efx_mdio_links_ok(efx,
-                                         MDIO_DEVS_PMAPMD |
-                                         MDIO_DEVS_PHYXS);
-
-        /* We must use the same definition of link state as LASI,
-         * otherwise we can miss a link state transition
-         */
-        if (ecmd->speed == 10000) {
-                reg = efx_mdio_read(efx, MDIO_MMD_PCS, MDIO_PCS_10GBRT_STAT1);
-                return reg & MDIO_PCS_10GBRT_STAT1_BLKLK;
-        } else {
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_STATUS_REG);
-                return reg & (1 << C22EXT_STATUS_LINK_LBN);
-        }
-}
-
 static void tenxpress_ext_loopback(struct efx_nic *efx)
 {
         efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, PHYXS_TEST1,
                           1 << LOOPBACK_NEAR_LBN,
                           efx->loopback_mode == LOOPBACK_PHYXS);
-        if (efx->phy_type != PHY_TYPE_SFX7101)
-                efx_mdio_set_flag(efx, MDIO_MMD_C22EXT, GPHY_XCONTROL_REG,
-                                  1 << GPHY_LOOPBACK_NEAR_LBN,
-                                  efx->loopback_mode == LOOPBACK_GPHY);
 }
 
 static void tenxpress_low_power(struct efx_nic *efx)
 {
-        if (efx->phy_type == PHY_TYPE_SFX7101)
-                efx_mdio_set_mmds_lpower(
-                        efx, !!(efx->phy_mode & PHY_MODE_LOW_POWER),
-                        TENXPRESS_REQUIRED_DEVS);
-        else
-                efx_mdio_set_flag(
-                        efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG,
-                        1 << PMA_PMD_EXT_LPOWER_LBN,
-                        !!(efx->phy_mode & PHY_MODE_LOW_POWER));
+        efx_mdio_set_mmds_lpower(
+                efx, !!(efx->phy_mode & PHY_MODE_LOW_POWER),
+                TENXPRESS_REQUIRED_DEVS);
 }
 
 static int tenxpress_phy_reconfigure(struct efx_nic *efx)
@@ -550,12 +338,7 @@ static int tenxpress_phy_reconfigure(struct efx_nic *efx)
 
         if (loop_reset || phy_mode_change) {
                 tenxpress_special_reset(efx);
-
-                /* Reset XAUI if we were in 10G, and are staying
-                 * in 10G. If we're moving into and out of 10G
-                 * then xaui will be reset anyway */
-                if (EFX_IS10G(efx))
-                        falcon_reset_xaui(efx);
+                falcon_reset_xaui(efx);
         }
 
         tenxpress_low_power(efx);
@@ -578,29 +361,12 @@ static bool tenxpress_phy_poll(struct efx_nic *efx)
 {
         struct efx_link_state old_state = efx->link_state;
 
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                efx->link_state.up = sfx7101_link_ok(efx);
-                efx->link_state.speed = 10000;
-                efx->link_state.fd = true;
-                efx->link_state.fc = efx_mdio_get_pause(efx);
-
-                sfx7101_check_bad_lp(efx, efx->link_state.up);
-        } else {
-                struct ethtool_cmd ecmd;
-
-                /* Check the LASI alarm first */
-                if (efx->loopback_mode == LOOPBACK_NONE &&
-                    !(efx_mdio_read(efx, MDIO_MMD_PMAPMD, MDIO_PMA_LASI_STAT) &
-                      MDIO_PMA_LASI_LSALARM))
-                        return false;
+        efx->link_state.up = sfx7101_link_ok(efx);
+        efx->link_state.speed = 10000;
+        efx->link_state.fd = true;
+        efx->link_state.fc = efx_mdio_get_pause(efx);
 
-                tenxpress_get_settings(efx, &ecmd);
-
-                efx->link_state.up = sft9001_link_ok(efx, &ecmd);
-                efx->link_state.speed = ecmd.speed;
-                efx->link_state.fd = (ecmd.duplex == DUPLEX_FULL);
-                efx->link_state.fc = efx_mdio_get_pause(efx);
-        }
+        sfx7101_check_bad_lp(efx, efx->link_state.up);
 
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
@@ -621,10 +387,6 @@ static void sfx7101_phy_fini(struct efx_nic *efx)
 
 static void tenxpress_phy_remove(struct efx_nic *efx)
 {
-        if (efx->phy_type == PHY_TYPE_SFT9001B)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &dev_attr_phy_short_reach);
-
         kfree(efx->phy_data);
         efx->phy_data = NULL;
 }
@@ -647,10 +409,7 @@ void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode)
                         (PMA_PMD_LED_ON << PMA_PMD_LED_LINK_LBN);
                 break;
         default:
-                if (efx->phy_type == PHY_TYPE_SFX7101)
-                        reg = SFX7101_PMA_PMD_LED_DEFAULT;
-                else
-                        reg = SFT9001_PMA_PMD_LED_DEFAULT;
+                reg = SFX7101_PMA_PMD_LED_DEFAULT;
                 break;
         }
 
@@ -685,102 +444,12 @@ sfx7101_run_tests(struct efx_nic *efx, int *results, unsigned flags)
         return rc;
 }
 
-static const char *const sft9001_test_names[] = {
-        "bist",
-        "cable.pairA.status",
-        "cable.pairB.status",
-        "cable.pairC.status",
-        "cable.pairD.status",
-        "cable.pairA.length",
-        "cable.pairB.length",
-        "cable.pairC.length",
-        "cable.pairD.length",
-};
-
-static const char *sft9001_test_name(struct efx_nic *efx, unsigned int index)
-{
-        if (index < ARRAY_SIZE(sft9001_test_names))
-                return sft9001_test_names[index];
-        return NULL;
-}
-
-static int sft9001_run_tests(struct efx_nic *efx, int *results, unsigned flags)
-{
-        int rc = 0, rc2, i, ctrl_reg, res_reg;
-
-        /* Initialise cable diagnostic results to unknown failure */
-        for (i = 1; i < 9; ++i)
-                results[i] = -1;
-
-        /* Run cable diagnostics; wait up to 5 seconds for them to complete.
-         * A cable fault is not a self-test failure, but a timeout is. */
-        ctrl_reg = ((1 << CDIAG_CTRL_IMMED_LBN) |
-                    (CDIAG_CTRL_LEN_METRES << CDIAG_CTRL_LEN_UNIT_LBN));
-        if (flags & ETH_TEST_FL_OFFLINE) {
-                /* Break the link in order to run full diagnostics.  We
-                 * must reset the PHY to resume normal service. */
-                ctrl_reg |= (1 << CDIAG_CTRL_BRK_LINK_LBN);
-        }
-        efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_CTRL_REG,
-                       ctrl_reg);
-        i = 0;
-        while (efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_CTRL_REG) &
-               (1 << CDIAG_CTRL_IN_PROG_LBN)) {
-                if (++i == 50) {
-                        rc = -ETIMEDOUT;
-                        goto out;
-                }
-                msleep(100);
-        }
-        res_reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD, PMA_PMD_CDIAG_RES_REG);
-        for (i = 0; i < 4; i++) {
-                int pair_res =
-                        (res_reg >> (CDIAG_RES_A_LBN - i * CDIAG_RES_WIDTH))
-                        & ((1 << CDIAG_RES_WIDTH) - 1);
-                int len_reg = efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                            PMA_PMD_CDIAG_LEN_REG + i);
-                if (pair_res == CDIAG_RES_OK)
-                        results[1 + i] = 1;
-                else if (pair_res == CDIAG_RES_INVALID)
-                        results[1 + i] = -1;
-                else
-                        results[1 + i] = -pair_res;
-                if (pair_res != CDIAG_RES_INVALID &&
-                    pair_res != CDIAG_RES_OPEN &&
-                    len_reg != 0xffff)
-                        results[5 + i] = len_reg;
-        }
-
-out:
-        if (flags & ETH_TEST_FL_OFFLINE) {
-                /* Reset, running the BIST and then resuming normal service. */
-                rc2 = tenxpress_special_reset(efx);
-                results[0] = rc2 ? -1 : 1;
-                if (!rc)
-                        rc = rc2;
-
-                efx_mdio_an_reconfigure(efx);
-        }
-
-        return rc;
-}
-
 static void
 tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
         u32 adv = 0, lpa = 0;
         int reg;
 
-        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_CTRL);
-                if (reg & (1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN))
-                        adv |= ADVERTISED_1000baseT_Full;
-                reg = efx_mdio_read(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_STATUS);
-                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN))
-                        lpa |= ADVERTISED_1000baseT_Half;
-                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN))
-                        lpa |= ADVERTISED_1000baseT_Full;
-        }
         reg = efx_mdio_read(efx, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL);
         if (reg & MDIO_AN_10GBT_CTRL_ADV10G)
                 adv |= ADVERTISED_10000baseT_Full;
@@ -790,23 +459,9 @@ tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 
         mdio45_ethtool_gset_npage(&efx->mdio, ecmd, adv, lpa);
 
-        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                ecmd->supported |= (SUPPORTED_100baseT_Full |
-                                    SUPPORTED_1000baseT_Full);
-                if (ecmd->speed != SPEED_10000) {
-                        ecmd->eth_tp_mdix =
-                                (efx_mdio_read(efx, MDIO_MMD_PMAPMD,
-                                               PMA_PMD_XSTATUS_REG) &
-                                 (1 << PMA_PMD_XSTAT_MDIX_LBN))
-                                ? ETH_TP_MDI_X : ETH_TP_MDI;
-                }
-        }
-
         /* In loopback, the PHY automatically brings up the correct interface,
          * but doesn't advertise the correct speed. So override it */
-        if (efx->loopback_mode == LOOPBACK_GPHY)
-                ecmd->speed = SPEED_1000;
-        else if (LOOPBACK_EXTERNAL(efx))
+        if (LOOPBACK_EXTERNAL(efx))
                 ecmd->speed = SPEED_10000;
 }
 
@@ -825,16 +480,6 @@ static void sfx7101_set_npage_adv(struct efx_nic *efx, u32 advertising)
                           advertising & ADVERTISED_10000baseT_Full);
 }
 
-static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
-{
-        efx_mdio_set_flag(efx, MDIO_MMD_C22EXT, C22EXT_MSTSLV_CTRL,
-                          1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN,
-                          advertising & ADVERTISED_1000baseT_Full);
-        efx_mdio_set_flag(efx, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL,
-                          MDIO_AN_10GBT_CTRL_ADV10G,
-                          advertising & ADVERTISED_10000baseT_Full);
-}
-
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
         .probe            = tenxpress_phy_probe,
         .init             = tenxpress_phy_init,
@@ -849,18 +494,3 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
         .test_name        = sfx7101_test_name,
         .run_tests        = sfx7101_run_tests,
 };
-
-struct efx_phy_operations falcon_sft9001_phy_ops = {
-        .probe            = tenxpress_phy_probe,
-        .init             = tenxpress_phy_init,
-        .reconfigure      = tenxpress_phy_reconfigure,
-        .poll             = tenxpress_phy_poll,
-        .fini             = efx_port_dummy_op_void,
-        .remove           = tenxpress_phy_remove,
-        .get_settings     = tenxpress_get_settings,
-        .set_settings     = tenxpress_set_settings,
-        .set_npage_adv    = sft9001_set_npage_adv,
-        .test_alive       = efx_mdio_test_alive,
-        .test_name        = sft9001_test_name,
-        .run_tests        = sft9001_run_tests,
-};
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index c6942da2c99a..11726989fe2d 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -28,7 +28,7 @@
  * The tx_queue descriptor ring fill-level must fall below this value
  * before we restart the netif queue
  */
-#define EFX_TXQ_THRESHOLD (EFX_TXQ_MASK / 2u)
+#define EFX_TXQ_THRESHOLD(_efx) ((_efx)->txq_entries / 2u)
 
 /* We need to be able to nest calls to netif_tx_stop_queue(), partly
  * because of the 2 hardware queues associated with each core queue,
@@ -37,8 +37,9 @@
 void efx_stop_queue(struct efx_channel *channel)
 {
         struct efx_nic *efx = channel->efx;
+        struct efx_tx_queue *tx_queue = efx_channel_get_tx_queue(channel, 0);
 
-        if (!channel->tx_queue)
+        if (!tx_queue)
                 return;
 
         spin_lock_bh(&channel->tx_stop_lock);
@@ -46,9 +47,8 @@ void efx_stop_queue(struct efx_channel *channel)
 
         atomic_inc(&channel->tx_stop_count);
         netif_tx_stop_queue(
-                netdev_get_tx_queue(
-                        efx->net_dev,
-                        channel->tx_queue->queue / EFX_TXQ_TYPES));
+                netdev_get_tx_queue(efx->net_dev,
+                                    tx_queue->queue / EFX_TXQ_TYPES));
 
         spin_unlock_bh(&channel->tx_stop_lock);
 }
@@ -57,8 +57,9 @@ void efx_stop_queue(struct efx_channel *channel)
 void efx_wake_queue(struct efx_channel *channel)
 {
         struct efx_nic *efx = channel->efx;
+        struct efx_tx_queue *tx_queue = efx_channel_get_tx_queue(channel, 0);
 
-        if (!channel->tx_queue)
+        if (!tx_queue)
                 return;
 
         local_bh_disable();
@@ -66,9 +67,8 @@ void efx_wake_queue(struct efx_channel *channel)
                                 &channel->tx_stop_lock)) {
                 netif_vdbg(efx, tx_queued, efx->net_dev, "waking TX queue\n");
                 netif_tx_wake_queue(
-                        netdev_get_tx_queue(
-                                efx->net_dev,
-                                channel->tx_queue->queue / EFX_TXQ_TYPES));
+                        netdev_get_tx_queue(efx->net_dev,
+                                            tx_queue->queue / EFX_TXQ_TYPES));
                 spin_unlock(&channel->tx_stop_lock);
         }
         local_bh_enable();
@@ -207,7 +207,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         }
 
         fill_level = tx_queue->insert_count - tx_queue->old_read_count;
-        q_space = EFX_TXQ_MASK - 1 - fill_level;
+        q_space = efx->txq_entries - 1 - fill_level;
 
         /* Map for DMA.  Use pci_map_single rather than pci_map_page
          * since this is more efficient on machines with sparse
@@ -244,14 +244,14 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
                                         &tx_queue->read_count;
                                 fill_level = (tx_queue->insert_count
                                               - tx_queue->old_read_count);
-                                q_space = EFX_TXQ_MASK - 1 - fill_level;
+                                q_space = efx->txq_entries - 1 - fill_level;
                                 if (unlikely(q_space-- <= 0))
                                         goto stop;
                                 smp_mb();
                                 --tx_queue->stopped;
                         }
 
-                        insert_ptr = tx_queue->insert_count & EFX_TXQ_MASK;
+                        insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
                         buffer = &tx_queue->buffer[insert_ptr];
                         efx_tsoh_free(tx_queue, buffer);
                         EFX_BUG_ON_PARANOID(buffer->tsoh);
@@ -320,7 +320,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         /* Work backwards until we hit the original insert pointer value */
         while (tx_queue->insert_count != tx_queue->write_count) {
                 --tx_queue->insert_count;
-                insert_ptr = tx_queue->insert_count & EFX_TXQ_MASK;
+                insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
                 buffer = &tx_queue->buffer[insert_ptr];
                 efx_dequeue_buffer(tx_queue, buffer);
                 buffer->len = 0;
@@ -350,8 +350,8 @@ static void efx_dequeue_buffers(struct efx_tx_queue *tx_queue,
         struct efx_nic *efx = tx_queue->efx;
         unsigned int stop_index, read_ptr;
 
-        stop_index = (index + 1) & EFX_TXQ_MASK;
-        read_ptr = tx_queue->read_count & EFX_TXQ_MASK;
+        stop_index = (index + 1) & tx_queue->ptr_mask;
+        read_ptr = tx_queue->read_count & tx_queue->ptr_mask;
 
         while (read_ptr != stop_index) {
                 struct efx_tx_buffer *buffer = &tx_queue->buffer[read_ptr];
@@ -368,7 +368,7 @@ static void efx_dequeue_buffers(struct efx_tx_queue *tx_queue,
                 buffer->len = 0;
 
                 ++tx_queue->read_count;
-                read_ptr = tx_queue->read_count & EFX_TXQ_MASK;
+                read_ptr = tx_queue->read_count & tx_queue->ptr_mask;
         }
 }
 
@@ -390,9 +390,9 @@ netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb,
         if (unlikely(efx->port_inhibited))
                 return NETDEV_TX_BUSY;
 
-        tx_queue = &efx->tx_queue[EFX_TXQ_TYPES * skb_get_queue_mapping(skb)];
-        if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
-                tx_queue += EFX_TXQ_TYPE_OFFLOAD;
+        tx_queue = efx_get_tx_queue(efx, skb_get_queue_mapping(skb),
+                                    skb->ip_summed == CHECKSUM_PARTIAL ?
+                                    EFX_TXQ_TYPE_OFFLOAD : 0);
 
         return efx_enqueue_skb(tx_queue, skb);
 }
@@ -402,7 +402,7 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
         unsigned fill_level;
         struct efx_nic *efx = tx_queue->efx;
 
-        EFX_BUG_ON_PARANOID(index > EFX_TXQ_MASK);
+        EFX_BUG_ON_PARANOID(index > tx_queue->ptr_mask);
 
         efx_dequeue_buffers(tx_queue, index);
 
@@ -412,7 +412,7 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
         smp_mb();
         if (unlikely(tx_queue->stopped) && likely(efx->port_enabled)) {
                 fill_level = tx_queue->insert_count - tx_queue->read_count;
-                if (fill_level < EFX_TXQ_THRESHOLD) {
+                if (fill_level < EFX_TXQ_THRESHOLD(efx)) {
                         EFX_BUG_ON_PARANOID(!efx_dev_registered(efx));
 
                         /* Do this under netif_tx_lock(), to avoid racing
@@ -430,18 +430,24 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
 int efx_probe_tx_queue(struct efx_tx_queue *tx_queue)
 {
         struct efx_nic *efx = tx_queue->efx;
-        unsigned int txq_size;
+        unsigned int entries;
         int i, rc;
 
-        netif_dbg(efx, probe, efx->net_dev, "creating TX queue %d\n",
-                  tx_queue->queue);
+        /* Create the smallest power-of-two aligned ring */
+        entries = max(roundup_pow_of_two(efx->txq_entries), EFX_MIN_DMAQ_SIZE);
+        EFX_BUG_ON_PARANOID(entries > EFX_MAX_DMAQ_SIZE);
+        tx_queue->ptr_mask = entries - 1;
+
+        netif_dbg(efx, probe, efx->net_dev,
+                  "creating TX queue %d size %#x mask %#x\n",
+                  tx_queue->queue, efx->txq_entries, tx_queue->ptr_mask);
 
         /* Allocate software ring */
-        txq_size = EFX_TXQ_SIZE * sizeof(*tx_queue->buffer);
-        tx_queue->buffer = kzalloc(txq_size, GFP_KERNEL);
+        tx_queue->buffer = kzalloc(entries * sizeof(*tx_queue->buffer),
+                                   GFP_KERNEL);
         if (!tx_queue->buffer)
                 return -ENOMEM;
-        for (i = 0; i <= EFX_TXQ_MASK; ++i)
+        for (i = 0; i <= tx_queue->ptr_mask; ++i)
                 tx_queue->buffer[i].continuation = true;
 
         /* Allocate hardware ring */
@@ -481,7 +487,7 @@ void efx_release_tx_buffers(struct efx_tx_queue *tx_queue)
 
         /* Free any buffers left in the ring */
         while (tx_queue->read_count != tx_queue->write_count) {
-                buffer = &tx_queue->buffer[tx_queue->read_count & EFX_TXQ_MASK];
+                buffer = &tx_queue->buffer[tx_queue->read_count & tx_queue->ptr_mask];
                 efx_dequeue_buffer(tx_queue, buffer);
                 buffer->continuation = true;
                 buffer->len = 0;
@@ -741,7 +747,7 @@ static int efx_tx_queue_insert(struct efx_tx_queue *tx_queue,
 
         fill_level = tx_queue->insert_count - tx_queue->old_read_count;
         /* -1 as there is no way to represent all descriptors used */
-        q_space = EFX_TXQ_MASK - 1 - fill_level;
+        q_space = efx->txq_entries - 1 - fill_level;
 
         while (1) {
                 if (unlikely(q_space-- <= 0)) {
@@ -757,7 +763,7 @@ static int efx_tx_queue_insert(struct efx_tx_queue *tx_queue,
                                 *(volatile unsigned *)&tx_queue->read_count;
                         fill_level = (tx_queue->insert_count
                                       - tx_queue->old_read_count);
-                        q_space = EFX_TXQ_MASK - 1 - fill_level;
+                        q_space = efx->txq_entries - 1 - fill_level;
                         if (unlikely(q_space-- <= 0)) {
                                 *final_buffer = NULL;
                                 return 1;
@@ -766,13 +772,13 @@ static int efx_tx_queue_insert(struct efx_tx_queue *tx_queue,
                         --tx_queue->stopped;
                 }
 
-                insert_ptr = tx_queue->insert_count & EFX_TXQ_MASK;
+                insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
                 buffer = &tx_queue->buffer[insert_ptr];
                 ++tx_queue->insert_count;
 
                 EFX_BUG_ON_PARANOID(tx_queue->insert_count -
-                                    tx_queue->read_count >
-                                    EFX_TXQ_MASK);
+                                    tx_queue->read_count >=
+                                    efx->txq_entries);
 
                 efx_tsoh_free(tx_queue, buffer);
                 EFX_BUG_ON_PARANOID(buffer->len);
@@ -813,7 +819,7 @@ static void efx_tso_put_header(struct efx_tx_queue *tx_queue,
 {
         struct efx_tx_buffer *buffer;
 
-        buffer = &tx_queue->buffer[tx_queue->insert_count & EFX_TXQ_MASK];
+        buffer = &tx_queue->buffer[tx_queue->insert_count & tx_queue->ptr_mask];
         efx_tsoh_free(tx_queue, buffer);
         EFX_BUG_ON_PARANOID(buffer->len);
         EFX_BUG_ON_PARANOID(buffer->unmap_len);
@@ -838,7 +844,7 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
         while (tx_queue->insert_count != tx_queue->write_count) {
                 --tx_queue->insert_count;
                 buffer = &tx_queue->buffer[tx_queue->insert_count &
-                                           EFX_TXQ_MASK];
+                                           tx_queue->ptr_mask];
                 efx_tsoh_free(tx_queue, buffer);
                 EFX_BUG_ON_PARANOID(buffer->skb);
                 if (buffer->unmap_len) {
@@ -1168,7 +1174,7 @@ static void efx_fini_tso(struct efx_tx_queue *tx_queue)
         unsigned i;
 
         if (tx_queue->buffer) {
-                for (i = 0; i <= EFX_TXQ_MASK; ++i)
+                for (i = 0; i <= tx_queue->ptr_mask; ++i)
                         efx_tsoh_free(tx_queue, &tx_queue->buffer[i]);
         }
 
diff --git a/drivers/net/sfc/txc43128_phy.c b/drivers/net/sfc/txc43128_phy.c
new file mode 100644
index 000000000000..351794a79215
--- /dev/null
+++ b/drivers/net/sfc/txc43128_phy.c
@@ -0,0 +1,560 @@
+/****************************************************************************
+ * Driver for Solarflare Solarstorm network controllers and boards
+ * Copyright 2006-2010 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+/*
+ * Driver for Transwitch/Mysticom CX4 retimer
+ * see www.transwitch.com, part is TXC-43128
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include "efx.h"
+#include "mdio_10g.h"
+#include "phy.h"
+#include "nic.h"
+
+/* We expect these MMDs to be in the package */
+#define TXC_REQUIRED_DEVS (MDIO_DEVS_PCS |      \
+                           MDIO_DEVS_PMAPMD |   \
+                           MDIO_DEVS_PHYXS)
+
+#define TXC_LOOPBACKS ((1 << LOOPBACK_PCS) |    \
+                       (1 << LOOPBACK_PMAPMD) | \
+                       (1 << LOOPBACK_PHYXS_WS))
+
+/**************************************************************************
+ *
+ * Compile-time config
+ *
+ **************************************************************************
+ */
+#define TXCNAME "TXC43128"
+/* Total length of time we'll wait for the PHY to come out of reset (ms) */
+#define TXC_MAX_RESET_TIME      500
+/* Interval between checks (ms) */
+#define TXC_RESET_WAIT          10
+/* How long to run BIST (us) */
+#define TXC_BIST_DURATION       50
+
+/**************************************************************************
+ *
+ * Register definitions
+ *
+ **************************************************************************
+ */
+
+/* Command register */
+#define TXC_GLRGS_GLCMD         0xc004
+/* Useful bits in command register */
+/* Lane power-down */
+#define TXC_GLCMD_L01PD_LBN     5
+#define TXC_GLCMD_L23PD_LBN     6
+/* Limited SW reset: preserves configuration but
+ * initiates a logic reset. Self-clearing */
+#define TXC_GLCMD_LMTSWRST_LBN  14
+
+/* Signal Quality Control */
+#define TXC_GLRGS_GSGQLCTL      0xc01a
+/* Enable bit */
+#define TXC_GSGQLCT_SGQLEN_LBN  15
+/* Lane selection */
+#define TXC_GSGQLCT_LNSL_LBN    13
+#define TXC_GSGQLCT_LNSL_WIDTH  2
+
+/* Analog TX control */
+#define TXC_ALRGS_ATXCTL        0xc040
+/* Lane power-down */
+#define TXC_ATXCTL_TXPD3_LBN    15
+#define TXC_ATXCTL_TXPD2_LBN    14
+#define TXC_ATXCTL_TXPD1_LBN    13
+#define TXC_ATXCTL_TXPD0_LBN    12
+
+/* Amplitude on lanes 0, 1 */
+#define TXC_ALRGS_ATXAMP0       0xc041
+/* Amplitude on lanes 2, 3 */
+#define TXC_ALRGS_ATXAMP1       0xc042
+/* Bit position of value for lane 0 (or 2) */
+#define TXC_ATXAMP_LANE02_LBN   3
+/* Bit position of value for lane 1 (or 3) */
+#define TXC_ATXAMP_LANE13_LBN   11
+
+#define TXC_ATXAMP_1280_mV      0
+#define TXC_ATXAMP_1200_mV      8
+#define TXC_ATXAMP_1120_mV      12
+#define TXC_ATXAMP_1060_mV      14
+#define TXC_ATXAMP_0820_mV      25
+#define TXC_ATXAMP_0720_mV      26
+#define TXC_ATXAMP_0580_mV      27
+#define TXC_ATXAMP_0440_mV      28
+
+#define TXC_ATXAMP_0820_BOTH                                    \
+        ((TXC_ATXAMP_0820_mV << TXC_ATXAMP_LANE02_LBN)          \
+         | (TXC_ATXAMP_0820_mV << TXC_ATXAMP_LANE13_LBN))
+
+#define TXC_ATXAMP_DEFAULT      0x6060 /* From databook */
+
+/* Preemphasis on lanes 0, 1 */
+#define TXC_ALRGS_ATXPRE0       0xc043
+/* Preemphasis on lanes 2, 3 */
+#define TXC_ALRGS_ATXPRE1       0xc044
+
+#define TXC_ATXPRE_NONE 0
+#define TXC_ATXPRE_DEFAULT      0x1010 /* From databook */
+
+#define TXC_ALRGS_ARXCTL        0xc045
+/* Lane power-down */
+#define TXC_ARXCTL_RXPD3_LBN    15
+#define TXC_ARXCTL_RXPD2_LBN    14
+#define TXC_ARXCTL_RXPD1_LBN    13
+#define TXC_ARXCTL_RXPD0_LBN    12
+
+/* Main control */
+#define TXC_MRGS_CTL            0xc340
+/* Bits in main control */
+#define TXC_MCTL_RESET_LBN      15      /* Self clear */
+#define TXC_MCTL_TXLED_LBN      14      /* 1 to show align status */
+#define TXC_MCTL_RXLED_LBN      13      /* 1 to show align status */
+
+/* GPIO output */
+#define TXC_GPIO_OUTPUT         0xc346
+#define TXC_GPIO_DIR            0xc348
+
+/* Vendor-specific BIST registers */
+#define TXC_BIST_CTL            0xc280
+#define TXC_BIST_TXFRMCNT       0xc281
+#define TXC_BIST_RX0FRMCNT      0xc282
+#define TXC_BIST_RX1FRMCNT      0xc283
+#define TXC_BIST_RX2FRMCNT      0xc284
+#define TXC_BIST_RX3FRMCNT      0xc285
+#define TXC_BIST_RX0ERRCNT      0xc286
+#define TXC_BIST_RX1ERRCNT      0xc287
+#define TXC_BIST_RX2ERRCNT      0xc288
+#define TXC_BIST_RX3ERRCNT      0xc289
+
+/* BIST type (controls bit patter in test) */
+#define TXC_BIST_CTRL_TYPE_LBN  10
+#define TXC_BIST_CTRL_TYPE_TSD  0       /* TranSwitch Deterministic */
+#define TXC_BIST_CTRL_TYPE_CRP  1       /* CRPAT standard */
+#define TXC_BIST_CTRL_TYPE_CJP  2       /* CJPAT standard */
+#define TXC_BIST_CTRL_TYPE_TSR  3       /* TranSwitch pseudo-random */
+/* Set this to 1 for 10 bit and 0 for 8 bit */
+#define TXC_BIST_CTRL_B10EN_LBN 12
+/* Enable BIST (write 0 to disable) */
+#define TXC_BIST_CTRL_ENAB_LBN  13
+/* Stop BIST (self-clears when stop complete) */
+#define TXC_BIST_CTRL_STOP_LBN  14
+/* Start BIST (cleared by writing 1 to STOP) */
+#define TXC_BIST_CTRL_STRT_LBN  15
+
+/* Mt. Diablo test configuration */
+#define TXC_MTDIABLO_CTRL       0xc34f
+#define TXC_MTDIABLO_CTRL_PMA_LOOP_LBN  10
+
+struct txc43128_data {
+        unsigned long bug10934_timer;
+        enum efx_phy_mode phy_mode;
+        enum efx_loopback_mode loopback_mode;
+};
+
+/* The PHY sometimes needs a reset to bring the link back up.  So long as
+ * it reports link down, we reset it every 5 seconds.
+ */
+#define BUG10934_RESET_INTERVAL (5 * HZ)
+
+/* Perform a reset that doesn't clear configuration changes */
+static void txc_reset_logic(struct efx_nic *efx);
+
+/* Set the output value of a gpio */
+void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int on)
+{
+        efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, TXC_GPIO_OUTPUT, 1 << pin, on);
+}
+
+/* Set up the GPIO direction register */
+void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir)
+{
+        efx_mdio_set_flag(efx, MDIO_MMD_PHYXS, TXC_GPIO_DIR, 1 << pin, dir);
+}
+
+/* Reset the PMA/PMD MMD. The documentation is explicit that this does a
+ * global reset (it's less clear what reset of other MMDs does).*/
+static int txc_reset_phy(struct efx_nic *efx)
+{
+        int rc = efx_mdio_reset_mmd(efx, MDIO_MMD_PMAPMD,
+                                    TXC_MAX_RESET_TIME / TXC_RESET_WAIT,
+                                    TXC_RESET_WAIT);
+        if (rc < 0)
+                goto fail;
+
+        /* Check that all the MMDs we expect are present and responding. */
+        rc = efx_mdio_check_mmds(efx, TXC_REQUIRED_DEVS, 0);
+        if (rc < 0)
+                goto fail;
+
+        return 0;
+
+fail:
+        netif_err(efx, hw, efx->net_dev, TXCNAME ": reset timed out!\n");
+        return rc;
+}
+
+/* Run a single BIST on one MMD */
+static int txc_bist_one(struct efx_nic *efx, int mmd, int test)
+{
+        int ctrl, bctl;
+        int lane;
+        int rc = 0;
+
+        /* Set PMA to test into loopback using Mt Diablo reg as per app note */
+        ctrl = efx_mdio_read(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL);
+        ctrl |= (1 << TXC_MTDIABLO_CTRL_PMA_LOOP_LBN);
+        efx_mdio_write(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL, ctrl);
+
+        /* The BIST app. note lists these  as 3 distinct steps. */
+        /* Set the BIST type */
+        bctl = (test << TXC_BIST_CTRL_TYPE_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* Set the BSTEN bit in the BIST Control register to enable */
+        bctl |= (1 << TXC_BIST_CTRL_ENAB_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* Set the BSTRT bit in the BIST Control register */
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL,
+                       bctl | (1 << TXC_BIST_CTRL_STRT_LBN));
+
+        /* Wait. */
+        udelay(TXC_BIST_DURATION);
+
+        /* Set the BSTOP bit in the BIST Control register */
+        bctl |= (1 << TXC_BIST_CTRL_STOP_LBN);
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, bctl);
+
+        /* The STOP bit should go off when things have stopped */
+        while (bctl & (1 << TXC_BIST_CTRL_STOP_LBN))
+                bctl = efx_mdio_read(efx, mmd, TXC_BIST_CTL);
+
+        /* Check all the error counts are 0 and all the frame counts are
+           non-zero */
+        for (lane = 0; lane < 4; lane++) {
+                int count = efx_mdio_read(efx, mmd, TXC_BIST_RX0ERRCNT + lane);
+                if (count != 0) {
+                        netif_err(efx, hw, efx->net_dev, TXCNAME": BIST error. "
+                                  "Lane %d had %d errs\n", lane, count);
+                        rc = -EIO;
+                }
+                count = efx_mdio_read(efx, mmd, TXC_BIST_RX0FRMCNT + lane);
+                if (count == 0) {
+                        netif_err(efx, hw, efx->net_dev, TXCNAME": BIST error. "
+                                  "Lane %d got 0 frames\n", lane);
+                        rc = -EIO;
+                }
+        }
+
+        if (rc == 0)
+                netif_info(efx, hw, efx->net_dev, TXCNAME": BIST pass\n");
+
+        /* Disable BIST */
+        efx_mdio_write(efx, mmd, TXC_BIST_CTL, 0);
+
+        /* Turn off loopback */
+        ctrl &= ~(1 << TXC_MTDIABLO_CTRL_PMA_LOOP_LBN);
+        efx_mdio_write(efx, MDIO_MMD_PCS, TXC_MTDIABLO_CTRL, ctrl);
+
+        return rc;
+}
+
+static int txc_bist(struct efx_nic *efx)
+{
+        return txc_bist_one(efx, MDIO_MMD_PCS, TXC_BIST_CTRL_TYPE_TSD);
+}
+
+/* Push the non-configurable defaults into the PHY. This must be
+ * done after every full reset */
+static void txc_apply_defaults(struct efx_nic *efx)
+{
+        int mctrl;
+
+        /* Turn amplitude down and preemphasis off on the host side
+         * (PHY<->MAC) as this is believed less likely to upset Falcon
+         * and no adverse effects have been noted. It probably also
+         * saves a picowatt or two */
+
+        /* Turn off preemphasis */
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_ALRGS_ATXPRE0, TXC_ATXPRE_NONE);
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_ALRGS_ATXPRE1, TXC_ATXPRE_NONE);
+
+        /* Turn down the amplitude */
+        efx_mdio_write(efx, MDIO_MMD_PHYXS,
+                       TXC_ALRGS_ATXAMP0, TXC_ATXAMP_0820_BOTH);
+        efx_mdio_write(efx, MDIO_MMD_PHYXS,
+                       TXC_ALRGS_ATXAMP1, TXC_ATXAMP_0820_BOTH);
+
+        /* Set the line side amplitude and preemphasis to the databook
+         * defaults as an erratum causes them to be 0 on at least some
+         * PHY rev.s */
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXPRE0, TXC_ATXPRE_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXPRE1, TXC_ATXPRE_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXAMP0, TXC_ATXAMP_DEFAULT);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD,
+                       TXC_ALRGS_ATXAMP1, TXC_ATXAMP_DEFAULT);
+
+        /* Set up the LEDs  */
+        mctrl = efx_mdio_read(efx, MDIO_MMD_PHYXS, TXC_MRGS_CTL);
+
+        /* Set the Green and Red LEDs to their default modes */
+        mctrl &= ~((1 << TXC_MCTL_TXLED_LBN) | (1 << TXC_MCTL_RXLED_LBN));
+        efx_mdio_write(efx, MDIO_MMD_PHYXS, TXC_MRGS_CTL, mctrl);
+
+        /* Databook recommends doing this after configuration changes */
+        txc_reset_logic(efx);
+
+        falcon_board(efx)->type->init_phy(efx);
+}
+
+static int txc43128_phy_probe(struct efx_nic *efx)
+{
+        struct txc43128_data *phy_data;
+
+        /* Allocate phy private storage */
+        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+        if (!phy_data)
+                return -ENOMEM;
+        efx->phy_data = phy_data;
+        phy_data->phy_mode = efx->phy_mode;
+
+        efx->mdio.mmds = TXC_REQUIRED_DEVS;
+        efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+
+        efx->loopback_modes = TXC_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+
+        return 0;
+}
+
+/* Initialisation entry point for this PHY driver */
+static int txc43128_phy_init(struct efx_nic *efx)
+{
+        int rc;
+
+        rc = txc_reset_phy(efx);
+        if (rc < 0)
+                return rc;
+
+        rc = txc_bist(efx);
+        if (rc < 0)
+                return rc;
+
+        txc_apply_defaults(efx);
+
+        return 0;
+}
+
+/* Set the lane power down state in the global registers */
+static void txc_glrgs_lane_power(struct efx_nic *efx, int mmd)
+{
+        int pd = (1 << TXC_GLCMD_L01PD_LBN) | (1 << TXC_GLCMD_L23PD_LBN);
+        int ctl = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+
+        if (!(efx->phy_mode & PHY_MODE_LOW_POWER))
+                ctl &= ~pd;
+        else
+                ctl |= pd;
+
+        efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, ctl);
+}
+
+/* Set the lane power down state in the analog control registers */
+static void txc_analog_lane_power(struct efx_nic *efx, int mmd)
+{
+        int txpd = (1 << TXC_ATXCTL_TXPD3_LBN) | (1 << TXC_ATXCTL_TXPD2_LBN)
+                | (1 << TXC_ATXCTL_TXPD1_LBN) | (1 << TXC_ATXCTL_TXPD0_LBN);
+        int rxpd = (1 << TXC_ARXCTL_RXPD3_LBN) | (1 << TXC_ARXCTL_RXPD2_LBN)
+                | (1 << TXC_ARXCTL_RXPD1_LBN) | (1 << TXC_ARXCTL_RXPD0_LBN);
+        int txctl = efx_mdio_read(efx, mmd, TXC_ALRGS_ATXCTL);
+        int rxctl = efx_mdio_read(efx, mmd, TXC_ALRGS_ARXCTL);
+
+        if (!(efx->phy_mode & PHY_MODE_LOW_POWER)) {
+                txctl &= ~txpd;
+                rxctl &= ~rxpd;
+        } else {
+                txctl |= txpd;
+                rxctl |= rxpd;
+        }
+
+        efx_mdio_write(efx, mmd, TXC_ALRGS_ATXCTL, txctl);
+        efx_mdio_write(efx, mmd, TXC_ALRGS_ARXCTL, rxctl);
+}
+
+static void txc_set_power(struct efx_nic *efx)
+{
+        /* According to the data book, all the MMDs can do low power */
+        efx_mdio_set_mmds_lpower(efx,
+                                 !!(efx->phy_mode & PHY_MODE_LOW_POWER),
+                                 TXC_REQUIRED_DEVS);
+
+        /* Global register bank is in PCS, PHY XS. These control the host
+         * side and line side settings respectively. */
+        txc_glrgs_lane_power(efx, MDIO_MMD_PCS);
+        txc_glrgs_lane_power(efx, MDIO_MMD_PHYXS);
+
+        /* Analog register bank in PMA/PMD, PHY XS */
+        txc_analog_lane_power(efx, MDIO_MMD_PMAPMD);
+        txc_analog_lane_power(efx, MDIO_MMD_PHYXS);
+}
+
+static void txc_reset_logic_mmd(struct efx_nic *efx, int mmd)
+{
+        int val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+        int tries = 50;
+
+        val |= (1 << TXC_GLCMD_LMTSWRST_LBN);
+        efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, val);
+        while (tries--) {
+                val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
+                if (!(val & (1 << TXC_GLCMD_LMTSWRST_LBN)))
+                        break;
+                udelay(1);
+        }
+        if (!tries)
+                netif_info(efx, hw, efx->net_dev,
+                           TXCNAME " Logic reset timed out!\n");
+}
+
+/* Perform a logic reset. This preserves the configuration registers
+ * and is needed for some configuration changes to take effect */
+static void txc_reset_logic(struct efx_nic *efx)
+{
+        /* The data sheet claims we can do the logic reset on either the
+         * PCS or the PHYXS and the result is a reset of both host- and
+         * line-side logic. */
+        txc_reset_logic_mmd(efx, MDIO_MMD_PCS);
+}
+
+static bool txc43128_phy_read_link(struct efx_nic *efx)
+{
+        return efx_mdio_links_ok(efx, TXC_REQUIRED_DEVS);
+}
+
+static int txc43128_phy_reconfigure(struct efx_nic *efx)
+{
+        struct txc43128_data *phy_data = efx->phy_data;
+        enum efx_phy_mode mode_change = efx->phy_mode ^ phy_data->phy_mode;
+        bool loop_change = LOOPBACK_CHANGED(phy_data, efx, TXC_LOOPBACKS);
+
+        if (efx->phy_mode & mode_change & PHY_MODE_TX_DISABLED) {
+                txc_reset_phy(efx);
+                txc_apply_defaults(efx);
+                falcon_reset_xaui(efx);
+                mode_change &= ~PHY_MODE_TX_DISABLED;
+        }
+
+        efx_mdio_transmit_disable(efx);
+        efx_mdio_phy_reconfigure(efx);
+        if (mode_change & PHY_MODE_LOW_POWER)
+                txc_set_power(efx);
+
+        /* The data sheet claims this is required after every reconfiguration
+         * (note at end of 7.1), but we mustn't do it when nothing changes as
+         * it glitches the link, and reconfigure gets called on link change,
+         * so we get an IRQ storm on link up. */
+        if (loop_change || mode_change)
+                txc_reset_logic(efx);
+
+        phy_data->phy_mode = efx->phy_mode;
+        phy_data->loopback_mode = efx->loopback_mode;
+
+        return 0;
+}
+
+static void txc43128_phy_fini(struct efx_nic *efx)
+{
+        /* Disable link events */
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD, MDIO_PMA_LASI_CTRL, 0);
+}
+
+static void txc43128_phy_remove(struct efx_nic *efx)
+{
+        kfree(efx->phy_data);
+        efx->phy_data = NULL;
+}
+
+/* Periodic callback: this exists mainly to poll link status as we
+ * don't use LASI interrupts */
+static bool txc43128_phy_poll(struct efx_nic *efx)
+{
+        struct txc43128_data *data = efx->phy_data;
+        bool was_up = efx->link_state.up;
+
+        efx->link_state.up = txc43128_phy_read_link(efx);
+        efx->link_state.speed = 10000;
+        efx->link_state.fd = true;
+        efx->link_state.fc = efx->wanted_fc;
+
+        if (efx->link_state.up || (efx->loopback_mode != LOOPBACK_NONE)) {
+                data->bug10934_timer = jiffies;
+        } else {
+                if (time_after_eq(jiffies, (data->bug10934_timer +
+                                            BUG10934_RESET_INTERVAL))) {
+                        data->bug10934_timer = jiffies;
+                        txc_reset_logic(efx);
+                }
+        }
+
+        return efx->link_state.up != was_up;
+}
+
+static const char *txc43128_test_names[] = {
+        "bist"
+};
+
+static const char *txc43128_test_name(struct efx_nic *efx, unsigned int index)
+{
+        if (index < ARRAY_SIZE(txc43128_test_names))
+                return txc43128_test_names[index];
+        return NULL;
+}
+
+static int txc43128_run_tests(struct efx_nic *efx, int *results, unsigned flags)
+{
+        int rc;
+
+        if (!(flags & ETH_TEST_FL_OFFLINE))
+                return 0;
+
+        rc = txc_reset_phy(efx);
+        if (rc < 0)
+                return rc;
+
+        rc = txc_bist(efx);
+        txc_apply_defaults(efx);
+        results[0] = rc ? -1 : 1;
+        return rc;
+}
+
+static void txc43128_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+{
+        mdio45_ethtool_gset(&efx->mdio, ecmd);
+}
+
+struct efx_phy_operations falcon_txc_phy_ops = {
+        .probe          = txc43128_phy_probe,
+        .init           = txc43128_phy_init,
+        .reconfigure    = txc43128_phy_reconfigure,
+        .poll           = txc43128_phy_poll,
+        .fini           = txc43128_phy_fini,
+        .remove         = txc43128_phy_remove,
+        .get_settings   = txc43128_get_settings,
+        .set_settings   = efx_mdio_set_settings,
+        .test_alive     = efx_mdio_test_alive,
+        .run_tests      = txc43128_run_tests,
+        .test_name      = txc43128_test_name,
+};
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 782e45a613d6..e0d63083c3a8 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -19,9 +19,7 @@
 #define EFX_WORKAROUND_FALCON_A(efx) (efx_nic_rev(efx) <= EFX_REV_FALCON_A1)
 #define EFX_WORKAROUND_FALCON_AB(efx) (efx_nic_rev(efx) <= EFX_REV_FALCON_B0)
 #define EFX_WORKAROUND_SIENA(efx) (efx_nic_rev(efx) == EFX_REV_SIENA_A0)
-#define EFX_WORKAROUND_10G(efx) EFX_IS10G(efx)
-#define EFX_WORKAROUND_SFT9001(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A || \
-                                     (efx)->phy_type == PHY_TYPE_SFT9001B)
+#define EFX_WORKAROUND_10G(efx) 1
 
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
@@ -58,9 +56,4 @@
 /* Leak overlength packets rather than free */
 #define EFX_WORKAROUND_8071 EFX_WORKAROUND_FALCON_A
 
-/* Need to send XNP pages for 100BaseT */
-#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001
-/* Don't restart AN in near-side loopback */
-#define EFX_WORKAROUND_15195 EFX_WORKAROUND_SFT9001
-
 #endif /* EFX_WORKAROUNDS_H */
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 79fd02bc69fd..50259dfec583 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -798,7 +798,7 @@ static int sh_eth_rx(struct net_device *ndev)
                         skb->dev = ndev;
                         sh_eth_set_receive_align(skb);
 
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
                         rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
                 }
                 if (entry >= RX_RING_SIZE - 1)
@@ -1031,7 +1031,7 @@ static int sh_eth_phy_init(struct net_device *ndev)
         mdp->duplex = -1;
 
         /* Try connect to PHY */
-        phydev = phy_connect(ndev, phy_id, &sh_eth_adjust_link,
+        phydev = phy_connect(ndev, phy_id, sh_eth_adjust_link,
                                 0, PHY_INTERFACE_MODE_MII);
         if (IS_ERR(phydev)) {
                 dev_err(&ndev->dev, "phy_connect failed\n");
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index bbbded76ff14..581836867098 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -832,7 +832,7 @@ static u16 __devinit read_eeprom(long ioaddr, int location)
         outl(0, ee_addr);
         eeprom_delay();
 
-        return (retval);
+        return retval;
 }
 
 /* Read and write the MII management registers using software-generated
@@ -1042,7 +1042,7 @@ sis900_open(struct net_device *net_dev)
         init_timer(&sis_priv->timer);
         sis_priv->timer.expires = jiffies + HZ;
         sis_priv->timer.data = (unsigned long)net_dev;
-        sis_priv->timer.function = &sis900_timer;
+        sis_priv->timer.function = sis900_timer;
         add_timer(&sis_priv->timer);
 
         return 0;
@@ -2247,9 +2247,9 @@ static inline u16 sis900_mcast_bitnr(u8 *addr, u8 revision)
 
         /* leave 8 or 7 most siginifant bits */
         if ((revision >= SIS635A_900_REV) || (revision == SIS900B_900_REV))
-                return ((int)(crc >> 24));
+                return (int)(crc >> 24);
         else
-                return ((int)(crc >> 25));
+                return (int)(crc >> 25);
 }
 
 /**
diff --git a/drivers/net/skfp/cfm.c b/drivers/net/skfp/cfm.c
index 5310d39b5737..e395ace3120b 100644
--- a/drivers/net/skfp/cfm.c
+++ b/drivers/net/skfp/cfm.c
@@ -542,8 +542,8 @@ static void cfm_fsm(struct s_smc *smc, int cmd)
  */
 int cfm_get_mac_input(struct s_smc *smc)
 {
-        return((smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
-                smc->mib.fddiSMTCF_State == SC5_THRU_B) ? PB : PA) ;
+        return (smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
+                smc->mib.fddiSMTCF_State == SC5_THRU_B) ? PB : PA;
 }
 
 /*
@@ -553,8 +553,8 @@ int cfm_get_mac_input(struct s_smc *smc)
  */
 int cfm_get_mac_output(struct s_smc *smc)
 {
-        return((smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
-                smc->mib.fddiSMTCF_State == SC4_THRU_A) ? PB : PA) ;
+        return (smc->mib.fddiSMTCF_State == SC10_C_WRAP_B ||
+                smc->mib.fddiSMTCF_State == SC4_THRU_A) ? PB : PA;
 }
 
 static char path_iso[] = {
@@ -623,5 +623,5 @@ int cem_build_path(struct s_smc *smc, char *to, int path_index)
 
         LINT_USE(path_index);
 
-        return(len) ;
+        return len;
 }
diff --git a/drivers/net/skfp/drvfbi.c b/drivers/net/skfp/drvfbi.c
index c77cc14b3227..07da97c303d6 100644
--- a/drivers/net/skfp/drvfbi.c
+++ b/drivers/net/skfp/drvfbi.c
@@ -267,7 +267,7 @@ void timer_irq(struct s_smc *smc)
 int pcm_get_s_port(struct s_smc *smc)
 {
         SK_UNUSED(smc) ;
-        return(PS) ;
+        return PS;
 }
 
 /*
@@ -366,7 +366,7 @@ void sm_pm_bypass_req(struct s_smc *smc, int mode)
  */
 int sm_pm_bypass_present(struct s_smc *smc)
 {
-        return( (inp(ADDR(B0_DAS)) & DAS_BYP_ST) ? TRUE: FALSE) ;
+        return (inp(ADDR(B0_DAS)) & DAS_BYP_ST) ? TRUE : FALSE;
 }
 
 void plc_clear_irq(struct s_smc *smc, int p)
@@ -483,9 +483,9 @@ static int is_equal_num(char comp1[], char comp2[], int num)
 
         for (i = 0 ; i < num ; i++) {
                 if (comp1[i] != comp2[i])
-                        return (0) ;
+                        return 0;
         }
-                return (1) ;
+                return 1;
 }       /* is_equal_num */
 
 
@@ -522,18 +522,18 @@ int set_oi_id_def(struct s_smc *smc)
                         i++ ;
                         break ;                 /* entry ok */
                 default:
-                        return (1) ;            /* invalid oi_status */
+                        return 1;               /* invalid oi_status */
                 }
         }
 
         if (i == 0)
-                return (2) ;
+                return 2;
         if (!act_entries)
-                return (3) ;
+                return 3;
 
         /* ok, we have a valid OEM data base with an active entry */
         smc->hw.oem_id = (struct s_oem_ids *)  &oem_ids[sel_id] ;
-        return (0) ;
+        return 0;
 }
 #endif  /* MULT_OEM */
 
diff --git a/drivers/net/skfp/ess.c b/drivers/net/skfp/ess.c
index e8387d25f24a..8639a0884f5c 100644
--- a/drivers/net/skfp/ess.c
+++ b/drivers/net/skfp/ess.c
@@ -135,7 +135,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
          */
         if (!(p = (void *) sm_to_para(smc,sm,SMT_P0015))) {
                 DB_ESS("ESS: RAF frame error, parameter type not found\n",0,0) ;
-                return(fs) ;
+                return fs;
         }
         msg_res_type = ((struct smt_p_0015 *)p)->res_type ;
 
@@ -147,7 +147,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  * error in frame: para ESS command was not found
                  */
                  DB_ESS("ESS: RAF frame error, parameter command not found\n",0,0);
-                 return(fs) ;
+                 return fs;
         }
 
         DB_ESSN(2,"fc %x        ft %x\n",sm->smt_class,sm->smt_type) ;
@@ -175,12 +175,12 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                          * local and no static allocation is used
                          */
                         if (!local || smc->mib.fddiESSPayload)
-                                return(fs) ;
+                                return fs;
                         
                         p = (void *) sm_to_para(smc,sm,SMT_P0019)  ;
                         for (i = 0; i < 5; i++) {
                                 if (((struct smt_p_0019 *)p)->alloc_addr.a[i]) {
-                                        return(fs) ;
+                                        return fs;
                                 }
                         }
 
@@ -199,10 +199,10 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                         sm->smt_dest = smt_sba_da ;
 
                         if (smc->ess.local_sba_active)
-                                return(fs | I_INDICATOR) ;
+                                return fs | I_INDICATOR;
 
                         if (!(db = smt_get_mbuf(smc)))
-                                return(fs) ;
+                                return fs;
 
                         db->sm_len = mb->sm_len ;
                         db->sm_off = mb->sm_off ;
@@ -212,7 +212,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                                 (struct smt_header *)(db->sm_data+db->sm_off),
                                 "RAF") ;
                         smt_send_frame(smc,db,FC_SMT_INFO,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -221,7 +221,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (smt_check_para(smc,sm,plist_raf_alc_res)) {
                         DB_ESS("ESS: RAF with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -242,7 +242,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                         (sm->smt_tid != smc->ess.alloc_trans_id)) {
 
                         DB_ESS("ESS: Allocation Responce not accepted\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -268,7 +268,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 (void)process_bw_alloc(smc,(long)payload,(long)overhead) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Allocation Request */
 
         /*
@@ -280,7 +280,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (sm->smt_type != SMT_REQUEST) {
                         DB_ESS("ESS: Do not process Change Responses\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -288,7 +288,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (smt_check_para(smc,sm,plist_raf_chg_req)) {
                         DB_ESS("ESS: RAF with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -300,7 +300,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                 if ((((struct smt_p_320b *)sm_to_para(smc,sm,SMT_P320B))->path_index
                         != PRIMARY_RING) || (msg_res_type != SYNC_BW)) {
                         DB_ESS("ESS: RAF frame with para problem, ignoring\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -319,14 +319,14 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  * process the bandwidth allocation
                  */
                 if(!process_bw_alloc(smc,(long)payload,(long)overhead))
-                        return(fs) ;
+                        return fs;
 
                 /*
                  * send an RAF Change Reply
                  */
                 ess_send_response(smc,sm,CHANGE_ALLOCATION) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Change Request */
 
         /*
@@ -338,7 +338,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (sm->smt_type != SMT_REQUEST) {
                         DB_ESS("ESS: Do not process a Report Reply\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 DB_ESSN(2,"ESS: Report Request from %s\n",
@@ -349,7 +349,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 if (msg_res_type != SYNC_BW) {
                         DB_ESS("ESS: ignoring RAF with para problem\n",0,0) ;
-                        return(fs) ;
+                        return fs;
                 }
 
                 /*
@@ -357,7 +357,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                  */
                 ess_send_response(smc,sm,REPORT_ALLOCATION) ;
 
-                return(fs) ;
+                return fs;
                 /* end of Process Report Request */
 
         default:
@@ -368,7 +368,7 @@ int ess_raf_received_pack(struct s_smc *smc, SMbuf *mb, struct smt_header *sm,
                 break ;
         }
 
-        return(fs) ;
+        return fs;
 }
 
 /*
@@ -418,17 +418,17 @@ static int process_bw_alloc(struct s_smc *smc, long int payload, long int overhe
          */
 /*      if (smt_set_obj(smc,SMT_P320F,payload,S_SET)) {
                 DB_ESS("ESS: SMT does not accept the payload value\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         }
         if (smt_set_obj(smc,SMT_P3210,overhead,S_SET)) {
                 DB_ESS("ESS: SMT does not accept the overhead value\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         } */
 
         /* premliminary */
         if (payload > MAX_PAYLOAD || overhead > 5000) {
                 DB_ESS("ESS: payload / overhead not accepted\n",0,0) ;
-                return(FALSE) ;
+                return FALSE;
         }
 
         /*
@@ -468,7 +468,7 @@ static int process_bw_alloc(struct s_smc *smc, long int payload, long int overhe
 
         ess_config_fifo(smc) ;
         set_formac_tsync(smc,smc->ess.sync_bw) ;
-        return(TRUE) ;
+        return TRUE;
 }
 
 static void ess_send_response(struct s_smc *smc, struct smt_header *sm,
diff --git a/drivers/net/skfp/fplustm.c b/drivers/net/skfp/fplustm.c
index 9d8d1ac48176..ca4e7bb6a5a8 100644
--- a/drivers/net/skfp/fplustm.c
+++ b/drivers/net/skfp/fplustm.c
@@ -112,8 +112,8 @@ static u_long mac_get_tneg(struct s_smc *smc)
         u_long  tneg ;
 
         tneg = (u_long)((long)inpw(FM_A(FM_TNEG))<<5) ;
-        return((u_long)((tneg + ((inpw(FM_A(FM_TMRS))>>10)&0x1f)) |
-                0xffe00000L)) ;
+        return (u_long)((tneg + ((inpw(FM_A(FM_TMRS))>>10)&0x1f)) |
+                0xffe00000L) ;
 }
 
 void mac_update_counter(struct s_smc *smc)
@@ -163,7 +163,7 @@ static u_long read_mdr(struct s_smc *smc, unsigned int addr)
                         /* is used */
         p = (u_long)inpw(FM_A(FM_MDRU))<<16 ;
         p += (u_long)inpw(FM_A(FM_MDRL)) ;
-        return(p) ;
+        return p;
 }
 #endif
 
@@ -887,7 +887,7 @@ int init_fplus(struct s_smc *smc)
         /* make sure all PCI settings are correct */
         mac_do_pci_fix(smc) ;
 
-        return(init_mac(smc,1)) ;
+        return init_mac(smc, 1);
         /* enable_formac(smc) ; */
 }
 
@@ -989,7 +989,7 @@ static int init_mac(struct s_smc *smc, int all)
         }
         smc->hw.hw_state = STARTED ;
 
-        return(0) ;
+        return 0;
 }
 
 
@@ -1049,7 +1049,7 @@ void sm_ma_control(struct s_smc *smc, int mode)
 
 int sm_mac_get_tx_state(struct s_smc *smc)
 {
-        return((inpw(FM_A(FM_STMCHN))>>4)&7) ;
+        return (inpw(FM_A(FM_STMCHN))>>4) & 7;
 }
 
 /*
@@ -1084,9 +1084,9 @@ static struct s_fpmc* mac_get_mc_table(struct s_smc *smc,
                 }
                 if (memcmp((char *)&tb->a,(char *)own,6))
                         continue ;
-                return(tb) ;
+                return tb;
         }
-        return(slot) ;                  /* return first free or NULL */
+        return slot;                    /* return first free or NULL */
 }
 
 /*
@@ -1152,12 +1152,12 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
          */
         if (can & 0x80) {
                 if (smc->hw.fp.smt_slots_used >= SMT_MAX_MULTI) {
-                        return(1) ;
+                        return 1;
                 }
         }
         else {
                 if (smc->hw.fp.os_slots_used >= FPMAX_MULTICAST-SMT_MAX_MULTI) {
-                        return(1) ;
+                        return 1;
                 }
         }
 
@@ -1165,7 +1165,7 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
          * find empty slot
          */
         if (!(tb = mac_get_mc_table(smc,addr,&own,0,can & ~0x80)))
-                return(1) ;
+                return 1;
         tb->n++ ;
         tb->a = own ;
         tb->perm = (can & 0x80) ? 1 : 0 ;
@@ -1175,7 +1175,7 @@ int mac_add_multicast(struct s_smc *smc, struct fddi_addr *addr, int can)
         else
                 smc->hw.fp.os_slots_used++ ;
 
-        return(0) ;
+        return 0;
 }
 
 /*
diff --git a/drivers/net/skfp/hwmtm.c b/drivers/net/skfp/hwmtm.c
index d322f1b702ac..af5a755e269d 100644
--- a/drivers/net/skfp/hwmtm.c
+++ b/drivers/net/skfp/hwmtm.c
@@ -232,16 +232,16 @@ u_int mac_drv_check_space(void)
 #ifdef  COMMON_MB_POOL
         call_count++ ;
         if (call_count == 1) {
-                return(EXT_VIRT_MEM) ;
+                return EXT_VIRT_MEM;
         }
         else {
-                return(EXT_VIRT_MEM_2) ;
+                return EXT_VIRT_MEM_2;
         }
 #else
-        return (EXT_VIRT_MEM) ;
+        return EXT_VIRT_MEM;
 #endif
 #else
-        return (0) ;
+        return 0;
 #endif
 }
 
@@ -271,7 +271,7 @@ int mac_drv_init(struct s_smc *smc)
         if (!(smc->os.hwm.descr_p = (union s_fp_descr volatile *)
                 mac_drv_get_desc_mem(smc,(u_int)
                 (RXD_TXD_COUNT+1)*sizeof(struct s_smt_fp_txd)))) {
-                return(1) ;     /* no space the hwm modul can't work */
+                return 1;       /* no space the hwm modul can't work */
         }
 
         /*
@@ -283,18 +283,18 @@ int mac_drv_init(struct s_smc *smc)
 #ifndef COMMON_MB_POOL
         if (!(smc->os.hwm.mbuf_pool.mb_start = (SMbuf *) mac_drv_get_space(smc,
                 MAX_MBUF*sizeof(SMbuf)))) {
-                return(1) ;     /* no space the hwm modul can't work */
+                return 1;       /* no space the hwm modul can't work */
         }
 #else
         if (!mb_start) {
                 if (!(mb_start = (SMbuf *) mac_drv_get_space(smc,
                         MAX_MBUF*sizeof(SMbuf)))) {
-                        return(1) ;     /* no space the hwm modul can't work */
+                        return 1;       /* no space the hwm modul can't work */
                 }
         }
 #endif
 #endif
-        return (0) ;
+        return 0;
 }
 
 /*
@@ -349,7 +349,7 @@ static u_long init_descr_ring(struct s_smc *smc,
                 DRV_BUF_FLUSH(&d1->r,DDI_DMA_SYNC_FORDEV) ;
                 d1++;
         }
-        return(phys) ;
+        return phys;
 }
 
 static void init_txd_ring(struct s_smc *smc)
@@ -502,7 +502,7 @@ SMbuf *smt_get_mbuf(struct s_smc *smc)
                 mb->sm_use_count = 1 ;
         }
         DB_GEN("get SMbuf: mb = %x",(void *)mb,0,3) ;
-        return (mb) ;   /* May be NULL */
+        return mb;      /* May be NULL */
 }
 
 void smt_free_mbuf(struct s_smc *smc, SMbuf *mb)
@@ -621,7 +621,7 @@ static u_long repair_txd_ring(struct s_smc *smc, struct s_smt_tx_queue *queue)
                 t = t->txd_next ;
                 tx_used-- ;
         }
-        return(phys) ;
+        return phys;
 }
 
 /*
@@ -673,7 +673,7 @@ static u_long repair_rxd_ring(struct s_smc *smc, struct s_smt_rx_queue *queue)
                 r = r->rxd_next ;
                 rx_used-- ;
         }
-        return(phys) ;
+        return phys;
 }
 
 
@@ -1595,7 +1595,7 @@ int hwm_tx_init(struct s_smc *smc, u_char fc, int frag_count, int frame_len,
         }
         DB_TX("frame_status = %x",frame_status,0,3) ;
         NDD_TRACE("THiE",frame_status,smc->os.hwm.tx_p->tx_free,0) ;
-        return(frame_status) ;
+        return frame_status;
 }
 
 /*
@@ -1764,7 +1764,7 @@ static SMbuf *get_llc_rx(struct s_smc *smc)
                 smc->os.hwm.llc_rx_pipe = mb->sm_next ;
         }
         DB_GEN("get_llc_rx: mb = 0x%x",(void *)mb,0,4) ;
-        return(mb) ;
+        return mb;
 }
 
 /*
@@ -1797,7 +1797,7 @@ static SMbuf *get_txd_mb(struct s_smc *smc)
                 smc->os.hwm.txd_tx_pipe = mb->sm_next ;
         }
         DB_GEN("get_txd_mb: mb = 0x%x",(void *)mb,0,4) ;
-        return(mb) ;
+        return mb;
 }
 
 /*
diff --git a/drivers/net/skfp/hwt.c b/drivers/net/skfp/hwt.c
index 053151468f93..e6baa53307c7 100644
--- a/drivers/net/skfp/hwt.c
+++ b/drivers/net/skfp/hwt.c
@@ -179,7 +179,7 @@ u_long hwt_read(struct s_smc *smc)
                 else
                         smc->hw.t_stop = smc->hw.t_start - tr ;
         }
-        return (smc->hw.t_stop) ;
+        return smc->hw.t_stop;
 }
 
 #ifdef  PCI
@@ -208,7 +208,7 @@ u_long hwt_quick_read(struct s_smc *smc)
         outpw(ADDR(B2_TI_CRTL), TIM_START) ;
         outpd(ADDR(B2_TI_INI),interval) ;
 
-        return(time) ;
+        return time;
 }
 
 /************************
diff --git a/drivers/net/skfp/pcmplc.c b/drivers/net/skfp/pcmplc.c
index ba45bc794d77..112d35b1bf0e 100644
--- a/drivers/net/skfp/pcmplc.c
+++ b/drivers/net/skfp/pcmplc.c
@@ -504,7 +504,7 @@ int sm_pm_get_ls(struct s_smc *smc, int phy)
 
 #ifdef  CONCENTRATOR
         if (!plc_is_installed(smc,phy))
-                return(PC_QLS) ;
+                return PC_QLS;
 #endif
 
         state = inpw(PLC(phy,PL_STATUS_A)) & PL_LINE_ST ;
@@ -528,7 +528,7 @@ int sm_pm_get_ls(struct s_smc *smc, int phy)
         default :
                 state = PC_LS_NONE ;
         }
-        return(state) ;
+        return state;
 }
 
 static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
@@ -547,7 +547,7 @@ static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
 #if     0
                 printf("PL_PCM_SIGNAL is set\n") ;
 #endif
-                return(1) ;
+                return 1;
         }
         /* write bit[n] & length = 1 to regs */
         outpw(PLC(np,PL_VECTOR_LEN),len-1) ;    /* len=nr-1 */
@@ -562,7 +562,7 @@ static int plc_send_bits(struct s_smc *smc, struct s_phy *phy, int len)
                 printf("SIGNALING bit %d .. %d\n",phy->bitn,phy->bitn+len-1) ;
 #endif
 #endif
-        return(0) ;
+        return 0;
 }
 
 /*
@@ -1590,12 +1590,12 @@ int pcm_status_twisted(struct s_smc *smc)
 {
         int     twist = 0 ;
         if (smc->s.sas != SMT_DAS)
-                return(0) ;
+                return 0;
         if (smc->y[PA].twisted && (smc->y[PA].mib->fddiPORTPCMState == PC8_ACTIVE))
                 twist |= 1 ;
         if (smc->y[PB].twisted && (smc->y[PB].mib->fddiPORTPCMState == PC8_ACTIVE))
                 twist |= 2 ;
-        return(twist) ;
+        return twist;
 }
 
 /*
@@ -1636,9 +1636,9 @@ int pcm_rooted_station(struct s_smc *smc)
         for (n = 0 ; n < NUMPHYS ; n++) {
                 if (smc->y[n].mib->fddiPORTPCMState == PC8_ACTIVE &&
                     smc->y[n].mib->fddiPORTNeighborType == TM)
-                        return(0) ;
+                        return 0;
         }
-        return(1) ;
+        return 1;
 }
 
 /*
@@ -1915,7 +1915,7 @@ int get_pcm_state(struct s_smc *smc, int np)
                 case PL_PC9 :   pcs = PC_MAINT ;        break ;
                 default :       pcs = PC_DISABLE ;      break ;
         }
-        return(pcs) ;
+        return pcs;
 }
 
 char *get_linestate(struct s_smc *smc, int np)
@@ -1937,7 +1937,7 @@ char *get_linestate(struct s_smc *smc, int np)
                 default:        ls = "unknown" ; break ;
 #endif
         }
-        return(ls) ;
+        return ls;
 }
 
 char *get_pcmstate(struct s_smc *smc, int np)
@@ -1959,7 +1959,7 @@ char *get_pcmstate(struct s_smc *smc, int np)
                 case PL_PC9 :   pcs = "MAINT" ;         break ;
                 default :       pcs = "UNKNOWN" ;       break ;
         }
-        return(pcs) ;
+        return pcs;
 }
 
 void list_phy(struct s_smc *smc)
diff --git a/drivers/net/skfp/pmf.c b/drivers/net/skfp/pmf.c
index a320fdb3727d..9ac4665d7411 100644
--- a/drivers/net/skfp/pmf.c
+++ b/drivers/net/skfp/pmf.c
@@ -328,7 +328,7 @@ static SMbuf *smt_build_pmf_response(struct s_smc *smc, struct smt_header *req,
          * build SMT header
          */
         if (!(mb = smt_get_mbuf(smc)))
-                return(mb) ;
+                return mb;
 
         smt = smtod(mb, struct smt_header *) ;
         smt->smt_dest = req->smt_source ;       /* DA == source of request */
@@ -493,7 +493,7 @@ static SMbuf *smt_build_pmf_response(struct s_smc *smc, struct smt_header *req,
                 smt_add_para(smc,&set_pcon,(u_short) SMT_P1035,0,0) ;
                 smt_add_para(smc,&set_pcon,(u_short) SMT_P1036,0,0) ;
         }
-        return(mb) ;
+        return mb;
 }
 
 static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
@@ -511,7 +511,7 @@ static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
         if (i != 8) {
                 if (memcmp((char *) &sm->smt_sid,
                         (char *) &smc->mib.fddiPRPMFStation,8))
-                        return(1) ;
+                        return 1;
         }
         /*
          * check authoriziation parameter if passwd not zero
@@ -522,13 +522,13 @@ static int smt_authorize(struct s_smc *smc, struct smt_header *sm)
         if (i != 8) {
                 pa = (struct smt_para *) sm_to_para(smc,sm,SMT_P_AUTHOR) ;
                 if (!pa)
-                        return(1) ;
+                        return 1;
                 if (pa->p_len != 8)
-                        return(1) ;
+                        return 1;
                 if (memcmp((char *)(pa+1),(char *)smc->mib.fddiPRPMFPasswd,8))
-                        return(1) ;
+                        return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 static int smt_check_set_count(struct s_smc *smc, struct smt_header *sm)
@@ -542,9 +542,9 @@ static int smt_check_set_count(struct s_smc *smc, struct smt_header *sm)
                 if ((smc->mib.fddiSMTSetCount.count != sc->count) ||
                         memcmp((char *) smc->mib.fddiSMTSetCount.timestamp,
                         (char *)sc->timestamp,8))
-                        return(1) ;
+                        return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 void smt_add_para(struct s_smc *smc, struct s_pcon *pcon, u_short para,
@@ -1109,7 +1109,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x2000 :
                 if (mac < 0 || mac >= NUMMACS) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_m = &smc->mib.m[mac] ;
                 mib_addr = (char *) mib_m ;
@@ -1118,7 +1118,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x3000 :
                 if (path < 0 || path >= NUMPATHS) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_a = &smc->mib.a[path] ;
                 mib_addr = (char *) mib_a ;
@@ -1127,7 +1127,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                 break ;
         case 0x4000 :
                 if (port < 0 || port >= smt_mib_phys(smc)) {
-                        return(SMT_RDF_NOPARAM) ;
+                        return SMT_RDF_NOPARAM;
                 }
                 mib_p = &smc->mib.p[port_to_mib(smc,port)] ;
                 mib_addr = (char *) mib_p ;
@@ -1151,22 +1151,20 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
         case SMT_P10F9 :
 #endif
         case SMT_P20F1 :
-                if (!local) {
-                        return(SMT_RDF_NOPARAM) ;
-                }
+                if (!local)
+                        return SMT_RDF_NOPARAM;
                 break ;
         }
         pt = smt_get_ptab(pa->p_type) ;
-        if (!pt) {
-                return( (pa->p_type & 0xff00) ? SMT_RDF_NOPARAM :
-                                                SMT_RDF_ILLEGAL ) ;
-        }
+        if (!pt)
+                return (pa->p_type & 0xff00) ? SMT_RDF_NOPARAM :
+                                               SMT_RDF_ILLEGAL;
         switch (pt->p_access) {
         case AC_GR :
         case AC_S :
                 break ;
         default :
-                return(SMT_RDF_ILLEGAL) ;
+                return SMT_RDF_ILLEGAL;
         }
         to = mib_addr + pt->p_offset ;
         swap = pt->p_swap ;             /* pointer to swap string */
@@ -1292,7 +1290,7 @@ static int smt_set_para(struct s_smc *smc, struct smt_para *pa, int index,
                         break ;
                 default :
                         SMT_PANIC(smc,SMT_E0120, SMT_E0120_MSG) ;
-                        return(SMT_RDF_ILLEGAL) ;
+                        return SMT_RDF_ILLEGAL;
                 }
         }
         /*
@@ -1501,15 +1499,15 @@ change_mac_para:
         default :
                 break ;
         }
-        return(0) ;
+        return 0;
 
 val_error:
         /* parameter value in frame is out of range */
-        return(SMT_RDF_RANGE) ;
+        return SMT_RDF_RANGE;
 
 len_error:
         /* parameter value in frame is too short */
-        return(SMT_RDF_LENGTH) ;
+        return SMT_RDF_LENGTH;
 
 #if     0
 no_author_error:
@@ -1518,7 +1516,7 @@ no_author_error:
          *  because SBA denied is not a valid return code in the
          * PMF protocol.
          */
-        return(SMT_RDF_AUTHOR) ;
+        return SMT_RDF_AUTHOR;
 #endif
 }
 
@@ -1527,7 +1525,7 @@ static const struct s_p_tab *smt_get_ptab(u_short para)
         const struct s_p_tab    *pt ;
         for (pt = p_tab ; pt->p_num && pt->p_num != para ; pt++)
                 ;
-        return(pt->p_num ? pt : NULL) ;
+        return pt->p_num ? pt : NULL;
 }
 
 static int smt_mib_phys(struct s_smc *smc)
@@ -1535,11 +1533,11 @@ static int smt_mib_phys(struct s_smc *smc)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
 
-        return(NUMPHYS) ;
+        return NUMPHYS;
 #else
         if (smc->s.sas == SMT_SAS)
-                return(1) ;
-        return(NUMPHYS) ;
+                return 1;
+        return NUMPHYS;
 #endif
 }
 
@@ -1548,11 +1546,11 @@ static int port_to_mib(struct s_smc *smc, int p)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
 
-        return(p) ;
+        return p;
 #else
         if (smc->s.sas == SMT_SAS)
-                return(PS) ;
-        return(p) ;
+                return PS;
+        return p;
 #endif
 }
 
diff --git a/drivers/net/skfp/queue.c b/drivers/net/skfp/queue.c
index 09adb3d68b7c..c1a0df455a59 100644
--- a/drivers/net/skfp/queue.c
+++ b/drivers/net/skfp/queue.c
@@ -128,7 +128,7 @@ u_short smt_online(struct s_smc *smc, int on)
 {
         queue_event(smc,EVENT_ECM,on ? EC_CONNECT : EC_DISCONNECT) ;
         ev_dispatcher(smc) ;
-        return(smc->mib.fddiSMTCF_State) ;
+        return smc->mib.fddiSMTCF_State;
 }
 
 /*
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 31b2dabf094c..ba2e8339fe90 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -209,7 +209,7 @@ static int skfp_init_one(struct pci_dev *pdev,
         void __iomem *mem;
         int err;
 
-        pr_debug(KERN_INFO "entering skfp_init_one\n");
+        pr_debug("entering skfp_init_one\n");
 
         if (num_boards == 0) 
                 printk("%s\n", boot_msg);
@@ -385,7 +385,7 @@ static  int skfp_driver_init(struct net_device *dev)
         skfddi_priv *bp = &smc->os;
         int err = -EIO;
 
-        pr_debug(KERN_INFO "entering skfp_driver_init\n");
+        pr_debug("entering skfp_driver_init\n");
 
         // set the io address in private structures
         bp->base_addr = dev->base_addr;
@@ -405,7 +405,7 @@ static  int skfp_driver_init(struct net_device *dev)
 
         // Determine the required size of the 'shared' memory area.
         bp->SharedMemSize = mac_drv_check_space();
-        pr_debug(KERN_INFO "Memory for HWM: %ld\n", bp->SharedMemSize);
+        pr_debug("Memory for HWM: %ld\n", bp->SharedMemSize);
         if (bp->SharedMemSize > 0) {
                 bp->SharedMemSize += 16;        // for descriptor alignment
 
@@ -429,18 +429,18 @@ static  int skfp_driver_init(struct net_device *dev)
 
         card_stop(smc);         // Reset adapter.
 
-        pr_debug(KERN_INFO "mac_drv_init()..\n");
+        pr_debug("mac_drv_init()..\n");
         if (mac_drv_init(smc) != 0) {
-                pr_debug(KERN_INFO "mac_drv_init() failed.\n");
+                pr_debug("mac_drv_init() failed\n");
                 goto fail;
         }
         read_address(smc, NULL);
-        pr_debug(KERN_INFO "HW-Addr: %pMF\n", smc->hw.fddi_canon_addr.a);
+        pr_debug("HW-Addr: %pMF\n", smc->hw.fddi_canon_addr.a);
         memcpy(dev->dev_addr, smc->hw.fddi_canon_addr.a, 6);
 
         smt_reset_defaults(smc, 0);
 
-        return (0);
+        return 0;
 
 fail:
         if (bp->SharedMemAddr) {
@@ -485,7 +485,7 @@ static int skfp_open(struct net_device *dev)
         struct s_smc *smc = netdev_priv(dev);
         int err;
 
-        pr_debug(KERN_INFO "entering skfp_open\n");
+        pr_debug("entering skfp_open\n");
         /* Register IRQ - support shared interrupts by passing device ptr */
         err = request_irq(dev->irq, skfp_interrupt, IRQF_SHARED,
                           dev->name, dev);
@@ -516,7 +516,7 @@ static int skfp_open(struct net_device *dev)
         mac_drv_rx_mode(smc, RX_DISABLE_PROMISC);
 
         netif_start_queue(dev);
-        return (0);
+        return 0;
 }                               // skfp_open
 
 
@@ -565,7 +565,7 @@ static int skfp_close(struct net_device *dev)
         skb_queue_purge(&bp->SendSkbQueue);
         bp->QueueSkb = MAX_TX_QUEUE_LEN;
 
-        return (0);
+        return 0;
 }                               // skfp_close
 
 
@@ -794,7 +794,7 @@ static struct net_device_stats *skfp_ctl_get_stats(struct net_device *dev)
         bp->stats.port_lem_cts[1] = bp->cmd_rsp_virt->cntrs_get.cntrs.link_errors[1].ls;
 
 #endif
-        return ((struct net_device_stats *) &bp->os.MacStat);
+        return (struct net_device_stats *)&bp->os.MacStat;
 }                               // ctl_get_stat
 
 
@@ -856,12 +856,12 @@ static void skfp_ctl_set_multicast_list_wo_lock(struct net_device *dev)
         /* Enable promiscuous mode, if necessary */
         if (dev->flags & IFF_PROMISC) {
                 mac_drv_rx_mode(smc, RX_ENABLE_PROMISC);
-                pr_debug(KERN_INFO "PROMISCUOUS MODE ENABLED\n");
+                pr_debug("PROMISCUOUS MODE ENABLED\n");
         }
         /* Else, update multicast address table */
         else {
                 mac_drv_rx_mode(smc, RX_DISABLE_PROMISC);
-                pr_debug(KERN_INFO "PROMISCUOUS MODE DISABLED\n");
+                pr_debug("PROMISCUOUS MODE DISABLED\n");
 
                 // Reset all MC addresses
                 mac_clear_multicast(smc);
@@ -869,7 +869,7 @@ static void skfp_ctl_set_multicast_list_wo_lock(struct net_device *dev)
 
                 if (dev->flags & IFF_ALLMULTI) {
                         mac_drv_rx_mode(smc, RX_ENABLE_ALLMULTI);
-                        pr_debug(KERN_INFO "ENABLE ALL MC ADDRESSES\n");
+                        pr_debug("ENABLE ALL MC ADDRESSES\n");
                 } else if (!netdev_mc_empty(dev)) {
                         if (netdev_mc_count(dev) <= FPMAX_MULTICAST) {
                                 /* use exact filtering */
@@ -880,18 +880,18 @@ static void skfp_ctl_set_multicast_list_wo_lock(struct net_device *dev)
                                                 (struct fddi_addr *)ha->addr,
                                                 1);
 
-                                        pr_debug(KERN_INFO "ENABLE MC ADDRESS: %pMF\n",
-                                                ha->addr);
+                                        pr_debug("ENABLE MC ADDRESS: %pMF\n",
+                                                 ha->addr);
                                 }
 
                         } else {        // more MC addresses than HW supports
 
                                 mac_drv_rx_mode(smc, RX_ENABLE_ALLMULTI);
-                                pr_debug(KERN_INFO "ENABLE ALL MC ADDRESSES\n");
+                                pr_debug("ENABLE ALL MC ADDRESSES\n");
                         }
                 } else {        // no MC addresses
 
-                        pr_debug(KERN_INFO "DISABLE ALL MC ADDRESSES\n");
+                        pr_debug("DISABLE ALL MC ADDRESSES\n");
                 }
 
                 /* Update adapter filters */
@@ -932,7 +932,7 @@ static int skfp_ctl_set_mac_address(struct net_device *dev, void *addr)
         ResetAdapter(smc);
         spin_unlock_irqrestore(&bp->DriverLock, Flags);
 
-        return (0);             /* always return zero */
+        return 0;               /* always return zero */
 }                               // skfp_ctl_set_mac_address
 
 
@@ -1045,7 +1045,7 @@ static netdev_tx_t skfp_send_pkt(struct sk_buff *skb,
         struct s_smc *smc = netdev_priv(dev);
         skfddi_priv *bp = &smc->os;
 
-        pr_debug(KERN_INFO "skfp_send_pkt\n");
+        pr_debug("skfp_send_pkt\n");
 
         /*
          * Verify that incoming transmit request is OK
@@ -1114,13 +1114,13 @@ static void send_queued_packets(struct s_smc *smc)
 
         int frame_status;       // HWM tx frame status.
 
-        pr_debug(KERN_INFO "send queued packets\n");
+        pr_debug("send queued packets\n");
         for (;;) {
                 // send first buffer from queue
                 skb = skb_dequeue(&bp->SendSkbQueue);
 
                 if (!skb) {
-                        pr_debug(KERN_INFO "queue empty\n");
+                        pr_debug("queue empty\n");
                         return;
                 }               // queue empty !
 
@@ -1232,7 +1232,7 @@ static void CheckSourceAddress(unsigned char *frame, unsigned char *hw_addr)
 static void ResetAdapter(struct s_smc *smc)
 {
 
-        pr_debug(KERN_INFO "[fddi: ResetAdapter]\n");
+        pr_debug("[fddi: ResetAdapter]\n");
 
         // Stop the adapter.
 
@@ -1278,7 +1278,7 @@ void llc_restart_tx(struct s_smc *smc)
 {
         skfddi_priv *bp = &smc->os;
 
-        pr_debug(KERN_INFO "[llc_restart_tx]\n");
+        pr_debug("[llc_restart_tx]\n");
 
         // Try to send queued packets
         spin_unlock(&bp->DriverLock);
@@ -1308,21 +1308,21 @@ void *mac_drv_get_space(struct s_smc *smc, unsigned int size)
 {
         void *virt;
 
-        pr_debug(KERN_INFO "mac_drv_get_space (%d bytes), ", size);
+        pr_debug("mac_drv_get_space (%d bytes), ", size);
         virt = (void *) (smc->os.SharedMemAddr + smc->os.SharedMemHeap);
 
         if ((smc->os.SharedMemHeap + size) > smc->os.SharedMemSize) {
                 printk("Unexpected SMT memory size requested: %d\n", size);
-                return (NULL);
+                return NULL;
         }
         smc->os.SharedMemHeap += size;  // Move heap pointer.
 
-        pr_debug(KERN_INFO "mac_drv_get_space end\n");
-        pr_debug(KERN_INFO "virt addr: %lx\n", (ulong) virt);
-        pr_debug(KERN_INFO "bus  addr: %lx\n", (ulong)
+        pr_debug("mac_drv_get_space end\n");
+        pr_debug("virt addr: %lx\n", (ulong) virt);
+        pr_debug("bus  addr: %lx\n", (ulong)
                (smc->os.SharedMemDMA +
                 ((char *) virt - (char *)smc->os.SharedMemAddr)));
-        return (virt);
+        return virt;
 }                               // mac_drv_get_space
 
 
@@ -1349,7 +1349,7 @@ void *mac_drv_get_desc_mem(struct s_smc *smc, unsigned int size)
 
         char *virt;
 
-        pr_debug(KERN_INFO "mac_drv_get_desc_mem\n");
+        pr_debug("mac_drv_get_desc_mem\n");
 
         // Descriptor memory must be aligned on 16-byte boundary.
 
@@ -1363,9 +1363,9 @@ void *mac_drv_get_desc_mem(struct s_smc *smc, unsigned int size)
 
         if (!mac_drv_get_space(smc, size)) {
                 printk("fddi: Unable to align descriptor memory.\n");
-                return (NULL);
+                return NULL;
         }
-        return (virt + size);
+        return virt + size;
 }                               // mac_drv_get_desc_mem
 
 
@@ -1384,8 +1384,8 @@ void *mac_drv_get_desc_mem(struct s_smc *smc, unsigned int size)
  ************************/
 unsigned long mac_drv_virt2phys(struct s_smc *smc, void *virt)
 {
-        return (smc->os.SharedMemDMA +
-                ((char *) virt - (char *)smc->os.SharedMemAddr));
+        return smc->os.SharedMemDMA +
+                ((char *) virt - (char *)smc->os.SharedMemAddr);
 }                               // mac_drv_virt2phys
 
 
@@ -1419,8 +1419,8 @@ unsigned long mac_drv_virt2phys(struct s_smc *smc, void *virt)
  ************************/
 u_long dma_master(struct s_smc * smc, void *virt, int len, int flag)
 {
-        return (smc->os.SharedMemDMA +
-                ((char *) virt - (char *)smc->os.SharedMemAddr));
+        return smc->os.SharedMemDMA +
+                ((char *) virt - (char *)smc->os.SharedMemAddr);
 }                               // dma_master
 
 
@@ -1493,7 +1493,7 @@ void mac_drv_tx_complete(struct s_smc *smc, volatile struct s_smt_fp_txd *txd)
 {
         struct sk_buff *skb;
 
-        pr_debug(KERN_INFO "entering mac_drv_tx_complete\n");
+        pr_debug("entering mac_drv_tx_complete\n");
         // Check if this TxD points to a skb
 
         if (!(skb = txd->txd_os.skb)) {
@@ -1513,7 +1513,7 @@ void mac_drv_tx_complete(struct s_smc *smc, volatile struct s_smt_fp_txd *txd)
         // free the skb
         dev_kfree_skb_irq(skb);
 
-        pr_debug(KERN_INFO "leaving mac_drv_tx_complete\n");
+        pr_debug("leaving mac_drv_tx_complete\n");
 }                               // mac_drv_tx_complete
 
 
@@ -1580,7 +1580,7 @@ void mac_drv_rx_complete(struct s_smc *smc, volatile struct s_smt_fp_rxd *rxd,
         unsigned short ri;
         u_int RifLength;
 
-        pr_debug(KERN_INFO "entering mac_drv_rx_complete (len=%d)\n", len);
+        pr_debug("entering mac_drv_rx_complete (len=%d)\n", len);
         if (frag_count != 1) {  // This is not allowed to happen.
 
                 printk("fddi: Multi-fragment receive!\n");
@@ -1589,7 +1589,7 @@ void mac_drv_rx_complete(struct s_smc *smc, volatile struct s_smt_fp_rxd *rxd,
         }
         skb = rxd->rxd_os.skb;
         if (!skb) {
-                pr_debug(KERN_INFO "No skb in rxd\n");
+                pr_debug("No skb in rxd\n");
                 smc->os.MacStat.gen.rx_errors++;
                 goto RequeueRxd;
         }
@@ -1619,7 +1619,7 @@ void mac_drv_rx_complete(struct s_smc *smc, volatile struct s_smt_fp_rxd *rxd,
         else {
                 int n;
 // goos: RIF removal has still to be tested
-                pr_debug(KERN_INFO "RIF found\n");
+                pr_debug("RIF found\n");
                 // Get RIF length from Routing Control (RC) field.
                 cp = virt + FDDI_MAC_HDR_LEN;   // Point behind MAC header.
 
@@ -1664,7 +1664,7 @@ void mac_drv_rx_complete(struct s_smc *smc, volatile struct s_smt_fp_rxd *rxd,
         return;
 
       RequeueRxd:
-        pr_debug(KERN_INFO "Rx: re-queue RXD.\n");
+        pr_debug("Rx: re-queue RXD.\n");
         mac_drv_requeue_rxd(smc, rxd, frag_count);
         smc->os.MacStat.gen.rx_errors++;        // Count receive packets
                                                 // not indicated.
@@ -1775,7 +1775,7 @@ void mac_drv_fill_rxd(struct s_smc *smc)
         struct sk_buff *skb;
         volatile struct s_smt_fp_rxd *rxd;
 
-        pr_debug(KERN_INFO "entering mac_drv_fill_rxd\n");
+        pr_debug("entering mac_drv_fill_rxd\n");
 
         // Walk through the list of free receive buffers, passing receive
         // buffers to the HWM as long as RXDs are available.
@@ -1783,7 +1783,7 @@ void mac_drv_fill_rxd(struct s_smc *smc)
         MaxFrameSize = smc->os.MaxFrameSize;
         // Check if there is any RXD left.
         while (HWM_GET_RX_FREE(smc) > 0) {
-                pr_debug(KERN_INFO ".\n");
+                pr_debug(".\n");
 
                 rxd = HWM_GET_CURR_RXD(smc);
                 skb = alloc_skb(MaxFrameSize + 3, GFP_ATOMIC);
@@ -1814,7 +1814,7 @@ void mac_drv_fill_rxd(struct s_smc *smc)
                 hwm_rx_frag(smc, v_addr, b_addr, MaxFrameSize,
                             FIRST_FRAG | LAST_FRAG);
         }
-        pr_debug(KERN_INFO "leaving mac_drv_fill_rxd\n");
+        pr_debug("leaving mac_drv_fill_rxd\n");
 }                               // mac_drv_fill_rxd
 
 
@@ -1904,12 +1904,12 @@ int mac_drv_rx_init(struct s_smc *smc, int len, int fc,
                 pr_debug("fddi: Discard invalid local SMT frame\n");
                 pr_debug("  len=%d, la_len=%d, (ULONG) look_ahead=%08lXh.\n",
                        len, la_len, (unsigned long) look_ahead);
-                return (0);
+                return 0;
         }
         skb = alloc_skb(len + 3, GFP_ATOMIC);
         if (!skb) {
                 pr_debug("fddi: Local SMT: skb memory exhausted.\n");
-                return (0);
+                return 0;
         }
         skb_reserve(skb, 3);
         skb_put(skb, len);
@@ -1919,7 +1919,7 @@ int mac_drv_rx_init(struct s_smc *smc, int len, int fc,
         skb->protocol = fddi_type_trans(skb, smc->os.dev);
         netif_rx(skb);
 
-        return (0);
+        return 0;
 }                               // mac_drv_rx_init
 
 
@@ -2034,17 +2034,17 @@ void smt_stat_counter(struct s_smc *smc, int stat)
 {
 //      BOOLEAN RingIsUp ;
 
-        pr_debug(KERN_INFO "smt_stat_counter\n");
+        pr_debug("smt_stat_counter\n");
         switch (stat) {
         case 0:
-                pr_debug(KERN_INFO "Ring operational change.\n");
+                pr_debug("Ring operational change.\n");
                 break;
         case 1:
-                pr_debug(KERN_INFO "Receive fifo overflow.\n");
+                pr_debug("Receive fifo overflow.\n");
                 smc->os.MacStat.gen.rx_errors++;
                 break;
         default:
-                pr_debug(KERN_INFO "Unknown status (%d).\n", stat);
+                pr_debug("Unknown status (%d).\n", stat);
                 break;
         }
 }                               // smt_stat_counter
@@ -2100,10 +2100,10 @@ void cfm_state_change(struct s_smc *smc, int c_state)
                 s = "SC11_C_WRAP_S";
                 break;
         default:
-                pr_debug(KERN_INFO "cfm_state_change: unknown %d\n", c_state);
+                pr_debug("cfm_state_change: unknown %d\n", c_state);
                 return;
         }
-        pr_debug(KERN_INFO "cfm_state_change: %s\n", s);
+        pr_debug("cfm_state_change: %s\n", s);
 #endif                          // DRIVERDEBUG
 }                               // cfm_state_change
 
@@ -2158,7 +2158,7 @@ void ecm_state_change(struct s_smc *smc, int e_state)
                 s = "unknown";
                 break;
         }
-        pr_debug(KERN_INFO "ecm_state_change: %s\n", s);
+        pr_debug("ecm_state_change: %s\n", s);
 #endif                          //DRIVERDEBUG
 }                               // ecm_state_change
 
@@ -2213,7 +2213,7 @@ void rmt_state_change(struct s_smc *smc, int r_state)
                 s = "unknown";
                 break;
         }
-        pr_debug(KERN_INFO "[rmt_state_change: %s]\n", s);
+        pr_debug("[rmt_state_change: %s]\n", s);
 #endif                          // DRIVERDEBUG
 }                               // rmt_state_change
 
@@ -2233,7 +2233,7 @@ void rmt_state_change(struct s_smc *smc, int r_state)
  ************************/
 void drv_reset_indication(struct s_smc *smc)
 {
-        pr_debug(KERN_INFO "entering drv_reset_indication\n");
+        pr_debug("entering drv_reset_indication\n");
 
         smc->os.ResetRequested = TRUE;  // Set flag.
 
diff --git a/drivers/net/skfp/smt.c b/drivers/net/skfp/smt.c
index 6f35bb77595f..2d9941c045bc 100644
--- a/drivers/net/skfp/smt.c
+++ b/drivers/net/skfp/smt.c
@@ -127,22 +127,22 @@ static inline int is_my_addr(const struct s_smc *smc,
 
 static inline int is_broadcast(const struct fddi_addr *addr)
 {
-        return(*(u_short *)(&addr->a[0]) == 0xffff &&
+        return *(u_short *)(&addr->a[0]) == 0xffff &&
                *(u_short *)(&addr->a[2]) == 0xffff &&
-               *(u_short *)(&addr->a[4]) == 0xffff ) ;
+               *(u_short *)(&addr->a[4]) == 0xffff;
 }
 
 static inline int is_individual(const struct fddi_addr *addr)
 {
-        return(!(addr->a[0] & GROUP_ADDR)) ;
+        return !(addr->a[0] & GROUP_ADDR);
 }
 
 static inline int is_equal(const struct fddi_addr *addr1, 
                            const struct fddi_addr *addr2)
 {
-        return(*(u_short *)(&addr1->a[0]) == *(u_short *)(&addr2->a[0]) &&
+        return *(u_short *)(&addr1->a[0]) == *(u_short *)(&addr2->a[0]) &&
                *(u_short *)(&addr1->a[2]) == *(u_short *)(&addr2->a[2]) &&
-               *(u_short *)(&addr1->a[4]) == *(u_short *)(&addr2->a[4]) ) ;
+               *(u_short *)(&addr1->a[4]) == *(u_short *)(&addr2->a[4]);
 }
 
 /*
@@ -457,8 +457,8 @@ static int div_ratio(u_long upper, u_long lower)
         else
                 upper <<= 16L ;
         if (!lower)
-                return(0) ;
-        return((int)(upper/lower)) ;
+                return 0;
+        return (int)(upper/lower) ;
 }
 
 #ifndef SLIM_SMT
@@ -1111,11 +1111,11 @@ SMbuf *smt_build_frame(struct s_smc *smc, int class, int type,
 
 #if     0
         if (!smc->r.sm_ma_avail) {
-                return(0) ;
+                return 0;
         }
 #endif
         if (!(mb = smt_get_mbuf(smc)))
-                return(mb) ;
+                return mb;
 
         mb->sm_len = length ;
         smt = smtod(mb, struct smt_header *) ;
@@ -1136,7 +1136,7 @@ SMbuf *smt_build_frame(struct s_smc *smc, int class, int type,
         smt->smt_tid = smt_get_tid(smc) ;       /* set transaction ID */
         smt->smt_pad = 0 ;
         smt->smt_len = length - sizeof(struct smt_header) ;
-        return(mb) ;
+        return mb;
 }
 
 static void smt_add_frame_len(SMbuf *mb, int len)
@@ -1375,7 +1375,7 @@ static int smt_fill_path(struct s_smc *smc, struct smt_p_path *path)
         pd_mac = (struct smt_mac_rec *) phy ;
         pd_mac->mac_addr = smc->mib.m[MAC0].fddiMACSMTAddress ;
         pd_mac->mac_resource_idx = mac_con_resource_index(smc,1) ;
-        return(len) ;
+        return len;
 }
 
 /*
@@ -1563,7 +1563,7 @@ u_long smt_get_tid(struct s_smc *smc)
         u_long  tid ;
         while ((tid = ++(smc->sm.smt_tid) ^ SMT_TID_MAGIC) == 0)
                 ;
-        return(tid & 0x3fffffffL) ;
+        return tid & 0x3fffffffL;
 }
 
 
@@ -1654,11 +1654,11 @@ int smt_check_para(struct s_smc *smc, struct smt_header	*sm,
         while (*p) {
                 if (!sm_to_para(smc,sm,(int) *p)) {
                         DB_SMT("SMT: smt_check_para - missing para %x\n",*p,0);
-                        return(-1) ;
+                        return -1;
                 }
                 p++ ;
         }
-        return(0) ;
+        return 0;
 }
 
 void *sm_to_para(struct s_smc *smc, struct smt_header *sm, int para)
@@ -1687,7 +1687,7 @@ void *sm_to_para(struct s_smc *smc, struct smt_header *sm, int para)
                         return NULL;
                 }
                 if (found)
-                        return(found) ;
+                        return found;
         }
         return NULL;
 }
@@ -1732,7 +1732,7 @@ char *addr_to_string(struct fddi_addr *addr)
                 string[i * 3 + 2] = ':';
         }
         string[5 * 3 + 2] = 0;
-        return(string);
+        return string;
 }
 #endif
 
@@ -1742,9 +1742,9 @@ int smt_ifconfig(int argc, char *argv[])
         if (argc >= 2 && !strcmp(argv[0],"opt_bypass") &&
             !strcmp(argv[1],"yes")) {
                 smc->mib.fddiSMTBypassPresent = 1 ;
-                return(0) ;
+                return 0;
         }
-        return(amdfddi_config(0,argc,argv)) ;
+        return amdfddi_config(0, argc, argv);
 }
 #endif
 
@@ -1756,9 +1756,9 @@ static int mac_index(struct s_smc *smc, int mac)
         SK_UNUSED(mac) ;
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
-        return(NUMPHYS+1) ;
+        return NUMPHYS + 1;
 #else
-        return((smc->s.sas == SMT_SAS) ? 2 : 3) ;
+        return (smc->s.sas == SMT_SAS) ? 2 : 3;
 #endif
 }
 
@@ -1768,7 +1768,7 @@ static int mac_index(struct s_smc *smc, int mac)
 static int phy_index(struct s_smc *smc, int phy)
 {
         SK_UNUSED(smc) ;
-        return(phy+1);
+        return phy + 1;
 }
 
 /*
@@ -1779,19 +1779,19 @@ static int mac_con_resource_index(struct s_smc *smc, int mac)
 #ifdef  CONCENTRATOR
         SK_UNUSED(smc) ;
         SK_UNUSED(mac) ;
-        return(entity_to_index(smc,cem_get_downstream(smc,ENTITY_MAC))) ;
+        return entity_to_index(smc, cem_get_downstream(smc, ENTITY_MAC));
 #else
         SK_UNUSED(mac) ;
         switch (smc->mib.fddiSMTCF_State) {
         case SC9_C_WRAP_A :
         case SC5_THRU_B :
         case SC11_C_WRAP_S :
-                return(1) ;
+                return 1;
         case SC10_C_WRAP_B :
         case SC4_THRU_A :
-                return(2) ;
+                return 2;
         }
-        return(smc->s.sas == SMT_SAS ? 2 : 3) ;
+        return smc->s.sas == SMT_SAS ? 2 : 3;
 #endif
 }
 
@@ -1801,21 +1801,21 @@ static int mac_con_resource_index(struct s_smc *smc, int mac)
 static int phy_con_resource_index(struct s_smc *smc, int phy)
 {
 #ifdef  CONCENTRATOR
-        return(entity_to_index(smc,cem_get_downstream(smc,ENTITY_PHY(phy)))) ;
+        return entity_to_index(smc, cem_get_downstream(smc, ENTITY_PHY(phy))) ;
 #else
         switch (smc->mib.fddiSMTCF_State) {
         case SC9_C_WRAP_A :
-                return(phy == PA ? 3 : 2) ;
+                return phy == PA ? 3 : 2;
         case SC10_C_WRAP_B :
-                return(phy == PA ? 1 : 3) ;
+                return phy == PA ? 1 : 3;
         case SC4_THRU_A :
-                return(phy == PA ? 3 : 1) ;
+                return phy == PA ? 3 : 1;
         case SC5_THRU_B :
-                return(phy == PA ? 2 : 3) ;
+                return phy == PA ? 2 : 3;
         case SC11_C_WRAP_S :
-                return(2) ;
+                return 2;
         }
-        return(phy) ;
+        return phy;
 #endif
 }
 
@@ -1823,16 +1823,16 @@ static int phy_con_resource_index(struct s_smc *smc, int phy)
 static int entity_to_index(struct s_smc *smc, int e)
 {
         if (e == ENTITY_MAC)
-                return(mac_index(smc,1)) ;
+                return mac_index(smc, 1);
         else
-                return(phy_index(smc,e - ENTITY_PHY(0))) ;
+                return phy_index(smc, e - ENTITY_PHY(0));
 }
 #endif
 
 #ifdef  LITTLE_ENDIAN
 static int smt_swap_short(u_short s)
 {
-        return(((s>>8)&0xff)|((s&0xff)<<8)) ;
+        return ((s>>8)&0xff) | ((s&0xff)<<8);
 }
 
 void smt_swap_para(struct smt_header *sm, int len, int direction)
@@ -1996,7 +1996,7 @@ int smt_action(struct s_smc *smc, int class, int code, int index)
                         }
                         break ;
                 default :
-                        return(1) ;
+                        return 1;
                 }
                 break ;
         case SMT_PORT_ACTION :
@@ -2017,14 +2017,14 @@ int smt_action(struct s_smc *smc, int class, int code, int index)
                         event = PC_STOP ;
                         break ;
                 default :
-                        return(1) ;
+                        return 1;
                 }
                 queue_event(smc,EVENT_PCM+index,event) ;
                 break ;
         default :
-                return(1) ;
+                return 1;
         }
-        return(0) ;
+        return 0;
 }
 
 /*
diff --git a/drivers/net/skfp/smtdef.c b/drivers/net/skfp/smtdef.c
index 4e07ff7073f1..1acab0b368e3 100644
--- a/drivers/net/skfp/smtdef.c
+++ b/drivers/net/skfp/smtdef.c
@@ -303,7 +303,7 @@ int smt_set_mac_opvalues(struct s_smc *smc)
                         FDDI_SMT_EVENT, (u_long) FDDI_REMOTE_T_REQ,
                         smt_get_event_word(smc));
         }
-        return(st) ;
+        return st;
 }
 
 void smt_fixup_mib(struct s_smc *smc)
@@ -350,6 +350,6 @@ static int set_min_max(int maxflag, u_long mib, u_long limit, u_long *oper)
                 *oper = limit ;
         else
                 *oper = mib ;
-        return(old != *oper) ;
+        return old != *oper;
 }
 
diff --git a/drivers/net/skfp/smtinit.c b/drivers/net/skfp/smtinit.c
index 3c8964ce1837..e3a0c0bc2233 100644
--- a/drivers/net/skfp/smtinit.c
+++ b/drivers/net/skfp/smtinit.c
@@ -120,6 +120,6 @@ int init_smt(struct s_smc *smc, u_char *mac_addr)
 
         PNMI_INIT(smc) ;                /* PNMI initialization */
 
-        return(0) ;
+        return 0;
 }
 
diff --git a/drivers/net/skfp/srf.c b/drivers/net/skfp/srf.c
index 40882b3faba6..f6f7baf9f27a 100644
--- a/drivers/net/skfp/srf.c
+++ b/drivers/net/skfp/srf.c
@@ -165,7 +165,7 @@ static struct s_srf_evc *smt_get_evc(struct s_smc *smc, int code, int index)
 
         for (i = 0, evc = smc->evcs ; (unsigned) i < MAX_EVCS ; i++, evc++) {
                 if (evc->evc_code == code && evc->evc_index == index)
-                        return(evc) ;
+                        return evc;
         }
         return NULL;
 }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..a8a63581d63d 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3178,8 +3178,7 @@ static int skge_poll(struct napi_struct *napi, int to_do)
 
                 skb = skge_rx_get(dev, e, control, rd->status, rd->csum2);
                 if (likely(skb)) {
-                        netif_receive_skb(skb);
-
+                        napi_gro_receive(napi, skb);
                         ++work_done;
                 }
         }
@@ -3192,6 +3191,7 @@ static int skge_poll(struct napi_struct *napi, int to_do)
         if (work_done < to_do) {
                 unsigned long flags;
 
+                napi_gro_flush(napi);
                 spin_lock_irqsave(&hw->hw_lock, flags);
                 __napi_complete(napi);
                 hw->intr_mask |= napimask[skge->port];
@@ -3849,6 +3849,7 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
                 dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
                 skge->rx_csum = 1;
         }
+        dev->features |= NETIF_F_GRO;
 
         /* read the mac address */
         memcpy_fromio(dev->dev_addr, hw->regs + B2_MAC_1 + port*8, ETH_ALEN);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 194e5cf8c763..3ef9b67ac6e6 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -4581,7 +4581,8 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
 
         sky2->port = port;
 
-        dev->features |= NETIF_F_TSO | NETIF_F_IP_CSUM | NETIF_F_SG;
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG
+                | NETIF_F_TSO  | NETIF_F_GRO;
         if (highmem)
                 dev->features |= NETIF_F_HIGHDMA;
 
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index fa434fb8fb7c..86cbb9ea2f26 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -271,7 +271,7 @@ static int sl_realloc_bufs(struct slip *sl, int mtu)
                         memcpy(sl->xbuff, sl->xhead, sl->xleft);
                 } else  {
                         sl->xleft = 0;
-                        sl->tx_dropped++;
+                        dev->stats.tx_dropped++;
                 }
         }
         sl->xhead = sl->xbuff;
@@ -281,7 +281,7 @@ static int sl_realloc_bufs(struct slip *sl, int mtu)
                         memcpy(sl->rbuff, rbuff, sl->rcount);
                 } else  {
                         sl->rcount = 0;
-                        sl->rx_over_errors++;
+                        dev->stats.rx_over_errors++;
                         set_bit(SLF_ERROR, &sl->flags);
                 }
         }
@@ -319,6 +319,7 @@ static inline void sl_unlock(struct slip *sl)
 /* Send one completely decapsulated IP datagram to the IP layer. */
 static void sl_bump(struct slip *sl)
 {
+        struct net_device *dev = sl->dev;
         struct sk_buff *skb;
         int count;
 
@@ -329,13 +330,13 @@ static void sl_bump(struct slip *sl)
                 if (c & SL_TYPE_COMPRESSED_TCP) {
                         /* ignore compressed packets when CSLIP is off */
                         if (!(sl->mode & SL_MODE_CSLIP)) {
-                                printk(KERN_WARNING "%s: compressed packet ignored\n", sl->dev->name);
+                                printk(KERN_WARNING "%s: compressed packet ignored\n", dev->name);
                                 return;
                         }
                         /* make sure we've reserved enough space for uncompress
                            to use */
                         if (count + 80 > sl->buffsize) {
-                                sl->rx_over_errors++;
+                                dev->stats.rx_over_errors++;
                                 return;
                         }
                         count = slhc_uncompress(sl->slcomp, sl->rbuff, count);
@@ -346,7 +347,7 @@ static void sl_bump(struct slip *sl)
                                 /* turn on header compression */
                                 sl->mode |= SL_MODE_CSLIP;
                                 sl->mode &= ~SL_MODE_ADAPTIVE;
-                                printk(KERN_INFO "%s: header compression turned on\n", sl->dev->name);
+                                printk(KERN_INFO "%s: header compression turned on\n", dev->name);
                         }
                         sl->rbuff[0] &= 0x4f;
                         if (slhc_remember(sl->slcomp, sl->rbuff, count) <= 0)
@@ -355,20 +356,20 @@ static void sl_bump(struct slip *sl)
         }
 #endif  /* SL_INCLUDE_CSLIP */
 
-        sl->rx_bytes += count;
+        dev->stats.rx_bytes += count;
 
         skb = dev_alloc_skb(count);
         if (skb == NULL) {
-                printk(KERN_WARNING "%s: memory squeeze, dropping packet.\n", sl->dev->name);
-                sl->rx_dropped++;
+                printk(KERN_WARNING "%s: memory squeeze, dropping packet.\n", dev->name);
+                dev->stats.rx_dropped++;
                 return;
         }
-        skb->dev = sl->dev;
+        skb->dev = dev;
         memcpy(skb_put(skb, count), sl->rbuff, count);
         skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IP);
         netif_rx(skb);
-        sl->rx_packets++;
+        dev->stats.rx_packets++;
 }
 
 /* Encapsulate one IP datagram and stuff into a TTY queue. */
@@ -379,7 +380,7 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
 
         if (len > sl->mtu) {            /* Sigh, shouldn't occur BUT ... */
                 printk(KERN_WARNING "%s: truncating oversized transmit packet!\n", sl->dev->name);
-                sl->tx_dropped++;
+                sl->dev->stats.tx_dropped++;
                 sl_unlock(sl);
                 return;
         }
@@ -433,7 +434,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
-                sl->tx_packets++;
+                sl->dev->stats.tx_packets++;
                 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
                 sl_unlock(sl);
                 return;
@@ -496,7 +497,7 @@ sl_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         sl_lock(sl);
-        sl->tx_bytes += skb->len;
+        dev->stats.tx_bytes += skb->len;
         sl_encaps(sl, skb->data, skb->len);
         spin_unlock(&sl->lock);
 
@@ -558,39 +559,39 @@ static int sl_change_mtu(struct net_device *dev, int new_mtu)
 
 /* Netdevice get statistics request */
 
-static struct net_device_stats *
-sl_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *
+sl_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
-        static struct net_device_stats stats;
-        struct slip *sl = netdev_priv(dev);
+        struct net_device_stats *devstats = &dev->stats;
+        unsigned long c_rx_dropped = 0;
 #ifdef SL_INCLUDE_CSLIP
-        struct slcompress *comp;
-#endif
+        unsigned long c_rx_fifo_errors = 0;
+        unsigned long c_tx_fifo_errors = 0;
+        unsigned long c_collisions = 0;
+        struct slip *sl = netdev_priv(dev);
+        struct slcompress *comp = sl->slcomp;
 
-        memset(&stats, 0, sizeof(struct net_device_stats));
-
-        stats.rx_packets     = sl->rx_packets;
-        stats.tx_packets     = sl->tx_packets;
-        stats.rx_bytes       = sl->rx_bytes;
-        stats.tx_bytes       = sl->tx_bytes;
-        stats.rx_dropped     = sl->rx_dropped;
-        stats.tx_dropped     = sl->tx_dropped;
-        stats.tx_errors      = sl->tx_errors;
-        stats.rx_errors      = sl->rx_errors;
-        stats.rx_over_errors = sl->rx_over_errors;
-#ifdef SL_INCLUDE_CSLIP
-        stats.rx_fifo_errors = sl->rx_compressed;
-        stats.tx_fifo_errors = sl->tx_compressed;
-        stats.collisions     = sl->tx_misses;
-        comp = sl->slcomp;
         if (comp) {
-                stats.rx_fifo_errors += comp->sls_i_compressed;
-                stats.rx_dropped     += comp->sls_i_tossed;
-                stats.tx_fifo_errors += comp->sls_o_compressed;
-                stats.collisions     += comp->sls_o_misses;
+                c_rx_fifo_errors = comp->sls_i_compressed;
+                c_rx_dropped     = comp->sls_i_tossed;
+                c_tx_fifo_errors = comp->sls_o_compressed;
+                c_collisions     = comp->sls_o_misses;
         }
-#endif /* CONFIG_INET */
-        return (&stats);
+        stats->rx_fifo_errors = sl->rx_compressed + c_rx_fifo_errors;
+        stats->tx_fifo_errors = sl->tx_compressed + c_tx_fifo_errors;
+        stats->collisions     = sl->tx_misses + c_collisions;
+#endif
+        stats->rx_packets     = devstats->rx_packets;
+        stats->tx_packets     = devstats->tx_packets;
+        stats->rx_bytes       = devstats->rx_bytes;
+        stats->tx_bytes       = devstats->tx_bytes;
+        stats->rx_dropped     = devstats->rx_dropped + c_rx_dropped;
+        stats->tx_dropped     = devstats->tx_dropped;
+        stats->tx_errors      = devstats->tx_errors;
+        stats->rx_errors      = devstats->rx_errors;
+        stats->rx_over_errors = devstats->rx_over_errors;
+
+        return stats;
 }
 
 /* Netdevice register callback */
@@ -633,7 +634,7 @@ static const struct net_device_ops sl_netdev_ops = {
         .ndo_open               = sl_open,
         .ndo_stop               = sl_close,
         .ndo_start_xmit         = sl_xmit,
-        .ndo_get_stats          = sl_get_stats,
+        .ndo_get_stats64        = sl_get_stats64,
         .ndo_change_mtu         = sl_change_mtu,
         .ndo_tx_timeout         = sl_tx_timeout,
 #ifdef CONFIG_SLIP_SMART
@@ -681,7 +682,7 @@ static void slip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
         while (count--) {
                 if (fp && *fp++) {
                         if (!test_and_set_bit(SLF_ERROR, &sl->flags))
-                                sl->rx_errors++;
+                                sl->dev->stats.rx_errors++;
                         cp++;
                         continue;
                 }
@@ -943,7 +944,7 @@ static int slip_esc(unsigned char *s, unsigned char *d, int len)
                 }
         }
         *ptr++ = END;
-        return (ptr - d);
+        return ptr - d;
 }
 
 static void slip_unesc(struct slip *sl, unsigned char s)
@@ -981,7 +982,7 @@ static void slip_unesc(struct slip *sl, unsigned char s)
                         sl->rbuff[sl->rcount++] = s;
                         return;
                 }
-                sl->rx_over_errors++;
+                sl->dev->stats.rx_over_errors++;
                 set_bit(SLF_ERROR, &sl->flags);
         }
 }
@@ -1057,7 +1058,7 @@ static void slip_unesc6(struct slip *sl, unsigned char s)
                                         sl->rbuff[sl->rcount++] = c;
                                         return;
                                 }
-                                sl->rx_over_errors++;
+                                sl->dev->stats.rx_over_errors++;
                                 set_bit(SLF_ERROR, &sl->flags);
                         }
                 }
diff --git a/drivers/net/slip.h b/drivers/net/slip.h
index 9ea5c11287d2..914e958abbfc 100644
--- a/drivers/net/slip.h
+++ b/drivers/net/slip.h
@@ -67,15 +67,6 @@ struct slip {
   int                   xleft;          /* bytes left in XMIT queue     */
 
   /* SLIP interface statistics. */
-  unsigned long         rx_packets;     /* inbound frames counter       */
-  unsigned long         tx_packets;     /* outbound frames counter      */
-  unsigned long         rx_bytes;       /* inbound byte counte          */
-  unsigned long         tx_bytes;       /* outbound byte counter        */
-  unsigned long         rx_errors;      /* Parity, etc. errors          */
-  unsigned long         tx_errors;      /* Planned stuff                */
-  unsigned long         rx_dropped;     /* No memory for skb            */
-  unsigned long         tx_dropped;     /* When MTU change              */
-  unsigned long         rx_over_errors; /* Frame bigger than SLIP buf.  */
 #ifdef SL_INCLUDE_CSLIP
   unsigned long         tx_compressed;
   unsigned long         rx_compressed;
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 8150ba154116..a8e5856ce882 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1049,7 +1049,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
                 smsc911x_rx_readfifo(pdata, (unsigned int *)skb->head,
                                      pktwords);
                 skb->protocol = eth_type_trans(skb, dev);
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
                 netif_receive_skb(skb);
 
                 /* Update counters */
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 1636a34d95dd..cb6bcca9d541 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -1000,9 +1000,9 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
                      !(data_error & SPIDER_NET_DATA_ERR_CKSUM_MASK))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
         } else
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
 
         if (data_status & SPIDER_NET_VLAN_PACKET) {
                 /* further enhancements: HW-accel VLAN
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index a42b6873370b..4adf12422787 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -148,7 +148,7 @@ static int full_duplex[MAX_UNITS] = {0, };
  * This SUCKS.
  * We need a much better method to determine if dma_addr_t is 64-bit.
  */
-#if (defined(__i386__) && defined(CONFIG_HIGHMEM64G)) || defined(__x86_64__) || defined (__ia64__) || defined(__alpha__) || defined(__mips64__) || (defined(__mips__) && defined(CONFIG_HIGHMEM) && defined(CONFIG_64BIT_PHYS_ADDR))
+#if (defined(__i386__) && defined(CONFIG_HIGHMEM64G)) || defined(__x86_64__) || defined (__ia64__) || defined(__alpha__) || defined(__mips64__) || (defined(__mips__) && defined(CONFIG_HIGHMEM) && defined(CONFIG_64BIT_PHYS_ADDR)) || (defined(__powerpc64__) || defined(CONFIG_PHYS_64BIT))
 /* 64-bit dma_addr_t */
 #define ADDR_64BITS     /* This chip uses 64 bit addresses. */
 #define netdrv_addr_t __le64
@@ -302,7 +302,7 @@ enum chipset {
 };
 
 static DEFINE_PCI_DEVICE_TABLE(starfire_pci_tbl) = {
-        { 0x9004, 0x6915, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_6915 },
+        { PCI_VDEVICE(ADAPTEC, 0x6915), CH_6915 },
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, starfire_pci_tbl);
@@ -2078,11 +2078,7 @@ static int __init starfire_init (void)
         printk(KERN_INFO DRV_NAME ": polling (NAPI) enabled\n");
 #endif
 
-        /* we can do this test only at run-time... sigh */
-        if (sizeof(dma_addr_t) != sizeof(netdrv_addr_t)) {
-                printk("This driver has dma_addr_t issues, please send email to maintainer\n");
-                return -ENODEV;
-        }
+        BUILD_BUG_ON(sizeof(dma_addr_t) != sizeof(netdrv_addr_t));
 
         return pci_register_driver(&starfire_driver);
 }
diff --git a/drivers/net/stmmac/Kconfig b/drivers/net/stmmac/Kconfig
index eb63d44748a7..3c2af7c6a39b 100644
--- a/drivers/net/stmmac/Kconfig
+++ b/drivers/net/stmmac/Kconfig
@@ -3,10 +3,10 @@ config STMMAC_ETH
         select MII
         select PHYLIB
         select CRC32
-        depends on NETDEVICES && CPU_SUBTYPE_ST40
+        depends on NETDEVICES
         help
           This is the driver for the Ethernet IPs are built around a
-          Synopsys IP Core and fully tested on the STMicroelectronics
+          Synopsys IP Core and only tested on the STMicroelectronics
           platforms.
 
 if STMMAC_ETH
@@ -32,6 +32,7 @@ config STMMAC_DUAL_MAC
 config STMMAC_TIMER
         bool "STMMAC Timer optimisation"
         default n
+        depends on RTC_HCTOSYS_DEVICE
         help
           Use an external timer for mitigating the number of network
           interrupts. Currently, for SH architectures, it is possible
diff --git a/drivers/net/stmmac/common.h b/drivers/net/stmmac/common.h
index 66b9da0260fe..dec7ce40c27a 100644
--- a/drivers/net/stmmac/common.h
+++ b/drivers/net/stmmac/common.h
@@ -102,8 +102,6 @@ struct stmmac_extra_stats {
 
 #define SF_DMA_MODE 1 /* DMA STORE-AND-FORWARD Operation Mode */
 
-#define HW_CSUM 1
-#define NO_HW_CSUM 0
 enum rx_frame_status { /* IPC status */
         good_frame = 0,
         discard_frame = 1,
@@ -167,7 +165,7 @@ struct stmmac_desc_ops {
         int (*get_tx_ls) (struct dma_desc *p);
         /* Return the transmit status looking at the TDES1 */
         int (*tx_status) (void *data, struct stmmac_extra_stats *x,
-                          struct dma_desc *p, unsigned long ioaddr);
+                          struct dma_desc *p, void __iomem *ioaddr);
         /* Get the buffer size from the descriptor */
         int (*get_tx_len) (struct dma_desc *p);
         /* Handle extra events on specific interrupts hw dependent */
@@ -182,44 +180,46 @@ struct stmmac_desc_ops {
 
 struct stmmac_dma_ops {
         /* DMA core initialization */
-        int (*init) (unsigned long ioaddr, int pbl, u32 dma_tx, u32 dma_rx);
+        int (*init) (void __iomem *ioaddr, int pbl, u32 dma_tx, u32 dma_rx);
         /* Dump DMA registers */
-        void (*dump_regs) (unsigned long ioaddr);
+        void (*dump_regs) (void __iomem *ioaddr);
         /* Set tx/rx threshold in the csr6 register
          * An invalid value enables the store-and-forward mode */
-        void (*dma_mode) (unsigned long ioaddr, int txmode, int rxmode);
+        void (*dma_mode) (void __iomem *ioaddr, int txmode, int rxmode);
         /* To track extra statistic (if supported) */
         void (*dma_diagnostic_fr) (void *data, struct stmmac_extra_stats *x,
-                                   unsigned long ioaddr);
-        void (*enable_dma_transmission) (unsigned long ioaddr);
-        void (*enable_dma_irq) (unsigned long ioaddr);
-        void (*disable_dma_irq) (unsigned long ioaddr);
-        void (*start_tx) (unsigned long ioaddr);
-        void (*stop_tx) (unsigned long ioaddr);
-        void (*start_rx) (unsigned long ioaddr);
-        void (*stop_rx) (unsigned long ioaddr);
-        int (*dma_interrupt) (unsigned long ioaddr,
+                                   void __iomem *ioaddr);
+        void (*enable_dma_transmission) (void __iomem *ioaddr);
+        void (*enable_dma_irq) (void __iomem *ioaddr);
+        void (*disable_dma_irq) (void __iomem *ioaddr);
+        void (*start_tx) (void __iomem *ioaddr);
+        void (*stop_tx) (void __iomem *ioaddr);
+        void (*start_rx) (void __iomem *ioaddr);
+        void (*stop_rx) (void __iomem *ioaddr);
+        int (*dma_interrupt) (void __iomem *ioaddr,
                               struct stmmac_extra_stats *x);
 };
 
 struct stmmac_ops {
         /* MAC core initialization */
-        void (*core_init) (unsigned long ioaddr) ____cacheline_aligned;
+        void (*core_init) (void __iomem *ioaddr) ____cacheline_aligned;
+        /* Support checksum offload engine */
+        int  (*rx_coe) (void __iomem *ioaddr);
         /* Dump MAC registers */
-        void (*dump_regs) (unsigned long ioaddr);
+        void (*dump_regs) (void __iomem *ioaddr);
         /* Handle extra events on specific interrupts hw dependent */
-        void (*host_irq_status) (unsigned long ioaddr);
+        void (*host_irq_status) (void __iomem *ioaddr);
         /* Multicast filter setting */
         void (*set_filter) (struct net_device *dev);
         /* Flow control setting */
-        void (*flow_ctrl) (unsigned long ioaddr, unsigned int duplex,
+        void (*flow_ctrl) (void __iomem *ioaddr, unsigned int duplex,
                            unsigned int fc, unsigned int pause_time);
         /* Set power management mode (e.g. magic frame) */
-        void (*pmt) (unsigned long ioaddr, unsigned long mode);
+        void (*pmt) (void __iomem *ioaddr, unsigned long mode);
         /* Set/Get Unicast MAC addresses */
-        void (*set_umac_addr) (unsigned long ioaddr, unsigned char *addr,
+        void (*set_umac_addr) (void __iomem *ioaddr, unsigned char *addr,
                                unsigned int reg_n);
-        void (*get_umac_addr) (unsigned long ioaddr, unsigned char *addr,
+        void (*get_umac_addr) (void __iomem *ioaddr, unsigned char *addr,
                                unsigned int reg_n);
 };
 
@@ -238,16 +238,15 @@ struct mac_device_info {
         struct stmmac_ops       *mac;
         struct stmmac_desc_ops  *desc;
         struct stmmac_dma_ops   *dma;
-        unsigned int pmt;       /* support Power-Down */
         struct mii_regs mii;    /* MII register Addresses */
         struct mac_link link;
 };
 
-struct mac_device_info *dwmac1000_setup(unsigned long addr);
-struct mac_device_info *dwmac100_setup(unsigned long addr);
+struct mac_device_info *dwmac1000_setup(void __iomem *ioaddr);
+struct mac_device_info *dwmac100_setup(void __iomem *ioaddr);
 
-extern void stmmac_set_mac_addr(unsigned long ioaddr, u8 addr[6],
+extern void stmmac_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
                                 unsigned int high, unsigned int low);
-extern void stmmac_get_mac_addr(unsigned long ioaddr, unsigned char *addr,
+extern void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
                                 unsigned int high, unsigned int low);
-extern void dwmac_dma_flush_tx_fifo(unsigned long ioaddr);
+extern void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
diff --git a/drivers/net/stmmac/dwmac1000.h b/drivers/net/stmmac/dwmac1000.h
index 8b20b19971cb..81ee4fd04386 100644
--- a/drivers/net/stmmac/dwmac1000.h
+++ b/drivers/net/stmmac/dwmac1000.h
@@ -99,7 +99,7 @@ enum inter_frame_gap {
 #define GMAC_CONTROL_RE         0x00000004 /* Receiver Enable */
 
 #define GMAC_CORE_INIT (GMAC_CONTROL_JD | GMAC_CONTROL_PS | GMAC_CONTROL_ACS | \
-                        GMAC_CONTROL_IPC | GMAC_CONTROL_JE | GMAC_CONTROL_BE)
+                        GMAC_CONTROL_JE | GMAC_CONTROL_BE)
 
 /* GMAC Frame Filter defines */
 #define GMAC_FRAME_FILTER_PR    0x00000001      /* Promiscuous Mode */
diff --git a/drivers/net/stmmac/dwmac1000_core.c b/drivers/net/stmmac/dwmac1000_core.c
index 2b2f5c8caf1c..65667b692024 100644
--- a/drivers/net/stmmac/dwmac1000_core.c
+++ b/drivers/net/stmmac/dwmac1000_core.c
@@ -30,7 +30,7 @@
 #include <linux/slab.h>
 #include "dwmac1000.h"
 
-static void dwmac1000_core_init(unsigned long ioaddr)
+static void dwmac1000_core_init(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + GMAC_CONTROL);
         value |= GMAC_CORE_INIT;
@@ -50,10 +50,22 @@ static void dwmac1000_core_init(unsigned long ioaddr)
 #endif
 }
 
-static void dwmac1000_dump_regs(unsigned long ioaddr)
+static int dwmac1000_rx_coe_supported(void __iomem *ioaddr)
+{
+        u32 value = readl(ioaddr + GMAC_CONTROL);
+
+        value |= GMAC_CONTROL_IPC;
+        writel(value, ioaddr + GMAC_CONTROL);
+
+        value = readl(ioaddr + GMAC_CONTROL);
+
+        return !!(value & GMAC_CONTROL_IPC);
+}
+
+static void dwmac1000_dump_regs(void __iomem *ioaddr)
 {
         int i;
-        pr_info("\tDWMAC1000 regs (base addr = 0x%8x)\n", (unsigned int)ioaddr);
+        pr_info("\tDWMAC1000 regs (base addr = 0x%p)\n", ioaddr);
 
         for (i = 0; i < 55; i++) {
                 int offset = i * 4;
@@ -62,14 +74,14 @@ static void dwmac1000_dump_regs(unsigned long ioaddr)
         }
 }
 
-static void dwmac1000_set_umac_addr(unsigned long ioaddr, unsigned char *addr,
+static void dwmac1000_set_umac_addr(void __iomem *ioaddr, unsigned char *addr,
                                 unsigned int reg_n)
 {
         stmmac_set_mac_addr(ioaddr, addr, GMAC_ADDR_HIGH(reg_n),
                                 GMAC_ADDR_LOW(reg_n));
 }
 
-static void dwmac1000_get_umac_addr(unsigned long ioaddr, unsigned char *addr,
+static void dwmac1000_get_umac_addr(void __iomem *ioaddr, unsigned char *addr,
                                 unsigned int reg_n)
 {
         stmmac_get_mac_addr(ioaddr, addr, GMAC_ADDR_HIGH(reg_n),
@@ -78,7 +90,7 @@ static void dwmac1000_get_umac_addr(unsigned long ioaddr, unsigned char *addr,
 
 static void dwmac1000_set_filter(struct net_device *dev)
 {
-        unsigned long ioaddr = dev->base_addr;
+        void __iomem *ioaddr = (void __iomem *) dev->base_addr;
         unsigned int value = 0;
 
         CHIP_DBG(KERN_INFO "%s: # mcasts %d, # unicast %d\n",
@@ -139,7 +151,7 @@ static void dwmac1000_set_filter(struct net_device *dev)
             readl(ioaddr + GMAC_HASH_HIGH), readl(ioaddr + GMAC_HASH_LOW));
 }
 
-static void dwmac1000_flow_ctrl(unsigned long ioaddr, unsigned int duplex,
+static void dwmac1000_flow_ctrl(void __iomem *ioaddr, unsigned int duplex,
                            unsigned int fc, unsigned int pause_time)
 {
         unsigned int flow = 0;
@@ -162,7 +174,7 @@ static void dwmac1000_flow_ctrl(unsigned long ioaddr, unsigned int duplex,
         writel(flow, ioaddr + GMAC_FLOW_CTRL);
 }
 
-static void dwmac1000_pmt(unsigned long ioaddr, unsigned long mode)
+static void dwmac1000_pmt(void __iomem *ioaddr, unsigned long mode)
 {
         unsigned int pmt = 0;
 
@@ -178,7 +190,7 @@ static void dwmac1000_pmt(unsigned long ioaddr, unsigned long mode)
 }
 
 
-static void dwmac1000_irq_status(unsigned long ioaddr)
+static void dwmac1000_irq_status(void __iomem *ioaddr)
 {
         u32 intr_status = readl(ioaddr + GMAC_INT_STATUS);
 
@@ -202,6 +214,7 @@ static void dwmac1000_irq_status(unsigned long ioaddr)
 
 struct stmmac_ops dwmac1000_ops = {
         .core_init = dwmac1000_core_init,
+        .rx_coe = dwmac1000_rx_coe_supported,
         .dump_regs = dwmac1000_dump_regs,
         .host_irq_status = dwmac1000_irq_status,
         .set_filter = dwmac1000_set_filter,
@@ -211,7 +224,7 @@ struct stmmac_ops dwmac1000_ops = {
         .get_umac_addr = dwmac1000_get_umac_addr,
 };
 
-struct mac_device_info *dwmac1000_setup(unsigned long ioaddr)
+struct mac_device_info *dwmac1000_setup(void __iomem *ioaddr)
 {
         struct mac_device_info *mac;
         u32 uid = readl(ioaddr + GMAC_VERSION);
@@ -226,7 +239,6 @@ struct mac_device_info *dwmac1000_setup(unsigned long ioaddr)
         mac->mac = &dwmac1000_ops;
         mac->dma = &dwmac1000_dma_ops;
 
-        mac->pmt = PMT_SUPPORTED;
         mac->link.port = GMAC_CONTROL_PS;
         mac->link.duplex = GMAC_CONTROL_DM;
         mac->link.speed = GMAC_CONTROL_FES;
diff --git a/drivers/net/stmmac/dwmac1000_dma.c b/drivers/net/stmmac/dwmac1000_dma.c
index 415805057cb0..ce6163e39cd5 100644
--- a/drivers/net/stmmac/dwmac1000_dma.c
+++ b/drivers/net/stmmac/dwmac1000_dma.c
@@ -29,14 +29,22 @@
 #include "dwmac1000.h"
 #include "dwmac_dma.h"
 
-static int dwmac1000_dma_init(unsigned long ioaddr, int pbl, u32 dma_tx,
+static int dwmac1000_dma_init(void __iomem *ioaddr, int pbl, u32 dma_tx,
                               u32 dma_rx)
 {
         u32 value = readl(ioaddr + DMA_BUS_MODE);
+        int limit;
+
         /* DMA SW reset */
         value |= DMA_BUS_MODE_SFT_RESET;
         writel(value, ioaddr + DMA_BUS_MODE);
-        do {} while ((readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET));
+        limit = 15000;
+        while (limit--) {
+                if (!(readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET))
+                        break;
+        }
+        if (limit < 0)
+                return -EBUSY;
 
         value = /* DMA_BUS_MODE_FB | */ DMA_BUS_MODE_4PBL |
             ((pbl << DMA_BUS_MODE_PBL_SHIFT) |
@@ -58,7 +66,7 @@ static int dwmac1000_dma_init(unsigned long ioaddr, int pbl, u32 dma_tx,
         return 0;
 }
 
-static void dwmac1000_dma_operation_mode(unsigned long ioaddr, int txmode,
+static void dwmac1000_dma_operation_mode(void __iomem *ioaddr, int txmode,
                                     int rxmode)
 {
         u32 csr6 = readl(ioaddr + DMA_CONTROL);
@@ -111,12 +119,12 @@ static void dwmac1000_dma_operation_mode(unsigned long ioaddr, int txmode,
 
 /* Not yet implemented --- no RMON module */
 static void dwmac1000_dma_diagnostic_fr(void *data,
-                  struct stmmac_extra_stats *x, unsigned long ioaddr)
+                  struct stmmac_extra_stats *x, void __iomem *ioaddr)
 {
         return;
 }
 
-static void dwmac1000_dump_dma_regs(unsigned long ioaddr)
+static void dwmac1000_dump_dma_regs(void __iomem *ioaddr)
 {
         int i;
         pr_info(" DMA registers\n");
diff --git a/drivers/net/stmmac/dwmac100_core.c b/drivers/net/stmmac/dwmac100_core.c
index 2fb165fa2ba0..94eeccf3a8a0 100644
--- a/drivers/net/stmmac/dwmac100_core.c
+++ b/drivers/net/stmmac/dwmac100_core.c
@@ -31,7 +31,7 @@
 #include <linux/crc32.h>
 #include "dwmac100.h"
 
-static void dwmac100_core_init(unsigned long ioaddr)
+static void dwmac100_core_init(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + MAC_CONTROL);
 
@@ -42,12 +42,17 @@ static void dwmac100_core_init(unsigned long ioaddr)
 #endif
 }
 
-static void dwmac100_dump_mac_regs(unsigned long ioaddr)
+static int dwmac100_rx_coe_supported(void __iomem *ioaddr)
+{
+        return 0;
+}
+
+static void dwmac100_dump_mac_regs(void __iomem *ioaddr)
 {
         pr_info("\t----------------------------------------------\n"
-                "\t  DWMAC 100 CSR (base addr = 0x%8x)\n"
+                "\t  DWMAC 100 CSR (base addr = 0x%p)\n"
                 "\t----------------------------------------------\n",
-                (unsigned int)ioaddr);
+                ioaddr);
         pr_info("\tcontrol reg (offset 0x%x): 0x%08x\n", MAC_CONTROL,
                 readl(ioaddr + MAC_CONTROL));
         pr_info("\taddr HI (offset 0x%x): 0x%08x\n ", MAC_ADDR_HIGH,
@@ -77,18 +82,18 @@ static void dwmac100_dump_mac_regs(unsigned long ioaddr)
                 MMC_LOW_INTR_MASK, readl(ioaddr + MMC_LOW_INTR_MASK));
 }
 
-static void dwmac100_irq_status(unsigned long ioaddr)
+static void dwmac100_irq_status(void __iomem *ioaddr)
 {
         return;
 }
 
-static void dwmac100_set_umac_addr(unsigned long ioaddr, unsigned char *addr,
+static void dwmac100_set_umac_addr(void __iomem *ioaddr, unsigned char *addr,
                                    unsigned int reg_n)
 {
         stmmac_set_mac_addr(ioaddr, addr, MAC_ADDR_HIGH, MAC_ADDR_LOW);
 }
 
-static void dwmac100_get_umac_addr(unsigned long ioaddr, unsigned char *addr,
+static void dwmac100_get_umac_addr(void __iomem *ioaddr, unsigned char *addr,
                                    unsigned int reg_n)
 {
         stmmac_get_mac_addr(ioaddr, addr, MAC_ADDR_HIGH, MAC_ADDR_LOW);
@@ -96,7 +101,7 @@ static void dwmac100_get_umac_addr(unsigned long ioaddr, unsigned char *addr,
 
 static void dwmac100_set_filter(struct net_device *dev)
 {
-        unsigned long ioaddr = dev->base_addr;
+        void __iomem *ioaddr = (void __iomem *) dev->base_addr;
         u32 value = readl(ioaddr + MAC_CONTROL);
 
         if (dev->flags & IFF_PROMISC) {
@@ -145,7 +150,7 @@ static void dwmac100_set_filter(struct net_device *dev)
             readl(ioaddr + MAC_HASH_HIGH), readl(ioaddr + MAC_HASH_LOW));
 }
 
-static void dwmac100_flow_ctrl(unsigned long ioaddr, unsigned int duplex,
+static void dwmac100_flow_ctrl(void __iomem *ioaddr, unsigned int duplex,
                                unsigned int fc, unsigned int pause_time)
 {
         unsigned int flow = MAC_FLOW_CTRL_ENABLE;
@@ -158,13 +163,14 @@ static void dwmac100_flow_ctrl(unsigned long ioaddr, unsigned int duplex,
 /* No PMT module supported for this Ethernet Controller.
  * Tested on ST platforms only.
  */
-static void dwmac100_pmt(unsigned long ioaddr, unsigned long mode)
+static void dwmac100_pmt(void __iomem *ioaddr, unsigned long mode)
 {
         return;
 }
 
 struct stmmac_ops dwmac100_ops = {
         .core_init = dwmac100_core_init,
+        .rx_coe = dwmac100_rx_coe_supported,
         .dump_regs = dwmac100_dump_mac_regs,
         .host_irq_status = dwmac100_irq_status,
         .set_filter = dwmac100_set_filter,
@@ -174,7 +180,7 @@ struct stmmac_ops dwmac100_ops = {
         .get_umac_addr = dwmac100_get_umac_addr,
 };
 
-struct mac_device_info *dwmac100_setup(unsigned long ioaddr)
+struct mac_device_info *dwmac100_setup(void __iomem *ioaddr)
 {
         struct mac_device_info *mac;
 
@@ -187,7 +193,6 @@ struct mac_device_info *dwmac100_setup(unsigned long ioaddr)
         mac->mac = &dwmac100_ops;
         mac->dma = &dwmac100_dma_ops;
 
-        mac->pmt = PMT_NOT_SUPPORTED;
         mac->link.port = MAC_CONTROL_PS;
         mac->link.duplex = MAC_CONTROL_F;
         mac->link.speed = 0;
diff --git a/drivers/net/stmmac/dwmac100_dma.c b/drivers/net/stmmac/dwmac100_dma.c
index 2fece7b72727..96aac93b789b 100644
--- a/drivers/net/stmmac/dwmac100_dma.c
+++ b/drivers/net/stmmac/dwmac100_dma.c
@@ -31,14 +31,22 @@
 #include "dwmac100.h"
 #include "dwmac_dma.h"
 
-static int dwmac100_dma_init(unsigned long ioaddr, int pbl, u32 dma_tx,
+static int dwmac100_dma_init(void __iomem *ioaddr, int pbl, u32 dma_tx,
                              u32 dma_rx)
 {
         u32 value = readl(ioaddr + DMA_BUS_MODE);
+        int limit;
+
         /* DMA SW reset */
         value |= DMA_BUS_MODE_SFT_RESET;
         writel(value, ioaddr + DMA_BUS_MODE);
-        do {} while ((readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET));
+        limit = 15000;
+        while (limit--) {
+                if (!(readl(ioaddr + DMA_BUS_MODE) & DMA_BUS_MODE_SFT_RESET))
+                        break;
+        }
+        if (limit < 0)
+                return -EBUSY;
 
         /* Enable Application Access by writing to DMA CSR0 */
         writel(DMA_BUS_MODE_DEFAULT | (pbl << DMA_BUS_MODE_PBL_SHIFT),
@@ -58,7 +66,7 @@ static int dwmac100_dma_init(unsigned long ioaddr, int pbl, u32 dma_tx,
 /* Store and Forward capability is not used at all..
  * The transmit threshold can be programmed by
  * setting the TTC bits in the DMA control register.*/
-static void dwmac100_dma_operation_mode(unsigned long ioaddr, int txmode,
+static void dwmac100_dma_operation_mode(void __iomem *ioaddr, int txmode,
                                         int rxmode)
 {
         u32 csr6 = readl(ioaddr + DMA_CONTROL);
@@ -73,7 +81,7 @@ static void dwmac100_dma_operation_mode(unsigned long ioaddr, int txmode,
         writel(csr6, ioaddr + DMA_CONTROL);
 }
 
-static void dwmac100_dump_dma_regs(unsigned long ioaddr)
+static void dwmac100_dump_dma_regs(void __iomem *ioaddr)
 {
         int i;
 
@@ -91,7 +99,7 @@ static void dwmac100_dump_dma_regs(unsigned long ioaddr)
 /* DMA controller has two counters to track the number of
  * the receive missed frames. */
 static void dwmac100_dma_diagnostic_fr(void *data, struct stmmac_extra_stats *x,
-                                       unsigned long ioaddr)
+                                       void __iomem *ioaddr)
 {
         struct net_device_stats *stats = (struct net_device_stats *)data;
         u32 csr8 = readl(ioaddr + DMA_MISSED_FRAME_CTR);
diff --git a/drivers/net/stmmac/dwmac_dma.h b/drivers/net/stmmac/dwmac_dma.h
index 7b815a1b7b8c..da3f5ccf83d3 100644
--- a/drivers/net/stmmac/dwmac_dma.h
+++ b/drivers/net/stmmac/dwmac_dma.h
@@ -97,12 +97,12 @@
 #define DMA_STATUS_TI   0x00000001      /* Transmit Interrupt */
 #define DMA_CONTROL_FTF         0x00100000 /* Flush transmit FIFO */
 
-extern void dwmac_enable_dma_transmission(unsigned long ioaddr);
-extern void dwmac_enable_dma_irq(unsigned long ioaddr);
-extern void dwmac_disable_dma_irq(unsigned long ioaddr);
-extern void dwmac_dma_start_tx(unsigned long ioaddr);
-extern void dwmac_dma_stop_tx(unsigned long ioaddr);
-extern void dwmac_dma_start_rx(unsigned long ioaddr);
-extern void dwmac_dma_stop_rx(unsigned long ioaddr);
-extern int dwmac_dma_interrupt(unsigned long ioaddr,
+extern void dwmac_enable_dma_transmission(void __iomem *ioaddr);
+extern void dwmac_enable_dma_irq(void __iomem *ioaddr);
+extern void dwmac_disable_dma_irq(void __iomem *ioaddr);
+extern void dwmac_dma_start_tx(void __iomem *ioaddr);
+extern void dwmac_dma_stop_tx(void __iomem *ioaddr);
+extern void dwmac_dma_start_rx(void __iomem *ioaddr);
+extern void dwmac_dma_stop_rx(void __iomem *ioaddr);
+extern int dwmac_dma_interrupt(void __iomem *ioaddr,
                                 struct stmmac_extra_stats *x);
diff --git a/drivers/net/stmmac/dwmac_lib.c b/drivers/net/stmmac/dwmac_lib.c
index a85415216ef4..d65fab1ba790 100644
--- a/drivers/net/stmmac/dwmac_lib.c
+++ b/drivers/net/stmmac/dwmac_lib.c
@@ -32,43 +32,43 @@
 #endif
 
 /* CSR1 enables the transmit DMA to check for new descriptor */
-void dwmac_enable_dma_transmission(unsigned long ioaddr)
+void dwmac_enable_dma_transmission(void __iomem *ioaddr)
 {
         writel(1, ioaddr + DMA_XMT_POLL_DEMAND);
 }
 
-void dwmac_enable_dma_irq(unsigned long ioaddr)
+void dwmac_enable_dma_irq(void __iomem *ioaddr)
 {
         writel(DMA_INTR_DEFAULT_MASK, ioaddr + DMA_INTR_ENA);
 }
 
-void dwmac_disable_dma_irq(unsigned long ioaddr)
+void dwmac_disable_dma_irq(void __iomem *ioaddr)
 {
         writel(0, ioaddr + DMA_INTR_ENA);
 }
 
-void dwmac_dma_start_tx(unsigned long ioaddr)
+void dwmac_dma_start_tx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + DMA_CONTROL);
         value |= DMA_CONTROL_ST;
         writel(value, ioaddr + DMA_CONTROL);
 }
 
-void dwmac_dma_stop_tx(unsigned long ioaddr)
+void dwmac_dma_stop_tx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + DMA_CONTROL);
         value &= ~DMA_CONTROL_ST;
         writel(value, ioaddr + DMA_CONTROL);
 }
 
-void dwmac_dma_start_rx(unsigned long ioaddr)
+void dwmac_dma_start_rx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + DMA_CONTROL);
         value |= DMA_CONTROL_SR;
         writel(value, ioaddr + DMA_CONTROL);
 }
 
-void dwmac_dma_stop_rx(unsigned long ioaddr)
+void dwmac_dma_stop_rx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + DMA_CONTROL);
         value &= ~DMA_CONTROL_SR;
@@ -145,7 +145,7 @@ static void show_rx_process_state(unsigned int status)
 }
 #endif
 
-int dwmac_dma_interrupt(unsigned long ioaddr,
+int dwmac_dma_interrupt(void __iomem *ioaddr,
                         struct stmmac_extra_stats *x)
 {
         int ret = 0;
@@ -219,7 +219,7 @@ int dwmac_dma_interrupt(unsigned long ioaddr,
         return ret;
 }
 
-void dwmac_dma_flush_tx_fifo(unsigned long ioaddr)
+void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr)
 {
         u32 csr6 = readl(ioaddr + DMA_CONTROL);
         writel((csr6 | DMA_CONTROL_FTF), ioaddr + DMA_CONTROL);
@@ -227,7 +227,7 @@ void dwmac_dma_flush_tx_fifo(unsigned long ioaddr)
         do {} while ((readl(ioaddr + DMA_CONTROL) & DMA_CONTROL_FTF));
 }
 
-void stmmac_set_mac_addr(unsigned long ioaddr, u8 addr[6],
+void stmmac_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
                          unsigned int high, unsigned int low)
 {
         unsigned long data;
@@ -238,7 +238,7 @@ void stmmac_set_mac_addr(unsigned long ioaddr, u8 addr[6],
         writel(data, ioaddr + low);
 }
 
-void stmmac_get_mac_addr(unsigned long ioaddr, unsigned char *addr,
+void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
                          unsigned int high, unsigned int low)
 {
         unsigned int hi_addr, lo_addr;
diff --git a/drivers/net/stmmac/enh_desc.c b/drivers/net/stmmac/enh_desc.c
index f612f986a7e1..5d1471d8f8f6 100644
--- a/drivers/net/stmmac/enh_desc.c
+++ b/drivers/net/stmmac/enh_desc.c
@@ -25,7 +25,7 @@
 #include "common.h"
 
 static int enh_desc_get_tx_status(void *data, struct stmmac_extra_stats *x,
-                                  struct dma_desc *p, unsigned long ioaddr)
+                                  struct dma_desc *p, void __iomem *ioaddr)
 {
         int ret = 0;
         struct net_device_stats *stats = (struct net_device_stats *)data;
@@ -284,7 +284,7 @@ static void enh_desc_release_tx_desc(struct dma_desc *p)
 {
         int ter = p->des01.etx.end_ring;
 
-        memset(p, 0, sizeof(struct dma_desc));
+        memset(p, 0, offsetof(struct dma_desc, des2));
         p->des01.etx.end_ring = ter;
 }
 
diff --git a/drivers/net/stmmac/norm_desc.c b/drivers/net/stmmac/norm_desc.c
index 31ad53643792..0dce90cb8124 100644
--- a/drivers/net/stmmac/norm_desc.c
+++ b/drivers/net/stmmac/norm_desc.c
@@ -25,7 +25,7 @@
 #include "common.h"
 
 static int ndesc_get_tx_status(void *data, struct stmmac_extra_stats *x,
-                               struct dma_desc *p, unsigned long ioaddr)
+                               struct dma_desc *p, void __iomem *ioaddr)
 {
         int ret = 0;
         struct net_device_stats *stats = (struct net_device_stats *)data;
@@ -174,22 +174,7 @@ static void ndesc_release_tx_desc(struct dma_desc *p)
 {
         int ter = p->des01.tx.end_ring;
 
-        /* clean field used within the xmit */
-        p->des01.tx.first_segment = 0;
-        p->des01.tx.last_segment = 0;
-        p->des01.tx.buffer1_size = 0;
-
-        /* clean status reported */
-        p->des01.tx.error_summary = 0;
-        p->des01.tx.underflow_error = 0;
-        p->des01.tx.no_carrier = 0;
-        p->des01.tx.loss_carrier = 0;
-        p->des01.tx.excessive_deferral = 0;
-        p->des01.tx.excessive_collisions = 0;
-        p->des01.tx.late_collision = 0;
-        p->des01.tx.heartbeat_fail = 0;
-        p->des01.tx.deferred = 0;
-
+        memset(p, 0, offsetof(struct dma_desc, des2));
         /* set termination field */
         p->des01.tx.end_ring = ter;
 }
diff --git a/drivers/net/stmmac/stmmac.h b/drivers/net/stmmac/stmmac.h
index ebebc644b1b8..92154ff7d702 100644
--- a/drivers/net/stmmac/stmmac.h
+++ b/drivers/net/stmmac/stmmac.h
@@ -21,6 +21,7 @@
 *******************************************************************************/
 
 #define DRV_MODULE_VERSION      "Apr_2010"
+#include <linux/platform_device.h>
 #include <linux/stmmac.h>
 
 #include "common.h"
@@ -50,10 +51,10 @@ struct stmmac_priv {
         int is_gmac;
         dma_addr_t dma_rx_phy;
         unsigned int dma_rx_size;
-        int rx_csum;
         unsigned int dma_buf_sz;
         struct device *device;
         struct mac_device_info *hw;
+        void __iomem *ioaddr;
 
         struct stmmac_extra_stats xstats;
         struct napi_struct napi;
@@ -65,7 +66,7 @@ struct stmmac_priv {
         int phy_mask;
         int (*phy_reset) (void *priv);
         void (*fix_mac_speed) (void *priv, unsigned int speed);
-        void (*bus_setup)(unsigned long ioaddr);
+        void (*bus_setup)(void __iomem *ioaddr);
         void *bsp_priv;
 
         int phy_irq;
@@ -76,6 +77,7 @@ struct stmmac_priv {
         unsigned int flow_ctrl;
         unsigned int pause;
         struct mii_bus *mii;
+        int mii_clk_csr;
 
         u32 msg_enable;
         spinlock_t lock;
@@ -89,6 +91,9 @@ struct stmmac_priv {
         struct vlan_group *vlgrp;
 #endif
         int enh_desc;
+        int rx_coe;
+        int bugged_jumbo;
+        int no_csum_insertion;
 };
 
 #ifdef CONFIG_STM_DRIVERS
diff --git a/drivers/net/stmmac/stmmac_ethtool.c b/drivers/net/stmmac/stmmac_ethtool.c
index f080509923f0..25a7e385f8ec 100644
--- a/drivers/net/stmmac/stmmac_ethtool.c
+++ b/drivers/net/stmmac/stmmac_ethtool.c
@@ -177,21 +177,21 @@ void stmmac_ethtool_gregs(struct net_device *dev,
         if (!priv->is_gmac) {
                 /* MAC registers */
                 for (i = 0; i < 12; i++)
-                        reg_space[i] = readl(dev->base_addr + (i * 4));
+                        reg_space[i] = readl(priv->ioaddr + (i * 4));
                 /* DMA registers */
                 for (i = 0; i < 9; i++)
                         reg_space[i + 12] =
-                            readl(dev->base_addr + (DMA_BUS_MODE + (i * 4)));
-                reg_space[22] = readl(dev->base_addr + DMA_CUR_TX_BUF_ADDR);
-                reg_space[23] = readl(dev->base_addr + DMA_CUR_RX_BUF_ADDR);
+                            readl(priv->ioaddr + (DMA_BUS_MODE + (i * 4)));
+                reg_space[22] = readl(priv->ioaddr + DMA_CUR_TX_BUF_ADDR);
+                reg_space[23] = readl(priv->ioaddr + DMA_CUR_RX_BUF_ADDR);
         } else {
                 /* MAC registers */
                 for (i = 0; i < 55; i++)
-                        reg_space[i] = readl(dev->base_addr + (i * 4));
+                        reg_space[i] = readl(priv->ioaddr + (i * 4));
                 /* DMA registers */
                 for (i = 0; i < 22; i++)
                         reg_space[i + 55] =
-                            readl(dev->base_addr + (DMA_BUS_MODE + (i * 4)));
+                            readl(priv->ioaddr + (DMA_BUS_MODE + (i * 4)));
         }
 }
 
@@ -209,7 +209,7 @@ u32 stmmac_ethtool_get_rx_csum(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        return priv->rx_csum;
+        return priv->rx_coe;
 }
 
 static void
@@ -263,11 +263,9 @@ stmmac_set_pauseparam(struct net_device *netdev,
                         cmd.phy_address = phy->addr;
                         ret = phy_ethtool_sset(phy, &cmd);
                 }
-        } else {
-                unsigned long ioaddr = netdev->base_addr;
-                priv->hw->mac->flow_ctrl(ioaddr, phy->duplex,
+        } else
+                priv->hw->mac->flow_ctrl(priv->ioaddr, phy->duplex,
                                          priv->flow_ctrl, priv->pause);
-        }
         spin_unlock(&priv->lock);
         return ret;
 }
@@ -276,12 +274,11 @@ static void stmmac_get_ethtool_stats(struct net_device *dev,
                                  struct ethtool_stats *dummy, u64 *data)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
         int i;
 
         /* Update HW stats if supported */
         priv->hw->dma->dma_diagnostic_fr(&dev->stats, (void *) &priv->xstats,
-                                         ioaddr);
+                                         priv->ioaddr);
 
         for (i = 0; i < STMMAC_STATS_LEN; i++) {
                 char *p = (char *)priv + stmmac_gstrings_stats[i].stat_offset;
@@ -325,7 +322,7 @@ static void stmmac_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct stmmac_priv *priv = netdev_priv(dev);
 
         spin_lock_irq(&priv->lock);
-        if (priv->wolenabled == PMT_SUPPORTED) {
+        if (device_can_wakeup(priv->device)) {
                 wol->supported = WAKE_MAGIC;
                 wol->wolopts = priv->wolopts;
         }
@@ -337,16 +334,20 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct stmmac_priv *priv = netdev_priv(dev);
         u32 support = WAKE_MAGIC;
 
-        if (priv->wolenabled == PMT_NOT_SUPPORTED)
+        if (!device_can_wakeup(priv->device))
                 return -EINVAL;
 
         if (wol->wolopts & ~support)
                 return -EINVAL;
 
-        if (wol->wolopts == 0)
-                device_set_wakeup_enable(priv->device, 0);
-        else
+        if (wol->wolopts) {
+                pr_info("stmmac: wakeup enable\n");
                 device_set_wakeup_enable(priv->device, 1);
+                enable_irq_wake(dev->irq);
+        } else {
+                device_set_wakeup_enable(priv->device, 0);
+                disable_irq_wake(dev->irq);
+        }
 
         spin_lock_irq(&priv->lock);
         priv->wolopts = wol->wolopts;
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index ea0461eb2dbe..823b9e6431d5 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -134,13 +134,6 @@ static int buf_sz = DMA_BUFFER_SIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
 
-/* In case of Giga ETH, we can enable/disable the COE for the
- * transmit HW checksum computation.
- * Note that, if tx csum is off in HW, SG will be still supported. */
-static int tx_coe = HW_CSUM;
-module_param(tx_coe, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(tx_coe, "GMAC COE type 2 [on/off]");
-
 static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
                                       NETIF_MSG_LINK | NETIF_MSG_IFUP |
                                       NETIF_MSG_IFDOWN | NETIF_MSG_TIMER);
@@ -202,7 +195,6 @@ static void stmmac_adjust_link(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
-        unsigned long ioaddr = dev->base_addr;
         unsigned long flags;
         int new_state = 0;
         unsigned int fc = priv->flow_ctrl, pause_time = priv->pause;
@@ -215,7 +207,7 @@ static void stmmac_adjust_link(struct net_device *dev)
 
         spin_lock_irqsave(&priv->lock, flags);
         if (phydev->link) {
-                u32 ctrl = readl(ioaddr + MAC_CTRL_REG);
+                u32 ctrl = readl(priv->ioaddr + MAC_CTRL_REG);
 
                 /* Now we make sure that we can be in full duplex mode.
                  * If not, we operate in half-duplex mode. */
@@ -229,7 +221,7 @@ static void stmmac_adjust_link(struct net_device *dev)
                 }
                 /* Flow Control operation */
                 if (phydev->pause)
-                        priv->hw->mac->flow_ctrl(ioaddr, phydev->duplex,
+                        priv->hw->mac->flow_ctrl(priv->ioaddr, phydev->duplex,
                                                  fc, pause_time);
 
                 if (phydev->speed != priv->speed) {
@@ -238,6 +230,9 @@ static void stmmac_adjust_link(struct net_device *dev)
                         case 1000:
                                 if (likely(priv->is_gmac))
                                         ctrl &= ~priv->hw->link.port;
+                                if (likely(priv->fix_mac_speed))
+                                        priv->fix_mac_speed(priv->bsp_priv,
+                                                            phydev->speed);
                                 break;
                         case 100:
                         case 10:
@@ -265,7 +260,7 @@ static void stmmac_adjust_link(struct net_device *dev)
                         priv->speed = phydev->speed;
                 }
 
-                writel(ctrl, ioaddr + MAC_CTRL_REG);
+                writel(ctrl, priv->ioaddr + MAC_CTRL_REG);
 
                 if (!priv->oldlink) {
                         new_state = 1;
@@ -342,7 +337,7 @@ static int stmmac_init_phy(struct net_device *dev)
         return 0;
 }
 
-static inline void stmmac_mac_enable_rx(unsigned long ioaddr)
+static inline void stmmac_mac_enable_rx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + MAC_CTRL_REG);
         value |= MAC_RNABLE_RX;
@@ -350,7 +345,7 @@ static inline void stmmac_mac_enable_rx(unsigned long ioaddr)
         writel(value, ioaddr + MAC_CTRL_REG);
 }
 
-static inline void stmmac_mac_enable_tx(unsigned long ioaddr)
+static inline void stmmac_mac_enable_tx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + MAC_CTRL_REG);
         value |= MAC_ENABLE_TX;
@@ -358,14 +353,14 @@ static inline void stmmac_mac_enable_tx(unsigned long ioaddr)
         writel(value, ioaddr + MAC_CTRL_REG);
 }
 
-static inline void stmmac_mac_disable_rx(unsigned long ioaddr)
+static inline void stmmac_mac_disable_rx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + MAC_CTRL_REG);
         value &= ~MAC_RNABLE_RX;
         writel(value, ioaddr + MAC_CTRL_REG);
 }
 
-static inline void stmmac_mac_disable_tx(unsigned long ioaddr)
+static inline void stmmac_mac_disable_tx(void __iomem *ioaddr)
 {
         u32 value = readl(ioaddr + MAC_CTRL_REG);
         value &= ~MAC_ENABLE_TX;
@@ -567,29 +562,22 @@ static void free_dma_desc_resources(struct stmmac_priv *priv)
  *  stmmac_dma_operation_mode - HW DMA operation mode
  *  @priv : pointer to the private device structure.
  *  Description: it sets the DMA operation mode: tx/rx DMA thresholds
- *  or Store-And-Forward capability. It also verifies the COE for the
- *  transmission in case of Giga ETH.
+ *  or Store-And-Forward capability.
  */
 static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 {
-        if (!priv->is_gmac) {
-                /* MAC 10/100 */
-                priv->hw->dma->dma_mode(priv->dev->base_addr, tc, 0);
-                priv->tx_coe = NO_HW_CSUM;
-        } else {
-                if ((priv->dev->mtu <= ETH_DATA_LEN) && (tx_coe)) {
-                        priv->hw->dma->dma_mode(priv->dev->base_addr,
-                                                SF_DMA_MODE, SF_DMA_MODE);
-                        tc = SF_DMA_MODE;
-                        priv->tx_coe = HW_CSUM;
-                } else {
-                        /* Checksum computation is performed in software. */
-                        priv->hw->dma->dma_mode(priv->dev->base_addr, tc,
-                                                SF_DMA_MODE);
-                        priv->tx_coe = NO_HW_CSUM;
-                }
-        }
-        tx_coe = priv->tx_coe;
+        if (likely((priv->tx_coe) && (!priv->no_csum_insertion))) {
+                /* In case of GMAC, SF mode has to be enabled
+                 * to perform the TX COE. This depends on:
+                 * 1) TX COE if actually supported
+                 * 2) There is no bugged Jumbo frame support
+                 *    that needs to not insert csum in the TDES.
+                 */
+                priv->hw->dma->dma_mode(priv->ioaddr,
+                                        SF_DMA_MODE, SF_DMA_MODE);
+                tc = SF_DMA_MODE;
+        } else
+                priv->hw->dma->dma_mode(priv->ioaddr, tc, SF_DMA_MODE);
 }
 
 /**
@@ -600,7 +588,6 @@ static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 static void stmmac_tx(struct stmmac_priv *priv)
 {
         unsigned int txsize = priv->dma_tx_size;
-        unsigned long ioaddr = priv->dev->base_addr;
 
         while (priv->dirty_tx != priv->cur_tx) {
                 int last;
@@ -618,7 +605,7 @@ static void stmmac_tx(struct stmmac_priv *priv)
                         int tx_error =
                                 priv->hw->desc->tx_status(&priv->dev->stats,
                                                           &priv->xstats, p,
-                                                          ioaddr);
+                                                          priv->ioaddr);
                         if (likely(tx_error == 0)) {
                                 priv->dev->stats.tx_packets++;
                                 priv->xstats.tx_pkt_n++;
@@ -674,7 +661,7 @@ static inline void stmmac_enable_irq(struct stmmac_priv *priv)
                 priv->tm->timer_start(tmrate);
         else
 #endif
-                priv->hw->dma->enable_dma_irq(priv->dev->base_addr);
+                priv->hw->dma->enable_dma_irq(priv->ioaddr);
 }
 
 static inline void stmmac_disable_irq(struct stmmac_priv *priv)
@@ -684,7 +671,7 @@ static inline void stmmac_disable_irq(struct stmmac_priv *priv)
                 priv->tm->timer_stop();
         else
 #endif
-                priv->hw->dma->disable_dma_irq(priv->dev->base_addr);
+                priv->hw->dma->disable_dma_irq(priv->ioaddr);
 }
 
 static int stmmac_has_work(struct stmmac_priv *priv)
@@ -739,14 +726,15 @@ static void stmmac_no_timer_stopped(void)
  */
 static void stmmac_tx_err(struct stmmac_priv *priv)
 {
+
         netif_stop_queue(priv->dev);
 
-        priv->hw->dma->stop_tx(priv->dev->base_addr);
+        priv->hw->dma->stop_tx(priv->ioaddr);
         dma_free_tx_skbufs(priv);
         priv->hw->desc->init_tx_desc(priv->dma_tx, priv->dma_tx_size);
         priv->dirty_tx = 0;
         priv->cur_tx = 0;
-        priv->hw->dma->start_tx(priv->dev->base_addr);
+        priv->hw->dma->start_tx(priv->ioaddr);
 
         priv->dev->stats.tx_errors++;
         netif_wake_queue(priv->dev);
@@ -755,11 +743,9 @@ static void stmmac_tx_err(struct stmmac_priv *priv)
 
 static void stmmac_dma_interrupt(struct stmmac_priv *priv)
 {
-        unsigned long ioaddr = priv->dev->base_addr;
         int status;
 
-        status = priv->hw->dma->dma_interrupt(priv->dev->base_addr,
-                                              &priv->xstats);
+        status = priv->hw->dma->dma_interrupt(priv->ioaddr, &priv->xstats);
         if (likely(status == handle_tx_rx))
                 _stmmac_schedule(priv);
 
@@ -767,7 +753,7 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
                 /* Try to bump up the dma threshold on this failure */
                 if (unlikely(tc != SF_DMA_MODE) && (tc <= 256)) {
                         tc += 64;
-                        priv->hw->dma->dma_mode(ioaddr, tc, SF_DMA_MODE);
+                        priv->hw->dma->dma_mode(priv->ioaddr, tc, SF_DMA_MODE);
                         priv->xstats.threshold = tc;
                 }
                 stmmac_tx_err(priv);
@@ -787,7 +773,6 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
 static int stmmac_open(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
         int ret;
 
         /* Check that the MAC address is valid.  If its not, refuse
@@ -843,7 +828,8 @@ static int stmmac_open(struct net_device *dev)
         init_dma_desc_rings(dev);
 
         /* DMA initialization and SW reset */
-        if (unlikely(priv->hw->dma->init(ioaddr, priv->pbl, priv->dma_tx_phy,
+        if (unlikely(priv->hw->dma->init(priv->ioaddr, priv->pbl,
+                                         priv->dma_tx_phy,
                                          priv->dma_rx_phy) < 0)) {
 
                 pr_err("%s: DMA initialization failed\n", __func__);
@@ -851,22 +837,28 @@ static int stmmac_open(struct net_device *dev)
         }
 
         /* Copy the MAC addr into the HW  */
-        priv->hw->mac->set_umac_addr(ioaddr, dev->dev_addr, 0);
+        priv->hw->mac->set_umac_addr(priv->ioaddr, dev->dev_addr, 0);
         /* If required, perform hw setup of the bus. */
         if (priv->bus_setup)
-                priv->bus_setup(ioaddr);
+                priv->bus_setup(priv->ioaddr);
         /* Initialize the MAC Core */
-        priv->hw->mac->core_init(ioaddr);
+        priv->hw->mac->core_init(priv->ioaddr);
+
+        priv->rx_coe = priv->hw->mac->rx_coe(priv->ioaddr);
+        if (priv->rx_coe)
+                pr_info("stmmac: Rx Checksum Offload Engine supported\n");
+        if (priv->tx_coe)
+                pr_info("\tTX Checksum insertion supported\n");
 
         priv->shutdown = 0;
 
         /* Initialise the MMC (if present) to disable all interrupts. */
-        writel(0xffffffff, ioaddr + MMC_HIGH_INTR_MASK);
-        writel(0xffffffff, ioaddr + MMC_LOW_INTR_MASK);
+        writel(0xffffffff, priv->ioaddr + MMC_HIGH_INTR_MASK);
+        writel(0xffffffff, priv->ioaddr + MMC_LOW_INTR_MASK);
 
         /* Enable the MAC Rx/Tx */
-        stmmac_mac_enable_rx(ioaddr);
-        stmmac_mac_enable_tx(ioaddr);
+        stmmac_mac_enable_rx(priv->ioaddr);
+        stmmac_mac_enable_tx(priv->ioaddr);
 
         /* Set the HW DMA mode and the COE */
         stmmac_dma_operation_mode(priv);
@@ -877,16 +869,16 @@ static int stmmac_open(struct net_device *dev)
 
         /* Start the ball rolling... */
         DBG(probe, DEBUG, "%s: DMA RX/TX processes started...\n", dev->name);
-        priv->hw->dma->start_tx(ioaddr);
-        priv->hw->dma->start_rx(ioaddr);
+        priv->hw->dma->start_tx(priv->ioaddr);
+        priv->hw->dma->start_rx(priv->ioaddr);
 
 #ifdef CONFIG_STMMAC_TIMER
         priv->tm->timer_start(tmrate);
 #endif
         /* Dump DMA/MAC registers */
         if (netif_msg_hw(priv)) {
-                priv->hw->mac->dump_regs(ioaddr);
-                priv->hw->dma->dump_regs(ioaddr);
+                priv->hw->mac->dump_regs(priv->ioaddr);
+                priv->hw->dma->dump_regs(priv->ioaddr);
         }
 
         if (priv->phydev)
@@ -930,15 +922,15 @@ static int stmmac_release(struct net_device *dev)
         free_irq(dev->irq, dev);
 
         /* Stop TX/RX DMA and clear the descriptors */
-        priv->hw->dma->stop_tx(dev->base_addr);
-        priv->hw->dma->stop_rx(dev->base_addr);
+        priv->hw->dma->stop_tx(priv->ioaddr);
+        priv->hw->dma->stop_rx(priv->ioaddr);
 
         /* Release and free the Rx/Tx resources */
         free_dma_desc_resources(priv);
 
         /* Disable the MAC core */
-        stmmac_mac_disable_tx(dev->base_addr);
-        stmmac_mac_disable_rx(dev->base_addr);
+        stmmac_mac_disable_tx(priv->ioaddr);
+        stmmac_mac_disable_rx(priv->ioaddr);
 
         netif_carrier_off(dev);
 
@@ -1066,7 +1058,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return stmmac_sw_tso(priv, skb);
 
         if (likely((skb->ip_summed == CHECKSUM_PARTIAL))) {
-                if (likely(priv->tx_coe == NO_HW_CSUM))
+                if (unlikely((!priv->tx_coe) || (priv->no_csum_insertion)))
                         skb_checksum_help(skb);
                 else
                         csum_insertion = 1;
@@ -1140,7 +1132,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         dev->stats.tx_bytes += skb->len;
 
-        priv->hw->dma->enable_dma_transmission(dev->base_addr);
+        priv->hw->dma->enable_dma_transmission(priv->ioaddr);
 
         return NETDEV_TX_OK;
 }
@@ -1256,7 +1248,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 
                         if (unlikely(status == csum_none)) {
                                 /* always for the old mac 10/100 */
-                                skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(skb);
                                 netif_receive_skb(skb);
                         } else {
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1390,6 +1382,15 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* Some GMAC devices have a bugged Jumbo frame support that
+         * needs to have the Tx COE disabled for oversized frames
+         * (due to limited buffer sizes). In this case we disable
+         * the TX csum insertionin the TDES and not use SF. */
+        if ((priv->bugged_jumbo) && (priv->dev->mtu > ETH_DATA_LEN))
+                priv->no_csum_insertion = 1;
+        else
+                priv->no_csum_insertion = 0;
+
         dev->mtu = new_mtu;
 
         return 0;
@@ -1405,11 +1406,9 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
                 return IRQ_NONE;
         }
 
-        if (priv->is_gmac) {
-                unsigned long ioaddr = dev->base_addr;
+        if (priv->is_gmac)
                 /* To handle GMAC own interrupts */
-                priv->hw->mac->host_irq_status(ioaddr);
-        }
+                priv->hw->mac->host_irq_status((void __iomem *) dev->base_addr);
 
         stmmac_dma_interrupt(priv);
 
@@ -1512,9 +1511,6 @@ static int stmmac_probe(struct net_device *dev)
 #endif
         priv->msg_enable = netif_msg_init(debug, default_msg_level);
 
-        if (priv->is_gmac)
-                priv->rx_csum = 1;
-
         if (flow_ctrl)
                 priv->flow_ctrl = FLOW_AUTO;    /* RX/TX pause on */
 
@@ -1522,7 +1518,8 @@ static int stmmac_probe(struct net_device *dev)
         netif_napi_add(dev, &priv->napi, stmmac_poll, 64);
 
         /* Get the MAC address */
-        priv->hw->mac->get_umac_addr(dev->base_addr, dev->dev_addr, 0);
+        priv->hw->mac->get_umac_addr((void __iomem *) dev->base_addr,
+                                     dev->dev_addr, 0);
 
         if (!is_valid_ether_addr(dev->dev_addr))
                 pr_warning("\tno valid MAC address;"
@@ -1552,14 +1549,13 @@ static int stmmac_probe(struct net_device *dev)
 static int stmmac_mac_device_setup(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
 
         struct mac_device_info *device;
 
         if (priv->is_gmac)
-                device = dwmac1000_setup(ioaddr);
+                device = dwmac1000_setup(priv->ioaddr);
         else
-                device = dwmac100_setup(ioaddr);
+                device = dwmac100_setup(priv->ioaddr);
 
         if (!device)
                 return -ENOMEM;
@@ -1572,9 +1568,8 @@ static int stmmac_mac_device_setup(struct net_device *dev)
 
         priv->hw = device;
 
-        priv->wolenabled = priv->hw->pmt;       /* PMT supported */
-        if (priv->wolenabled == PMT_SUPPORTED)
-                priv->wolopts = WAKE_MAGIC;             /* Magic Frame */
+        if (device_can_wakeup(priv->device))
+                priv->wolopts = WAKE_MAGIC; /* Magic Frame as default */
 
         return 0;
 }
@@ -1653,7 +1648,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
 {
         int ret = 0;
         struct resource *res;
-        unsigned int *addr = NULL;
+        void __iomem *addr = NULL;
         struct net_device *ndev = NULL;
         struct stmmac_priv *priv;
         struct plat_stmmacenet_data *plat_dat;
@@ -1664,7 +1659,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
                 ret = -ENODEV;
                 goto out;
         }
-        pr_info("done!\n");
+        pr_info("\tdone!\n");
 
         if (!request_mem_region(res->start, resource_size(res),
                                 pdev->name)) {
@@ -1706,8 +1701,18 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         plat_dat = pdev->dev.platform_data;
         priv->bus_id = plat_dat->bus_id;
         priv->pbl = plat_dat->pbl;      /* TLI */
+        priv->mii_clk_csr = plat_dat->clk_csr;
+        priv->tx_coe = plat_dat->tx_coe;
+        priv->bugged_jumbo = plat_dat->bugged_jumbo;
         priv->is_gmac = plat_dat->has_gmac;     /* GMAC is on board */
         priv->enh_desc = plat_dat->enh_desc;
+        priv->ioaddr = addr;
+
+        /* PMT module is not integrated in all the MAC devices. */
+        if (plat_dat->pmt) {
+                pr_info("\tPMT module supported\n");
+                device_set_wakeup_capable(&pdev->dev, 1);
+        }
 
         platform_set_drvdata(pdev, ndev);
 
@@ -1743,8 +1748,8 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         priv->bsp_priv = plat_dat->bsp_priv;
 
         pr_info("\t%s - (dev. name: %s - id: %d, IRQ #%d\n"
-               "\tIO base addr: 0x%08x)\n", ndev->name, pdev->name,
-               pdev->id, ndev->irq, (unsigned int)addr);
+               "\tIO base addr: 0x%p)\n", ndev->name, pdev->name,
+               pdev->id, ndev->irq, addr);
 
         /* MDIO bus Registration */
         pr_debug("\tMDIO bus (id: %d)...", priv->bus_id);
@@ -1779,11 +1784,11 @@ static int stmmac_dvr_remove(struct platform_device *pdev)
 
         pr_info("%s:\n\tremoving driver", __func__);
 
-        priv->hw->dma->stop_rx(ndev->base_addr);
-        priv->hw->dma->stop_tx(ndev->base_addr);
+        priv->hw->dma->stop_rx(priv->ioaddr);
+        priv->hw->dma->stop_tx(priv->ioaddr);
 
-        stmmac_mac_disable_rx(ndev->base_addr);
-        stmmac_mac_disable_tx(ndev->base_addr);
+        stmmac_mac_disable_rx(priv->ioaddr);
+        stmmac_mac_disable_tx(priv->ioaddr);
 
         netif_carrier_off(ndev);
 
@@ -1792,7 +1797,7 @@ static int stmmac_dvr_remove(struct platform_device *pdev)
         platform_set_drvdata(pdev, NULL);
         unregister_netdev(ndev);
 
-        iounmap((void *)ndev->base_addr);
+        iounmap((void *)priv->ioaddr);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(res->start, resource_size(res));
 
@@ -1827,23 +1832,20 @@ static int stmmac_suspend(struct platform_device *pdev, pm_message_t state)
                 napi_disable(&priv->napi);
 
                 /* Stop TX/RX DMA */
-                priv->hw->dma->stop_tx(dev->base_addr);
-                priv->hw->dma->stop_rx(dev->base_addr);
+                priv->hw->dma->stop_tx(priv->ioaddr);
+                priv->hw->dma->stop_rx(priv->ioaddr);
                 /* Clear the Rx/Tx descriptors */
                 priv->hw->desc->init_rx_desc(priv->dma_rx, priv->dma_rx_size,
                                              dis_ic);
                 priv->hw->desc->init_tx_desc(priv->dma_tx, priv->dma_tx_size);
 
-                stmmac_mac_disable_tx(dev->base_addr);
+                stmmac_mac_disable_tx(priv->ioaddr);
 
-                if (device_may_wakeup(&(pdev->dev))) {
-                        /* Enable Power down mode by programming the PMT regs */
-                        if (priv->wolenabled == PMT_SUPPORTED)
-                                priv->hw->mac->pmt(dev->base_addr,
-                                                   priv->wolopts);
-                } else {
-                        stmmac_mac_disable_rx(dev->base_addr);
-                }
+                /* Enable Power down mode by programming the PMT regs */
+                if (device_can_wakeup(priv->device))
+                        priv->hw->mac->pmt(priv->ioaddr, priv->wolopts);
+                else
+                        stmmac_mac_disable_rx(priv->ioaddr);
         } else {
                 priv->shutdown = 1;
                 /* Although this can appear slightly redundant it actually
@@ -1860,7 +1862,6 @@ static int stmmac_resume(struct platform_device *pdev)
 {
         struct net_device *dev = platform_get_drvdata(pdev);
         struct stmmac_priv *priv = netdev_priv(dev);
-        unsigned long ioaddr = dev->base_addr;
 
         if (!netif_running(dev))
                 return 0;
@@ -1879,17 +1880,16 @@ static int stmmac_resume(struct platform_device *pdev)
          * is received. Anyway, it's better to manually clear
          * this bit because it can generate problems while resuming
          * from another devices (e.g. serial console). */
-        if (device_may_wakeup(&(pdev->dev)))
-                if (priv->wolenabled == PMT_SUPPORTED)
-                        priv->hw->mac->pmt(dev->base_addr, 0);
+        if (device_can_wakeup(priv->device))
+                priv->hw->mac->pmt(priv->ioaddr, 0);
 
         netif_device_attach(dev);
 
         /* Enable the MAC and DMA */
-        stmmac_mac_enable_rx(ioaddr);
-        stmmac_mac_enable_tx(ioaddr);
-        priv->hw->dma->start_tx(ioaddr);
-        priv->hw->dma->start_rx(ioaddr);
+        stmmac_mac_enable_rx(priv->ioaddr);
+        stmmac_mac_enable_tx(priv->ioaddr);
+        priv->hw->dma->start_tx(priv->ioaddr);
+        priv->hw->dma->start_rx(priv->ioaddr);
 
 #ifdef CONFIG_STMMAC_TIMER
         priv->tm->timer_start(tmrate);
@@ -1968,8 +1968,6 @@ static int __init stmmac_cmdline_opt(char *str)
                         strict_strtoul(opt + 7, 0, (unsigned long *)&buf_sz);
                 else if (!strncmp(opt, "tc:", 3))
                         strict_strtoul(opt + 3, 0, (unsigned long *)&tc);
-                else if (!strncmp(opt, "tx_coe:", 7))
-                        strict_strtoul(opt + 7, 0, (unsigned long *)&tx_coe);
                 else if (!strncmp(opt, "watchdog:", 9))
                         strict_strtoul(opt + 9, 0, (unsigned long *)&watchdog);
                 else if (!strncmp(opt, "flow_ctrl:", 10))
diff --git a/drivers/net/stmmac/stmmac_mdio.c b/drivers/net/stmmac/stmmac_mdio.c
index 40b2c7929719..d7441616357d 100644
--- a/drivers/net/stmmac/stmmac_mdio.c
+++ b/drivers/net/stmmac/stmmac_mdio.c
@@ -47,21 +47,20 @@ static int stmmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 {
         struct net_device *ndev = bus->priv;
         struct stmmac_priv *priv = netdev_priv(ndev);
-        unsigned long ioaddr = ndev->base_addr;
         unsigned int mii_address = priv->hw->mii.addr;
         unsigned int mii_data = priv->hw->mii.data;
 
         int data;
         u16 regValue = (((phyaddr << 11) & (0x0000F800)) |
                         ((phyreg << 6) & (0x000007C0)));
-        regValue |= MII_BUSY;   /* in case of GMAC */
+        regValue |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
 
-        do {} while (((readl(ioaddr + mii_address)) & MII_BUSY) == 1);
-        writel(regValue, ioaddr + mii_address);
-        do {} while (((readl(ioaddr + mii_address)) & MII_BUSY) == 1);
+        do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
+        writel(regValue, priv->ioaddr + mii_address);
+        do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
 
         /* Read the data from the MII data register */
-        data = (int)readl(ioaddr + mii_data);
+        data = (int)readl(priv->ioaddr + mii_data);
 
         return data;
 }
@@ -79,7 +78,6 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
 {
         struct net_device *ndev = bus->priv;
         struct stmmac_priv *priv = netdev_priv(ndev);
-        unsigned long ioaddr = ndev->base_addr;
         unsigned int mii_address = priv->hw->mii.addr;
         unsigned int mii_data = priv->hw->mii.data;
 
@@ -87,17 +85,18 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
             (((phyaddr << 11) & (0x0000F800)) | ((phyreg << 6) & (0x000007C0)))
             | MII_WRITE;
 
-        value |= MII_BUSY;
+        value |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
+
 
         /* Wait until any existing MII operation is complete */
-        do {} while (((readl(ioaddr + mii_address)) & MII_BUSY) == 1);
+        do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
 
         /* Set the MII address register to write */
-        writel(phydata, ioaddr + mii_data);
-        writel(value, ioaddr + mii_address);
+        writel(phydata, priv->ioaddr + mii_data);
+        writel(value, priv->ioaddr + mii_address);
 
         /* Wait until any existing MII operation is complete */
-        do {} while (((readl(ioaddr + mii_address)) & MII_BUSY) == 1);
+        do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
 
         return 0;
 }
@@ -111,7 +110,6 @@ static int stmmac_mdio_reset(struct mii_bus *bus)
 {
         struct net_device *ndev = bus->priv;
         struct stmmac_priv *priv = netdev_priv(ndev);
-        unsigned long ioaddr = ndev->base_addr;
         unsigned int mii_address = priv->hw->mii.addr;
 
         if (priv->phy_reset) {
@@ -123,7 +121,7 @@ static int stmmac_mdio_reset(struct mii_bus *bus)
          * It doesn't complete its reset until at least one clock cycle
          * on MDC, so perform a dummy mdio read.
          */
-        writel(0, ioaddr + mii_address);
+        writel(0, priv->ioaddr + mii_address);
 
         return 0;
 }
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 358c22f9acbe..7d9ec23aabf6 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -436,7 +436,7 @@ static int lance_open( struct net_device *dev )
                 DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
                                           dev->name, i, DREG ));
                 DREG = CSR0_STOP;
-                return( -EIO );
+                return -EIO;
         }
 
         DREG = CSR0_IDON | CSR0_STRT | CSR0_INEA;
@@ -445,7 +445,7 @@ static int lance_open( struct net_device *dev )
 
         DPRINTK( 2, ( "%s: LANCE is open, csr0 %04x\n", dev->name, DREG ));
 
-        return( 0 );
+        return 0;
 }
 
 
diff --git a/drivers/net/sunbmac.c b/drivers/net/sunbmac.c
index 618643e3ca3e..0a6a5ced3c1c 100644
--- a/drivers/net/sunbmac.c
+++ b/drivers/net/sunbmac.c
@@ -617,7 +617,7 @@ static void bigmac_begin_auto_negotiation(struct bigmac *bp)
         bp->timer_ticks = 0;
         bp->bigmac_timer.expires = jiffies + (12 * HZ) / 10;
         bp->bigmac_timer.data = (unsigned long) bp;
-        bp->bigmac_timer.function = &bigmac_timer;
+        bp->bigmac_timer.function = bigmac_timer;
         add_timer(&bp->bigmac_timer);
 }
 
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
index 2678588ea4b2..8b5aeca24d5d 100644
--- a/drivers/net/sundance.c
+++ b/drivers/net/sundance.c
@@ -96,6 +96,7 @@ static char *media[MAX_UNITS];
 #include <asm/io.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
+#include <linux/dma-mapping.h>
 #ifndef _COMPAT_WITH_OLD_KERNEL
 #include <linux/crc32.h>
 #include <linux/ethtool.h>
@@ -523,13 +524,15 @@ static int __devinit sundance_probe1 (struct pci_dev *pdev,
         tasklet_init(&np->rx_tasklet, rx_poll, (unsigned long)dev);
         tasklet_init(&np->tx_tasklet, tx_poll, (unsigned long)dev);
 
-        ring_space = pci_alloc_consistent(pdev, TX_TOTAL_SIZE, &ring_dma);
+        ring_space = dma_alloc_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                        &ring_dma, GFP_KERNEL);
         if (!ring_space)
                 goto err_out_cleardev;
         np->tx_ring = (struct netdev_desc *)ring_space;
         np->tx_ring_dma = ring_dma;
 
-        ring_space = pci_alloc_consistent(pdev, RX_TOTAL_SIZE, &ring_dma);
+        ring_space = dma_alloc_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                        &ring_dma, GFP_KERNEL);
         if (!ring_space)
                 goto err_out_unmap_tx;
         np->rx_ring = (struct netdev_desc *)ring_space;
@@ -663,9 +666,11 @@ static int __devinit sundance_probe1 (struct pci_dev *pdev,
 err_out_unregister:
         unregister_netdev(dev);
 err_out_unmap_rx:
-        pci_free_consistent(pdev, RX_TOTAL_SIZE, np->rx_ring, np->rx_ring_dma);
+        dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                np->rx_ring, np->rx_ring_dma);
 err_out_unmap_tx:
-        pci_free_consistent(pdev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma);
+        dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                np->tx_ring, np->tx_ring_dma);
 err_out_cleardev:
         pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
@@ -874,7 +879,7 @@ static int netdev_open(struct net_device *dev)
         init_timer(&np->timer);
         np->timer.expires = jiffies + 3*HZ;
         np->timer.data = (unsigned long)dev;
-        np->timer.function = &netdev_timer;                             /* timer handler */
+        np->timer.function = netdev_timer;                              /* timer handler */
         add_timer(&np->timer);
 
         /* Enable interrupts by setting the interrupt mask. */
@@ -1011,8 +1016,14 @@ static void init_ring(struct net_device *dev)
                 skb->dev = dev;         /* Mark as being used by this device. */
                 skb_reserve(skb, 2);    /* 16 byte align the IP header. */
                 np->rx_ring[i].frag[0].addr = cpu_to_le32(
-                        pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz,
-                                PCI_DMA_FROMDEVICE));
+                        dma_map_single(&np->pci_dev->dev, skb->data,
+                                np->rx_buf_sz, DMA_FROM_DEVICE));
+                if (dma_mapping_error(&np->pci_dev->dev,
+                                        np->rx_ring[i].frag[0].addr)) {
+                        dev_kfree_skb(skb);
+                        np->rx_skbuff[i] = NULL;
+                        break;
+                }
                 np->rx_ring[i].frag[0].length = cpu_to_le32(np->rx_buf_sz | LastFrag);
         }
         np->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
@@ -1063,9 +1074,11 @@ start_tx (struct sk_buff *skb, struct net_device *dev)
 
         txdesc->next_desc = 0;
         txdesc->status = cpu_to_le32 ((entry << 2) | DisableAlign);
-        txdesc->frag[0].addr = cpu_to_le32 (pci_map_single (np->pci_dev, skb->data,
-                                                        skb->len,
-                                                        PCI_DMA_TODEVICE));
+        txdesc->frag[0].addr = cpu_to_le32(dma_map_single(&np->pci_dev->dev,
+                                skb->data, skb->len, DMA_TO_DEVICE));
+        if (dma_mapping_error(&np->pci_dev->dev,
+                                txdesc->frag[0].addr))
+                        goto drop_frame;
         txdesc->frag[0].length = cpu_to_le32 (skb->len | LastFrag);
 
         /* Increment cur_tx before tasklet_schedule() */
@@ -1087,6 +1100,12 @@ start_tx (struct sk_buff *skb, struct net_device *dev)
                         dev->name, np->cur_tx, entry);
         }
         return NETDEV_TX_OK;
+
+drop_frame:
+        dev_kfree_skb(skb);
+        np->tx_skbuff[entry] = NULL;
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
 }
 
 /* Reset hardware tx and free all of tx buffers */
@@ -1097,7 +1116,6 @@ reset_tx (struct net_device *dev)
         void __iomem *ioaddr = np->base;
         struct sk_buff *skb;
         int i;
-        int irq = in_interrupt();
 
         /* Reset tx logic, TxListPtr will be cleaned */
         iowrite16 (TxDisable, ioaddr + MACCtrl1);
@@ -1109,13 +1127,10 @@ reset_tx (struct net_device *dev)
 
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->tx_ring[i].frag[0].addr),
-                                skb->len, PCI_DMA_TODEVICE);
-                        if (irq)
-                                dev_kfree_skb_irq (skb);
-                        else
-                                dev_kfree_skb (skb);
+                                skb->len, DMA_TO_DEVICE);
+                        dev_kfree_skb_any(skb);
                         np->tx_skbuff[i] = NULL;
                         dev->stats.tx_dropped++;
                 }
@@ -1233,9 +1248,9 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
                                                 break;
                                 skb = np->tx_skbuff[entry];
                                 /* Free the original skb. */
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(np->tx_ring[entry].frag[0].addr),
-                                        skb->len, PCI_DMA_TODEVICE);
+                                        skb->len, DMA_TO_DEVICE);
                                 dev_kfree_skb_irq (np->tx_skbuff[entry]);
                                 np->tx_skbuff[entry] = NULL;
                                 np->tx_ring[entry].frag[0].addr = 0;
@@ -1252,9 +1267,9 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
                                         break;
                                 skb = np->tx_skbuff[entry];
                                 /* Free the original skb. */
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(np->tx_ring[entry].frag[0].addr),
-                                        skb->len, PCI_DMA_TODEVICE);
+                                        skb->len, DMA_TO_DEVICE);
                                 dev_kfree_skb_irq (np->tx_skbuff[entry]);
                                 np->tx_skbuff[entry] = NULL;
                                 np->tx_ring[entry].frag[0].addr = 0;
@@ -1334,22 +1349,18 @@ static void rx_poll(unsigned long data)
                         if (pkt_len < rx_copybreak &&
                             (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
-                                pci_dma_sync_single_for_cpu(np->pci_dev,
-                                                            le32_to_cpu(desc->frag[0].addr),
-                                                            np->rx_buf_sz,
-                                                            PCI_DMA_FROMDEVICE);
-
+                                dma_sync_single_for_cpu(&np->pci_dev->dev,
+                                                le32_to_cpu(desc->frag[0].addr),
+                                                np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_copy_to_linear_data(skb, np->rx_skbuff[entry]->data, pkt_len);
-                                pci_dma_sync_single_for_device(np->pci_dev,
-                                                               le32_to_cpu(desc->frag[0].addr),
-                                                               np->rx_buf_sz,
-                                                               PCI_DMA_FROMDEVICE);
+                                dma_sync_single_for_device(&np->pci_dev->dev,
+                                                le32_to_cpu(desc->frag[0].addr),
+                                                np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_put(skb, pkt_len);
                         } else {
-                                pci_unmap_single(np->pci_dev,
+                                dma_unmap_single(&np->pci_dev->dev,
                                         le32_to_cpu(desc->frag[0].addr),
-                                        np->rx_buf_sz,
-                                        PCI_DMA_FROMDEVICE);
+                                        np->rx_buf_sz, DMA_FROM_DEVICE);
                                 skb_put(skb = np->rx_skbuff[entry], pkt_len);
                                 np->rx_skbuff[entry] = NULL;
                         }
@@ -1396,8 +1407,14 @@ static void refill_rx (struct net_device *dev)
                         skb->dev = dev;         /* Mark as being used by this device. */
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                         np->rx_ring[entry].frag[0].addr = cpu_to_le32(
-                                pci_map_single(np->pci_dev, skb->data,
-                                        np->rx_buf_sz, PCI_DMA_FROMDEVICE));
+                                dma_map_single(&np->pci_dev->dev, skb->data,
+                                        np->rx_buf_sz, DMA_FROM_DEVICE));
+                        if (dma_mapping_error(&np->pci_dev->dev,
+                                    np->rx_ring[entry].frag[0].addr)) {
+                            dev_kfree_skb_irq(skb);
+                            np->rx_skbuff[entry] = NULL;
+                            break;
+                        }
                 }
                 /* Perhaps we need not reset this field. */
                 np->rx_ring[entry].frag[0].length =
@@ -1715,9 +1732,9 @@ static int netdev_close(struct net_device *dev)
                 np->rx_ring[i].status = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->rx_ring[i].frag[0].addr),
-                                np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                                np->rx_buf_sz, DMA_FROM_DEVICE);
                         dev_kfree_skb(skb);
                         np->rx_skbuff[i] = NULL;
                 }
@@ -1727,9 +1744,9 @@ static int netdev_close(struct net_device *dev)
                 np->tx_ring[i].next_desc = 0;
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single(np->pci_dev,
+                        dma_unmap_single(&np->pci_dev->dev,
                                 le32_to_cpu(np->tx_ring[i].frag[0].addr),
-                                skb->len, PCI_DMA_TODEVICE);
+                                skb->len, DMA_TO_DEVICE);
                         dev_kfree_skb(skb);
                         np->tx_skbuff[i] = NULL;
                 }
@@ -1743,25 +1760,72 @@ static void __devexit sundance_remove1 (struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
 
         if (dev) {
-                struct netdev_private *np = netdev_priv(dev);
-
-                unregister_netdev(dev);
-                pci_free_consistent(pdev, RX_TOTAL_SIZE, np->rx_ring,
-                        np->rx_ring_dma);
-                pci_free_consistent(pdev, TX_TOTAL_SIZE, np->tx_ring,
-                        np->tx_ring_dma);
-                pci_iounmap(pdev, np->base);
-                pci_release_regions(pdev);
-                free_netdev(dev);
-                pci_set_drvdata(pdev, NULL);
+            struct netdev_private *np = netdev_priv(dev);
+            unregister_netdev(dev);
+            dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE,
+                    np->rx_ring, np->rx_ring_dma);
+            dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE,
+                    np->tx_ring, np->tx_ring_dma);
+            pci_iounmap(pdev, np->base);
+            pci_release_regions(pdev);
+            free_netdev(dev);
+            pci_set_drvdata(pdev, NULL);
         }
 }
 
+#ifdef CONFIG_PM
+
+static int sundance_suspend(struct pci_dev *pci_dev, pm_message_t state)
+{
+        struct net_device *dev = pci_get_drvdata(pci_dev);
+
+        if (!netif_running(dev))
+                return 0;
+
+        netdev_close(dev);
+        netif_device_detach(dev);
+
+        pci_save_state(pci_dev);
+        pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
+
+        return 0;
+}
+
+static int sundance_resume(struct pci_dev *pci_dev)
+{
+        struct net_device *dev = pci_get_drvdata(pci_dev);
+        int err = 0;
+
+        if (!netif_running(dev))
+                return 0;
+
+        pci_set_power_state(pci_dev, PCI_D0);
+        pci_restore_state(pci_dev);
+
+        err = netdev_open(dev);
+        if (err) {
+                printk(KERN_ERR "%s: Can't resume interface!\n",
+                                dev->name);
+                goto out;
+        }
+
+        netif_device_attach(dev);
+
+out:
+        return err;
+}
+
+#endif /* CONFIG_PM */
+
 static struct pci_driver sundance_driver = {
         .name           = DRV_NAME,
         .id_table       = sundance_pci_tbl,
         .probe          = sundance_probe1,
         .remove         = __devexit_p(sundance_remove1),
+#ifdef CONFIG_PM
+        .suspend        = sundance_suspend,
+        .resume         = sundance_resume,
+#endif /* CONFIG_PM */
 };
 
 static int __init sundance_init(void)
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 434f9d735333..4ceb3cf6a9a9 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -31,6 +31,8 @@
  *    about when we can start taking interrupts or get xmit() called...
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
@@ -105,7 +107,6 @@ MODULE_DESCRIPTION("Sun GEM Gbit ethernet driver");
 MODULE_LICENSE("GPL");
 
 #define GEM_MODULE_NAME "gem"
-#define PFX GEM_MODULE_NAME ": "
 
 static DEFINE_PCI_DEVICE_TABLE(gem_pci_tbl) = {
         { PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_GEM,
@@ -262,8 +263,7 @@ static int gem_pcs_interrupt(struct net_device *dev, struct gem *gp, u32 gem_sta
                         gp->dev->name, pcs_istat);
 
         if (!(pcs_istat & PCS_ISTAT_LSC)) {
-                printk(KERN_ERR "%s: PCS irq but no link status change???\n",
-                       dev->name);
+                netdev_err(dev, "PCS irq but no link status change???\n");
                 return 0;
         }
 
@@ -282,20 +282,16 @@ static int gem_pcs_interrupt(struct net_device *dev, struct gem *gp, u32 gem_sta
                  * when autoneg has completed.
                  */
                 if (pcs_miistat & PCS_MIISTAT_RF)
-                        printk(KERN_INFO "%s: PCS AutoNEG complete, "
-                               "RemoteFault\n", dev->name);
+                        netdev_info(dev, "PCS AutoNEG complete, RemoteFault\n");
                 else
-                        printk(KERN_INFO "%s: PCS AutoNEG complete.\n",
-                               dev->name);
+                        netdev_info(dev, "PCS AutoNEG complete\n");
         }
 
         if (pcs_miistat & PCS_MIISTAT_LS) {
-                printk(KERN_INFO "%s: PCS link is now up.\n",
-                       dev->name);
+                netdev_info(dev, "PCS link is now up\n");
                 netif_carrier_on(gp->dev);
         } else {
-                printk(KERN_INFO "%s: PCS link is now down.\n",
-                       dev->name);
+                netdev_info(dev, "PCS link is now down\n");
                 netif_carrier_off(gp->dev);
                 /* If this happens and the link timer is not running,
                  * reset so we re-negotiate.
@@ -323,14 +319,12 @@ static int gem_txmac_interrupt(struct net_device *dev, struct gem *gp, u32 gem_s
                 return 0;
 
         if (txmac_stat & MAC_TXSTAT_URUN) {
-                printk(KERN_ERR "%s: TX MAC xmit underrun.\n",
-                       dev->name);
+                netdev_err(dev, "TX MAC xmit underrun\n");
                 gp->net_stats.tx_fifo_errors++;
         }
 
         if (txmac_stat & MAC_TXSTAT_MPE) {
-                printk(KERN_ERR "%s: TX MAC max packet size error.\n",
-                       dev->name);
+                netdev_err(dev, "TX MAC max packet size error\n");
                 gp->net_stats.tx_errors++;
         }
 
@@ -377,8 +371,7 @@ static int gem_rxmac_reset(struct gem *gp)
                 udelay(10);
         }
         if (limit == 5000) {
-                printk(KERN_ERR "%s: RX MAC will not reset, resetting whole "
-                       "chip.\n", dev->name);
+                netdev_err(dev, "RX MAC will not reset, resetting whole chip\n");
                 return 1;
         }
 
@@ -390,8 +383,7 @@ static int gem_rxmac_reset(struct gem *gp)
                 udelay(10);
         }
         if (limit == 5000) {
-                printk(KERN_ERR "%s: RX MAC will not disable, resetting whole "
-                       "chip.\n", dev->name);
+                netdev_err(dev, "RX MAC will not disable, resetting whole chip\n");
                 return 1;
         }
 
@@ -403,8 +395,7 @@ static int gem_rxmac_reset(struct gem *gp)
                 udelay(10);
         }
         if (limit == 5000) {
-                printk(KERN_ERR "%s: RX DMA will not disable, resetting whole "
-                       "chip.\n", dev->name);
+                netdev_err(dev, "RX DMA will not disable, resetting whole chip\n");
                 return 1;
         }
 
@@ -419,8 +410,7 @@ static int gem_rxmac_reset(struct gem *gp)
                 udelay(10);
         }
         if (limit == 5000) {
-                printk(KERN_ERR "%s: RX reset command will not execute, resetting "
-                       "whole chip.\n", dev->name);
+                netdev_err(dev, "RX reset command will not execute, resetting whole chip\n");
                 return 1;
         }
 
@@ -429,8 +419,7 @@ static int gem_rxmac_reset(struct gem *gp)
                 struct gem_rxd *rxd = &gp->init_block->rxd[i];
 
                 if (gp->rx_skbs[i] == NULL) {
-                        printk(KERN_ERR "%s: Parts of RX ring empty, resetting "
-                               "whole chip.\n", dev->name);
+                        netdev_err(dev, "Parts of RX ring empty, resetting whole chip\n");
                         return 1;
                 }
 
@@ -479,8 +468,7 @@ static int gem_rxmac_interrupt(struct net_device *dev, struct gem *gp, u32 gem_s
         if (rxmac_stat & MAC_RXSTAT_OFLW) {
                 u32 smac = readl(gp->regs + MAC_SMACHINE);
 
-                printk(KERN_ERR "%s: RX MAC fifo overflow smac[%08x].\n",
-                                dev->name, smac);
+                netdev_err(dev, "RX MAC fifo overflow smac[%08x]\n", smac);
                 gp->net_stats.rx_over_errors++;
                 gp->net_stats.rx_fifo_errors++;
 
@@ -542,19 +530,18 @@ static int gem_pci_interrupt(struct net_device *dev, struct gem *gp, u32 gem_sta
 
         if (gp->pdev->vendor == PCI_VENDOR_ID_SUN &&
             gp->pdev->device == PCI_DEVICE_ID_SUN_GEM) {
-                printk(KERN_ERR "%s: PCI error [%04x] ",
-                       dev->name, pci_estat);
+                netdev_err(dev, "PCI error [%04x]", pci_estat);
 
                 if (pci_estat & GREG_PCIESTAT_BADACK)
-                        printk("<No ACK64# during ABS64 cycle> ");
+                        pr_cont(" <No ACK64# during ABS64 cycle>");
                 if (pci_estat & GREG_PCIESTAT_DTRTO)
-                        printk("<Delayed transaction timeout> ");
+                        pr_cont(" <Delayed transaction timeout>");
                 if (pci_estat & GREG_PCIESTAT_OTHER)
-                        printk("<other>");
-                printk("\n");
+                        pr_cont(" <other>");
+                pr_cont("\n");
         } else {
                 pci_estat |= GREG_PCIESTAT_OTHER;
-                printk(KERN_ERR "%s: PCI error\n", dev->name);
+                netdev_err(dev, "PCI error\n");
         }
 
         if (pci_estat & GREG_PCIESTAT_OTHER) {
@@ -565,26 +552,20 @@ static int gem_pci_interrupt(struct net_device *dev, struct gem *gp, u32 gem_sta
                  */
                 pci_read_config_word(gp->pdev, PCI_STATUS,
                                      &pci_cfg_stat);
-                printk(KERN_ERR "%s: Read PCI cfg space status [%04x]\n",
-                       dev->name, pci_cfg_stat);
+                netdev_err(dev, "Read PCI cfg space status [%04x]\n",
+                           pci_cfg_stat);
                 if (pci_cfg_stat & PCI_STATUS_PARITY)
-                        printk(KERN_ERR "%s: PCI parity error detected.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI parity error detected\n");
                 if (pci_cfg_stat & PCI_STATUS_SIG_TARGET_ABORT)
-                        printk(KERN_ERR "%s: PCI target abort.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI target abort\n");
                 if (pci_cfg_stat & PCI_STATUS_REC_TARGET_ABORT)
-                        printk(KERN_ERR "%s: PCI master acks target abort.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI master acks target abort\n");
                 if (pci_cfg_stat & PCI_STATUS_REC_MASTER_ABORT)
-                        printk(KERN_ERR "%s: PCI master abort.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI master abort\n");
                 if (pci_cfg_stat & PCI_STATUS_SIG_SYSTEM_ERROR)
-                        printk(KERN_ERR "%s: PCI system error SERR#.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI system error SERR#\n");
                 if (pci_cfg_stat & PCI_STATUS_DETECTED_PARITY)
-                        printk(KERN_ERR "%s: PCI parity error.\n",
-                               dev->name);
+                        netdev_err(dev, "PCI parity error\n");
 
                 /* Write the error bits back to clear them. */
                 pci_cfg_stat &= (PCI_STATUS_PARITY |
@@ -874,8 +855,7 @@ static int gem_rx(struct gem *gp, int work_to_do)
         gp->rx_new = entry;
 
         if (drops)
-                printk(KERN_INFO "%s: Memory squeeze, deferring packet.\n",
-                       gp->dev->name);
+                netdev_info(gp->dev, "Memory squeeze, deferring packet\n");
 
         return work_done;
 }
@@ -981,21 +961,19 @@ static void gem_tx_timeout(struct net_device *dev)
 {
         struct gem *gp = netdev_priv(dev);
 
-        printk(KERN_ERR "%s: transmit timed out, resetting\n", dev->name);
+        netdev_err(dev, "transmit timed out, resetting\n");
         if (!gp->running) {
-                printk("%s: hrm.. hw not running !\n", dev->name);
+                netdev_err(dev, "hrm.. hw not running !\n");
                 return;
         }
-        printk(KERN_ERR "%s: TX_STATE[%08x:%08x:%08x]\n",
-               dev->name,
-               readl(gp->regs + TXDMA_CFG),
-               readl(gp->regs + MAC_TXSTAT),
-               readl(gp->regs + MAC_TXCFG));
-        printk(KERN_ERR "%s: RX_STATE[%08x:%08x:%08x]\n",
-               dev->name,
-               readl(gp->regs + RXDMA_CFG),
-               readl(gp->regs + MAC_RXSTAT),
-               readl(gp->regs + MAC_RXCFG));
+        netdev_err(dev, "TX_STATE[%08x:%08x:%08x]\n",
+                   readl(gp->regs + TXDMA_CFG),
+                   readl(gp->regs + MAC_TXSTAT),
+                   readl(gp->regs + MAC_TXCFG));
+        netdev_err(dev, "RX_STATE[%08x:%08x:%08x]\n",
+                   readl(gp->regs + RXDMA_CFG),
+                   readl(gp->regs + MAC_RXSTAT),
+                   readl(gp->regs + MAC_RXCFG));
 
         spin_lock_irq(&gp->lock);
         spin_lock(&gp->tx_lock);
@@ -1048,8 +1026,7 @@ static netdev_tx_t gem_start_xmit(struct sk_buff *skb,
         if (TX_BUFFS_AVAIL(gp) <= (skb_shinfo(skb)->nr_frags + 1)) {
                 netif_stop_queue(dev);
                 spin_unlock_irqrestore(&gp->tx_lock, flags);
-                printk(KERN_ERR PFX "%s: BUG! Tx Ring full when queue awake!\n",
-                       dev->name);
+                netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");
                 return NETDEV_TX_BUSY;
         }
 
@@ -1158,8 +1135,7 @@ static void gem_pcs_reset(struct gem *gp)
                         break;
         }
         if (limit < 0)
-                printk(KERN_WARNING "%s: PCS reset bit would not clear.\n",
-                       gp->dev->name);
+                netdev_warn(gp->dev, "PCS reset bit would not clear\n");
 }
 
 static void gem_pcs_reinit_adv(struct gem *gp)
@@ -1230,7 +1206,7 @@ static void gem_reset(struct gem *gp)
         } while (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST));
 
         if (limit < 0)
-                printk(KERN_ERR "%s: SW reset is ghetto.\n", gp->dev->name);
+                netdev_err(gp->dev, "SW reset is ghetto\n");
 
         if (gp->phy_type == phy_serialink || gp->phy_type == phy_serdes)
                 gem_pcs_reinit_adv(gp);
@@ -1395,9 +1371,8 @@ static int gem_set_link_modes(struct gem *gp)
                 speed = SPEED_1000;
         }
 
-        if (netif_msg_link(gp))
-                printk(KERN_INFO "%s: Link is up at %d Mbps, %s-duplex.\n",
-                        gp->dev->name, speed, (full_duplex ? "full" : "half"));
+        netif_info(gp, link, gp->dev, "Link is up at %d Mbps, %s-duplex\n",
+                   speed, (full_duplex ? "full" : "half"));
 
         if (!gp->running)
                 return 0;
@@ -1451,15 +1426,13 @@ static int gem_set_link_modes(struct gem *gp)
 
         if (netif_msg_link(gp)) {
                 if (pause) {
-                        printk(KERN_INFO "%s: Pause is enabled "
-                               "(rxfifo: %d off: %d on: %d)\n",
-                               gp->dev->name,
-                               gp->rx_fifo_sz,
-                               gp->rx_pause_off,
-                               gp->rx_pause_on);
+                        netdev_info(gp->dev,
+                                    "Pause is enabled (rxfifo: %d off: %d on: %d)\n",
+                                    gp->rx_fifo_sz,
+                                    gp->rx_pause_off,
+                                    gp->rx_pause_on);
                 } else {
-                        printk(KERN_INFO "%s: Pause is disabled\n",
-                               gp->dev->name);
+                        netdev_info(gp->dev, "Pause is disabled\n");
                 }
         }
 
@@ -1484,9 +1457,8 @@ static int gem_mdio_link_not_up(struct gem *gp)
 {
         switch (gp->lstate) {
         case link_force_ret:
-                if (netif_msg_link(gp))
-                        printk(KERN_INFO "%s: Autoneg failed again, keeping"
-                                " forced mode\n", gp->dev->name);
+                netif_info(gp, link, gp->dev,
+                           "Autoneg failed again, keeping forced mode\n");
                 gp->phy_mii.def->ops->setup_forced(&gp->phy_mii,
                         gp->last_forced_speed, DUPLEX_HALF);
                 gp->timer_ticks = 5;
@@ -1499,9 +1471,7 @@ static int gem_mdio_link_not_up(struct gem *gp)
                  */
                 if (gp->phy_mii.def->magic_aneg)
                         return 1;
-                if (netif_msg_link(gp))
-                        printk(KERN_INFO "%s: switching to forced 100bt\n",
-                                gp->dev->name);
+                netif_info(gp, link, gp->dev, "switching to forced 100bt\n");
                 /* Try forced modes. */
                 gp->phy_mii.def->ops->setup_forced(&gp->phy_mii, SPEED_100,
                         DUPLEX_HALF);
@@ -1517,9 +1487,8 @@ static int gem_mdio_link_not_up(struct gem *gp)
                         gp->phy_mii.def->ops->setup_forced(&gp->phy_mii, SPEED_10,
                                 DUPLEX_HALF);
                         gp->timer_ticks = 5;
-                        if (netif_msg_link(gp))
-                                printk(KERN_INFO "%s: switching to forced 10bt\n",
-                                        gp->dev->name);
+                        netif_info(gp, link, gp->dev,
+                                   "switching to forced 10bt\n");
                         return 0;
                 } else
                         return 1;
@@ -1574,8 +1543,8 @@ static void gem_link_timer(unsigned long data)
                         gp->last_forced_speed = gp->phy_mii.speed;
                         gp->timer_ticks = 5;
                         if (netif_msg_link(gp))
-                                printk(KERN_INFO "%s: Got link after fallback, retrying"
-                                        " autoneg once...\n", gp->dev->name);
+                                netdev_info(gp->dev,
+                                            "Got link after fallback, retrying autoneg once...\n");
                         gp->phy_mii.def->ops->setup_aneg(&gp->phy_mii, gp->phy_mii.advertising);
                 } else if (gp->lstate != link_up) {
                         gp->lstate = link_up;
@@ -1589,9 +1558,7 @@ static void gem_link_timer(unsigned long data)
                  */
                 if (gp->lstate == link_up) {
                         gp->lstate = link_down;
-                        if (netif_msg_link(gp))
-                                printk(KERN_INFO "%s: Link down\n",
-                                        gp->dev->name);
+                        netif_info(gp, link, gp->dev, "Link down\n");
                         netif_carrier_off(gp->dev);
                         gp->reset_task_pending = 1;
                         schedule_work(&gp->reset_task);
@@ -1746,8 +1713,7 @@ static void gem_init_phy(struct gem *gp)
                         if (phy_read(gp, MII_BMCR) != 0xffff)
                                 break;
                         if (i == 2)
-                                printk(KERN_WARNING "%s: GMAC PHY not responding !\n",
-                                       gp->dev->name);
+                                netdev_warn(gp->dev, "GMAC PHY not responding !\n");
                 }
         }
 
@@ -2038,7 +2004,7 @@ static int gem_check_invariants(struct gem *gp)
                  * as this chip has no gigabit PHY.
                  */
                 if ((mif_cfg & (MIF_CFG_MDI0 | MIF_CFG_MDI1)) == 0) {
-                        printk(KERN_ERR PFX "RIO GEM lacks MII phy, mif_cfg[%08x]\n",
+                        pr_err("RIO GEM lacks MII phy, mif_cfg[%08x]\n",
                                mif_cfg);
                         return -1;
                 }
@@ -2078,7 +2044,7 @@ static int gem_check_invariants(struct gem *gp)
                 }
                 if (i == 32) {
                         if (pdev->device != PCI_DEVICE_ID_SUN_GEM) {
-                                printk(KERN_ERR PFX "RIO MII phy will not respond.\n");
+                                pr_err("RIO MII phy will not respond\n");
                                 return -1;
                         }
                         gp->phy_type = phy_serdes;
@@ -2093,7 +2059,7 @@ static int gem_check_invariants(struct gem *gp)
                 if (pdev->device == PCI_DEVICE_ID_SUN_GEM) {
                         if (gp->tx_fifo_sz != (9 * 1024) ||
                             gp->rx_fifo_sz != (20 * 1024)) {
-                                printk(KERN_ERR PFX "GEM has bogus fifo sizes tx(%d) rx(%d)\n",
+                                pr_err("GEM has bogus fifo sizes tx(%d) rx(%d)\n",
                                        gp->tx_fifo_sz, gp->rx_fifo_sz);
                                 return -1;
                         }
@@ -2101,7 +2067,7 @@ static int gem_check_invariants(struct gem *gp)
                 } else {
                         if (gp->tx_fifo_sz != (2 * 1024) ||
                             gp->rx_fifo_sz != (2 * 1024)) {
-                                printk(KERN_ERR PFX "RIO GEM has bogus fifo sizes tx(%d) rx(%d)\n",
+                                pr_err("RIO GEM has bogus fifo sizes tx(%d) rx(%d)\n",
                                        gp->tx_fifo_sz, gp->rx_fifo_sz);
                                 return -1;
                         }
@@ -2239,7 +2205,7 @@ static int gem_do_start(struct net_device *dev)
 
         if (request_irq(gp->pdev->irq, gem_interrupt,
                                    IRQF_SHARED, dev->name, (void *)dev)) {
-                printk(KERN_ERR "%s: failed to request irq !\n", gp->dev->name);
+                netdev_err(dev, "failed to request irq !\n");
 
                 spin_lock_irqsave(&gp->lock, flags);
                 spin_lock(&gp->tx_lock);
@@ -2378,9 +2344,8 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
 
         mutex_lock(&gp->pm_mutex);
 
-        printk(KERN_INFO "%s: suspending, WakeOnLan %s\n",
-               dev->name,
-               (gp->wake_on_lan && gp->opened) ? "enabled" : "disabled");
+        netdev_info(dev, "suspending, WakeOnLan %s\n",
+                    (gp->wake_on_lan && gp->opened) ? "enabled" : "disabled");
 
         /* Keep the cell enabled during the entire operation */
         spin_lock_irqsave(&gp->lock, flags);
@@ -2440,7 +2405,7 @@ static int gem_resume(struct pci_dev *pdev)
         struct gem *gp = netdev_priv(dev);
         unsigned long flags;
 
-        printk(KERN_INFO "%s: resuming\n", dev->name);
+        netdev_info(dev, "resuming\n");
 
         mutex_lock(&gp->pm_mutex);
 
@@ -2452,8 +2417,7 @@ static int gem_resume(struct pci_dev *pdev)
 
         /* Make sure PCI access and bus master are enabled */
         if (pci_enable_device(gp->pdev)) {
-                printk(KERN_ERR "%s: Can't re-enable chip !\n",
-                       dev->name);
+                netdev_err(dev, "Can't re-enable chip !\n");
                 /* Put cell and forget it for now, it will be considered as
                  * still asleep, a new sleep cycle may bring it back
                  */
@@ -2938,7 +2902,7 @@ static int __devinit gem_get_device_address(struct gem *gp)
                 addr = idprom->id_ethaddr;
 #else
                 printk("\n");
-                printk(KERN_ERR "%s: can't get mac-address\n", dev->name);
+                pr_err("%s: can't get mac-address\n", dev->name);
                 return -1;
 #endif
         }
@@ -3009,14 +2973,12 @@ static const struct net_device_ops gem_netdev_ops = {
 static int __devinit gem_init_one(struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
-        static int gem_version_printed = 0;
         unsigned long gemreg_base, gemreg_len;
         struct net_device *dev;
         struct gem *gp;
         int err, pci_using_dac;
 
-        if (gem_version_printed++ == 0)
-                printk(KERN_INFO "%s", version);
+        printk_once(KERN_INFO "%s", version);
 
         /* Apple gmac note: during probe, the chip is powered up by
          * the arch code to allow the code below to work (and to let
@@ -3026,8 +2988,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
          */
         err = pci_enable_device(pdev);
         if (err) {
-                printk(KERN_ERR PFX "Cannot enable MMIO operation, "
-                       "aborting.\n");
+                pr_err("Cannot enable MMIO operation, aborting\n");
                 return err;
         }
         pci_set_master(pdev);
@@ -3048,8 +3009,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
         } else {
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (err) {
-                        printk(KERN_ERR PFX "No usable DMA configuration, "
-                               "aborting.\n");
+                        pr_err("No usable DMA configuration, aborting\n");
                         goto err_disable_device;
                 }
                 pci_using_dac = 0;
@@ -3059,15 +3019,14 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
         gemreg_len = pci_resource_len(pdev, 0);
 
         if ((pci_resource_flags(pdev, 0) & IORESOURCE_IO) != 0) {
-                printk(KERN_ERR PFX "Cannot find proper PCI device "
-                       "base address, aborting.\n");
+                pr_err("Cannot find proper PCI device base address, aborting\n");
                 err = -ENODEV;
                 goto err_disable_device;
         }
 
         dev = alloc_etherdev(sizeof(*gp));
         if (!dev) {
-                printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+                pr_err("Etherdev alloc failed, aborting\n");
                 err = -ENOMEM;
                 goto err_disable_device;
         }
@@ -3077,8 +3036,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
 
         err = pci_request_regions(pdev, DRV_NAME);
         if (err) {
-                printk(KERN_ERR PFX "Cannot obtain PCI resources, "
-                       "aborting.\n");
+                pr_err("Cannot obtain PCI resources, aborting\n");
                 goto err_out_free_netdev;
         }
 
@@ -3104,8 +3062,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
 
         gp->regs = ioremap(gemreg_base, gemreg_len);
         if (!gp->regs) {
-                printk(KERN_ERR PFX "Cannot map device registers, "
-                       "aborting.\n");
+                pr_err("Cannot map device registers, aborting\n");
                 err = -EIO;
                 goto err_out_free_res;
         }
@@ -3150,8 +3107,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
                 pci_alloc_consistent(pdev, sizeof(struct gem_init_block),
                                      &gp->gblock_dvma);
         if (!gp->init_block) {
-                printk(KERN_ERR PFX "Cannot allocate init block, "
-                       "aborting.\n");
+                pr_err("Cannot allocate init block, aborting\n");
                 err = -ENOMEM;
                 goto err_out_iounmap;
         }
@@ -3180,19 +3136,18 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
 
         /* Register with kernel */
         if (register_netdev(dev)) {
-                printk(KERN_ERR PFX "Cannot register net device, "
-                       "aborting.\n");
+                pr_err("Cannot register net device, aborting\n");
                 err = -ENOMEM;
                 goto err_out_free_consistent;
         }
 
-        printk(KERN_INFO "%s: Sun GEM (PCI) 10/100/1000BaseT Ethernet %pM\n",
-               dev->name, dev->dev_addr);
+        netdev_info(dev, "Sun GEM (PCI) 10/100/1000BaseT Ethernet %pM\n",
+                    dev->dev_addr);
 
         if (gp->phy_type == phy_mii_mdio0 ||
             gp->phy_type == phy_mii_mdio1)
-                printk(KERN_INFO "%s: Found %s PHY\n", dev->name,
-                        gp->phy_mii.def ? gp->phy_mii.def->name : "no");
+                netdev_info(dev, "Found %s PHY\n",
+                            gp->phy_mii.def ? gp->phy_mii.def->name : "no");
 
         /* GEM can do it all... */
         dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_LLTX;
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index 78f8cee5fd74..d16880d7099b 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -88,7 +88,7 @@ static int reset_one_mii_phy(struct mii_phy* phy, int phy_id)
         if ((val & BMCR_ISOLATE) && limit > 0)
                 __phy_write(phy, phy_id, MII_BMCR, val & ~BMCR_ISOLATE);
 
-        return (limit <= 0);
+        return limit <= 0;
 }
 
 static int bcm5201_init(struct mii_phy* phy)
@@ -1175,7 +1175,8 @@ int mii_phy_probe(struct mii_phy *phy, int mii_id)
 
         /* Read ID and find matching entry */
         id = (phy_read(phy, MII_PHYSID1) << 16 | phy_read(phy, MII_PHYSID2));
-        printk(KERN_DEBUG "PHY ID: %x, addr: %x\n", id, mii_id);
+        printk(KERN_DEBUG KBUILD_MODNAME ": " "PHY ID: %x, addr: %x\n",
+               id, mii_id);
         for (i=0; (def = mii_phy_table[i]) != NULL; i++)
                 if ((id & def->phy_id_mask) == def->phy_id)
                         break;
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index bd0df1c14955..5e28c414421a 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -1409,7 +1409,7 @@ force_link:
         hp->timer_ticks = 0;
         hp->happy_timer.expires = jiffies + (12 * HZ)/10;  /* 1.2 sec. */
         hp->happy_timer.data = (unsigned long) hp;
-        hp->happy_timer.function = &happy_meal_timer;
+        hp->happy_timer.function = happy_meal_timer;
         add_timer(&hp->happy_timer);
 }
 
@@ -2497,7 +2497,7 @@ static u32 hme_get_link(struct net_device *dev)
         hp->sw_bmcr = happy_meal_tcvr_read(hp, hp->tcvregs, MII_BMCR);
         spin_unlock_irq(&hp->happy_lock);
 
-        return (hp->sw_bmsr & BMSR_LSTATUS);
+        return hp->sw_bmsr & BMSR_LSTATUS;
 }
 
 static const struct ethtool_ops hme_ethtool_ops = {
@@ -2808,7 +2808,8 @@ static int __devinit happy_meal_sbus_probe_one(struct platform_device *op, int i
         happy_meal_set_initial_advertisement(hp);
         spin_unlock_irq(&hp->happy_lock);
 
-        if (register_netdev(hp->dev)) {
+        err = register_netdev(hp->dev);
+        if (err) {
                 printk(KERN_ERR "happymeal: Cannot register net device, "
                        "aborting.\n");
                 goto err_out_free_coherent;
@@ -3130,7 +3131,8 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
         happy_meal_set_initial_advertisement(hp);
         spin_unlock_irq(&hp->happy_lock);
 
-        if (register_netdev(hp->dev)) {
+        err = register_netdev(hp->dev);
+        if (err) {
                 printk(KERN_ERR "happymeal(PCI): Cannot register net device, "
                        "aborting.\n");
                 goto err_out_iounmap;
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 8dcb858f2168..2cf84e5968b2 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -1483,7 +1483,7 @@ no_link_test:
          */
         init_timer(&lp->multicast_timer);
         lp->multicast_timer.data = (unsigned long) dev;
-        lp->multicast_timer.function = &lance_set_multicast_retry;
+        lp->multicast_timer.function = lance_set_multicast_retry;
 
         if (register_netdev(dev)) {
                 printk(KERN_ERR "SunLance: Cannot register device.\n");
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 72e65d4666ef..9536b2f010be 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -711,7 +711,7 @@ static u32 qe_get_link(struct net_device *dev)
         phyconfig = sbus_readb(mregs + MREGS_PHYCONFIG);
         spin_unlock_irq(&qep->lock);
 
-        return (phyconfig & MREGS_PHYCONFIG_LSTAT);
+        return phyconfig & MREGS_PHYCONFIG_LSTAT;
 }
 
 static const struct ethtool_ops qe_ethtool_ops = {
diff --git a/drivers/net/sunvnet.c b/drivers/net/sunvnet.c
index d281a7b34701..bf3c762de620 100644
--- a/drivers/net/sunvnet.c
+++ b/drivers/net/sunvnet.c
@@ -3,6 +3,8 @@
  * Copyright (C) 2007, 2008 David S. Miller <davem@davemloft.net>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
@@ -20,7 +22,6 @@
 #include "sunvnet.h"
 
 #define DRV_MODULE_NAME         "sunvnet"
-#define PFX DRV_MODULE_NAME     ": "
 #define DRV_MODULE_VERSION      "1.0"
 #define DRV_MODULE_RELDATE      "June 25, 2007"
 
@@ -45,9 +46,9 @@ static int vnet_handle_unknown(struct vnet_port *port, void *arg)
 {
         struct vio_msg_tag *pkt = arg;
 
-        printk(KERN_ERR PFX "Received unknown msg [%02x:%02x:%04x:%08x]\n",
+        pr_err("Received unknown msg [%02x:%02x:%04x:%08x]\n",
                pkt->type, pkt->stype, pkt->stype_env, pkt->sid);
-        printk(KERN_ERR PFX "Resetting connection.\n");
+        pr_err("Resetting connection\n");
 
         ldc_disconnect(port->vio.lp);
 
@@ -400,8 +401,8 @@ static int vnet_rx(struct vnet_port *port, void *msgbuf)
         if (unlikely(pkt->tag.stype_env != VIO_DRING_DATA))
                 return 0;
         if (unlikely(pkt->seq != dr->rcv_nxt)) {
-                printk(KERN_ERR PFX "RX out of sequence seq[0x%llx] "
-                       "rcv_nxt[0x%llx]\n", pkt->seq, dr->rcv_nxt);
+                pr_err("RX out of sequence seq[0x%llx] rcv_nxt[0x%llx]\n",
+                       pkt->seq, dr->rcv_nxt);
                 return 0;
         }
 
@@ -464,8 +465,7 @@ static int handle_mcast(struct vnet_port *port, void *msgbuf)
         struct vio_net_mcast_info *pkt = msgbuf;
 
         if (pkt->tag.stype != VIO_SUBTYPE_ACK)
-                printk(KERN_ERR PFX "%s: Got unexpected MCAST reply "
-                       "[%02x:%02x:%04x:%08x]\n",
+                pr_err("%s: Got unexpected MCAST reply [%02x:%02x:%04x:%08x]\n",
                        port->vp->dev->name,
                        pkt->tag.type,
                        pkt->tag.stype,
@@ -520,7 +520,7 @@ static void vnet_event(void *arg, int event)
         }
 
         if (unlikely(event != LDC_EVENT_DATA_READY)) {
-                printk(KERN_WARNING PFX "Unexpected LDC event %d\n", event);
+                pr_warning("Unexpected LDC event %d\n", event);
                 spin_unlock_irqrestore(&vio->lock, flags);
                 return;
         }
@@ -662,8 +662,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         netif_stop_queue(dev);
 
                         /* This is a hard error, log it. */
-                        printk(KERN_ERR PFX "%s: BUG! Tx Ring full when "
-                               "queue awake!\n", dev->name);
+                        netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");
                         dev->stats.tx_errors++;
                 }
                 spin_unlock_irqrestore(&port->vio.lock, flags);
@@ -696,8 +695,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         err = __vnet_tx_trigger(port);
         if (unlikely(err < 0)) {
-                printk(KERN_INFO PFX "%s: TX trigger error %d\n",
-                       dev->name, err);
+                netdev_info(dev, "TX trigger error %d\n", err);
                 d->hdr.state = VIO_DESC_FREE;
                 dev->stats.tx_carrier_errors++;
                 goto out_dropped_unlock;
@@ -952,12 +950,12 @@ static int __devinit vnet_port_alloc_tx_bufs(struct vnet_port *port)
 
                 err = -ENOMEM;
                 if (!buf) {
-                        printk(KERN_ERR "TX buffer allocation failure\n");
+                        pr_err("TX buffer allocation failure\n");
                         goto err_out;
                 }
                 err = -EFAULT;
                 if ((unsigned long)buf & (8UL - 1)) {
-                        printk(KERN_ERR "TX buffer misaligned\n");
+                        pr_err("TX buffer misaligned\n");
                         kfree(buf);
                         goto err_out;
                 }
@@ -1030,7 +1028,7 @@ static struct vnet * __devinit vnet_new(const u64 *local_mac)
 
         dev = alloc_etherdev(sizeof(*vp));
         if (!dev) {
-                printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+                pr_err("Etherdev alloc failed, aborting\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -1056,12 +1054,11 @@ static struct vnet * __devinit vnet_new(const u64 *local_mac)
 
         err = register_netdev(dev);
         if (err) {
-                printk(KERN_ERR PFX "Cannot register net device, "
-                       "aborting.\n");
+                pr_err("Cannot register net device, aborting\n");
                 goto err_out_free_dev;
         }
 
-        printk(KERN_INFO "%s: Sun LDOM vnet %pM\n", dev->name, dev->dev_addr);
+        netdev_info(dev, "Sun LDOM vnet %pM\n", dev->dev_addr);
 
         list_add(&vp->list, &vnet_list);
 
@@ -1133,10 +1130,7 @@ static struct vio_driver_ops vnet_vio_ops = {
 
 static void __devinit print_version(void)
 {
-        static int version_printed;
-
-        if (version_printed++ == 0)
-                printk(KERN_INFO "%s", version);
+        printk_once(KERN_INFO "%s", version);
 }
 
 const char *remote_macaddr_prop = "remote-mac-address";
@@ -1157,7 +1151,7 @@ static int __devinit vnet_port_probe(struct vio_dev *vdev,
 
         vp = vnet_find_parent(hp, vdev->mp);
         if (IS_ERR(vp)) {
-                printk(KERN_ERR PFX "Cannot find port parent vnet.\n");
+                pr_err("Cannot find port parent vnet\n");
                 err = PTR_ERR(vp);
                 goto err_out_put_mdesc;
         }
@@ -1165,15 +1159,14 @@ static int __devinit vnet_port_probe(struct vio_dev *vdev,
         rmac = mdesc_get_property(hp, vdev->mp, remote_macaddr_prop, &len);
         err = -ENODEV;
         if (!rmac) {
-                printk(KERN_ERR PFX "Port lacks %s property.\n",
-                       remote_macaddr_prop);
+                pr_err("Port lacks %s property\n", remote_macaddr_prop);
                 goto err_out_put_mdesc;
         }
 
         port = kzalloc(sizeof(*port), GFP_KERNEL);
         err = -ENOMEM;
         if (!port) {
-                printk(KERN_ERR PFX "Cannot allocate vnet_port.\n");
+                pr_err("Cannot allocate vnet_port\n");
                 goto err_out_put_mdesc;
         }
 
@@ -1214,9 +1207,8 @@ static int __devinit vnet_port_probe(struct vio_dev *vdev,
 
         dev_set_drvdata(&vdev->dev, port);
 
-        printk(KERN_INFO "%s: PORT ( remote-mac %pM%s )\n",
-               vp->dev->name, port->raddr,
-               switch_port ? " switch-port" : "");
+        pr_info("%s: PORT ( remote-mac %pM%s )\n",
+                vp->dev->name, port->raddr, switch_port ? " switch-port" : "");
 
         vio_port_up(&port->vio);
 
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 99e423a5b9f1..b6eec8cea209 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1167,7 +1167,7 @@ static void print_eth(const u8 *add)
 static int tc35815_tx_full(struct net_device *dev)
 {
         struct tc35815_local *lp = netdev_priv(dev);
-        return ((lp->tfd_start + 1) % TX_FD_NUM == lp->tfd_end);
+        return (lp->tfd_start + 1) % TX_FD_NUM == lp->tfd_end;
 }
 
 static void tc35815_restart(struct net_device *dev)
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 737df6032bbc..8b3dc1eb4015 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -92,7 +92,7 @@ static void bdx_rx_free(struct bdx_priv *priv);
 static void bdx_tx_free(struct bdx_priv *priv);
 
 /* Definitions needed by bdx_probe */
-static void bdx_ethtool_ops(struct net_device *netdev);
+static void bdx_set_ethtool_ops(struct net_device *netdev);
 
 /*************************************************************************
  *    Print Info                                                         *
@@ -927,13 +927,6 @@ static void bdx_update_stats(struct bdx_priv *priv)
         BDX_ASSERT((sizeof(struct bdx_stats) / sizeof(u64)) != i);
 }
 
-static struct net_device_stats *bdx_get_stats(struct net_device *ndev)
-{
-        struct bdx_priv *priv = netdev_priv(ndev);
-        struct net_device_stats *net_stat = &priv->net_stats;
-        return net_stat;
-}
-
 static void print_rxdd(struct rxd_desc *rxdd, u32 rxd_val1, u16 len,
                        u16 rxd_vlan);
 static void print_rxfd(struct rxf_desc *rxfd);
@@ -1220,6 +1213,7 @@ static void bdx_recycle_skb(struct bdx_priv *priv, struct rxd_desc *rxdd)
 
 static int bdx_rx_receive(struct bdx_priv *priv, struct rxd_fifo *f, int budget)
 {
+        struct net_device *ndev = priv->ndev;
         struct sk_buff *skb, *skb2;
         struct rxd_desc *rxdd;
         struct rx_map *dm;
@@ -1273,7 +1267,7 @@ static int bdx_rx_receive(struct bdx_priv *priv, struct rxd_fifo *f, int budget)
 
                 if (unlikely(GET_RXD_ERR(rxd_val1))) {
                         DBG("rxd_err = 0x%x\n", GET_RXD_ERR(rxd_val1));
-                        priv->net_stats.rx_errors++;
+                        ndev->stats.rx_errors++;
                         bdx_recycle_skb(priv, rxdd);
                         continue;
                 }
@@ -1300,15 +1294,16 @@ static int bdx_rx_receive(struct bdx_priv *priv, struct rxd_fifo *f, int budget)
                         bdx_rxdb_free_elem(db, rxdd->va_lo);
                 }
 
-                priv->net_stats.rx_bytes += len;
+                ndev->stats.rx_bytes += len;
 
                 skb_put(skb, len);
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                skb->protocol = eth_type_trans(skb, priv->ndev);
+                skb->protocol = eth_type_trans(skb, ndev);
 
                 /* Non-IP packets aren't checksum-offloaded */
                 if (GET_RXD_PKT_ID(rxd_val1) == 0)
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
+                else
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 NETIF_RX_MUX(priv, rxd_val1, rxd_vlan, skb);
 
@@ -1316,7 +1311,7 @@ static int bdx_rx_receive(struct bdx_priv *priv, struct rxd_fifo *f, int budget)
                         break;
         }
 
-        priv->net_stats.rx_packets += done;
+        ndev->stats.rx_packets += done;
 
         /* FIXME: do smth to minimize pci accesses    */
         WRITE_REG(priv, f->m.reg_RPTR, f->m.rptr & TXF_WPTR_WR_PTR);
@@ -1712,8 +1707,8 @@ static netdev_tx_t bdx_tx_transmit(struct sk_buff *skb,
 #ifdef BDX_LLTX
         ndev->trans_start = jiffies; /* NETIF_F_LLTX driver :( */
 #endif
-        priv->net_stats.tx_packets++;
-        priv->net_stats.tx_bytes += skb->len;
+        ndev->stats.tx_packets++;
+        ndev->stats.tx_bytes += skb->len;
 
         if (priv->tx_level < BDX_MIN_TX_LEVEL) {
                 DBG("%s: %s: TX Q STOP level %d\n",
@@ -1888,7 +1883,6 @@ static const struct net_device_ops bdx_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_do_ioctl           = bdx_ioctl,
         .ndo_set_multicast_list = bdx_setmulti,
-        .ndo_get_stats          = bdx_get_stats,
         .ndo_change_mtu         = bdx_change_mtu,
         .ndo_set_mac_address    = bdx_set_mac,
         .ndo_vlan_rx_register   = bdx_vlan_rx_register,
@@ -2012,7 +2006,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 ndev->netdev_ops = &bdx_netdev_ops;
                 ndev->tx_queue_len = BDX_NDEV_TXQ_LEN;
 
-                bdx_ethtool_ops(ndev);  /* ethtool interface */
+                bdx_set_ethtool_ops(ndev);      /* ethtool interface */
 
                 /* these fields are used for info purposes only
                  * so we can have them same for all ports of the board */
@@ -2417,10 +2411,10 @@ static void bdx_get_ethtool_stats(struct net_device *netdev,
 }
 
 /*
- * bdx_ethtool_ops - ethtool interface implementation
+ * bdx_set_ethtool_ops - ethtool interface implementation
  * @netdev
  */
-static void bdx_ethtool_ops(struct net_device *netdev)
+static void bdx_set_ethtool_ops(struct net_device *netdev)
 {
         static const struct ethtool_ops bdx_ethtool_ops = {
                 .get_settings = bdx_get_settings,
diff --git a/drivers/net/tehuti.h b/drivers/net/tehuti.h
index 67e3b71bf705..b6ba8601e2b5 100644
--- a/drivers/net/tehuti.h
+++ b/drivers/net/tehuti.h
@@ -269,7 +269,6 @@ struct bdx_priv {
         u32 msg_enable;
         int stats_flag;
         struct bdx_stats hw_stats;
-        struct net_device_stats net_stats;
         struct pci_dev *pdev;
 
         struct pci_nic *nic;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc3af78a869f..fdb438dca9b3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -1917,19 +1917,16 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
  */
 static int tg3_phy_reset(struct tg3 *tp)
 {
-        u32 cpmuctrl;
-        u32 phy_status;
+        u32 val, cpmuctrl;
         int err;
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                u32 val;
-
                 val = tr32(GRC_MISC_CFG);
                 tw32_f(GRC_MISC_CFG, val & ~GRC_MISC_CFG_EPHY_IDDQ);
                 udelay(40);
         }
-        err  = tg3_readphy(tp, MII_BMSR, &phy_status);
-        err |= tg3_readphy(tp, MII_BMSR, &phy_status);
+        err  = tg3_readphy(tp, MII_BMSR, &val);
+        err |= tg3_readphy(tp, MII_BMSR, &val);
         if (err != 0)
                 return -EBUSY;
 
@@ -1961,18 +1958,14 @@ static int tg3_phy_reset(struct tg3 *tp)
                 return err;
 
         if (cpmuctrl & CPMU_CTRL_GPHY_10MB_RXONLY) {
-                u32 phy;
-
-                phy = MII_TG3_DSP_EXP8_AEDW | MII_TG3_DSP_EXP8_REJ2MHz;
-                tg3_phydsp_write(tp, MII_TG3_DSP_EXP8, phy);
+                val = MII_TG3_DSP_EXP8_AEDW | MII_TG3_DSP_EXP8_REJ2MHz;
+                tg3_phydsp_write(tp, MII_TG3_DSP_EXP8, val);
 
                 tw32(TG3_CPMU_CTRL, cpmuctrl);
         }
 
         if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5784_AX ||
             GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5761_AX) {
-                u32 val;
-
                 val = tr32(TG3_CPMU_LSPD_1000MB_CLK);
                 if ((val & CPMU_LSPD_1000MB_MACCLK_MASK) ==
                     CPMU_LSPD_1000MB_MACCLK_12_5) {
@@ -2028,23 +2021,19 @@ out:
                 /* Cannot do read-modify-write on 5401 */
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x4c20);
         } else if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                u32 phy_reg;
-
                 /* Set bit 14 with read-modify-write to preserve other bits */
                 if (!tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0007) &&
-                    !tg3_readphy(tp, MII_TG3_AUX_CTRL, &phy_reg))
-                        tg3_writephy(tp, MII_TG3_AUX_CTRL, phy_reg | 0x4000);
+                    !tg3_readphy(tp, MII_TG3_AUX_CTRL, &val))
+                        tg3_writephy(tp, MII_TG3_AUX_CTRL, val | 0x4000);
         }
 
         /* Set phy register 0x10 bit 0 to high fifo elasticity to support
          * jumbo frames transmission.
          */
         if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE) {
-                u32 phy_reg;
-
-                if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &phy_reg))
+                if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &val))
                         tg3_writephy(tp, MII_TG3_EXT_CTRL,
-                                     phy_reg | MII_TG3_EXT_CTRL_FIFO_ELASTIC);
+                                     val | MII_TG3_EXT_CTRL_FIFO_ELASTIC);
         }
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
@@ -3060,7 +3049,7 @@ static int tg3_adv_1000T_flowctrl_ok(struct tg3 *tp, u32 *lcladv, u32 *rmtadv)
 static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
 {
         int current_link_up;
-        u32 bmsr, dummy;
+        u32 bmsr, val;
         u32 lcl_adv, rmt_adv;
         u16 current_speed;
         u8 current_duplex;
@@ -3140,8 +3129,8 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
         }
 
         /* Clear pending interrupts... */
-        tg3_readphy(tp, MII_TG3_ISTAT, &dummy);
-        tg3_readphy(tp, MII_TG3_ISTAT, &dummy);
+        tg3_readphy(tp, MII_TG3_ISTAT, &val);
+        tg3_readphy(tp, MII_TG3_ISTAT, &val);
 
         if (tp->phy_flags & TG3_PHYFLG_USE_MI_INTERRUPT)
                 tg3_writephy(tp, MII_TG3_IMASK, ~MII_TG3_INT_LINKCHG);
@@ -3162,8 +3151,6 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
         current_duplex = DUPLEX_INVALID;
 
         if (tp->phy_flags & TG3_PHYFLG_CAPACITIVE_COUPLING) {
-                u32 val;
-
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x4007);
                 tg3_readphy(tp, MII_TG3_AUX_CTRL, &val);
                 if (!(val & (1 << 10))) {
@@ -3238,13 +3225,11 @@ static int tg3_setup_copper_phy(struct tg3 *tp, int force_reset)
 
 relink:
         if (current_link_up == 0 || (tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER)) {
-                u32 tmp;
-
                 tg3_phy_copper_begin(tp);
 
-                tg3_readphy(tp, MII_BMSR, &tmp);
-                if (!tg3_readphy(tp, MII_BMSR, &tmp) &&
-                    (tmp & BMSR_LSTATUS))
+                tg3_readphy(tp, MII_BMSR, &bmsr);
+                if (!tg3_readphy(tp, MII_BMSR, &bmsr) &&
+                    (bmsr & BMSR_LSTATUS))
                         current_link_up = 1;
         }
 
@@ -4549,7 +4534,7 @@ static void tg3_recycle_rx(struct tg3_napi *tnapi,
         struct tg3 *tp = tnapi->tp;
         struct tg3_rx_buffer_desc *src_desc, *dest_desc;
         struct ring_info *src_map, *dest_map;
-        struct tg3_rx_prodring_set *spr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *spr = &tp->napi[0].prodring;
         int dest_idx;
 
         switch (opaque_key) {
@@ -4619,7 +4604,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
         u32 sw_idx = tnapi->rx_rcb_ptr;
         u16 hw_idx;
         int received;
-        struct tg3_rx_prodring_set *tpr = tnapi->prodring;
+        struct tg3_rx_prodring_set *tpr = &tnapi->prodring;
 
         hw_idx = *(tnapi->rx_rcb_prod_idx);
         /*
@@ -4644,13 +4629,13 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 desc_idx = desc->opaque & RXD_OPAQUE_INDEX_MASK;
                 opaque_key = desc->opaque & RXD_OPAQUE_RING_MASK;
                 if (opaque_key == RXD_OPAQUE_RING_STD) {
-                        ri = &tp->prodring[0].rx_std_buffers[desc_idx];
+                        ri = &tp->napi[0].prodring.rx_std_buffers[desc_idx];
                         dma_addr = dma_unmap_addr(ri, mapping);
                         skb = ri->skb;
                         post_ptr = &std_prod_idx;
                         rx_std_posted++;
                 } else if (opaque_key == RXD_OPAQUE_RING_JUMBO) {
-                        ri = &tp->prodring[0].rx_jmb_buffers[desc_idx];
+                        ri = &tp->napi[0].prodring.rx_jmb_buffers[desc_idx];
                         dma_addr = dma_unmap_addr(ri, mapping);
                         skb = ri->skb;
                         post_ptr = &jmb_prod_idx;
@@ -4719,7 +4704,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                       >> RXD_TCPCSUM_SHIFT) == 0xffff))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                 skb->protocol = eth_type_trans(skb, tp->dev);
 
@@ -4981,14 +4966,14 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
                 work_done += tg3_rx(tnapi, budget - work_done);
 
         if ((tp->tg3_flags3 & TG3_FLG3_ENABLE_RSS) && tnapi == &tp->napi[1]) {
-                struct tg3_rx_prodring_set *dpr = &tp->prodring[0];
+                struct tg3_rx_prodring_set *dpr = &tp->napi[0].prodring;
                 int i, err = 0;
                 u32 std_prod_idx = dpr->rx_std_prod_idx;
                 u32 jmb_prod_idx = dpr->rx_jmb_prod_idx;
 
                 for (i = 1; i < tp->irq_cnt; i++)
                         err |= tg3_rx_prodring_xfer(tp, dpr,
-                                                    tp->napi[i].prodring);
+                                                    &tp->napi[i].prodring);
 
                 wmb();
 
@@ -5404,8 +5389,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
         u32 base = (u32) mapping & 0xffffffff;
 
-        return ((base > 0xffffdcc0) &&
-                (base + len + 8 < base));
+        return (base > 0xffffdcc0) && (base + len + 8 < base);
 }
 
 /* Test for DMA addresses > 40-bit */
@@ -5414,7 +5398,7 @@ static inline int tg3_40bit_overflow_test(struct tg3 *tp, dma_addr_t mapping,
 {
 #if defined(CONFIG_HIGHMEM) && (BITS_PER_LONG == 64)
         if (tp->tg3_flags & TG3_FLAG_40BIT_DMA_BUG)
-                return (((u64) mapping + len) > DMA_BIT_MASK(40));
+                return ((u64) mapping + len) > DMA_BIT_MASK(40);
         return 0;
 #else
         return 0;
@@ -5574,9 +5558,9 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
                         goto out_unlock;
                 }
 
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                if (skb_is_gso_v6(skb)) {
                         hdrlen = skb_headlen(skb) - ETH_HLEN;
-                else {
+                } else {
                         struct iphdr *iph = ip_hdr(skb);
 
                         tcp_opt_len = tcp_optlen(skb);
@@ -5798,7 +5782,7 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
                 iph = ip_hdr(skb);
                 tcp_opt_len = tcp_optlen(skb);
 
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                if (skb_is_gso_v6(skb)) {
                         hdr_len = skb_headlen(skb) - ETH_HLEN;
                 } else {
                         u32 ip_tcp_len;
@@ -6057,7 +6041,7 @@ static void tg3_rx_prodring_free(struct tg3 *tp,
 {
         int i;
 
-        if (tpr != &tp->prodring[0]) {
+        if (tpr != &tp->napi[0].prodring) {
                 for (i = tpr->rx_std_cons_idx; i != tpr->rx_std_prod_idx;
                      i = (i + 1) % TG3_RX_RING_SIZE)
                         tg3_rx_skb_free(tp, &tpr->rx_std_buffers[i],
@@ -6103,7 +6087,7 @@ static int tg3_rx_prodring_alloc(struct tg3 *tp,
         tpr->rx_jmb_cons_idx = 0;
         tpr->rx_jmb_prod_idx = 0;
 
-        if (tpr != &tp->prodring[0]) {
+        if (tpr != &tp->napi[0].prodring) {
                 memset(&tpr->rx_std_buffers[0], 0, TG3_RX_STD_BUFF_RING_SIZE);
                 if (tp->tg3_flags & TG3_FLAG_JUMBO_CAPABLE)
                         memset(&tpr->rx_jmb_buffers[0], 0,
@@ -6253,7 +6237,7 @@ static void tg3_free_rings(struct tg3 *tp)
         for (j = 0; j < tp->irq_cnt; j++) {
                 struct tg3_napi *tnapi = &tp->napi[j];
 
-                tg3_rx_prodring_free(tp, &tp->prodring[j]);
+                tg3_rx_prodring_free(tp, &tnapi->prodring);
 
                 if (!tnapi->tx_buffers)
                         continue;
@@ -6325,7 +6309,7 @@ static int tg3_init_rings(struct tg3 *tp)
                 if (tnapi->rx_rcb)
                         memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
 
-                if (tg3_rx_prodring_alloc(tp, &tp->prodring[i])) {
+                if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
                         tg3_free_rings(tp);
                         return -ENOMEM;
                 }
@@ -6361,6 +6345,8 @@ static void tg3_free_consistent(struct tg3 *tp)
                         tnapi->rx_rcb = NULL;
                 }
 
+                tg3_rx_prodring_fini(tp, &tnapi->prodring);
+
                 if (tnapi->hw_status) {
                         pci_free_consistent(tp->pdev, TG3_HW_STATUS_SIZE,
                                             tnapi->hw_status,
@@ -6374,9 +6360,6 @@ static void tg3_free_consistent(struct tg3 *tp)
                                     tp->hw_stats, tp->stats_mapping);
                 tp->hw_stats = NULL;
         }
-
-        for (i = 0; i < tp->irq_cnt; i++)
-                tg3_rx_prodring_fini(tp, &tp->prodring[i]);
 }
 
 /*
@@ -6387,11 +6370,6 @@ static int tg3_alloc_consistent(struct tg3 *tp)
 {
         int i;
 
-        for (i = 0; i < tp->irq_cnt; i++) {
-                if (tg3_rx_prodring_init(tp, &tp->prodring[i]))
-                        goto err_out;
-        }
-
         tp->hw_stats = pci_alloc_consistent(tp->pdev,
                                             sizeof(struct tg3_hw_stats),
                                             &tp->stats_mapping);
@@ -6413,6 +6391,9 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                 memset(tnapi->hw_status, 0, TG3_HW_STATUS_SIZE);
                 sblk = tnapi->hw_status;
 
+                if (tg3_rx_prodring_init(tp, &tnapi->prodring))
+                        goto err_out;
+
                 /* If multivector TSS is enabled, vector 0 does not handle
                  * tx interrupts.  Don't allocate any resources for it.
                  */
@@ -6452,8 +6433,6 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                         break;
                 }
 
-                tnapi->prodring = &tp->prodring[i];
-
                 /*
                  * If multivector RSS is enabled, vector 0 does not handle
                  * rx or tx interrupts.  Don't allocate any resources for it.
@@ -6596,6 +6575,10 @@ static void tg3_ape_send_event(struct tg3 *tp, u32 event)
         int i;
         u32 apedata;
 
+        /* NCSI does not support APE events */
+        if (tp->tg3_flags3 & TG3_FLG3_APE_HAS_NCSI)
+                return;
+
         apedata = tg3_ape_read32(tp, TG3_APE_SEG_SIG);
         if (apedata != APE_SEG_SIG_MAGIC)
                 return;
@@ -6647,6 +6630,8 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                         APE_HOST_DRIVER_ID_MAGIC(TG3_MAJ_NUM, TG3_MIN_NUM));
                 tg3_ape_write32(tp, TG3_APE_HOST_BEHAVIOR,
                                 APE_HOST_BEHAV_NO_PHYLOCK);
+                tg3_ape_write32(tp, TG3_APE_HOST_DRVR_STATE,
+                                    TG3_APE_HOST_DRVR_STATE_START);
 
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
@@ -6658,6 +6643,16 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                  */
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
 
+                if (device_may_wakeup(&tp->pdev->dev) &&
+                    (tp->tg3_flags & TG3_FLAG_WOL_ENABLE)) {
+                        tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
+                                            TG3_APE_HOST_WOL_SPEED_AUTO);
+                        apedata = TG3_APE_HOST_DRVR_STATE_WOL;
+                } else
+                        apedata = TG3_APE_HOST_DRVR_STATE_UNLOAD;
+
+                tg3_ape_write32(tp, TG3_APE_HOST_DRVR_STATE, apedata);
+
                 event = APE_EVENT_STATUS_STATE_UNLOAD;
                 break;
         case RESET_KIND_SUSPEND:
@@ -7548,7 +7543,7 @@ static void tg3_rings_reset(struct tg3 *tp)
 
         /* Zero mailbox registers. */
         if (tp->tg3_flags & TG3_FLAG_SUPPORT_MSIX) {
-                for (i = 1; i < TG3_IRQ_MAX_VECS; i++) {
+                for (i = 1; i < tp->irq_max; i++) {
                         tp->napi[i].tx_prod = 0;
                         tp->napi[i].tx_cons = 0;
                         if (tp->tg3_flags3 & TG3_FLG3_ENABLE_TSS)
@@ -7631,7 +7626,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 {
         u32 val, rdmac_mode;
         int i, err, limit;
-        struct tg3_rx_prodring_set *tpr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *tpr = &tp->napi[0].prodring;
 
         tg3_disable_ints(tp);
 
@@ -8015,6 +8010,16 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780)
                 rdmac_mode |= RDMAC_MODE_IPV6_LSO_EN;
 
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5761 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5784 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5785 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 ||
+            (tp->tg3_flags3 & TG3_FLG3_5717_PLUS)) {
+                val = tr32(TG3_RDMA_RSRVCTRL_REG);
+                tw32(TG3_RDMA_RSRVCTRL_REG,
+                     val | TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX);
+        }
+
         /* Receive/send statistics. */
         if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS) {
                 val = tr32(RCVLPC_STATS_ENABLE);
@@ -8817,16 +8822,9 @@ static bool tg3_enable_msix(struct tg3 *tp)
                 tp->napi[i].irq_vec = msix_ent[i].vector;
 
         tp->dev->real_num_tx_queues = 1;
-        if (tp->irq_cnt > 1) {
+        if (tp->irq_cnt > 1)
                 tp->tg3_flags3 |= TG3_FLG3_ENABLE_RSS;
 
-                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
-                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
-                        tp->tg3_flags3 |= TG3_FLG3_ENABLE_TSS;
-                        tp->dev->real_num_tx_queues = tp->irq_cnt - 1;
-                }
-        }
-
         return true;
 }
 
@@ -9867,7 +9865,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
                 tp->rx_pending = 63;
         tp->rx_jumbo_pending = ering->rx_jumbo_pending;
 
-        for (i = 0; i < TG3_IRQ_MAX_VECS; i++)
+        for (i = 0; i < tp->irq_max; i++)
                 tp->napi[i].tx_pending = ering->tx_pending;
 
         if (netif_running(dev)) {
@@ -10608,7 +10606,7 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
         int num_pkts, tx_len, rx_len, i, err;
         struct tg3_rx_buffer_desc *desc;
         struct tg3_napi *tnapi, *rnapi;
-        struct tg3_rx_prodring_set *tpr = &tp->prodring[0];
+        struct tg3_rx_prodring_set *tpr = &tp->napi[0].prodring;
 
         tnapi = &tp->napi[0];
         rnapi = &tp->napi[0];
@@ -12401,14 +12399,18 @@ skip_phy_reset:
 
 static void __devinit tg3_read_vpd(struct tg3 *tp)
 {
-        u8 vpd_data[TG3_NVM_VPD_LEN];
+        u8 *vpd_data;
         unsigned int block_end, rosize, len;
         int j, i = 0;
         u32 magic;
 
         if ((tp->tg3_flags3 & TG3_FLG3_NO_NVRAM) ||
             tg3_nvram_read(tp, 0x0, &magic))
-                goto out_not_found;
+                goto out_no_vpd;
+
+        vpd_data = kmalloc(TG3_NVM_VPD_LEN, GFP_KERNEL);
+        if (!vpd_data)
+                goto out_no_vpd;
 
         if (magic == TG3_EEPROM_MAGIC) {
                 for (i = 0; i < TG3_NVM_VPD_LEN; i += 4) {
@@ -12492,9 +12494,12 @@ partno:
 
         memcpy(tp->board_part_number, &vpd_data[i], len);
 
-        return;
-
 out_not_found:
+        kfree(vpd_data);
+        if (!tp->board_part_number[0])
+                return;
+
+out_no_vpd:
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                 strcpy(tp->board_part_number, "BCM95906");
         else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
@@ -12736,10 +12741,12 @@ static void __devinit tg3_read_dash_ver(struct tg3 *tp)
 
         apedata = tg3_ape_read32(tp, TG3_APE_FW_VERSION);
 
-        if (tg3_ape_read32(tp, TG3_APE_FW_FEATURES) & TG3_APE_FW_FEATURE_NCSI)
+        if (tg3_ape_read32(tp, TG3_APE_FW_FEATURES) & TG3_APE_FW_FEATURE_NCSI) {
+                tp->tg3_flags3 |= TG3_FLG3_APE_HAS_NCSI;
                 fwtype = "NCSI";
-        else
+        } else {
                 fwtype = "DASH";
+        }
 
         vlen = strlen(tp->fw_ver);
 
@@ -13410,10 +13417,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (err)
                 return err;
 
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 &&
-            tp->pci_chip_rev_id != CHIPREV_ID_5717_A0)
-                return -ENOTSUPP;
-
         /* Initialize data/descriptor byte/word swapping. */
         val = tr32(GRC_MODE);
         val &= GRC_MODE_HOST_STACKUP;
@@ -14442,7 +14445,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         }
 
         if ((tp->tg3_flags3 & TG3_FLG3_5755_PLUS) &&
-            tp->pci_chip_rev_id != CHIPREV_ID_5717_A0 &&
+            GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717 &&
             GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5719)
                 dev->netdev_ops = &tg3_netdev_ops;
         else
@@ -14581,7 +14584,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
         rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
         sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
-        for (i = 0; i < TG3_IRQ_MAX_VECS; i++) {
+        for (i = 0; i < tp->irq_max; i++) {
                 struct tg3_napi *tnapi = &tp->napi[i];
 
                 tnapi->tp = tp;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..44733e4a68a2 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1302,7 +1302,11 @@
 #define  RDMAC_STATUS_FIFOURUN           0x00000080
 #define  RDMAC_STATUS_FIFOOREAD          0x00000100
 #define  RDMAC_STATUS_LNGREAD            0x00000200
-/* 0x4808 --> 0x4c00 unused */
+/* 0x4808 --> 0x4900 unused */
+
+#define TG3_RDMA_RSRVCTRL_REG           0x00004900
+#define TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX  0x00000004
+/* 0x4904 --> 0x4c00 unused */
 
 /* Write DMA control registers */
 #define WDMAC_MODE                      0x00004c00
@@ -2176,7 +2180,7 @@
 #define TG3_APE_HOST_SEG_SIG            0x4200
 #define  APE_HOST_SEG_SIG_MAGIC          0x484f5354
 #define TG3_APE_HOST_SEG_LEN            0x4204
-#define  APE_HOST_SEG_LEN_MAGIC          0x0000001c
+#define  APE_HOST_SEG_LEN_MAGIC          0x00000020
 #define TG3_APE_HOST_INIT_COUNT         0x4208
 #define TG3_APE_HOST_DRIVER_ID          0x420c
 #define  APE_HOST_DRIVER_ID_LINUX        0xf0000000
@@ -2188,6 +2192,12 @@
 #define  APE_HOST_HEARTBEAT_INT_DISABLE  0
 #define  APE_HOST_HEARTBEAT_INT_5SEC     5000
 #define TG3_APE_HOST_HEARTBEAT_COUNT    0x4218
+#define TG3_APE_HOST_DRVR_STATE         0x421c
+#define TG3_APE_HOST_DRVR_STATE_START    0x00000001
+#define TG3_APE_HOST_DRVR_STATE_UNLOAD   0x00000002
+#define TG3_APE_HOST_DRVR_STATE_WOL      0x00000003
+#define TG3_APE_HOST_WOL_SPEED          0x4224
+#define TG3_APE_HOST_WOL_SPEED_AUTO      0x00008000
 
 #define TG3_APE_EVENT_STATUS            0x4300
 
@@ -2649,7 +2659,8 @@ struct tg3_rx_prodring_set {
         dma_addr_t                      rx_jmb_mapping;
 };
 
-#define TG3_IRQ_MAX_VECS 5
+#define TG3_IRQ_MAX_VECS_RSS            5
+#define TG3_IRQ_MAX_VECS                TG3_IRQ_MAX_VECS_RSS
 
 struct tg3_napi {
         struct napi_struct              napi    ____cacheline_aligned;
@@ -2668,7 +2679,7 @@ struct tg3_napi {
         u32                             consmbox;
         u32                             rx_rcb_ptr;
         u16                             *rx_rcb_prod_idx;
-        struct tg3_rx_prodring_set      *prodring;
+        struct tg3_rx_prodring_set      prodring;
 
         struct tg3_rx_buffer_desc       *rx_rcb;
         struct tg3_tx_buffer_desc       *tx_ring;
@@ -2755,8 +2766,6 @@ struct tg3 {
         struct vlan_group               *vlgrp;
 #endif
 
-        struct tg3_rx_prodring_set      prodring[TG3_IRQ_MAX_VECS];
-
 
         /* begin "everything else" cacheline(s) section */
         struct rtnl_link_stats64        net_stats;
@@ -2850,6 +2859,7 @@ struct tg3 {
 #define TG3_FLG3_USE_JUMBO_BDFLAG       0x00400000
 #define TG3_FLG3_L1PLLPD_EN             0x00800000
 #define TG3_FLG3_5717_PLUS              0x01000000
+#define TG3_FLG3_APE_HAS_NCSI           0x02000000
 
         struct timer_list               timer;
         u16                             timer_counter;
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index ccee3eddc5f4..ec8c804a795d 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -393,7 +393,7 @@ TLan_SetTimer( struct net_device *dev, u32 ticks, u32 type )
                         spin_unlock_irqrestore(&priv->lock, flags);
                 return;
         }
-        priv->timer.function = &TLan_Timer;
+        priv->timer.function = TLan_Timer;
         if (!in_irq())
                 spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -1453,7 +1453,7 @@ static u32 TLan_HandleTxEOF( struct net_device *dev, u16 host_int )
                 TLan_DioWrite8( dev->base_addr,
                                 TLAN_LED_REG, TLAN_LED_LINK | TLAN_LED_ACT );
                 if ( priv->timer.function == NULL ) {
-                         priv->timer.function = &TLan_Timer;
+                         priv->timer.function = TLan_Timer;
                          priv->timer.data = (unsigned long) dev;
                          priv->timer.expires = jiffies + TLAN_TIMER_ACT_DELAY;
                          priv->timerSetAt = jiffies;
@@ -1601,7 +1601,7 @@ drop_and_reuse:
                 TLan_DioWrite8( dev->base_addr,
                                 TLAN_LED_REG, TLAN_LED_LINK | TLAN_LED_ACT );
                 if ( priv->timer.function == NULL )  {
-                        priv->timer.function = &TLan_Timer;
+                        priv->timer.function = TLan_Timer;
                         priv->timer.data = (unsigned long) dev;
                         priv->timer.expires = jiffies + TLAN_TIMER_ACT_DELAY;
                         priv->timerSetAt = jiffies;
@@ -1897,7 +1897,7 @@ static void TLan_Timer( unsigned long data )
                                         TLan_DioWrite8( dev->base_addr,
                                                         TLAN_LED_REG, TLAN_LED_LINK );
                                 } else  {
-                                        priv->timer.function = &TLan_Timer;
+                                        priv->timer.function = TLan_Timer;
                                         priv->timer.expires = priv->timerSetAt
                                                 + TLAN_TIMER_ACT_DELAY;
                                         spin_unlock_irqrestore(&priv->lock, flags);
@@ -3187,7 +3187,7 @@ static int TLan_EeSendByte( u16 io_base, u8 data, int stop )
                 TLan_SetBit( TLAN_NET_SIO_EDATA, sio );
         }
 
-        return ( err );
+        return err;
 
 } /* TLan_EeSendByte */
 
diff --git a/drivers/net/tlan.h b/drivers/net/tlan.h
index d13ff12d7500..3315ced774e2 100644
--- a/drivers/net/tlan.h
+++ b/drivers/net/tlan.h
@@ -442,7 +442,7 @@ typedef struct tlan_private_tag {
 static inline u8 TLan_DioRead8(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inb((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x3)));
+        return inb((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x3));
 
 } /* TLan_DioRead8 */
 
@@ -452,7 +452,7 @@ static inline u8 TLan_DioRead8(u16 base_addr, u16 internal_addr)
 static inline u16 TLan_DioRead16(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inw((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x2)));
+        return inw((base_addr + TLAN_DIO_DATA) + (internal_addr & 0x2));
 
 } /* TLan_DioRead16 */
 
@@ -462,7 +462,7 @@ static inline u16 TLan_DioRead16(u16 base_addr, u16 internal_addr)
 static inline u32 TLan_DioRead32(u16 base_addr, u16 internal_addr)
 {
         outw(internal_addr, base_addr + TLAN_DIO_ADR);
-        return (inl(base_addr + TLAN_DIO_DATA));
+        return inl(base_addr + TLAN_DIO_DATA);
 
 } /* TLan_DioRead32 */
 
@@ -537,6 +537,6 @@ static inline u32 TLan_HashFunc( const u8 *a )
         hash ^= ((a[2]^a[5])<<4);       /* & 060 */
         hash ^= ((a[2]^a[5])>>2);       /* & 077 */
 
-        return (hash & 077);
+        return hash & 077;
 }
 #endif
diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
index 16e8783ee9cd..8d362e64a40e 100644
--- a/drivers/net/tokenring/proteon.c
+++ b/drivers/net/tokenring/proteon.c
@@ -110,7 +110,7 @@ static int __init proteon_probe1(struct net_device *dev, int ioaddr)
         }
 
         dev->base_addr = ioaddr;
-        return (0);
+        return 0;
 nodev:
         release_region(ioaddr, PROTEON_IO_EXTENT); 
         return -ENODEV;
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index 0929fff5982c..63db5a6762ae 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -435,7 +435,7 @@ static int smctr_alloc_shared_memory(struct net_device *dev)
                 RX_DATA_BUFFER_SIZE * tp->num_rx_bdbs[NON_MAC_QUEUE]);
         tp->rx_buff_end[NON_MAC_QUEUE] = (__u16 *)smctr_malloc(dev, 0);
 
-        return (0);
+        return 0;
 }
 
 /* Enter Bypass state. */
@@ -448,7 +448,7 @@ static int smctr_bypass_state(struct net_device *dev)
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE, JS_BYPASS_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_checksum_firmware(struct net_device *dev)
@@ -471,9 +471,9 @@ static int smctr_checksum_firmware(struct net_device *dev)
         smctr_disable_adapter_ctrl_store(dev);
 
         if(checksum)
-                return (checksum);
+                return checksum;
 
-        return (0);
+        return 0;
 }
 
 static int __init smctr_chk_mca(struct net_device *dev)
@@ -485,7 +485,7 @@ static int __init smctr_chk_mca(struct net_device *dev)
 
         current_slot = mca_find_unused_adapter(smctr_posid, 0);
         if(current_slot == MCA_NOTFOUND)
-                return (-ENODEV);
+                return -ENODEV;
 
         mca_set_adapter_name(current_slot, smctr_name);
         mca_mark_as_used(current_slot);
@@ -622,9 +622,9 @@ static int __init smctr_chk_mca(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 #else
-        return (-1);
+        return -1;
 #endif /* CONFIG_MCA_LEGACY */
 }
 
@@ -677,18 +677,18 @@ static int smctr_chg_rx_mask(struct net_device *dev)
         if((err = smctr_issue_write_word_cmd(dev, RW_CONFIG_REGISTER_0,
                 &tp->config_word0)))
         {
-                return (err);
+                return err;
         }
 
         if((err = smctr_issue_write_word_cmd(dev, RW_CONFIG_REGISTER_1,
                 &tp->config_word1)))
         {
-                return (err);
+                return err;
         }
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_clear_int(struct net_device *dev)
@@ -697,7 +697,7 @@ static int smctr_clear_int(struct net_device *dev)
 
         outb((tp->trc_mask | CSR_CLRTINT), dev->base_addr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_clear_trc_reset(int ioaddr)
@@ -707,7 +707,7 @@ static int smctr_clear_trc_reset(int ioaddr)
         r = inb(ioaddr + MSR);
         outb(~MSR_RST & r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -725,7 +725,7 @@ static int smctr_close(struct net_device *dev)
 
         /* Check to see if adapter is already in a closed state. */
         if(tp->status != OPEN)
-                return (0);
+                return 0;
 
         smctr_enable_16bit(dev);
         smctr_set_page(dev, (__u8 *)tp->ram_access);
@@ -733,7 +733,7 @@ static int smctr_close(struct net_device *dev)
         if((err = smctr_issue_remove_cmd(dev)))
         {
                 smctr_disable_16bit(dev);
-                return (err);
+                return err;
         }
 
         for(;;)
@@ -746,7 +746,7 @@ static int smctr_close(struct net_device *dev)
         }
 
 
-        return (0);
+        return 0;
 }
 
 static int smctr_decode_firmware(struct net_device *dev,
@@ -807,12 +807,12 @@ static int smctr_decode_firmware(struct net_device *dev,
         if(buff)
                 *(mem++) = SWAP_BYTES(buff);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_disable_16bit(struct net_device *dev)
 {
-        return (0);
+        return 0;
 }
 
 /*
@@ -832,7 +832,7 @@ static int smctr_disable_adapter_ctrl_store(struct net_device *dev)
         tp->trc_mask |= CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_disable_bic_int(struct net_device *dev)
@@ -844,7 +844,7 @@ static int smctr_disable_bic_int(struct net_device *dev)
                 | CSR_MSKTINT | CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_16bit(struct net_device *dev)
@@ -858,7 +858,7 @@ static int smctr_enable_16bit(struct net_device *dev)
                 outb((r | LAAR_MEM16ENB), dev->base_addr + LAAR);
         }
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -881,7 +881,7 @@ static int smctr_enable_adapter_ctrl_store(struct net_device *dev)
         tp->trc_mask &= ~CSR_WCSS;
         outb(tp->trc_mask, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_adapter_ram(struct net_device *dev)
@@ -895,7 +895,7 @@ static int smctr_enable_adapter_ram(struct net_device *dev)
         r = inb(ioaddr + MSR);
         outb(MSR_MEMB | r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_enable_bic_int(struct net_device *dev)
@@ -921,7 +921,7 @@ static int smctr_enable_bic_int(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int __init smctr_chk_isa(struct net_device *dev)
@@ -1145,7 +1145,7 @@ static int __init smctr_chk_isa(struct net_device *dev)
                 */
         }
 
-        return (0);
+        return 0;
 
 out2:
         release_region(ioaddr, SMCTR_IO_EXTENT);
@@ -1199,7 +1199,7 @@ static int __init smctr_get_boardid(struct net_device *dev, int mca)
          *      return;
          */
         if(IdByte & 0xF8)
-                return (-1);
+                return -1;
 
         r1 = inb(ioaddr + BID_REG_1);
         r1 &= BID_ICR_MASK;
@@ -1250,21 +1250,21 @@ static int __init smctr_get_boardid(struct net_device *dev, int mca)
         while(r1 & BID_RECALL_DONE_MASK)
                 r1 = inb(ioaddr + BID_REG_1);
 
-        return (BoardIdMask);
+        return BoardIdMask;
 }
 
 static int smctr_get_group_address(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_INDIVIDUAL_GROUP_ADDR);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static int smctr_get_functional_address(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_FUNCTIONAL_ADDR);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 /* Calculate number of Non-MAC receive BDB's and data buffers.
@@ -1346,14 +1346,14 @@ static unsigned int smctr_get_num_rx_bdbs(struct net_device *dev)
          */
         mem_used += 0x100;
 
-        return((0xffff - mem_used) / (RX_DATA_BUFFER_SIZE + sizeof(BDBlock)));
+        return (0xffff - mem_used) / (RX_DATA_BUFFER_SIZE + sizeof(BDBlock));
 }
 
 static int smctr_get_physical_drop_number(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_PHYSICAL_DROP_NUMBER);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static __u8 * smctr_get_rx_pointer(struct net_device *dev, short queue)
@@ -1366,14 +1366,14 @@ static __u8 * smctr_get_rx_pointer(struct net_device *dev, short queue)
 
         tp->rx_fcb_curr[queue]->bdb_ptr = bdb;
 
-        return ((__u8 *)bdb->data_block_ptr);
+        return (__u8 *)bdb->data_block_ptr;
 }
 
 static int smctr_get_station_id(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_INDIVIDUAL_MAC_ADDRESS);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 /*
@@ -1384,7 +1384,7 @@ static struct net_device_stats *smctr_get_stats(struct net_device *dev)
 {
         struct net_local *tp = netdev_priv(dev);
 
-        return ((struct net_device_stats *)&tp->MacStat);
+        return (struct net_device_stats *)&tp->MacStat;
 }
 
 static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
@@ -1401,14 +1401,14 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
 
         /* check if there is enough FCB blocks */
         if(tp->num_tx_fcbs_used[queue] >= tp->num_tx_fcbs[queue])
-                return ((FCBlock *)(-1L));
+                return (FCBlock *)(-1L);
 
         /* round off the input pkt size to the nearest even number */
         alloc_size = (bytes_count + 1) & 0xfffe;
 
         /* check if enough mem */
         if((tp->tx_buff_used[queue] + alloc_size) > tp->tx_buff_size[queue])
-                return ((FCBlock *)(-1L));
+                return (FCBlock *)(-1L);
 
         /* check if past the end ;
          * if exactly enough mem to end of ring, alloc from front.
@@ -1425,7 +1425,7 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
                 if((tp->tx_buff_used[queue] + alloc_size)
                         > tp->tx_buff_size[queue])
                 {
-                        return ((FCBlock *)(-1L));
+                        return (FCBlock *)(-1L);
                 }
 
                 /* ring wrap */
@@ -1448,14 +1448,14 @@ static FCBlock *smctr_get_tx_fcb(struct net_device *dev, __u16 queue,
         pFCB = tp->tx_fcb_curr[queue];
         tp->tx_fcb_curr[queue] = tp->tx_fcb_curr[queue]->next_ptr;
 
-        return (pFCB);
+        return pFCB;
 }
 
 static int smctr_get_upstream_neighbor_addr(struct net_device *dev)
 {
         smctr_issue_read_word_cmd(dev, RW_UPSTREAM_NEIGHBOR_ADDRESS);
 
-        return(smctr_wait_cmd(dev));
+        return smctr_wait_cmd(dev);
 }
 
 static int smctr_hardware_send_packet(struct net_device *dev,
@@ -1469,21 +1469,22 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                 printk(KERN_DEBUG"%s: smctr_hardware_send_packet\n", dev->name);
 
         if(tp->status != OPEN)
-                return (-1);
+                return -1;
 
         if(tp->monitor_state_ready != 1)
-                return (-1);
+                return -1;
 
         for(;;)
         {
                 /* Send first buffer from queue */
                 skb = skb_dequeue(&tp->SendSkbQueue);
                 if(skb == NULL)
-                        return (-1);
+                        return -1;
 
                 tp->QueueSkb++;
 
-                if(skb->len < SMC_HEADER_SIZE || skb->len > tp->max_packet_size)                        return (-1);
+                if(skb->len < SMC_HEADER_SIZE || skb->len > tp->max_packet_size)
+                        return -1;
 
                 smctr_enable_16bit(dev);
                 smctr_set_page(dev, (__u8 *)tp->ram_access);
@@ -1492,7 +1493,7 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                         == (FCBlock *)(-1L))
                 {
                         smctr_disable_16bit(dev);
-                        return (-1);
+                        return -1;
                 }
 
                 smctr_tx_move_frame(dev, skb,
@@ -1508,7 +1509,7 @@ static int smctr_hardware_send_packet(struct net_device *dev,
                 smctr_disable_16bit(dev);
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_acbs(struct net_device *dev)
@@ -1552,7 +1553,7 @@ static int smctr_init_acbs(struct net_device *dev)
         tp->acb_curr            = tp->acb_head->next_ptr;
         tp->num_acbs_used       = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_adapter(struct net_device *dev)
@@ -1590,13 +1591,14 @@ static int smctr_init_adapter(struct net_device *dev)
 
         if(smctr_checksum_firmware(dev))
         {
-                printk(KERN_ERR "%s: Previously loaded firmware is missing\n",dev->name);                return (-ENOENT);
+                printk(KERN_ERR "%s: Previously loaded firmware is missing\n",dev->name);
+                return -ENOENT;
         }
 
         if((err = smctr_ram_memory_test(dev)))
         {
                 printk(KERN_ERR "%s: RAM memory test failed.\n", dev->name);
-                return (-EIO);
+                return -EIO;
         }
 
         smctr_set_rx_look_ahead(dev);
@@ -1608,7 +1610,7 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Initialization of card failed (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         /* This routine clobbers the TRC's internal registers. */
@@ -1616,7 +1618,7 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Card failed internal self test (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         /* Re-Initialize adapter's internal registers */
@@ -1625,17 +1627,17 @@ static int smctr_init_adapter(struct net_device *dev)
         {
                 printk(KERN_ERR "%s: Initialization of card failed (%d)\n",
                         dev->name, err);
-                return (-EINVAL);
+                return -EINVAL;
         }
 
         smctr_enable_bic_int(dev);
 
         if((err = smctr_issue_enable_int_cmd(dev, TRC_INTERRUPT_ENABLE_MASK)))
-                return (err);
+                return err;
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_card_real(struct net_device *dev)
@@ -1703,15 +1705,15 @@ static int smctr_init_card_real(struct net_device *dev)
         smctr_init_shared_memory(dev);
 
         if((err = smctr_issue_init_timers_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_issue_init_txrx_cmd(dev)))
         {
                 printk(KERN_ERR "%s: Hardware failure\n", dev->name);
-                return (err);
+                return err;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_rx_bdbs(struct net_device *dev)
@@ -1763,7 +1765,7 @@ static int smctr_init_rx_bdbs(struct net_device *dev)
                 tp->rx_bdb_curr[i]              = tp->rx_bdb_head[i]->next_ptr;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_rx_fcbs(struct net_device *dev)
@@ -1813,7 +1815,7 @@ static int smctr_init_rx_fcbs(struct net_device *dev)
                 tp->rx_fcb_curr[i]              = tp->rx_fcb_head[i]->next_ptr;
         }
 
-        return(0);
+        return 0;
 }
 
 static int smctr_init_shared_memory(struct net_device *dev)
@@ -1871,7 +1873,7 @@ static int smctr_init_shared_memory(struct net_device *dev)
         smctr_init_rx_bdbs(dev);
         smctr_init_rx_fcbs(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_tx_bdbs(struct net_device *dev)
@@ -1901,7 +1903,7 @@ static int smctr_init_tx_bdbs(struct net_device *dev)
                 tp->tx_bdb_head[i]->back_ptr = bdb;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_init_tx_fcbs(struct net_device *dev)
@@ -1940,7 +1942,7 @@ static int smctr_init_tx_fcbs(struct net_device *dev)
                 tp->num_tx_fcbs_used[i]         = 0;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_internal_self_test(struct net_device *dev)
@@ -1949,33 +1951,33 @@ static int smctr_internal_self_test(struct net_device *dev)
         int err;
 
         if((err = smctr_issue_test_internal_rom_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
         if((err = smctr_issue_test_hic_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
         if((err = smctr_issue_test_mac_reg_cmd(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return (-1);
+                return -1;
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -2468,14 +2470,14 @@ static int smctr_issue_enable_int_cmd(struct net_device *dev,
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->int_mask_control  = interrupt_enable_mask;
         tp->sclb_ptr->valid_command     = SCLB_VALID | SCLB_CMD_CLEAR_INTERRUPT_MASK;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ibits)
@@ -2483,7 +2485,7 @@ static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ib
         struct net_local *tp = netdev_priv(dev);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         tp->sclb_ptr->int_mask_control = ibits;
         tp->sclb_ptr->iack_code = iack_code << 1; /* use the offset from base */        tp->sclb_ptr->resume_control = 0;
@@ -2491,7 +2493,7 @@ static int smctr_issue_int_ack(struct net_device *dev, __u16 iack_code, __u16 ib
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_init_timers_cmd(struct net_device *dev)
@@ -2502,10 +2504,10 @@ static int smctr_issue_init_timers_cmd(struct net_device *dev)
         __u16 *pTimer_Struc = (__u16 *)tp->misc_command_data;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         tp->config_word0 = THDREN | DMA_TRIGGER | USETPT | NO_AUTOREMOVE;
         tp->config_word1 = 0;
@@ -2648,7 +2650,7 @@ static int smctr_issue_init_timers_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_INIT_TRC_TIMERS, 0);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_init_txrx_cmd(struct net_device *dev)
@@ -2659,12 +2661,12 @@ static int smctr_issue_init_txrx_cmd(struct net_device *dev)
         void **txrx_ptrs = (void *)tp->misc_command_data;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
         {
                 printk(KERN_ERR "%s: Hardware failure\n", dev->name);
-                return (err);
+                return err;
         }
 
         /* Initialize Transmit Queue Pointers that are used, to point to
@@ -2695,7 +2697,7 @@ static int smctr_issue_init_txrx_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_INIT_TX_RX, 0);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_insert_cmd(struct net_device *dev)
@@ -2704,7 +2706,7 @@ static int smctr_issue_insert_cmd(struct net_device *dev)
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_INSERT, ACB_SUB_CMD_NOP);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_read_ring_status_cmd(struct net_device *dev)
@@ -2712,15 +2714,15 @@ static int smctr_issue_read_ring_status_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_READ_TRC_STATUS,
                 RW_TRC_STATUS_BLOCK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_read_word_cmd(struct net_device *dev, __u16 aword_cnt)
@@ -2728,15 +2730,15 @@ static int smctr_issue_read_word_cmd(struct net_device *dev, __u16 aword_cnt)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_READ_VALUE,
                 aword_cnt);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_remove_cmd(struct net_device *dev)
@@ -2745,14 +2747,14 @@ static int smctr_issue_remove_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->resume_control    = 0;
         tp->sclb_ptr->valid_command     = SCLB_VALID | SCLB_CMD_REMOVE;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_acb_cmd(struct net_device *dev)
@@ -2761,7 +2763,7 @@ static int smctr_issue_resume_acb_cmd(struct net_device *dev)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         tp->sclb_ptr->resume_control = SCLB_RC_ACB;
         tp->sclb_ptr->valid_command  = SCLB_VALID | SCLB_RESUME_CONTROL_VALID;
@@ -2770,7 +2772,7 @@ static int smctr_issue_resume_acb_cmd(struct net_device *dev)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
@@ -2779,7 +2781,7 @@ static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if(queue == MAC_QUEUE)
                 tp->sclb_ptr->resume_control = SCLB_RC_RX_MAC_BDB;
@@ -2790,7 +2792,7 @@ static int smctr_issue_resume_rx_bdb_cmd(struct net_device *dev, __u16 queue)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
@@ -2801,7 +2803,7 @@ static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
                 printk(KERN_DEBUG "%s: smctr_issue_resume_rx_fcb_cmd\n", dev->name);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         if(queue == MAC_QUEUE)
                 tp->sclb_ptr->resume_control = SCLB_RC_RX_MAC_FCB;
@@ -2812,7 +2814,7 @@ static int smctr_issue_resume_rx_fcb_cmd(struct net_device *dev, __u16 queue)
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_resume_tx_fcb_cmd(struct net_device *dev, __u16 queue)
@@ -2823,14 +2825,14 @@ static int smctr_issue_resume_tx_fcb_cmd(struct net_device *dev, __u16 queue)
                 printk(KERN_DEBUG "%s: smctr_issue_resume_tx_fcb_cmd\n", dev->name);
 
         if(smctr_wait_while_cbusy(dev))
-                return (-1);
+                return -1;
 
         tp->sclb_ptr->resume_control = (SCLB_RC_TFCB0 << queue);
         tp->sclb_ptr->valid_command = SCLB_RESUME_CONTROL_VALID | SCLB_VALID;
 
         smctr_set_ctrl_attention(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_issue_test_internal_rom_cmd(struct net_device *dev)
@@ -2840,7 +2842,7 @@ static int smctr_issue_test_internal_rom_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_INTERNAL_ROM_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_test_hic_cmd(struct net_device *dev)
@@ -2850,7 +2852,7 @@ static int smctr_issue_test_hic_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_HIC_TEST,
                 TRC_HOST_INTERFACE_REG_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_test_mac_reg_cmd(struct net_device *dev)
@@ -2860,7 +2862,7 @@ static int smctr_issue_test_mac_reg_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_MAC_REGISTERS_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_trc_loopback_cmd(struct net_device *dev)
@@ -2870,7 +2872,7 @@ static int smctr_issue_trc_loopback_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_INTERNAL_LOOPBACK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_tri_loopback_cmd(struct net_device *dev)
@@ -2880,7 +2882,7 @@ static int smctr_issue_tri_loopback_cmd(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_TRI_LOOPBACK);
 
-        return (err);
+        return err;
 }
 
 static int smctr_issue_write_byte_cmd(struct net_device *dev,
@@ -2891,10 +2893,10 @@ static int smctr_issue_write_byte_cmd(struct net_device *dev,
         int err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         for(iword = 0, ibyte = 0; iword < (unsigned int)(aword_cnt & 0xff);
                 iword++, ibyte += 2)
@@ -2903,8 +2905,8 @@ static int smctr_issue_write_byte_cmd(struct net_device *dev,
                         | (*((__u8 *)byte + ibyte + 1));
         }
 
-        return (smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE, 
-                aword_cnt));
+        return smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE,
+                aword_cnt);
 }
 
 static int smctr_issue_write_word_cmd(struct net_device *dev,
@@ -2914,10 +2916,10 @@ static int smctr_issue_write_word_cmd(struct net_device *dev,
         unsigned int i, err;
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         for(i = 0; i < (unsigned int)(aword_cnt & 0xff); i++)
                 tp->misc_command_data[i] = *((__u16 *)word + i);
@@ -2925,7 +2927,7 @@ static int smctr_issue_write_word_cmd(struct net_device *dev,
         err = smctr_setup_single_cmd_w_data(dev, ACB_CMD_MCT_WRITE_VALUE,
                 aword_cnt);
 
-        return (err);
+        return err;
 }
 
 static int smctr_join_complete_state(struct net_device *dev)
@@ -2935,7 +2937,7 @@ static int smctr_join_complete_state(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE,
                 JS_JOIN_COMPLETE_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_link_tx_fcbs_to_bdbs(struct net_device *dev)
@@ -2959,7 +2961,7 @@ static int smctr_link_tx_fcbs_to_bdbs(struct net_device *dev)
                 }
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_load_firmware(struct net_device *dev)
@@ -2974,7 +2976,7 @@ static int smctr_load_firmware(struct net_device *dev)
 
         if (request_firmware(&fw, "tr_smctr.bin", &dev->dev)) {
                 printk(KERN_ERR "%s: firmware not found\n", dev->name);
-                return (UCODE_NOT_PRESENT);
+                return UCODE_NOT_PRESENT;
         }
 
         tp->num_of_tx_buffs     = 4;
@@ -3036,7 +3038,7 @@ static int smctr_load_firmware(struct net_device *dev)
         smctr_disable_16bit(dev);
  out:
         release_firmware(fw);
-        return (err);
+        return err;
 }
 
 static int smctr_load_node_addr(struct net_device *dev)
@@ -3052,7 +3054,7 @@ static int smctr_load_node_addr(struct net_device *dev)
         }
         dev->addr_len = 6;
 
-        return (0);
+        return 0;
 }
 
 /* Lobe Media Test.
@@ -3146,14 +3148,14 @@ static int smctr_lobe_media_test_cmd(struct net_device *dev)
                 if(smctr_wait_cmd(dev))
                 {
                         printk(KERN_ERR "Lobe Failed test state\n");
-                        return (LOBE_MEDIA_TEST_FAILED);
+                        return LOBE_MEDIA_TEST_FAILED;
                 }
         }
 
         err = smctr_setup_single_cmd(dev, ACB_CMD_MCT_TEST,
                 TRC_LOBE_MEDIA_TEST);
 
-        return (err);
+        return err;
 }
 
 static int smctr_lobe_media_test_state(struct net_device *dev)
@@ -3163,7 +3165,7 @@ static int smctr_lobe_media_test_state(struct net_device *dev)
         err = smctr_setup_single_cmd(dev, ACB_CMD_CHANGE_JOIN_STATE,
                 JS_LOBE_TEST_STATE);
 
-        return (err);
+        return err;
 }
 
 static int smctr_make_8025_hdr(struct net_device *dev,
@@ -3212,7 +3214,7 @@ static int smctr_make_8025_hdr(struct net_device *dev,
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_access_pri(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3225,7 +3227,7 @@ static int smctr_make_access_pri(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[0] = MSB(tp->authorized_access_priority);
         tsv->svv[1] = LSB(tp->authorized_access_priority);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_addr_mod(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3236,7 +3238,7 @@ static int smctr_make_addr_mod(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[0] = 0;
         tsv->svv[1] = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_auth_funct_class(struct net_device *dev,
@@ -3250,7 +3252,7 @@ static int smctr_make_auth_funct_class(struct net_device *dev,
         tsv->svv[0] = MSB(tp->authorized_function_classes);
         tsv->svv[1] = LSB(tp->authorized_function_classes);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_corr(struct net_device *dev,
@@ -3262,7 +3264,7 @@ static int smctr_make_corr(struct net_device *dev,
         tsv->svv[0] = MSB(correlator);
         tsv->svv[1] = LSB(correlator);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_funct_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3280,7 +3282,7 @@ static int smctr_make_funct_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[2] = MSB(tp->misc_command_data[1]);
         tsv->svv[3] = LSB(tp->misc_command_data[1]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_group_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3305,7 +3307,7 @@ static int smctr_make_group_addr(struct net_device *dev, MAC_SUB_VECTOR *tsv)
            tsv->svv[2] == 0x00 && tsv->svv[3] == 0x00)
                 tsv->svv[0] = 0x00;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_phy_drop_num(struct net_device *dev,
@@ -3324,7 +3326,7 @@ static int smctr_make_phy_drop_num(struct net_device *dev,
         tsv->svv[2] = MSB(tp->misc_command_data[1]);
         tsv->svv[3] = LSB(tp->misc_command_data[1]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_product_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3337,7 +3339,7 @@ static int smctr_make_product_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         for(i = 0; i < 18; i++)
                 tsv->svv[i] = 0xF0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_station_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3358,7 +3360,7 @@ static int smctr_make_station_id(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svv[4] = MSB(tp->misc_command_data[2]);
         tsv->svv[5] = LSB(tp->misc_command_data[2]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_ring_station_status(struct net_device *dev,
@@ -3374,7 +3376,7 @@ static int smctr_make_ring_station_status(struct net_device *dev,
         tsv->svv[4] = 0;
         tsv->svv[5] = 0;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_ring_station_version(struct net_device *dev,
@@ -3400,7 +3402,7 @@ static int smctr_make_ring_station_version(struct net_device *dev,
         else
                 tsv->svv[9] = 0xc4;    /* EBCDIC - D */
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_tx_status_code(struct net_device *dev,
@@ -3414,7 +3416,7 @@ static int smctr_make_tx_status_code(struct net_device *dev,
         /* Stripped frame status of Transmitted Frame */
         tsv->svv[1] = tx_fstatus & 0xff;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_upstream_neighbor_addr(struct net_device *dev,
@@ -3436,7 +3438,7 @@ static int smctr_make_upstream_neighbor_addr(struct net_device *dev,
         tsv->svv[4] = MSB(tp->misc_command_data[2]);
         tsv->svv[5] = LSB(tp->misc_command_data[2]);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_make_wrap_data(struct net_device *dev, MAC_SUB_VECTOR *tsv)
@@ -3444,7 +3446,7 @@ static int smctr_make_wrap_data(struct net_device *dev, MAC_SUB_VECTOR *tsv)
         tsv->svi = WRAP_DATA;
         tsv->svl = S_WRAP_DATA;
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -3464,9 +3466,9 @@ static int smctr_open(struct net_device *dev)
 
         err = smctr_init_adapter(dev);
         if(err < 0)
-                return (err);
+                return err;
 
-        return (err);
+        return err;
 }
 
 /* Interrupt driven open of Token card. */
@@ -3481,9 +3483,9 @@ static int smctr_open_tr(struct net_device *dev)
 
         /* Now we can actually open the adapter. */
         if(tp->status == OPEN)
-                return (0);
+                return 0;
         if(tp->status != INITIALIZED)
-                return (-1);
+                return -1;
 
         /* FIXME: it would work a lot better if we masked the irq sources
            on the card here, then we could skip the locking and poll nicely */
@@ -3560,7 +3562,7 @@ static int smctr_open_tr(struct net_device *dev)
 out:
         spin_unlock_irqrestore(&tp->lock, flags);
 
-        return (err);
+        return err;
 }
 
 /* Check for a network adapter of this type, 
@@ -3675,7 +3677,7 @@ static int __init smctr_probe1(struct net_device *dev, int ioaddr)
 
         dev->netdev_ops = &smctr_netdev_ops;
         dev->watchdog_timeo     = HZ;
-        return (0);
+        return 0;
 
 out:
         return err;
@@ -3699,13 +3701,13 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                         case INIT:
                                 if((rcode = smctr_rcv_init(dev, rmf, &correlator)) == HARDWARE_FAILED)
                                 {
-                                        return (rcode);
+                                        return rcode;
                                 }
 
                                 if((err = smctr_send_rsp(dev, rmf, rcode,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3713,13 +3715,13 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                 if((rcode = smctr_rcv_chg_param(dev, rmf,
                                         &correlator)) ==HARDWARE_FAILED)
                                 {
-                                        return (rcode);
+                                        return rcode;
                                 }
 
                                 if((err = smctr_send_rsp(dev, rmf, rcode,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3728,16 +3730,16 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
-                                                        rcode, correlator));
+                                                return smctr_send_rsp(dev, rmf,
+                                                        rcode, correlator);
                                 }
 
                                 if((err = smctr_send_rpt_addr(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3746,17 +3748,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_rpt_attch(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3765,17 +3767,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         rmf, &correlator)) != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_rpt_state(dev, rmf,
                                         correlator)))
                                 {
-                                        return (err);
+                                        return err;
                                 }
                                 break;
 
@@ -3786,17 +3788,17 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         != POSITIVE_ACK)
                                 {
                                         if(rcode == HARDWARE_FAILED)
-                                                return (rcode);
+                                                return rcode;
                                         else
-                                                return (smctr_send_rsp(dev, rmf,
+                                                return smctr_send_rsp(dev, rmf,
                                                         rcode,
-                                                        correlator));
+                                                        correlator);
                                 }
 
                                 if((err = smctr_send_tx_forward(dev, rmf,
                                         &tx_fstatus)) == HARDWARE_FAILED)
                                 {
-                                        return (err);
+                                        return err;
                                 }
 
                                 if(err == A_FRAME_WAS_FORWARDED)
@@ -3805,7 +3807,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                                 rmf, tx_fstatus))
                                                 == HARDWARE_FAILED)
                                         {
-                                                return (err);
+                                                return err;
                                         }
                                 }
                                 break;
@@ -3834,7 +3836,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                                         if((err = smctr_send_rsp(dev, rmf,rcode,
                                                 correlator)))
                                         {
-                                                return (err);
+                                                return err;
                                         }
                                 }
 
@@ -3899,7 +3901,7 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
                 err = 0;
         }
 
-        return (err);
+        return err;
 }
 
 /* Adapter RAM test. Incremental word ODD boundary data test. */
@@ -3942,7 +3944,7 @@ static int smctr_ram_memory_test(struct net_device *dev)
                                 err_offset      = j;
                                 err_word        = word_read;
                                 err_pattern     = word_pattern;
-                                return (RAM_TEST_FAILED);
+                                return RAM_TEST_FAILED;
                         }
                 }
         }
@@ -3966,14 +3968,14 @@ static int smctr_ram_memory_test(struct net_device *dev)
                                 err_offset      = j;
                                 err_word        = word_read;
                                 err_pattern     = word_pattern;
-                                return (RAM_TEST_FAILED);
+                                return RAM_TEST_FAILED;
                         }
                 }
         }
 
         smctr_set_page(dev, (__u8 *)tp->ram_access);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
@@ -3986,7 +3988,7 @@ static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
 
         /* This Frame can only come from a CRS */
         if((rmf->dc_sc & SC_MASK) != SC_CRS)
-                return(E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length. */
         vlen = (signed short)rmf->vl - 4;
@@ -4058,7 +4060,7 @@ static int smctr_rcv_chg_param(struct net_device *dev, MAC_HEADER *rmf,
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
@@ -4071,7 +4073,7 @@ static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
 
         /* This Frame can only come from a RPS */
         if((rmf->dc_sc & SC_MASK) != SC_RPS)
-                return (E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length. */
         vlen = (signed short)rmf->vl - 4;
@@ -4133,7 +4135,7 @@ static int smctr_rcv_init(struct net_device *dev, MAC_HEADER *rmf,
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
@@ -4145,7 +4147,7 @@ static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
 
         /* This Frame can only come from a CRS */
         if((rmf->dc_sc & SC_MASK) != SC_CRS)
-                return (E_INAPPROPRIATE_SOURCE_CLASS);
+                return E_INAPPROPRIATE_SOURCE_CLASS;
 
         /* Remove MVID Length from total length */
         vlen = (signed short)rmf->vl - 4;
@@ -4193,7 +4195,7 @@ static int smctr_rcv_tx_forward(struct net_device *dev, MAC_HEADER *rmf)
                 }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_rq_addr_state_attch(struct net_device *dev,
@@ -4250,7 +4252,7 @@ static int smctr_rcv_rq_addr_state_attch(struct net_device *dev,
                         }
         }
 
-        return (rcode);
+        return rcode;
 }
 
 static int smctr_rcv_unknown(struct net_device *dev, MAC_HEADER *rmf,
@@ -4284,7 +4286,7 @@ static int smctr_rcv_unknown(struct net_device *dev, MAC_HEADER *rmf,
                 rsv = (MAC_SUB_VECTOR *)((__u32)rsv + rsv->svl);
         }
 
-        return (E_UNRECOGNIZED_VECTOR_ID);
+        return E_UNRECOGNIZED_VECTOR_ID;
 }
 
 /*
@@ -4311,7 +4313,7 @@ static int smctr_reset_adapter(struct net_device *dev)
          */
         outb(tp->trc_mask | CSR_CLRTINT | CSR_CLRCBUSY, ioaddr + CSR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_restart_tx_chain(struct net_device *dev, short queue)
@@ -4329,7 +4331,7 @@ static int smctr_restart_tx_chain(struct net_device *dev, short queue)
                 err = smctr_issue_resume_tx_fcb_cmd(dev, queue);
         }
 
-        return (err);
+        return err;
 }
 
 static int smctr_ring_status_chg(struct net_device *dev)
@@ -4371,7 +4373,7 @@ static int smctr_ring_status_chg(struct net_device *dev)
         }
 
         if(!(tp->ring_status_flags & RING_STATUS_CHANGED))
-                return (0);
+                return 0;
 
         switch(tp->ring_status)
         {
@@ -4421,7 +4423,7 @@ static int smctr_ring_status_chg(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_rx_frame(struct net_device *dev)
@@ -4486,7 +4488,7 @@ static int smctr_rx_frame(struct net_device *dev)
                         break;
         }
 
-        return (err);
+        return err;
 }
 
 static int smctr_send_dat(struct net_device *dev)
@@ -4502,7 +4504,7 @@ static int smctr_send_dat(struct net_device *dev)
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE,
                 sizeof(MAC_HEADER))) == (FCBlock *)(-1L))
         {
-                return (OUT_OF_RESOURCES);
+                return OUT_OF_RESOURCES;
         }
 
         /* Initialize DAT Data Fields. */
@@ -4524,7 +4526,7 @@ static int smctr_send_dat(struct net_device *dev)
 
         /* Start Transmit. */
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete */
         for(i = 0; i < 10000; i++)
@@ -4538,7 +4540,7 @@ static int smctr_send_dat(struct net_device *dev)
         if(!(fcb->frame_status &  FCB_COMMAND_DONE) ||
            fcb->frame_status & (FCB_TX_STATUS_E | FCB_TX_AC_BITS))
         {
-                return (INITIALIZE_FAILED);
+                return INITIALIZE_FAILED;
         }
 
         /* De-allocated Tx FCB and Frame Buffer
@@ -4549,7 +4551,7 @@ static int smctr_send_dat(struct net_device *dev)
         tp->tx_queue_status[MAC_QUEUE] = NOT_TRANSMITING;
         smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
 
-        return (0);
+        return 0;
 }
 
 static void smctr_timeout(struct net_device *dev)
@@ -4610,7 +4612,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(struct trh_hdr)
                 + S_WRAP_DATA + S_WRAP_DATA)) == (FCBlock *)(-1L))
         {
-                return (OUT_OF_RESOURCES);
+                return OUT_OF_RESOURCES;
         }
 
         /* Initialize DAT Data Fields. */
@@ -4639,7 +4641,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         /* Start Transmit. */
         tmf->vl = SWAP_BYTES(tmf->vl);
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete. (10 ms). */
         for(i=0; i < 10000; i++)
@@ -4653,7 +4655,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         if(!(fcb->frame_status & FCB_COMMAND_DONE) ||
            fcb->frame_status & (FCB_TX_STATUS_E | FCB_TX_AC_BITS))
         {
-                return (LOBE_MEDIA_TEST_FAILED);
+                return LOBE_MEDIA_TEST_FAILED;
         }
 
         /* De-allocated Tx FCB and Frame Buffer
@@ -4664,7 +4666,7 @@ static int smctr_send_lobe_media_test(struct net_device *dev)
         tp->tx_queue_status[MAC_QUEUE] = NOT_TRANSMITING;
         smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
@@ -4679,7 +4681,7 @@ static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
                 + S_ADDRESS_MODIFER + S_GROUP_ADDRESS + S_FUNCTIONAL_ADDRESS))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf             = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4722,7 +4724,7 @@ static int smctr_send_rpt_addr(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
@@ -4737,7 +4739,7 @@ static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
                 + S_AUTHORIZED_FUNCTION_CLASS + S_AUTHORIZED_ACCESS_PRIORITY))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4776,7 +4778,7 @@ static int smctr_send_rpt_attch(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
@@ -4791,7 +4793,7 @@ static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
                 + S_RING_STATION_STATUS + S_STATION_IDENTIFER))
                 == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4826,7 +4828,7 @@ static int smctr_send_rpt_state(struct net_device *dev, MAC_HEADER *rmf,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return (smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rpt_tx_forward(struct net_device *dev,
@@ -4839,7 +4841,7 @@ static int smctr_send_rpt_tx_forward(struct net_device *dev,
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(MAC_HEADER)
                 + S_TRANSMIT_STATUS_CODE)) == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4862,7 +4864,7 @@ static int smctr_send_rpt_tx_forward(struct net_device *dev,
 */
         tmf->vl = SWAP_BYTES(tmf->vl);
 
-        return(smctr_trc_send_packet(dev, fcb, MAC_QUEUE));
+        return smctr_trc_send_packet(dev, fcb, MAC_QUEUE);
 }
 
 static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
@@ -4875,7 +4877,7 @@ static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, sizeof(MAC_HEADER)
                 + S_CORRELATOR + S_RESPONSE_CODE)) == (FCBlock *)(-1L))
         {
-                return (0);
+                return 0;
         }
 
         tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4888,7 +4890,7 @@ static int smctr_send_rsp(struct net_device *dev, MAC_HEADER *rmf,
         tsv = (MAC_SUB_VECTOR *)((__u32)tmf + sizeof(MAC_HEADER));
         smctr_make_corr(dev, tsv, correlator);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_send_rq_init(struct net_device *dev)
@@ -4907,7 +4909,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                         + S_RING_STATION_VERSION_NUMBER + S_ADDRESS_MODIFER))
                         == (FCBlock *)(-1L)))
                 {
-                        return (0);
+                        return 0;
                 }
 
                 tmf        = (MAC_HEADER *)fcb->bdb_ptr->data_block_ptr;
@@ -4943,7 +4945,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 tmf->vl = SWAP_BYTES(tmf->vl);
 
                 if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                        return (err);
+                        return err;
 
                 /* Wait for Transmit to Complete */
                 for(i = 0; i < 10000; i++) 
@@ -4957,7 +4959,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 fstatus = fcb->frame_status;
 
                 if(!(fstatus & FCB_COMMAND_DONE))
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
 
                 if(!(fstatus & FCB_TX_STATUS_E))
                         count++;
@@ -4971,7 +4973,7 @@ static int smctr_send_rq_init(struct net_device *dev)
                 smctr_update_tx_chain(dev, fcb, MAC_QUEUE);
         } while(count < 4 && ((fstatus & FCB_TX_AC_BITS) ^ FCB_TX_AC_BITS));
 
-        return (smctr_join_complete_state(dev));
+        return smctr_join_complete_state(dev);
 }
 
 static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
@@ -4984,13 +4986,13 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
 
         /* Check if this is the END POINT of the Transmit Forward Chain. */
         if(rmf->vl <= 18)
-                return (0);
+                return 0;
 
         /* Allocate Transmit FCB only by requesting 0 bytes
          * of data buffer.
          */
         if((fcb = smctr_get_tx_fcb(dev, MAC_QUEUE, 0)) == (FCBlock *)(-1L))
-                return (0);
+                return 0;
 
         /* Set pointer to Transmit Frame Buffer to the data
          * portion of the received TX Forward frame, making
@@ -5006,7 +5008,7 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
         fcb->bdb_ptr->buffer_length      = rmf->vl - 4 - 2;
 
         if((err = smctr_trc_send_packet(dev, fcb, MAC_QUEUE)))
-                return (err);
+                return err;
 
         /* Wait for Transmit to Complete */
         for(i = 0; i < 10000; i++) 
@@ -5020,7 +5022,7 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
         if(!(fcb->frame_status & FCB_COMMAND_DONE))
         {
                 if((err = smctr_issue_resume_tx_fcb_cmd(dev, MAC_QUEUE)))
-                        return (err);
+                        return err;
 
                 for(i = 0; i < 10000; i++) 
                 {
@@ -5030,12 +5032,12 @@ static int smctr_send_tx_forward(struct net_device *dev, MAC_HEADER *rmf,
                 }
 
                 if(!(fcb->frame_status & FCB_COMMAND_DONE))
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
         }
 
         *tx_fstatus = fcb->frame_status;
 
-        return (A_FRAME_WAS_FORWARDED);
+        return A_FRAME_WAS_FORWARDED;
 }
 
 static int smctr_set_auth_access_pri(struct net_device *dev,
@@ -5044,11 +5046,11 @@ static int smctr_set_auth_access_pri(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_AUTHORIZED_ACCESS_PRIORITY)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         tp->authorized_access_priority = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_auth_funct_class(struct net_device *dev,
@@ -5057,22 +5059,22 @@ static int smctr_set_auth_funct_class(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_AUTHORIZED_FUNCTION_CLASS)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         tp->authorized_function_classes = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_corr(struct net_device *dev, MAC_SUB_VECTOR *rsv,
         __u16 *correlator)
 {
         if(rsv->svl != S_CORRELATOR)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         *correlator = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_error_timer_value(struct net_device *dev,
@@ -5082,34 +5084,34 @@ static int smctr_set_error_timer_value(struct net_device *dev,
         int err;
 
         if(rsv->svl != S_ERROR_TIMER_VALUE)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         err_tval = (rsv->svv[0] << 8 | rsv->svv[1])*10;
 
         smctr_issue_write_word_cmd(dev, RW_TER_THRESHOLD, &err_tval);
 
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_frame_forward(struct net_device *dev,
         MAC_SUB_VECTOR *rsv, __u8 dc_sc)
 {
         if((rsv->svl < 2) || (rsv->svl > S_FRAME_FORWARD))
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         if((dc_sc & DC_MASK) != DC_CRS)
         {
                 if(rsv->svl >= 2 && rsv->svl < 20)
-                        return (E_TRANSMIT_FORWARD_INVALID);
+                        return E_TRANSMIT_FORWARD_INVALID;
 
                 if((rsv->svv[0] != 0) || (rsv->svv[1] != 0))
-                        return (E_TRANSMIT_FORWARD_INVALID);
+                        return E_TRANSMIT_FORWARD_INVALID;
         }
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static int smctr_set_local_ring_num(struct net_device *dev,
@@ -5118,13 +5120,13 @@ static int smctr_set_local_ring_num(struct net_device *dev,
         struct net_local *tp = netdev_priv(dev);
 
         if(rsv->svl != S_LOCAL_RING_NUMBER)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         if(tp->ptr_local_ring_num)
                 *(__u16 *)(tp->ptr_local_ring_num) 
                         = (rsv->svv[0] << 8 | rsv->svv[1]);
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 static unsigned short smctr_set_ctrl_attention(struct net_device *dev)
@@ -5140,7 +5142,7 @@ static unsigned short smctr_set_ctrl_attention(struct net_device *dev)
                 outb(tp->trc_mask, ioaddr + CSR);
         }
 
-        return (0);
+        return 0;
 }
 
 static void smctr_set_multicast_list(struct net_device *dev)
@@ -5159,7 +5161,7 @@ static int smctr_set_page(struct net_device *dev, __u8 *buf)
         amask = (__u8)((tptr & PR_PAGE_MASK) >> 8);
         outb(amask, dev->base_addr + PR);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_phy_drop(struct net_device *dev, MAC_SUB_VECTOR *rsv)
@@ -5167,13 +5169,13 @@ static int smctr_set_phy_drop(struct net_device *dev, MAC_SUB_VECTOR *rsv)
         int err;
 
         if(rsv->svl != S_PHYSICAL_DROP)
-                return (E_SUB_VECTOR_LENGTH_ERROR);
+                return E_SUB_VECTOR_LENGTH_ERROR;
 
         smctr_issue_write_byte_cmd(dev, RW_PHYSICAL_DROP_NUMBER, &rsv->svv[0]);
         if((err = smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
-        return (POSITIVE_ACK);
+        return POSITIVE_ACK;
 }
 
 /* Reset the ring speed to the opposite of what it was. This auto-pilot
@@ -5195,16 +5197,16 @@ static int smctr_set_ring_speed(struct net_device *dev)
         smctr_reset_adapter(dev);
 
         if((err = smctr_init_card_real(dev)))
-                return (err);
+                return err;
 
         smctr_enable_bic_int(dev);
 
         if((err = smctr_issue_enable_int_cmd(dev, TRC_INTERRUPT_ENABLE_MASK)))
-                return (err);
+                return err;
 
         smctr_disable_16bit(dev);
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_rx_look_ahead(struct net_device *dev)
@@ -5233,7 +5235,7 @@ static int smctr_set_rx_look_ahead(struct net_device *dev)
                 *((__u16 *)(tp->ram_access)) = sword;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_set_trc_reset(int ioaddr)
@@ -5243,7 +5245,7 @@ static int smctr_set_trc_reset(int ioaddr)
         r = inb(ioaddr + MSR);
         outb(MSR_RST | r, ioaddr + MSR);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -5259,10 +5261,10 @@ static int smctr_setup_single_cmd(struct net_device *dev,
                 printk(KERN_DEBUG "%s: smctr_setup_single_cmd\n", dev->name);
 
         if((err = smctr_wait_while_cbusy(dev)))
-                return (err);
+                return err;
 
         if((err = (unsigned int)smctr_wait_cmd(dev)))
-                return (err);
+                return err;
 
         tp->acb_head->cmd_done_status   = 0;
         tp->acb_head->cmd               = command;
@@ -5270,7 +5272,7 @@ static int smctr_setup_single_cmd(struct net_device *dev,
 
         err = smctr_issue_resume_acb_cmd(dev);
 
-        return (err);
+        return err;
 }
 
 /*
@@ -5287,7 +5289,7 @@ static int smctr_setup_single_cmd_w_data(struct net_device *dev,
         tp->acb_head->data_offset_lo
                 = (__u16)TRC_POINTER(tp->misc_command_data);
 
-        return(smctr_issue_resume_acb_cmd(dev));
+        return smctr_issue_resume_acb_cmd(dev);
 }
 
 static char *smctr_malloc(struct net_device *dev, __u16 size)
@@ -5298,7 +5300,7 @@ static char *smctr_malloc(struct net_device *dev, __u16 size)
         m = (char *)(tp->ram_access + tp->sh_mem_used);
         tp->sh_mem_used += (__u32)size;
 
-        return (m);
+        return m;
 }
 
 static int smctr_status_chg(struct net_device *dev)
@@ -5333,7 +5335,7 @@ static int smctr_status_chg(struct net_device *dev)
                         break;
         }
 
-        return (0);
+        return 0;
 }
 
 static int smctr_trc_send_packet(struct net_device *dev, FCBlock *fcb,
@@ -5355,7 +5357,7 @@ static int smctr_trc_send_packet(struct net_device *dev, FCBlock *fcb,
                 err = smctr_issue_resume_tx_fcb_cmd(dev, queue);
         }
 
-        return (err);
+        return err;
 }
 
 static __u16 smctr_tx_complete(struct net_device *dev, __u16 queue)
@@ -5409,7 +5411,7 @@ static __u16 smctr_tx_complete(struct net_device *dev, __u16 queue)
                         break;
         }
 
-        return (err);
+        return err;
 }
 
 static unsigned short smctr_tx_move_frame(struct net_device *dev,
@@ -5450,7 +5452,7 @@ static unsigned short smctr_tx_move_frame(struct net_device *dev,
                 pbuff += len;
         }
 
-        return (0);
+        return 0;
 }
 
 /* Update the error statistic counters for this adapter. */
@@ -5493,7 +5495,7 @@ static int smctr_update_err_stats(struct net_device *dev)
         if(tstat->token_errors)
                 tstat->token_errors += *(tp->misc_command_data + 5) >> 8;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_update_rx_chain(struct net_device *dev, __u16 queue)
@@ -5530,7 +5532,7 @@ static int smctr_update_rx_chain(struct net_device *dev, __u16 queue)
         tp->rx_bdb_curr[queue]->back_ptr->info = BDB_NOT_CHAIN_END;
         tp->rx_bdb_curr[queue] = bdb;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
@@ -5542,13 +5544,13 @@ static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
                 printk(KERN_DEBUG "smctr_update_tx_chain\n");
 
         if(tp->num_tx_fcbs_used[queue] <= 0)
-                return (HARDWARE_FAILED);
+                return HARDWARE_FAILED;
         else
         {
                 if(tp->tx_buff_used[queue] < fcb->memory_alloc)
                 {
                         tp->tx_buff_used[queue] = 0;
-                        return (HARDWARE_FAILED);
+                        return HARDWARE_FAILED;
                 }
 
                 tp->tx_buff_used[queue] -= fcb->memory_alloc;
@@ -5566,7 +5568,7 @@ static int smctr_update_tx_chain(struct net_device *dev, FCBlock *fcb,
                 fcb->frame_status = 0;
                 tp->tx_fcb_end[queue] = fcb->next_ptr;
                 netif_wake_queue(dev);
-                return (0);
+                return 0;
         }
 }
 
@@ -5587,12 +5589,12 @@ static int smctr_wait_cmd(struct net_device *dev)
         }
 
         if(loop_count == 0)
-                return(HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 
         if(tp->acb_head->cmd_done_status & 0xff)
-                return(HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 
-        return (0);
+        return 0;
 }
 
 static int smctr_wait_while_cbusy(struct net_device *dev)
@@ -5624,9 +5626,9 @@ static int smctr_wait_while_cbusy(struct net_device *dev)
         }
 
         if(timeout)
-                return (0);
+                return 0;
         else
-                return (HARDWARE_FAILED);
+                return HARDWARE_FAILED;
 }
 
 #ifdef MODULE
diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
index 435ef7d5470f..c83f4f6e39e1 100644
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -224,7 +224,7 @@ static int madgemc_sifprobe(struct net_device *dev)
                 chk2 ^= 0x0FE;
 
                 if(chk1 != chk2)
-                        return (-1);    /* No adapter */
+                        return -1;    /* No adapter */
                 chk1 -= 2;
         } while(chk1 != 0);     /* Repeat 128 times (all byte values) */
 
@@ -232,7 +232,7 @@ static int madgemc_sifprobe(struct net_device *dev)
         /* Restore the SIFADR value */
         SIFWRITEB(old, SIFADR);
 
-        return (0);
+        return 0;
 }
 #endif
 
@@ -271,7 +271,7 @@ int tms380tr_open(struct net_device *dev)
         {
                 printk(KERN_INFO "%s: Chipset initialization error\n", 
                         dev->name);
-                return (-1);
+                return -1;
         }
 
         tp->timer.expires       = jiffies + 30*HZ;
@@ -298,7 +298,7 @@ int tms380tr_open(struct net_device *dev)
         if(tp->AdapterVirtOpenFlag == 0)
         {
                 tms380tr_disable_interrupts(dev);
-                return (-1);
+                return -1;
         }
 
         tp->StartTime = jiffies;
@@ -309,7 +309,7 @@ int tms380tr_open(struct net_device *dev)
         tp->timer.data          = (unsigned long)dev;
         add_timer(&tp->timer);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -343,23 +343,23 @@ static int tms380tr_chipset_init(struct net_device *dev)
                 printk(KERN_DEBUG "%s: Resetting adapter...\n", dev->name);
         err = tms380tr_reset_adapter(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Bringup diags...\n", dev->name);
         err = tms380tr_bringup_diags(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Init adapter...\n", dev->name);
         err = tms380tr_init_adapter(dev);
         if(err < 0)
-                return (-1);
+                return -1;
 
         if(tms380tr_debug > 3)
                 printk(KERN_DEBUG "%s: Done!\n", dev->name);
-        return (0);
+        return 0;
 }
 
 /*
@@ -877,7 +877,7 @@ static unsigned char tms380tr_chk_ssb(struct net_local *tp, unsigned short IrqTy
            IrqType != STS_IRQ_COMMAND_STATUS &&
            IrqType != STS_IRQ_RING_STATUS)
         {
-                return (1);     /* SSB not involved. */
+                return 1;       /* SSB not involved. */
         }
 
         /* Note: All fields of the SSB have been set to all ones (-1) after it
@@ -887,21 +887,21 @@ static unsigned char tms380tr_chk_ssb(struct net_local *tp, unsigned short IrqTy
          */
 
         if(ssb->STS == (unsigned short) -1)
-                return (0);     /* Command field not yet available. */
+                return 0;       /* Command field not yet available. */
         if(IrqType == STS_IRQ_COMMAND_STATUS)
-                return (1);     /* Status fields not always affected. */
+                return 1;       /* Status fields not always affected. */
         if(ssb->Parm[0] == (unsigned short) -1)
-                return (0);     /* Status 1 field not yet available. */
+                return 0;       /* Status 1 field not yet available. */
         if(IrqType == STS_IRQ_RING_STATUS)
-                return (1);     /* Status 2 & 3 fields not affected. */
+                return 1;       /* Status 2 & 3 fields not affected. */
 
         /* Note: At this point, the interrupt is either TRANSMIT or RECEIVE. */
         if(ssb->Parm[1] == (unsigned short) -1)
-                return (0);     /* Status 2 field not yet available. */
+                return 0;       /* Status 2 field not yet available. */
         if(ssb->Parm[2] == (unsigned short) -1)
-                return (0);     /* Status 3 field not yet available. */
+                return 0;       /* Status 3 field not yet available. */
 
-        return (1);     /* All SSB fields have been written by the adapter. */
+        return 1;       /* All SSB fields have been written by the adapter. */
 }
 
 /*
@@ -1143,7 +1143,7 @@ int tms380tr_close(struct net_device *dev)
 #endif
         tms380tr_cancel_tx_queue(tp);
 
-        return (0);
+        return 0;
 }
 
 /*
@@ -1154,7 +1154,7 @@ static struct net_device_stats *tms380tr_get_stats(struct net_device *dev)
 {
         struct net_local *tp = netdev_priv(dev);
 
-        return ((struct net_device_stats *)&tp->MacStat);
+        return (struct net_device_stats *)&tp->MacStat;
 }
 
 /*
@@ -1256,7 +1256,7 @@ static int tms380tr_reset_adapter(struct net_device *dev)
         if (request_firmware(&fw_entry, "tms380tr.bin", tp->pdev) != 0) {
                 printk(KERN_ALERT "%s: firmware %s is missing, cannot start.\n",
                         dev->name, "tms380tr.bin");
-                return (-1);
+                return -1;
         }
 
         fw_ptr = (unsigned short *)fw_entry->data;
@@ -1321,16 +1321,14 @@ static int tms380tr_reset_adapter(struct net_device *dev)
 
                         /* Clear CPHALT and start BUD */
                         SIFWRITEW(c, SIFACL);
-                        if (fw_entry)
-                                release_firmware(fw_entry);
-                        return (1);
+                        release_firmware(fw_entry);
+                        return 1;
                 }
         } while(count == 0);
 
-        if (fw_entry)
-                release_firmware(fw_entry);
+        release_firmware(fw_entry);
         printk(KERN_INFO "%s: Adapter Download Failed\n", dev->name);
-        return (-1);
+        return -1;
 }
 
 MODULE_FIRMWARE("tms380tr.bin");
@@ -1365,7 +1363,7 @@ static int tms380tr_bringup_diags(struct net_device *dev)
                                 printk(KERN_DEBUG " %04X\n", Status);
                         /* BUD successfully completed */
                         if(Status == STS_INITIALIZE)
-                                return (1);
+                                return 1;
                 /* Unrecoverable hardware error, BUD not completed? */
                 } while((loop_cnt > 0) && ((Status & (STS_ERROR | STS_TEST))
                         != (STS_ERROR | STS_TEST)));
@@ -1392,7 +1390,7 @@ static int tms380tr_bringup_diags(struct net_device *dev)
         else
                 printk(KERN_INFO "%s: Bring Up Diagnostics Error (%04X) occurred\n", dev->name, Status & 0x000f);
 
-        return (-1);
+        return -1;
 }
 
 /*
@@ -1466,7 +1464,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
                                 {
                                         printk(KERN_INFO "%s: DMA failed\n", dev->name);
                                         /* DMA data error: wrong data in SCB */
-                                        return (-1);
+                                        return -1;
                                 }
                                 i++;
                         } while(i < 6);
@@ -1475,11 +1473,11 @@ static int tms380tr_init_adapter(struct net_device *dev)
                         do {    /* Test if contents of SSB is valid */
                                 if(SSB_Test[i] != *(sb_ptr + i))
                                         /* DMA data error: wrong data in SSB */
-                                        return (-1);
+                                        return -1;
                                 i++;
                         } while (i < 8);
 
-                        return (1);     /* Adapter successfully initialized */
+                        return 1;       /* Adapter successfully initialized */
                 }
                 else
                 {
@@ -1490,7 +1488,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
                                 Status &= STS_ERROR_MASK;
                                 /* ShowInitialisationErrorCode(Status); */
                                 printk(KERN_INFO "%s: Status error: %d\n", dev->name, Status);
-                                return (-1); /* Unrecoverable error */
+                                return -1; /* Unrecoverable error */
                         }
                         else
                         {
@@ -1505,7 +1503,7 @@ static int tms380tr_init_adapter(struct net_device *dev)
         } while(retry_cnt > 0);
 
         printk(KERN_INFO "%s: Retry exceeded\n", dev->name);
-        return (-1);
+        return -1;
 }
 
 /*
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index d4c7c0c0a3d6..d3e788a9cd1c 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -125,18 +125,16 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
         dev->irq        = pci_irq_line;
         dev->dma        = 0;
 
-        printk("%s: %s\n", dev->name, cardinfo->name);
-        printk("%s:    IO: %#4lx  IRQ: %d\n",
-               dev->name, dev->base_addr, dev->irq);
+        dev_info(&pdev->dev, "%s\n", cardinfo->name);
+        dev_info(&pdev->dev, "    IO: %#4lx  IRQ: %d\n", dev->base_addr, dev->irq);
                 
         tms_pci_read_eeprom(dev);
 
-        printk("%s:    Ring Station Address: %pM\n",
-               dev->name, dev->dev_addr);
+        dev_info(&pdev->dev, "    Ring Station Address: %pM\n", dev->dev_addr);
                 
         ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
-                printk("%s: unable to get memory for dev->priv.\n", dev->name);
+                dev_info(&pdev->dev, "unable to get memory for dev->priv.\n");
                 goto err_out_region;
         }
 
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index a03730bd1da5..5c633a32eaeb 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -219,7 +219,7 @@ static int tsi108_read_mii(struct tsi108_prv_data *data, int reg)
         if (i == 100)
                 return 0xffff;
         else
-                return (TSI_READ_PHY(TSI108_MAC_MII_DATAIN));
+                return TSI_READ_PHY(TSI108_MAC_MII_DATAIN);
 }
 
 static void tsi108_write_mii(struct tsi108_prv_data *data,
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index 75a64c88cf7a..251c6ce15aea 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -1448,7 +1448,7 @@ de4x5_sw_reset(struct net_device *dev)
         status = -EIO;
     }
 
-    lp->tx_new = (++lp->tx_new) % lp->txRingSize;
+    lp->tx_new = (lp->tx_new + 1) % lp->txRingSize;
     lp->tx_old = lp->tx_new;
 
     return status;
@@ -1506,7 +1506,7 @@ de4x5_queue_pkt(struct sk_buff *skb, struct net_device *dev)
             lp->stats.tx_bytes += skb->len;
             outl(POLL_DEMAND, DE4X5_TPD);/* Start the TX */
 
-            lp->tx_new = (++lp->tx_new) % lp->txRingSize;
+            lp->tx_new = (lp->tx_new + 1) % lp->txRingSize;
 
             if (TX_BUFFS_AVAIL) {
                 netif_start_queue(dev);         /* Another pkt may be queued */
@@ -1657,7 +1657,7 @@ de4x5_rx(struct net_device *dev)
             }
 
             /* Change buffer ownership for this frame, back to the adapter */
-            for (;lp->rx_old!=entry;lp->rx_old=(++lp->rx_old)%lp->rxRingSize) {
+            for (;lp->rx_old!=entry;lp->rx_old=(lp->rx_old + 1)%lp->rxRingSize) {
                 lp->rx_ring[lp->rx_old].status = cpu_to_le32(R_OWN);
                 barrier();
             }
@@ -1668,7 +1668,7 @@ de4x5_rx(struct net_device *dev)
         /*
         ** Update entry information
         */
-        lp->rx_new = (++lp->rx_new) % lp->rxRingSize;
+        lp->rx_new = (lp->rx_new + 1) % lp->rxRingSize;
     }
 
     return 0;
@@ -1726,7 +1726,7 @@ de4x5_tx(struct net_device *dev)
         }
 
         /* Update all the pointers */
-        lp->tx_old = (++lp->tx_old) % lp->txRingSize;
+        lp->tx_old = (lp->tx_old + 1) % lp->txRingSize;
     }
 
     /* Any resources available? */
@@ -1801,7 +1801,7 @@ de4x5_rx_ovfc(struct net_device *dev)
 
     for (; (s32)le32_to_cpu(lp->rx_ring[lp->rx_new].status)>=0;) {
         lp->rx_ring[lp->rx_new].status = cpu_to_le32(R_OWN);
-        lp->rx_new = (++lp->rx_new % lp->rxRingSize);
+        lp->rx_new = (lp->rx_new + 1) % lp->rxRingSize;
     }
 
     outl(omr, DE4X5_OMR);
@@ -1932,7 +1932,7 @@ set_multicast_list(struct net_device *dev)
             load_packet(dev, lp->setup_frame, TD_IC | PERFECT_F | TD_SET |
                                                         SETUP_FRAME_LEN, (struct sk_buff *)1);
 
-            lp->tx_new = (++lp->tx_new) % lp->txRingSize;
+            lp->tx_new = (lp->tx_new + 1) % lp->txRingSize;
             outl(POLL_DEMAND, DE4X5_TPD);       /* Start the TX */
             dev->trans_start = jiffies; /* prevent tx timeout */
         }
@@ -3119,7 +3119,7 @@ dc2114x_autoconf(struct net_device *dev)
           if (lp->media == _100Mb) {
               if ((slnk = test_for_100Mb(dev, 6500)) < 0) {
                   lp->media = SPD_DET;
-                  return  (slnk & ~TIMER_CB);
+                  return slnk & ~TIMER_CB;
               }
           } else {
               if (wait_for_link(dev) < 0) {
@@ -3484,7 +3484,7 @@ is_spd_100(struct net_device *dev)
         spd = ((~gep_rd(dev)) & GEP_SLNK);
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return ((lp->chipset == DC21143)?(~inl(DE4X5_SISR)&SISR_LS100):0);
+            return (lp->chipset == DC21143) ? (~inl(DE4X5_SISR)&SISR_LS100) : 0;
 
         spd = (lp->asBitValid & (lp->asPolarity ^ (gep_rd(dev) & lp->asBit))) |
                   (lp->linkOK & ~lp->asBitValid);
@@ -3502,15 +3502,15 @@ is_100_up(struct net_device *dev)
     if (lp->useMII) {
         /* Double read for sticky bits & temporary drops */
         mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS);
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS;
     } else if (!lp->useSROM) {                       /* de500-xa */
-        return ((~gep_rd(dev)) & GEP_SLNK);
+        return (~gep_rd(dev)) & GEP_SLNK;
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return ((lp->chipset == DC21143)?(~inl(DE4X5_SISR)&SISR_LS100):0);
+            return (lp->chipset == DC21143) ? (~inl(DE4X5_SISR)&SISR_LS100) : 0;
 
-        return ((lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
-                (lp->linkOK & ~lp->asBitValid));
+        return (lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
+                (lp->linkOK & ~lp->asBitValid);
     }
 }
 
@@ -3523,17 +3523,17 @@ is_10_up(struct net_device *dev)
     if (lp->useMII) {
         /* Double read for sticky bits & temporary drops */
         mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS);
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII) & MII_SR_LKS;
     } else if (!lp->useSROM) {                       /* de500-xa */
-        return ((~gep_rd(dev)) & GEP_LNP);
+        return (~gep_rd(dev)) & GEP_LNP;
     } else {
         if ((lp->ibn == 2) || !lp->asBitValid)
-            return (((lp->chipset & ~0x00ff) == DC2114x) ?
+            return ((lp->chipset & ~0x00ff) == DC2114x) ?
                     (~inl(DE4X5_SISR)&SISR_LS10):
-                    0);
+                    0;
 
-        return ((lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
-                (lp->linkOK & ~lp->asBitValid));
+        return  (lp->asBitValid&(lp->asPolarity^(gep_rd(dev)&lp->asBit))) |
+                (lp->linkOK & ~lp->asBitValid);
     }
 }
 
@@ -3544,7 +3544,7 @@ is_anc_capable(struct net_device *dev)
     u_long iobase = dev->base_addr;
 
     if (lp->phy[lp->active].id && (!lp->useSROM || lp->useMII)) {
-        return (mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII));
+        return mii_rd(MII_SR, lp->phy[lp->active].addr, DE4X5_MII);
     } else if ((lp->chipset & ~0x00ff) == DC2114x) {
         return (inl(DE4X5_SISR) & SISR_LPN) >> 12;
     } else {
@@ -3568,7 +3568,7 @@ ping_media(struct net_device *dev, int msec)
 
         lp->tmp = lp->tx_new;                /* Remember the ring position */
         load_packet(dev, lp->frame, TD_LS | TD_FS | sizeof(lp->frame), (struct sk_buff *)1);
-        lp->tx_new = (++lp->tx_new) % lp->txRingSize;
+        lp->tx_new = (lp->tx_new + 1) % lp->txRingSize;
         outl(POLL_DEMAND, DE4X5_TPD);
     }
 
@@ -4930,7 +4930,7 @@ getfrom_mii(u32 command, u_long ioaddr)
     outl(command | MII_MDC, ioaddr);
     udelay(1);
 
-    return ((inl(ioaddr) >> 19) & 1);
+    return (inl(ioaddr) >> 19) & 1;
 }
 
 /*
@@ -4975,8 +4975,8 @@ mii_get_oui(u_char phyaddr, u_long ioaddr)
     a.breg[0]=a.breg[1];
     a.breg[1]=i;
 
-    return ((a.reg<<8)|ret); */                 /* SEEQ and Cypress way */
-/*    return ((r2<<6)|(u_int)(r3>>10)); */      /* NATIONAL and BROADCOM way */
+    return (a.reg<<8)|ret; */                 /* SEEQ and Cypress way */
+/*    return (r2<<6)|(u_int)(r3>>10); */      /* NATIONAL and BROADCOM way */
     return r2;                                  /* (I did it) My way */
 }
 
@@ -5144,7 +5144,7 @@ gep_rd(struct net_device *dev)
     if (lp->chipset == DC21140) {
         return inl(DE4X5_GEP);
     } else if ((lp->chipset & ~0x00ff) == DC2114x) {
-        return (inl(DE4X5_SIGR) & 0x000fffff);
+        return inl(DE4X5_SIGR) & 0x000fffff;
     }
 
     return 0;
@@ -5417,7 +5417,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         /* Set up the descriptor and give ownership to the card */
         load_packet(dev, lp->setup_frame, TD_IC | PERFECT_F | TD_SET |
                                                        SETUP_FRAME_LEN, (struct sk_buff *)1);
-        lp->tx_new = (++lp->tx_new) % lp->txRingSize;
+        lp->tx_new = (lp->tx_new + 1) % lp->txRingSize;
         outl(POLL_DEMAND, DE4X5_TPD);                /* Start the TX */
         netif_wake_queue(dev);                      /* Unlock the TX ring */
         break;
@@ -5474,7 +5474,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         tmp.lval[6] = inl(DE4X5_STRR); j+=4;
         tmp.lval[7] = inl(DE4X5_SIGR); j+=4;
         ioc->len = j;
-        if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+        if (copy_to_user(ioc->data, tmp.lval, ioc->len)) return -EFAULT;
         break;
 
 #define DE4X5_DUMP              0x0f /* Dump the DE4X5 Status */
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 0bc4f3030a80..a9f7d5d1a269 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -599,7 +599,7 @@ static int dmfe_open(struct DEVICE *dev)
         init_timer(&db->timer);
         db->timer.expires = DMFE_TIMER_WUT + HZ * 2;
         db->timer.data = (unsigned long)dev;
-        db->timer.function = &dmfe_timer;
+        db->timer.function = dmfe_timer;
         add_timer(&db->timer);
 
         return 0;
diff --git a/drivers/net/tulip/interrupt.c b/drivers/net/tulip/interrupt.c
index 1faf7a4d7202..0013642903ee 100644
--- a/drivers/net/tulip/interrupt.c
+++ b/drivers/net/tulip/interrupt.c
@@ -180,21 +180,24 @@ int tulip_poll(struct napi_struct *napi, int budget)
                                                        dev_warn(&dev->dev,
                                                                 "Oversized Ethernet frame spanned multiple buffers, status %08x!\n",
                                                                 status);
-                                               tp->stats.rx_length_errors++;
-                                       }
+                                                dev->stats.rx_length_errors++;
+                                        }
                                } else {
                                 /* There was a fatal error. */
                                        if (tulip_debug > 2)
                                                printk(KERN_DEBUG "%s: Receive error, Rx status %08x\n",
                                                       dev->name, status);
-                                       tp->stats.rx_errors++; /* end of a packet.*/
-                                       if (pkt_len > 1518 ||
-                                           (status & RxDescRunt))
-                                               tp->stats.rx_length_errors++;
-
-                                       if (status & 0x0004) tp->stats.rx_frame_errors++;
-                                       if (status & 0x0002) tp->stats.rx_crc_errors++;
-                                       if (status & 0x0001) tp->stats.rx_fifo_errors++;
+                                        dev->stats.rx_errors++; /* end of a packet.*/
+                                        if (pkt_len > 1518 ||
+                                            (status & RxDescRunt))
+                                                dev->stats.rx_length_errors++;
+
+                                        if (status & 0x0004)
+                                                dev->stats.rx_frame_errors++;
+                                        if (status & 0x0002)
+                                                dev->stats.rx_crc_errors++;
+                                        if (status & 0x0001)
+                                                dev->stats.rx_fifo_errors++;
                                }
                        } else {
                                struct sk_buff *skb;
@@ -244,8 +247,8 @@ int tulip_poll(struct napi_struct *napi, int budget)
 
                                netif_receive_skb(skb);
 
-                               tp->stats.rx_packets++;
-                               tp->stats.rx_bytes += pkt_len;
+                                dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += pkt_len;
                        }
 #ifdef CONFIG_TULIP_NAPI_HW_MITIGATION
                        received++;
@@ -404,20 +407,23 @@ static int tulip_rx(struct net_device *dev)
                                                 dev_warn(&dev->dev,
                                                          "Oversized Ethernet frame spanned multiple buffers, status %08x!\n",
                                                          status);
-                                        tp->stats.rx_length_errors++;
+                                        dev->stats.rx_length_errors++;
                                 }
                         } else {
                                 /* There was a fatal error. */
                                 if (tulip_debug > 2)
                                         printk(KERN_DEBUG "%s: Receive error, Rx status %08x\n",
                                                dev->name, status);
-                                tp->stats.rx_errors++; /* end of a packet.*/
+                                dev->stats.rx_errors++; /* end of a packet.*/
                                 if (pkt_len > 1518 ||
                                     (status & RxDescRunt))
-                                        tp->stats.rx_length_errors++;
-                                if (status & 0x0004) tp->stats.rx_frame_errors++;
-                                if (status & 0x0002) tp->stats.rx_crc_errors++;
-                                if (status & 0x0001) tp->stats.rx_fifo_errors++;
+                                        dev->stats.rx_length_errors++;
+                                if (status & 0x0004)
+                                        dev->stats.rx_frame_errors++;
+                                if (status & 0x0002)
+                                        dev->stats.rx_crc_errors++;
+                                if (status & 0x0001)
+                                        dev->stats.rx_fifo_errors++;
                         }
                 } else {
                         struct sk_buff *skb;
@@ -467,8 +473,8 @@ static int tulip_rx(struct net_device *dev)
 
                         netif_rx(skb);
 
-                        tp->stats.rx_packets++;
-                        tp->stats.rx_bytes += pkt_len;
+                        dev->stats.rx_packets++;
+                        dev->stats.rx_bytes += pkt_len;
                 }
                 received++;
                 entry = (++tp->cur_rx) % RX_RING_SIZE;
@@ -602,18 +608,22 @@ irqreturn_t tulip_interrupt(int irq, void *dev_instance)
                                                 printk(KERN_DEBUG "%s: Transmit error, Tx status %08x\n",
                                                        dev->name, status);
 #endif
-                                        tp->stats.tx_errors++;
-                                        if (status & 0x4104) tp->stats.tx_aborted_errors++;
-                                        if (status & 0x0C00) tp->stats.tx_carrier_errors++;
-                                        if (status & 0x0200) tp->stats.tx_window_errors++;
-                                        if (status & 0x0002) tp->stats.tx_fifo_errors++;
+                                        dev->stats.tx_errors++;
+                                        if (status & 0x4104)
+                                                dev->stats.tx_aborted_errors++;
+                                        if (status & 0x0C00)
+                                                dev->stats.tx_carrier_errors++;
+                                        if (status & 0x0200)
+                                                dev->stats.tx_window_errors++;
+                                        if (status & 0x0002)
+                                                dev->stats.tx_fifo_errors++;
                                         if ((status & 0x0080) && tp->full_duplex == 0)
-                                                tp->stats.tx_heartbeat_errors++;
+                                                dev->stats.tx_heartbeat_errors++;
                                 } else {
-                                        tp->stats.tx_bytes +=
+                                        dev->stats.tx_bytes +=
                                                 tp->tx_buffers[entry].skb->len;
-                                        tp->stats.collisions += (status >> 3) & 15;
-                                        tp->stats.tx_packets++;
+                                        dev->stats.collisions += (status >> 3) & 15;
+                                        dev->stats.tx_packets++;
                                 }
 
                                 pci_unmap_single(tp->pdev, tp->tx_buffers[entry].mapping,
@@ -655,7 +665,8 @@ irqreturn_t tulip_interrupt(int irq, void *dev_instance)
                 if (csr5 & AbnormalIntr) {      /* Abnormal error summary bit. */
                         if (csr5 == 0xffffffff)
                                 break;
-                        if (csr5 & TxJabber) tp->stats.tx_errors++;
+                        if (csr5 & TxJabber)
+                                dev->stats.tx_errors++;
                         if (csr5 & TxFIFOUnderflow) {
                                 if ((tp->csr6 & 0xC000) != 0xC000)
                                         tp->csr6 += 0x4000;     /* Bump up the Tx threshold */
@@ -672,8 +683,8 @@ irqreturn_t tulip_interrupt(int irq, void *dev_instance)
                                 }
                         }
                         if (csr5 & RxDied) {            /* Missed a Rx frame. */
-                                tp->stats.rx_missed_errors += ioread32(ioaddr + CSR8) & 0xffff;
-                                tp->stats.rx_errors++;
+                                dev->stats.rx_missed_errors += ioread32(ioaddr + CSR8) & 0xffff;
+                                dev->stats.rx_errors++;
                                 tulip_start_rxtx(tp);
                         }
                         /*
@@ -789,7 +800,7 @@ irqreturn_t tulip_interrupt(int irq, void *dev_instance)
 #endif /* CONFIG_TULIP_NAPI */
 
         if ((missed = ioread32(ioaddr + CSR8) & 0x1ffff)) {
-                tp->stats.rx_dropped += missed & 0x10000 ? 0x10000 : missed;
+                dev->stats.rx_dropped += missed & 0x10000 ? 0x10000 : missed;
         }
 
         if (tulip_debug > 4)
diff --git a/drivers/net/tulip/tulip.h b/drivers/net/tulip/tulip.h
index e525875ed67d..ed66a16711dc 100644
--- a/drivers/net/tulip/tulip.h
+++ b/drivers/net/tulip/tulip.h
@@ -417,7 +417,6 @@ struct tulip_private {
         int revision;
         int flags;
         struct napi_struct napi;
-        struct net_device_stats stats;
         struct timer_list timer;        /* Media selection timer. */
         struct timer_list oom_timer;    /* Out of memory timer. */
         u32 mc_filter[2];
@@ -570,7 +569,7 @@ static inline void tulip_tx_timeout_complete(struct tulip_private *tp, void __io
         /* Trigger an immediate transmit demand. */
         iowrite32(0, ioaddr + CSR1);
 
-        tp->stats.tx_errors++;
+        tp->dev->stats.tx_errors++;
 }
 
 #endif /* __NET_TULIP_H__ */
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 3a8d7efa2acf..2c39f2591216 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -725,7 +725,7 @@ static void tulip_clean_tx_ring(struct tulip_private *tp)
                 int status = le32_to_cpu(tp->tx_ring[entry].status);
 
                 if (status < 0) {
-                        tp->stats.tx_errors++;  /* It wasn't Txed */
+                        tp->dev->stats.tx_errors++;     /* It wasn't Txed */
                         tp->tx_ring[entry].status = 0;
                 }
 
@@ -781,8 +781,8 @@ static void tulip_down (struct net_device *dev)
         /* release any unconsumed transmit buffers */
         tulip_clean_tx_ring(tp);
 
-        if (ioread32 (ioaddr + CSR6) != 0xffffffff)
-                tp->stats.rx_missed_errors += ioread32 (ioaddr + CSR8) & 0xffff;
+        if (ioread32(ioaddr + CSR6) != 0xffffffff)
+                dev->stats.rx_missed_errors += ioread32(ioaddr + CSR8) & 0xffff;
 
         spin_unlock_irqrestore (&tp->lock, flags);
 
@@ -864,12 +864,12 @@ static struct net_device_stats *tulip_get_stats(struct net_device *dev)
 
                 spin_lock_irqsave (&tp->lock, flags);
 
-                tp->stats.rx_missed_errors += ioread32(ioaddr + CSR8) & 0xffff;
+                dev->stats.rx_missed_errors += ioread32(ioaddr + CSR8) & 0xffff;
 
                 spin_unlock_irqrestore(&tp->lock, flags);
         }
 
-        return &tp->stats;
+        return &dev->stats;
 }
 
 
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 96de5829b940..74217dbf0143 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -480,7 +480,7 @@ static int uli526x_open(struct net_device *dev)
         init_timer(&db->timer);
         db->timer.expires = ULI526X_TIMER_WUT + HZ * 2;
         db->timer.data = (unsigned long)dev;
-        db->timer.function = &uli526x_timer;
+        db->timer.function = uli526x_timer;
         add_timer(&db->timer);
 
         return 0;
@@ -1747,7 +1747,7 @@ static u16 phy_readby_cr10(unsigned long iobase, u8 phy_addr, u8 offset)
                 if(cr10_value&0x10000000)
                         break;
         }
-        return (cr10_value&0x0ffff);
+        return cr10_value & 0x0ffff;
 }
 
 static void phy_writeby_cr10(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data)
diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
index 66d41cf8da29..f0b231035dee 100644
--- a/drivers/net/tulip/winbond-840.c
+++ b/drivers/net/tulip/winbond-840.c
@@ -662,7 +662,7 @@ static int netdev_open(struct net_device *dev)
         init_timer(&np->timer);
         np->timer.expires = jiffies + 1*HZ;
         np->timer.data = (unsigned long)dev;
-        np->timer.function = &netdev_timer;                             /* timer handler */
+        np->timer.function = netdev_timer;                              /* timer handler */
         add_timer(&np->timer);
         return 0;
 out_err:
diff --git a/drivers/net/tulip/xircom_cb.c b/drivers/net/tulip/xircom_cb.c
index a439e93be22d..5a73752be2ca 100644
--- a/drivers/net/tulip/xircom_cb.c
+++ b/drivers/net/tulip/xircom_cb.c
@@ -29,7 +29,6 @@
 #include <linux/skbuff.h>
 #include <linux/delay.h>
 #include <linux/init.h>
-#include <linux/ethtool.h>
 #include <linux/bitops.h>
 
 #include <asm/uaccess.h>
@@ -181,19 +180,6 @@ static void print_binary(unsigned int number)
 }
 #endif
 
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        struct xircom_private *private = netdev_priv(dev);
-
-        strcpy(info->driver, "xircom_cb");
-        strcpy(info->bus_info, pci_name(private->pdev));
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo            = netdev_get_drvinfo,
-};
-
 static const struct net_device_ops netdev_ops = {
         .ndo_open               = xircom_open,
         .ndo_stop               = xircom_close,
@@ -279,7 +265,6 @@ static int __devinit xircom_probe(struct pci_dev *pdev, const struct pci_device_
         setup_descriptors(private);
 
         dev->netdev_ops = &netdev_ops;
-        SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
         pci_set_drvdata(pdev, dev);
 
         if (register_netdev(dev)) {
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 2e50077ff450..1cc67138adbf 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -541,7 +541,7 @@ cleanup:
 
         indexes->respCleared = cpu_to_le32(cleared);
         wmb();
-        return (resp_save == NULL);
+        return resp_save == NULL;
 }
 
 static inline int
@@ -962,36 +962,34 @@ typhoon_do_get_stats(struct typhoon *tp)
          * The extra status reported would be a good candidate for
          * ethtool_ops->get_{strings,stats}()
          */
-        stats->tx_packets = le32_to_cpu(s->txPackets);
-        stats->tx_bytes = le64_to_cpu(s->txBytes);
-        stats->tx_errors = le32_to_cpu(s->txCarrierLost);
-        stats->tx_carrier_errors = le32_to_cpu(s->txCarrierLost);
-        stats->collisions = le32_to_cpu(s->txMultipleCollisions);
-        stats->rx_packets = le32_to_cpu(s->rxPacketsGood);
-        stats->rx_bytes = le64_to_cpu(s->rxBytesGood);
-        stats->rx_fifo_errors = le32_to_cpu(s->rxFifoOverruns);
+        stats->tx_packets = le32_to_cpu(s->txPackets) +
+                        saved->tx_packets;
+        stats->tx_bytes = le64_to_cpu(s->txBytes) +
+                        saved->tx_bytes;
+        stats->tx_errors = le32_to_cpu(s->txCarrierLost) +
+                        saved->tx_errors;
+        stats->tx_carrier_errors = le32_to_cpu(s->txCarrierLost) +
+                        saved->tx_carrier_errors;
+        stats->collisions = le32_to_cpu(s->txMultipleCollisions) +
+                        saved->collisions;
+        stats->rx_packets = le32_to_cpu(s->rxPacketsGood) +
+                        saved->rx_packets;
+        stats->rx_bytes = le64_to_cpu(s->rxBytesGood) +
+                        saved->rx_bytes;
+        stats->rx_fifo_errors = le32_to_cpu(s->rxFifoOverruns) +
+                        saved->rx_fifo_errors;
         stats->rx_errors = le32_to_cpu(s->rxFifoOverruns) +
-                        le32_to_cpu(s->BadSSD) + le32_to_cpu(s->rxCrcErrors);
-        stats->rx_crc_errors = le32_to_cpu(s->rxCrcErrors);
-        stats->rx_length_errors = le32_to_cpu(s->rxOversized);
+                        le32_to_cpu(s->BadSSD) + le32_to_cpu(s->rxCrcErrors) +
+                        saved->rx_errors;
+        stats->rx_crc_errors = le32_to_cpu(s->rxCrcErrors) +
+                        saved->rx_crc_errors;
+        stats->rx_length_errors = le32_to_cpu(s->rxOversized) +
+                        saved->rx_length_errors;
         tp->speed = (s->linkStatus & TYPHOON_LINK_100MBPS) ?
                         SPEED_100 : SPEED_10;
         tp->duplex = (s->linkStatus & TYPHOON_LINK_FULL_DUPLEX) ?
                         DUPLEX_FULL : DUPLEX_HALF;
 
-        /* add in the saved statistics
-         */
-        stats->tx_packets += saved->tx_packets;
-        stats->tx_bytes += saved->tx_bytes;
-        stats->tx_errors += saved->tx_errors;
-        stats->collisions += saved->collisions;
-        stats->rx_packets += saved->rx_packets;
-        stats->rx_bytes += saved->rx_bytes;
-        stats->rx_fifo_errors += saved->rx_fifo_errors;
-        stats->rx_errors += saved->rx_errors;
-        stats->rx_crc_errors += saved->rx_crc_errors;
-        stats->rx_length_errors += saved->rx_length_errors;
-
         return 0;
 }
 
@@ -1762,7 +1760,7 @@ typhoon_rx(struct typhoon *tp, struct basic_ring *rxRing, volatile __le32 * read
                    (TYPHOON_RX_IP_CHK_GOOD | TYPHOON_RX_UDP_CHK_GOOD)) {
                         new_skb->ip_summed = CHECKSUM_UNNECESSARY;
                 } else
-                        new_skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(new_skb);
 
                 spin_lock(&tp->state_lock);
                 if(tp->vlgrp != NULL && rx->rxStatus & TYPHOON_RX_VLAN)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index d7b7018a1de1..52ffabe6db0e 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -358,6 +358,14 @@ config USB_NET_ZAURUS
           really need this non-conformant variant of CDC Ethernet (or in
           some cases CDC MDLM) protocol, not "g_ether".
 
+config USB_NET_CX82310_ETH
+        tristate "Conexant CX82310 USB ethernet port"
+        depends on USB_USBNET
+        help
+          Choose this option if you're using a Conexant CX82310-based ADSL
+          router with USB ethernet port. This driver is for routers only,
+          it will not work with ADSL modems (use cxacru driver instead).
+
 config USB_HSO
         tristate "Option USB High Speed Mobile Devices"
         depends on USB && RFKILL
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b13a279663ba..a19b0259ae16 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -25,4 +25,5 @@ obj-$(CONFIG_USB_NET_INT51X1)	+= int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
+obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
 
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
new file mode 100644
index 000000000000..8969f124c18c
--- /dev/null
+++ b/drivers/net/usb/cx82310_eth.c
@@ -0,0 +1,346 @@
+/*
+ * Driver for USB ethernet port of Conexant CX82310-based ADSL routers
+ * Copyright (C) 2010 by Ondrej Zary
+ * some parts inspired by the cxacru driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/usb/usbnet.h>
+
+enum cx82310_cmd {
+        CMD_START               = 0x84, /* no effect? */
+        CMD_STOP                = 0x85, /* no effect? */
+        CMD_GET_STATUS          = 0x90, /* returns nothing? */
+        CMD_GET_MAC_ADDR        = 0x91, /* read MAC address */
+        CMD_GET_LINK_STATUS     = 0x92, /* not useful, link is always up */
+        CMD_ETHERNET_MODE       = 0x99, /* unknown, needed during init */
+};
+
+enum cx82310_status {
+        STATUS_UNDEFINED,
+        STATUS_SUCCESS,
+        STATUS_ERROR,
+        STATUS_UNSUPPORTED,
+        STATUS_UNIMPLEMENTED,
+        STATUS_PARAMETER_ERROR,
+        STATUS_DBG_LOOPBACK,
+};
+
+#define CMD_PACKET_SIZE 64
+/* first command after power on can take around 8 seconds */
+#define CMD_TIMEOUT     15000
+#define CMD_REPLY_RETRY 5
+
+#define CX82310_MTU     1514
+#define CMD_EP          0x01
+
+/*
+ * execute control command
+ *  - optionally send some data (command parameters)
+ *  - optionally wait for the reply
+ *  - optionally read some data from the reply
+ */
+static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
+                       u8 *wdata, int wlen, u8 *rdata, int rlen)
+{
+        int actual_len, retries, ret;
+        struct usb_device *udev = dev->udev;
+        u8 *buf = kzalloc(CMD_PACKET_SIZE, GFP_KERNEL);
+
+        if (!buf)
+                return -ENOMEM;
+
+        /* create command packet */
+        buf[0] = cmd;
+        if (wdata)
+                memcpy(buf + 4, wdata, min_t(int, wlen, CMD_PACKET_SIZE - 4));
+
+        /* send command packet */
+        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
+                           CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
+        if (ret < 0) {
+                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                        cmd, ret);
+                goto end;
+        }
+
+        if (reply) {
+                /* wait for reply, retry if it's empty */
+                for (retries = 0; retries < CMD_REPLY_RETRY; retries++) {
+                        ret = usb_bulk_msg(udev, usb_rcvbulkpipe(udev, CMD_EP),
+                                           buf, CMD_PACKET_SIZE, &actual_len,
+                                           CMD_TIMEOUT);
+                        if (ret < 0) {
+                                dev_err(&dev->udev->dev,
+                                        "reply receive error %d\n", ret);
+                                goto end;
+                        }
+                        if (actual_len > 0)
+                                break;
+                }
+                if (actual_len == 0) {
+                        dev_err(&dev->udev->dev, "no reply to command %#x\n",
+                                cmd);
+                        ret = -EIO;
+                        goto end;
+                }
+                if (buf[0] != cmd) {
+                        dev_err(&dev->udev->dev,
+                                "got reply to command %#x, expected: %#x\n",
+                                buf[0], cmd);
+                        ret = -EIO;
+                        goto end;
+                }
+                if (buf[1] != STATUS_SUCCESS) {
+                        dev_err(&dev->udev->dev, "command %#x failed: %#x\n",
+                                cmd, buf[1]);
+                        ret = -EIO;
+                        goto end;
+                }
+                if (rdata)
+                        memcpy(rdata, buf + 4,
+                               min_t(int, rlen, CMD_PACKET_SIZE - 4));
+        }
+end:
+        kfree(buf);
+        return ret;
+}
+
+#define partial_len     data[0]         /* length of partial packet data */
+#define partial_rem     data[1]         /* remaining (missing) data length */
+#define partial_data    data[2]         /* partial packet data */
+
+static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+        char buf[15];
+        struct usb_device *udev = dev->udev;
+
+        /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
+        if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
+            && strcmp(buf, "USB NET CARD")) {
+                dev_info(&udev->dev, "ignoring: probably an ADSL modem\n");
+                return -ENODEV;
+        }
+
+        ret = usbnet_get_endpoints(dev, intf);
+        if (ret)
+                return ret;
+
+        /*
+         * this must not include ethernet header as the device can send partial
+         * packets with no header (and sometimes even empty URBs)
+         */
+        dev->net->hard_header_len = 0;
+        /* we can send at most 1514 bytes of data (+ 2-byte header) per URB */
+        dev->hard_mtu = CX82310_MTU + 2;
+        /* we can receive URBs up to 4KB from the device */
+        dev->rx_urb_size = 4096;
+
+        dev->partial_data = (unsigned long) kmalloc(dev->hard_mtu, GFP_KERNEL);
+        if (!dev->partial_data)
+                return -ENOMEM;
+
+        /* enable ethernet mode (?) */
+        ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
+        if (ret) {
+                dev_err(&udev->dev, "unable to enable ethernet mode: %d\n",
+                        ret);
+                goto err;
+        }
+
+        /* get the MAC address */
+        ret = cx82310_cmd(dev, CMD_GET_MAC_ADDR, true, NULL, 0,
+                          dev->net->dev_addr, ETH_ALEN);
+        if (ret) {
+                dev_err(&udev->dev, "unable to read MAC address: %d\n", ret);
+                goto err;
+        }
+
+        /* start (does not seem to have any effect?) */
+        ret = cx82310_cmd(dev, CMD_START, false, NULL, 0, NULL, 0);
+        if (ret)
+                goto err;
+
+        return 0;
+err:
+        kfree((void *)dev->partial_data);
+        return ret;
+}
+
+static void cx82310_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        kfree((void *)dev->partial_data);
+}
+
+/*
+ * RX is NOT easy - we can receive multiple packets per skb, each having 2-byte
+ * packet length at the beginning.
+ * The last packet might be incomplete (when it crosses the 4KB URB size),
+ * continuing in the next skb (without any headers).
+ * If a packet has odd length, there is one extra byte at the end (before next
+ * packet or at the end of the URB).
+ */
+static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int len;
+        struct sk_buff *skb2;
+
+        /*
+         * If the last skb ended with an incomplete packet, this skb contains
+         * end of that packet at the beginning.
+         */
+        if (dev->partial_rem) {
+                len = dev->partial_len + dev->partial_rem;
+                skb2 = alloc_skb(len, GFP_ATOMIC);
+                if (!skb2)
+                        return 0;
+                skb_put(skb2, len);
+                memcpy(skb2->data, (void *)dev->partial_data,
+                       dev->partial_len);
+                memcpy(skb2->data + dev->partial_len, skb->data,
+                       dev->partial_rem);
+                usbnet_skb_return(dev, skb2);
+                skb_pull(skb, (dev->partial_rem + 1) & ~1);
+                dev->partial_rem = 0;
+                if (skb->len < 2)
+                        return 1;
+        }
+
+        /* a skb can contain multiple packets */
+        while (skb->len > 1) {
+                /* first two bytes are packet length */
+                len = skb->data[0] | (skb->data[1] << 8);
+                skb_pull(skb, 2);
+
+                /* if last packet in the skb, let usbnet to process it */
+                if (len == skb->len || len + 1 == skb->len) {
+                        skb_trim(skb, len);
+                        break;
+                }
+
+                if (len > CX82310_MTU) {
+                        dev_err(&dev->udev->dev, "RX packet too long: %d B\n",
+                                len);
+                        return 0;
+                }
+
+                /* incomplete packet, save it for the next skb */
+                if (len > skb->len) {
+                        dev->partial_len = skb->len;
+                        dev->partial_rem = len - skb->len;
+                        memcpy((void *)dev->partial_data, skb->data,
+                               dev->partial_len);
+                        skb_pull(skb, skb->len);
+                        break;
+                }
+
+                skb2 = alloc_skb(len, GFP_ATOMIC);
+                if (!skb2)
+                        return 0;
+                skb_put(skb2, len);
+                memcpy(skb2->data, skb->data, len);
+                /* process the packet */
+                usbnet_skb_return(dev, skb2);
+
+                skb_pull(skb, (len + 1) & ~1);
+        }
+
+        /* let usbnet process the last packet */
+        return 1;
+}
+
+/* TX is easy, just add 2 bytes of length at the beginning */
+static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        int len = skb->len;
+
+        if (skb_headroom(skb) < 2) {
+                struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+        skb_push(skb, 2);
+
+        skb->data[0] = len;
+        skb->data[1] = len >> 8;
+
+        return skb;
+}
+
+
+static const struct driver_info cx82310_info = {
+        .description    = "Conexant CX82310 USB ethernet",
+        .flags          = FLAG_ETHER,
+        .bind           = cx82310_bind,
+        .unbind         = cx82310_unbind,
+        .rx_fixup       = cx82310_rx_fixup,
+        .tx_fixup       = cx82310_tx_fixup,
+};
+
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
+
+static const struct usb_device_id products[] = {
+        {
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
+                .driver_info = (unsigned long) &cx82310_info
+        },
+        { },
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver cx82310_driver = {
+        .name           = "cx82310_eth",
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .disconnect     = usbnet_disconnect,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+};
+
+static int __init cx82310_init(void)
+{
+        return usb_register(&cx82310_driver);
+}
+module_init(cx82310_init);
+
+static void __exit cx82310_exit(void)
+{
+        usb_deregister(&cx82310_driver);
+}
+module_exit(cx82310_exit);
+
+MODULE_AUTHOR("Ondrej Zary");
+MODULE_DESCRIPTION("Conexant CX82310-based ADSL router USB ethernet driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 1cd752f9a6e1..8110595fbbcc 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -843,16 +843,7 @@ static netdev_tx_t hso_net_start_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 }
 
-static void hso_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
-{
-        struct hso_net *odev = netdev_priv(net);
-
-        strncpy(info->driver, driver_name, ETHTOOL_BUSINFO_LEN);
-        usb_make_path(odev->parent->usb, info->bus_info, sizeof info->bus_info);
-}
-
 static const struct ethtool_ops ops = {
-        .get_drvinfo = hso_get_drvinfo,
         .get_link = ethtool_op_get_link
 };
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 2b7b39cad1ce..5e98643a4a21 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -759,14 +759,6 @@ static int kaweth_close(struct net_device *net)
         return 0;
 }
 
-static void kaweth_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
-{
-        struct kaweth_device *kaweth = netdev_priv(dev);
-
-        strlcpy(info->driver, driver_name, sizeof(info->driver));
-        usb_make_path(kaweth->dev, info->bus_info, sizeof (info->bus_info));
-}
-
 static u32 kaweth_get_link(struct net_device *dev)
 {
         struct kaweth_device *kaweth = netdev_priv(dev);
@@ -775,7 +767,6 @@ static u32 kaweth_get_link(struct net_device *dev)
 }
 
 static const struct ethtool_ops ops = {
-        .get_drvinfo    = kaweth_get_drvinfo,
         .get_link       = kaweth_get_link
 };
 
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index ee85c8b9a858..d1ac15c95faf 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -203,7 +203,7 @@ static inline void sierra_net_set_private(struct usbnet *dev,
 /* is packet IPv4 */
 static inline int is_ip(struct sk_buff *skb)
 {
-        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+        return skb->protocol == cpu_to_be16(ETH_P_IP);
 }
 
 /*
@@ -354,7 +354,7 @@ static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
 
 static inline int sierra_net_is_valid_addrlen(u8 len)
 {
-        return (len == sizeof(struct in_addr));
+        return len == sizeof(struct in_addr);
 }
 
 static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 5ec542dd5b50..0bbc0c323135 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -250,7 +250,7 @@ static int veth_close(struct net_device *dev)
 
 static int is_valid_veth_mtu(int new_mtu)
 {
-        return (new_mtu >= MIN_MTU && new_mtu <= MAX_MTU);
+        return new_mtu >= MIN_MTU && new_mtu <= MAX_MTU;
 }
 
 static int veth_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index f53412368ce1..6884813b809c 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1954,7 +1954,7 @@ static int velocity_tx_srv(struct velocity_info *vptr)
  */
 static inline void velocity_rx_csum(struct rx_desc *rd, struct sk_buff *skb)
 {
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         if (rd->rdesc1.CSM & CSM_IPKT) {
                 if (rd->rdesc1.CSM & CSM_IPOK) {
diff --git a/drivers/net/via-velocity.h b/drivers/net/via-velocity.h
index f7b33ae7a703..b5e120b0074b 100644
--- a/drivers/net/via-velocity.h
+++ b/drivers/net/via-velocity.h
@@ -1504,22 +1504,25 @@ struct velocity_info {
  *      addresses on this chain then we use the first - multi-IP WOL is not
  *      supported.
  *
- *      CHECK ME: locking
  */
 
 static inline int velocity_get_ip(struct velocity_info *vptr)
 {
-        struct in_device *in_dev = (struct in_device *) vptr->dev->ip_ptr;
+        struct in_device *in_dev;
         struct in_ifaddr *ifa;
+        int res = -ENOENT;
 
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(vptr->dev);
         if (in_dev != NULL) {
                 ifa = (struct in_ifaddr *) in_dev->ifa_list;
                 if (ifa != NULL) {
                         memcpy(vptr->ip_addr, &ifa->ifa_address, 4);
-                        return 0;
+                        res = 0;
                 }
         }
-        return -ENOENT;
+        rcu_read_unlock();
+        return res;
 }
 
 /**
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 4598e9d2608f..bb6b67f6b0cc 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -705,19 +705,6 @@ static int virtnet_close(struct net_device *dev)
         return 0;
 }
 
-static void virtnet_get_drvinfo(struct net_device *dev,
-                                struct ethtool_drvinfo *drvinfo)
-{
-        struct virtnet_info *vi = netdev_priv(dev);
-        struct virtio_device *vdev = vi->vdev;
-
-        strncpy(drvinfo->driver, KBUILD_MODNAME, ARRAY_SIZE(drvinfo->driver));
-        strncpy(drvinfo->version, "N/A", ARRAY_SIZE(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", ARRAY_SIZE(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, dev_name(&vdev->dev),
-                ARRAY_SIZE(drvinfo->bus_info));
-}
-
 static int virtnet_set_tx_csum(struct net_device *dev, u32 data)
 {
         struct virtnet_info *vi = netdev_priv(dev);
@@ -830,7 +817,6 @@ static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 }
 
 static const struct ethtool_ops virtnet_ethtool_ops = {
-        .get_drvinfo = virtnet_get_drvinfo,
         .set_tx_csum = virtnet_set_tx_csum,
         .set_sg = ethtool_op_set_sg,
         .set_tso = ethtool_op_set_tso,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index abe0ff53daf3..198ce92af0c3 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1042,11 +1042,11 @@ vmxnet3_rx_csum(struct vmxnet3_adapter *adapter,
                                 skb->csum = htons(gdesc->rcd.csum);
                                 skb->ip_summed = CHECKSUM_PARTIAL;
                         } else {
-                                skb->ip_summed = CHECKSUM_NONE;
+                                skb_checksum_none_assert(skb);
                         }
                 }
         } else {
-                skb->ip_summed = CHECKSUM_NONE;
+                skb_checksum_none_assert(skb);
         }
 }
 
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index c7c5605b3728..5378b849f54f 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -501,7 +501,7 @@ vxge_rx_1b_compl(struct __vxge_hw_ring *ringh, void *dtr,
                     ext_info.l4_cksum == VXGE_HW_L4_CKSUM_OK)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb_checksum_none_assert(skb);
 
                 vxge_rx_complete(ring, skb, ext_info.vlan,
                         pkt_length, &ext_info);
@@ -2159,8 +2159,8 @@ start:
         /* Alarm MSIX Vectors count */
         vdev->intr_cnt++;
 
-        vdev->entries = kzalloc(vdev->intr_cnt * sizeof(struct msix_entry),
-                                                GFP_KERNEL);
+        vdev->entries = kcalloc(vdev->intr_cnt, sizeof(struct msix_entry),
+                                GFP_KERNEL);
         if (!vdev->entries) {
                 vxge_debug_init(VXGE_ERR,
                         "%s: memory allocation failed",
@@ -2169,9 +2169,9 @@ start:
                 goto alloc_entries_failed;
         }
 
-        vdev->vxge_entries =
-                kzalloc(vdev->intr_cnt * sizeof(struct vxge_msix_entry),
-                                GFP_KERNEL);
+        vdev->vxge_entries = kcalloc(vdev->intr_cnt,
+                                     sizeof(struct vxge_msix_entry),
+                                     GFP_KERNEL);
         if (!vdev->vxge_entries) {
                 vxge_debug_init(VXGE_ERR, "%s: memory allocation failed",
                         VXGE_DRIVER_NAME);
@@ -2914,26 +2914,18 @@ static int vxge_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 /**
- * vxge_get_stats
+ * vxge_get_stats64
  * @dev: pointer to the device structure
+ * @stats: pointer to struct rtnl_link_stats64
  *
- * Updates the device statistics structure. This function updates the device
- * statistics structure in the net_device structure and returns a pointer
- * to the same.
  */
-static struct net_device_stats *
-vxge_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *
+vxge_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *net_stats)
 {
-        struct vxgedev *vdev;
-        struct net_device_stats *net_stats;
+        struct vxgedev *vdev = netdev_priv(dev);
         int k;
 
-        vdev = netdev_priv(dev);
-
-        net_stats = &vdev->stats.net_stats;
-
-        memset(net_stats, 0, sizeof(struct net_device_stats));
-
+        /* net_stats already zeroed by caller */
         for (k = 0; k < vdev->no_of_vpath; k++) {
                 net_stats->rx_packets += vdev->vpaths[k].ring.stats.rx_frms;
                 net_stats->rx_bytes += vdev->vpaths[k].ring.stats.rx_bytes;
@@ -3102,7 +3094,7 @@ vxge_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
 static const struct net_device_ops vxge_netdev_ops = {
         .ndo_open               = vxge_open,
         .ndo_stop               = vxge_close,
-        .ndo_get_stats          = vxge_get_stats,
+        .ndo_get_stats64        = vxge_get_stats64,
         .ndo_start_xmit         = vxge_xmit,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_multicast_list = vxge_set_multicast,
diff --git a/drivers/net/vxge/vxge-main.h b/drivers/net/vxge/vxge-main.h
index 2e3b064b8e4b..d4be07eaacd7 100644
--- a/drivers/net/vxge/vxge-main.h
+++ b/drivers/net/vxge/vxge-main.h
@@ -172,7 +172,6 @@ struct vxge_msix_entry {
 
 struct vxge_sw_stats {
         /* Network Stats (interface stats) */
-        struct net_device_stats net_stats;
 
         /* Tx */
         u64 tx_frms;
diff --git a/drivers/net/wan/c101.c b/drivers/net/wan/c101.c
index 0bd898c94759..4ac85a09c5a6 100644
--- a/drivers/net/wan/c101.c
+++ b/drivers/net/wan/c101.c
@@ -264,7 +264,7 @@ static int c101_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                     new_line.clock_type != CLOCK_TXFROMRX &&
                     new_line.clock_type != CLOCK_INT &&
                     new_line.clock_type != CLOCK_TXINT)
-                return -EINVAL; /* No such clock setting */
+                        return -EINVAL; /* No such clock setting */
 
                 if (new_line.loopback != 0 && new_line.loopback != 1)
                         return -EINVAL;
diff --git a/drivers/net/wan/cycx_drv.c b/drivers/net/wan/cycx_drv.c
index a5ddc6c8963e..164c3624ba89 100644
--- a/drivers/net/wan/cycx_drv.c
+++ b/drivers/net/wan/cycx_drv.c
@@ -73,7 +73,7 @@ static int reset_cyc2x(void __iomem *addr);
 static int detect_cyc2x(void __iomem *addr);
 
 /* Miscellaneous functions */
-static int get_option_index(long *optlist, long optval);
+static int get_option_index(const long *optlist, long optval);
 static u16 checksum(u8 *buf, u32 len);
 
 #define wait_cyc(addr) cycx_exec(addr + CMD_OFFSET)
@@ -81,23 +81,23 @@ static u16 checksum(u8 *buf, u32 len);
 /* Global Data */
 
 /* private data */
-static char modname[] = "cycx_drv";
-static char fullname[] = "Cyclom 2X Support Module";
-static char copyright[] = "(c) 1998-2003 Arnaldo Carvalho de Melo "
+static const char modname[] = "cycx_drv";
+static const char fullname[] = "Cyclom 2X Support Module";
+static const char copyright[] = "(c) 1998-2003 Arnaldo Carvalho de Melo "
                           "<acme@conectiva.com.br>";
 
 /* Hardware configuration options.
  * These are arrays of configuration options used by verification routines.
  * The first element of each array is its size (i.e. number of options).
  */
-static long cyc2x_dpmbase_options[] = {
+static const long cyc2x_dpmbase_options[] = {
         20,
         0xA0000, 0xA4000, 0xA8000, 0xAC000, 0xB0000, 0xB4000, 0xB8000,
         0xBC000, 0xC0000, 0xC4000, 0xC8000, 0xCC000, 0xD0000, 0xD4000,
         0xD8000, 0xDC000, 0xE0000, 0xE4000, 0xE8000, 0xEC000
 };
 
-static long cycx_2x_irq_options[]  = { 7, 3, 5, 9, 10, 11, 12, 15 };
+static const long cycx_2x_irq_options[]  = { 7, 3, 5, 9, 10, 11, 12, 15 };
 
 /* Kernel Loadable Module Entry Points */
 /* Module 'insert' entry point.
@@ -529,7 +529,7 @@ static int detect_cyc2x(void __iomem *addr)
 /* Miscellaneous */
 /* Get option's index into the options list.
  *      Return option's index (1 .. N) or zero if option is invalid. */
-static int get_option_index(long *optlist, long optval)
+static int get_option_index(const long *optlist, long optval)
 {
         int i = 1;
 
diff --git a/drivers/net/wan/cycx_main.c b/drivers/net/wan/cycx_main.c
index a0e8611ad8e8..859dba9b972e 100644
--- a/drivers/net/wan/cycx_main.c
+++ b/drivers/net/wan/cycx_main.c
@@ -81,9 +81,9 @@ static irqreturn_t cycx_isr(int irq, void *dev_id);
  */
 
 /* private data */
-static char cycx_drvname[] = "cyclomx";
-static char cycx_fullname[] = "CYCLOM 2X(tm) Sync Card Driver";
-static char cycx_copyright[] = "(c) 1998-2003 Arnaldo Carvalho de Melo "
+static const char cycx_drvname[] = "cyclomx";
+static const char cycx_fullname[] = "CYCLOM 2X(tm) Sync Card Driver";
+static const char cycx_copyright[] = "(c) 1998-2003 Arnaldo Carvalho de Melo "
                           "<acme@conectiva.com.br>";
 static int cycx_ncards = CONFIG_CYCX_CARDS;
 static struct cycx_device *cycx_card_array;     /* adapter data space */
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 421d0715310e..1481a446fefb 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -97,11 +97,11 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
 
         dest = skb_push(skb, hlen);
         if (!dest)
-                return(0);
+                return 0;
 
         memcpy(dest, &hdr, hlen);
 
-        return(hlen);
+        return hlen;
 }
 
 static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
@@ -211,14 +211,14 @@ static int dlci_config(struct net_device *dev, struct dlci_conf __user *conf, in
                 if (copy_from_user(&config, conf, sizeof(struct dlci_conf)))
                         return -EFAULT;
                 if (config.flags & ~DLCI_VALID_FLAGS)
-                        return(-EINVAL);
+                        return -EINVAL;
                 memcpy(&dlp->config, &config, sizeof(struct dlci_conf));
                 dlp->configured = 1;
         }
 
         err = (*flp->dlci_conf)(dlp->slave, dev, get);
         if (err)
-                return(err);
+                return err;
 
         if (get)
         {
@@ -226,7 +226,7 @@ static int dlci_config(struct net_device *dev, struct dlci_conf __user *conf, in
                         return -EFAULT;
         }
 
-        return(0);
+        return 0;
 }
 
 static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -234,7 +234,7 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         struct dlci_local *dlp;
 
         if (!capable(CAP_NET_ADMIN))
-                return(-EPERM);
+                return -EPERM;
 
         dlp = netdev_priv(dev);
 
@@ -242,7 +242,7 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         {
                 case DLCI_GET_SLAVE:
                         if (!*(short *)(dev->dev_addr))
-                                return(-EINVAL);
+                                return -EINVAL;
 
                         strncpy(ifr->ifr_slave, dlp->slave->name, sizeof(ifr->ifr_slave));
                         break;
@@ -250,15 +250,15 @@ static int dlci_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case DLCI_GET_CONF:
                 case DLCI_SET_CONF:
                         if (!*(short *)(dev->dev_addr))
-                                return(-EINVAL);
+                                return -EINVAL;
 
-                        return(dlci_config(dev, ifr->ifr_data, cmd == DLCI_GET_CONF));
+                        return dlci_config(dev, ifr->ifr_data, cmd == DLCI_GET_CONF);
                         break;
 
                 default: 
-                        return(-EOPNOTSUPP);
+                        return -EOPNOTSUPP;
         }
-        return(0);
+        return 0;
 }
 
 static int dlci_change_mtu(struct net_device *dev, int new_mtu)
@@ -277,15 +277,15 @@ static int dlci_open(struct net_device *dev)
         dlp = netdev_priv(dev);
 
         if (!*(short *)(dev->dev_addr))
-                return(-EINVAL);
+                return -EINVAL;
 
         if (!netif_running(dlp->slave))
-                return(-ENOTCONN);
+                return -ENOTCONN;
 
         flp = netdev_priv(dlp->slave);
         err = (*flp->activate)(dlp->slave, dev);
         if (err)
-                return(err);
+                return err;
 
         netif_start_queue(dev);
 
@@ -365,14 +365,14 @@ static int dlci_add(struct dlci_add *dlci)
         list_add(&dlp->list, &dlci_devs);
         rtnl_unlock();
 
-        return(0);
+        return 0;
 
  err2:
         rtnl_unlock();
         free_netdev(master);
  err1:
         dev_put(slave);
-        return(err);
+        return err;
 }
 
 static int dlci_del(struct dlci_add *dlci)
@@ -385,10 +385,10 @@ static int dlci_del(struct dlci_add *dlci)
         /* validate slave device */
         master = __dev_get_by_name(&init_net, dlci->devname);
         if (!master)
-                return(-ENODEV);
+                return -ENODEV;
 
         if (netif_running(master)) {
-                return(-EBUSY);
+                return -EBUSY;
         }
 
         dlp = netdev_priv(master);
@@ -406,7 +406,7 @@ static int dlci_del(struct dlci_add *dlci)
         }
         rtnl_unlock();
 
-        return(err);
+        return err;
 }
 
 static int dlci_ioctl(unsigned int cmd, void __user *arg)
@@ -415,7 +415,7 @@ static int dlci_ioctl(unsigned int cmd, void __user *arg)
         int err;
         
         if (!capable(CAP_NET_ADMIN))
-                return(-EPERM);
+                return -EPERM;
 
         if (copy_from_user(&add, arg, sizeof(struct dlci_add)))
                 return -EFAULT;
@@ -438,7 +438,7 @@ static int dlci_ioctl(unsigned int cmd, void __user *arg)
                         err = -EINVAL;
         }
 
-        return(err);
+        return err;
 }
 
 static const struct header_ops dlci_header_ops = {
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index b38ffa149aba..b1e5e5b69c2a 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -191,7 +191,8 @@ static int cisco_rx(struct sk_buff *skb)
 
                 switch (ntohl (cisco_data->type)) {
                 case CISCO_ADDR_REQ: /* Stolen from syncppp.c :-) */
-                        in_dev = dev->ip_ptr;
+                        rcu_read_lock();
+                        in_dev = __in_dev_get_rcu(dev);
                         addr = 0;
                         mask = ~cpu_to_be32(0); /* is the mask correct? */
 
@@ -211,6 +212,7 @@ static int cisco_rx(struct sk_buff *skb)
                                 cisco_keepalive_send(dev, CISCO_ADDR_REPLY,
                                                      addr, mask);
                         }
+                        rcu_read_unlock();
                         dev_kfree_skb_any(skb);
                         return NET_RX_SUCCESS;
 
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 4d4dc38c7290..7f5bb913c8b9 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -46,7 +46,7 @@
 
 #include <net/x25device.h>
 
-static char bcast_addr[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+static const u8 bcast_addr[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
 /* If this number is made larger, check that the temporary string buffer
  * in lapbeth_new_device is large enough to store the probe device name.*/
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index e2c6f7f4f51c..70feb84df670 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1022,7 +1022,7 @@ static int lmc_open(struct net_device *dev)
 
     if (sc->lmc_ok){
         lmc_trace(dev, "lmc_open lmc_ok out");
-        return (0);
+        return 0;
     }
 
     lmc_softreset (sc);
@@ -1105,12 +1105,12 @@ static int lmc_open(struct net_device *dev)
     init_timer (&sc->timer);
     sc->timer.expires = jiffies + HZ;
     sc->timer.data = (unsigned long) dev;
-    sc->timer.function = &lmc_watchdog;
+    sc->timer.function = lmc_watchdog;
     add_timer (&sc->timer);
 
     lmc_trace(dev, "lmc_open out");
 
-    return (0);
+    return 0;
 }
 
 /* Total reset to compensate for the AdTran DSU doing bad things
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index 5394b51bdb2f..17d408fe693f 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -282,7 +282,7 @@ static int n2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                     new_line.clock_type != CLOCK_TXFROMRX &&
                     new_line.clock_type != CLOCK_INT &&
                     new_line.clock_type != CLOCK_TXINT)
-                return -EINVAL; /* No such clock setting */
+                        return -EINVAL; /* No such clock setting */
 
                 if (new_line.loopback != 0 && new_line.loopback != 1)
                         return -EINVAL;
@@ -379,14 +379,14 @@ static int __init n2_run(unsigned long io, unsigned long irq,
         if (request_irq(irq, sca_intr, 0, devname, card)) {
                 printk(KERN_ERR "n2: could not allocate IRQ\n");
                 n2_destroy_card(card);
-                return(-EBUSY);
+                return -EBUSY;
         }
         card->irq = irq;
 
         if (!request_mem_region(winbase, USE_WINDOWSIZE, devname)) {
                 printk(KERN_ERR "n2: could not request RAM window\n");
                 n2_destroy_card(card);
-                return(-EBUSY);
+                return -EBUSY;
         }
         card->phy_winbase = winbase;
         card->winbase = ioremap(winbase, USE_WINDOWSIZE);
diff --git a/drivers/net/wan/pc300_drv.c b/drivers/net/wan/pc300_drv.c
index c6aa66e5b52f..f875cfae3093 100644
--- a/drivers/net/wan/pc300_drv.c
+++ b/drivers/net/wan/pc300_drv.c
@@ -1,5 +1,5 @@
 #define USE_PCI_CLOCK
-static char rcsid[] = 
+static const char rcsid[] =
 "Revision: 3.4.5 Date: 2002/03/07 ";
 
 /*
@@ -451,11 +451,11 @@ static int dma_get_rx_frame_size(pc300_t * card, int ch)
                 if ((status & DST_EOM) || (first_bd == card->chan[ch].rx_last_bd)) {
                         /* Return the size of a good frame or incomplete bad frame 
                         * (dma_buf_read will clean the buffer descriptors in this case). */
-                        return (rcvd);
+                        return rcvd;
                 }
                 ptdescr = (card->hw.rambase + cpc_readl(&ptdescr->next));
         }
-        return (-1);
+        return -1;
 }
 
 /*
@@ -557,7 +557,7 @@ static int dma_buf_read(pc300_t * card, int ch, struct sk_buff *skb)
                 cpc_writel(card->hw.scabase + DRX_REG(EDAL, ch),
                            RX_BD_ADDR(ch, chan->rx_last_bd));
         }
-        return (rcvd);
+        return rcvd;
 }
 
 static void tx_dma_stop(pc300_t * card, int ch)
@@ -1733,7 +1733,7 @@ static u16 falc_pattern_test_error(pc300_t * card, int ch)
         pc300ch_t *chan = (pc300ch_t *) & card->chan[ch];
         falc_t *pfalc = (falc_t *) & chan->falc;
 
-        return (pfalc->bec);
+        return pfalc->bec;
 }
 
 /**********************************/
@@ -2819,7 +2819,7 @@ static int clock_rate_calc(u32 rate, u32 clock, int *br_io)
         *br_io = 0;
 
         if (rate == 0)
-                return (0);
+                return 0;
 
         for (br = 0, br_pwr = 1; br <= 9; br++, br_pwr <<= 1) {
                 if ((tc = clock / br_pwr / rate) <= 0xff) {
@@ -2832,11 +2832,11 @@ static int clock_rate_calc(u32 rate, u32 clock, int *br_io)
                 error = ((rate - (clock / br_pwr / rate)) / rate) * 1000;
                 /* Errors bigger than +/- 1% won't be tolerated */
                 if (error < -10 || error > 10)
-                        return (-1);
+                        return -1;
                 else
-                        return (tc);
+                        return tc;
         } else {
-                return (-1);
+                return -1;
         }
 }
 
@@ -3207,7 +3207,7 @@ static u32 detect_ram(pc300_t * card)
                         break;
                 }
         }
-        return (i);
+        return i;
 }
 
 static void plx_init(pc300_t * card)
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 4293889e287e..515d9b8af01e 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -540,7 +540,7 @@ static int cpc_tty_chars_in_buffer(struct tty_struct *tty)
                 return -ENODEV; 
         }
    
-        return(0); 
+        return 0;
 } 
 
 static int pc300_tiocmset(struct tty_struct *tty, struct file *file,
diff --git a/drivers/net/wan/pci200syn.c b/drivers/net/wan/pci200syn.c
index e2cff64a446a..fd7375955e41 100644
--- a/drivers/net/wan/pci200syn.c
+++ b/drivers/net/wan/pci200syn.c
@@ -220,7 +220,7 @@ static int pci200_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                     new_line.clock_type != CLOCK_TXFROMRX &&
                     new_line.clock_type != CLOCK_INT &&
                     new_line.clock_type != CLOCK_TXINT)
-                return -EINVAL; /* No such clock setting */
+                        return -EINVAL; /* No such clock setting */
 
                 if (new_line.loopback != 0 && new_line.loopback != 1)
                         return -EINVAL;
diff --git a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
index f4125da2762f..3f4e2b5684db 100644
--- a/drivers/net/wan/sdla.c
+++ b/drivers/net/wan/sdla.c
@@ -178,7 +178,7 @@ static char sdla_byte(struct net_device *dev, int addr)
         byte = *temp;
         spin_unlock_irqrestore(&sdla_lock, flags);
 
-        return(byte);
+        return byte;
 }
 
 static void sdla_stop(struct net_device *dev)
@@ -267,7 +267,7 @@ static int sdla_z80_poll(struct net_device *dev, int z80_addr, int jiffs, char r
                         resp = *temp;
                 }
         }
-        return(time_before(jiffies, done) ? jiffies - start : -1);
+        return time_before(jiffies, done) ? jiffies - start : -1;
 }
 
 /* constants for Z80 CPU speed */
@@ -283,13 +283,13 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
 
         sdla_start(dev);
         if (sdla_z80_poll(dev, 0, 3*HZ, Z80_READY, 0) < 0)
-                return(-EIO);
+                return -EIO;
 
         data = LOADER_READY;
         sdla_write(dev, 0, &data, 1);
 
         if ((jiffs = sdla_z80_poll(dev, 0, 8*HZ, Z80_SCC_OK, Z80_SCC_BAD)) < 0)
-                return(-EIO);
+                return -EIO;
 
         sdla_stop(dev);
         sdla_read(dev, 0, &data, 1);
@@ -297,11 +297,11 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
         if (data == Z80_SCC_BAD)
         {
                 printk("%s: SCC bad\n", dev->name);
-                return(-EIO);
+                return -EIO;
         }
 
         if (data != Z80_SCC_OK)
-                return(-EINVAL);
+                return -EINVAL;
 
         if (jiffs < 165)
                 ifr->ifr_mtu = SDLA_CPU_16M;
@@ -316,7 +316,7 @@ static int sdla_cpuspeed(struct net_device *dev, struct ifreq *ifr)
         else
                 ifr->ifr_mtu = SDLA_CPU_3M;
  
-        return(0);
+        return 0;
 }
 
 /************************************************
@@ -493,7 +493,7 @@ static int sdla_cmd(struct net_device *dev, int cmd, short dlci, short flags,
         if (ret != SDLA_RET_OK)
                 sdla_errors(dev, cmd, dlci, ret, len, &status);
 
-        return(ret);
+        return ret;
 }
 
 /***********************************************
@@ -516,14 +516,14 @@ static int sdla_activate(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->dlci[i] = abs(flp->dlci[i]);
 
         if (netif_running(slave) && (flp->config.station == FRAD_STATION_NODE))
                 sdla_cmd(slave, SDLA_ACTIVATE_DLCI, 0, 0, &flp->dlci[i], sizeof(short), NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_deactivate(struct net_device *slave, struct net_device *master)
@@ -538,14 +538,14 @@ static int sdla_deactivate(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->dlci[i] = -abs(flp->dlci[i]);
 
         if (netif_running(slave) && (flp->config.station == FRAD_STATION_NODE))
                 sdla_cmd(slave, SDLA_DEACTIVATE_DLCI, 0, 0, &flp->dlci[i], sizeof(short), NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_assoc(struct net_device *slave, struct net_device *master)
@@ -554,7 +554,7 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
         int               i;
 
         if (master->type != ARPHRD_DLCI)
-                return(-EINVAL);
+                return -EINVAL;
 
         flp = netdev_priv(slave);
 
@@ -563,11 +563,11 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
                 if (!flp->master[i])
                         break;
                 if (abs(flp->dlci[i]) == *(short *)(master->dev_addr))
-                        return(-EADDRINUSE);
+                        return -EADDRINUSE;
         } 
 
         if (i == CONFIG_DLCI_MAX)
-                return(-EMLINK);  /* #### Alan: Comments on this ?? */
+                return -EMLINK;  /* #### Alan: Comments on this ?? */
 
 
         flp->master[i] = master;
@@ -581,7 +581,7 @@ static int sdla_assoc(struct net_device *slave, struct net_device *master)
                         sdla_cmd(slave, SDLA_ADD_DLCI, 0, 0, master->dev_addr, sizeof(short), NULL, NULL);
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_deassoc(struct net_device *slave, struct net_device *master)
@@ -596,7 +596,7 @@ static int sdla_deassoc(struct net_device *slave, struct net_device *master)
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         flp->master[i] = NULL;
         flp->dlci[i] = 0;
@@ -609,7 +609,7 @@ static int sdla_deassoc(struct net_device *slave, struct net_device *master)
                         sdla_cmd(slave, SDLA_DELETE_DLCI, 0, 0, master->dev_addr, sizeof(short), NULL, NULL);
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, int get)
@@ -626,7 +626,7 @@ static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, i
                         break;
 
         if (i == CONFIG_DLCI_MAX)
-                return(-ENODEV);
+                return -ENODEV;
 
         dlp = netdev_priv(master);
 
@@ -641,7 +641,7 @@ static int sdla_dlci_conf(struct net_device *slave, struct net_device *master, i
                                     &dlp->config, sizeof(struct dlci_conf) - 4 * sizeof(short), NULL, NULL);
         }
 
-        return(ret == SDLA_RET_OK ? 0 : -EIO);
+        return ret == SDLA_RET_OK ? 0 : -EIO;
 }
 
 /**************************
@@ -986,7 +986,7 @@ static int sdla_close(struct net_device *dev)
 
         netif_stop_queue(dev);
         
-        return(0);
+        return 0;
 }
 
 struct conf_data {
@@ -1006,10 +1006,10 @@ static int sdla_open(struct net_device *dev)
         flp = netdev_priv(dev);
 
         if (!flp->initialized)
-                return(-EPERM);
+                return -EPERM;
 
         if (!flp->configured)
-                return(-EPERM);
+                return -EPERM;
 
         /* time to send in the configuration */
         len = 0;
@@ -1087,7 +1087,7 @@ static int sdla_open(struct net_device *dev)
 
         netif_start_queue(dev);
         
-        return(0);
+        return 0;
 }
 
 static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, int get)
@@ -1098,48 +1098,48 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
         short             size;
 
         if (dev->type == 0xFFFF)
-                return(-EUNATCH);
+                return -EUNATCH;
 
         flp = netdev_priv(dev);
 
         if (!get)
         {
                 if (netif_running(dev))
-                        return(-EBUSY);
+                        return -EBUSY;
 
                 if(copy_from_user(&data.config, conf, sizeof(struct frad_conf)))
                         return -EFAULT;
 
                 if (data.config.station & ~FRAD_STATION_NODE)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (data.config.flags & ~FRAD_VALID_FLAGS)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.kbaud < 0) || 
                          ((data.config.kbaud > 128) && (flp->type != SDLA_S508)))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (data.config.clocking & ~(FRAD_CLOCK_INT | SDLA_S508_PORT_RS232))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.mtu < 0) || (data.config.mtu > SDLA_MAX_MTU))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.T391 < 5) || (data.config.T391 > 30))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.T392 < 5) || (data.config.T392 > 30))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N391 < 1) || (data.config.N391 > 255))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N392 < 1) || (data.config.N392 > 10))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if ((data.config.N393 < 1) || (data.config.N393 > 10))
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 memcpy(&flp->config, &data.config, sizeof(struct frad_conf));
                 flp->config.flags |= SDLA_DIRECT_RECV;
@@ -1171,7 +1171,7 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
                 {
                         size = sizeof(data);
                         if (sdla_cmd(dev, SDLA_READ_DLCI_CONFIGURATION, 0, 0, NULL, 0, &data, &size) != SDLA_RET_OK)
-                                return(-EIO);
+                                return -EIO;
                 }
                 else
                         if (flp->configured)
@@ -1185,7 +1185,7 @@ static int sdla_config(struct net_device *dev, struct frad_conf __user *conf, in
                 return copy_to_user(conf, &data.config, sizeof(struct frad_conf))?-EFAULT:0;
         }
 
-        return(0);
+        return 0;
 }
 
 static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int read)
@@ -1200,7 +1200,7 @@ static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int r
         {       
                 temp = kzalloc(mem.len, GFP_KERNEL);
                 if (!temp)
-                        return(-ENOMEM);
+                        return -ENOMEM;
                 sdla_read(dev, mem.addr, temp, mem.len);
                 if(copy_to_user(mem.data, temp, mem.len))
                 {
@@ -1217,7 +1217,7 @@ static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int r
                 sdla_write(dev, mem.addr, temp, mem.len);
                 kfree(temp);
         }
-        return(0);
+        return 0;
 }
 
 static int sdla_reconfig(struct net_device *dev)
@@ -1241,7 +1241,7 @@ static int sdla_reconfig(struct net_device *dev)
         sdla_cmd(dev, SDLA_SET_DLCI_CONFIGURATION, 0, 0, &data, len, NULL, NULL);
         sdla_cmd(dev, SDLA_ENABLE_COMMUNICATIONS, 0, 0, NULL, 0, NULL, NULL);
 
-        return(0);
+        return 0;
 }
 
 static int sdla_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1254,20 +1254,20 @@ static int sdla_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         flp = netdev_priv(dev);
 
         if (!flp->initialized)
-                return(-EINVAL);
+                return -EINVAL;
 
         switch (cmd)
         {
                 case FRAD_GET_CONF:
                 case FRAD_SET_CONF:
-                        return(sdla_config(dev, ifr->ifr_data, cmd == FRAD_GET_CONF));
+                        return sdla_config(dev, ifr->ifr_data, cmd == FRAD_GET_CONF);
 
                 case SDLA_IDENTIFY:
                         ifr->ifr_flags = flp->type;
                         break;
 
                 case SDLA_CPUSPEED:
-                        return(sdla_cpuspeed(dev, ifr)); 
+                        return sdla_cpuspeed(dev, ifr);
 
 /* ==========================================================
 NOTE:  This is rather a useless action right now, as the
@@ -1277,7 +1277,7 @@ NOTE:  This is rather a useless action right now, as the
 ============================================================*/
                 case SDLA_PROTOCOL:
                         if (flp->configured)
-                                return(-EALREADY);
+                                return -EALREADY;
 
                         switch (ifr->ifr_flags)
                         {
@@ -1285,7 +1285,7 @@ NOTE:  This is rather a useless action right now, as the
                                         dev->type = ifr->ifr_flags;
                                         break;
                                 default:
-                                        return(-ENOPROTOOPT);
+                                        return -ENOPROTOOPT;
                         }
                         break;
 
@@ -1297,7 +1297,7 @@ NOTE:  This is rather a useless action right now, as the
                 case SDLA_READMEM:
                         if(!capable(CAP_SYS_RAWIO))
                                 return -EPERM;
-                        return(sdla_xfer(dev, ifr->ifr_data, cmd == SDLA_READMEM));
+                        return sdla_xfer(dev, ifr->ifr_data, cmd == SDLA_READMEM);
 
                 case SDLA_START:
                         sdla_start(dev);
@@ -1308,9 +1308,9 @@ NOTE:  This is rather a useless action right now, as the
                         break;
 
                 default:
-                        return(-EOPNOTSUPP);
+                        return -EOPNOTSUPP;
         }
-        return(0);
+        return 0;
 }
 
 static int sdla_change_mtu(struct net_device *dev, int new_mtu)
@@ -1320,10 +1320,10 @@ static int sdla_change_mtu(struct net_device *dev, int new_mtu)
         flp = netdev_priv(dev);
 
         if (netif_running(dev))
-                return(-EBUSY);
+                return -EBUSY;
 
         /* for now, you can't change the MTU! */
-        return(-EOPNOTSUPP);
+        return -EOPNOTSUPP;
 }
 
 static int sdla_set_config(struct net_device *dev, struct ifmap *map)
@@ -1337,18 +1337,18 @@ static int sdla_set_config(struct net_device *dev, struct ifmap *map)
         flp = netdev_priv(dev);
 
         if (flp->initialized)
-                return(-EINVAL);
+                return -EINVAL;
 
         for(i=0; i < ARRAY_SIZE(valid_port); i++)
                 if (valid_port[i] == map->base_addr)
                         break;   
 
         if (i == ARRAY_SIZE(valid_port))
-                return(-EINVAL);
+                return -EINVAL;
 
         if (!request_region(map->base_addr, SDLA_IO_EXTENTS, dev->name)){
                 printk(KERN_WARNING "SDLA: io-port 0x%04lx in use\n", dev->base_addr);
-                return(-EINVAL);
+                return -EINVAL;
         }
         base = map->base_addr;
 
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index e47f5a986b1c..d81ad8397885 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -648,7 +648,7 @@ static int x25_asy_esc(unsigned char *s, unsigned char *d, int len)
                 }
         }
         *ptr++ = X25_END;
-        return (ptr - d);
+        return ptr - d;
 }
 
 static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index fbf5e843d48c..93956861ea21 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -766,7 +766,7 @@ irqreturn_t z8530_interrupt(int irq, void *dev_id)
 
 EXPORT_SYMBOL(z8530_interrupt);
 
-static char reg_init[16]=
+static const u8 reg_init[16]=
 {
         0,0,0,0,
         0,0,0,0,
@@ -1206,7 +1206,7 @@ EXPORT_SYMBOL(z8530_sync_txdma_close);
  *      it exists...
  */
  
-static char *z8530_type_name[]={
+static const char *z8530_type_name[]={
         "Z8530",
         "Z85C30",
         "Z85230"
diff --git a/drivers/net/wd.c b/drivers/net/wd.c
index eb72c67699ab..f1549fff0edc 100644
--- a/drivers/net/wd.c
+++ b/drivers/net/wd.c
@@ -342,10 +342,10 @@ static int __init wd_probe1(struct net_device *dev, int ioaddr)
         printk(" %s, IRQ %d, shared memory at %#lx-%#lx.\n",
                    model_name, dev->irq, dev->mem_start, dev->mem_end-1);
 
-        ei_status.reset_8390 = &wd_reset_8390;
-        ei_status.block_input = &wd_block_input;
-        ei_status.block_output = &wd_block_output;
-        ei_status.get_8390_hdr = &wd_get_8390_hdr;
+        ei_status.reset_8390 = wd_reset_8390;
+        ei_status.block_input = wd_block_input;
+        ei_status.block_output = wd_block_output;
+        ei_status.get_8390_hdr = wd_get_8390_hdr;
 
         dev->netdev_ops = &wd_netdev_ops;
         NS8390_init(dev, 0);
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 5d4ce4d2b32b..85af697574a6 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -50,5 +50,7 @@ obj-$(CONFIG_ATH_COMMON)	+= ath/
 obj-$(CONFIG_MAC80211_HWSIM)    += mac80211_hwsim.o
 
 obj-$(CONFIG_WL12XX)    += wl12xx/
+# small builtin driver bit
+obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx/wl12xx_platform_data.o
 
 obj-$(CONFIG_IWM)       += iwmc3200wifi/
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 1d05445d4ba3..924ed095dd99 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -105,7 +105,7 @@ static struct pci_driver airo_driver = {
    of statistics in the /proc filesystem */
 
 #define IGNLABEL(comment) NULL
-static char *statsLabels[] = {
+static const char *statsLabels[] = {
         "RxOverrun",
         IGNLABEL("RxPlcpCrcErr"),
         IGNLABEL("RxPlcpFormatErr"),
@@ -932,7 +932,7 @@ typedef struct aironet_ioctl {
         unsigned char __user *data;     // d-data
 } aironet_ioctl;
 
-static char swversion[] = "2.1";
+static const char swversion[] = "2.1";
 #endif /* CISCO_EXT */
 
 #define NUM_MODULES       2
@@ -1374,7 +1374,7 @@ static int micsetup(struct airo_info *ai) {
         return SUCCESS;
 }
 
-static char micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
+static const u8 micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
 
 /*===========================================================================
  * Description: Mic a packet
@@ -2723,9 +2723,8 @@ static int airo_networks_allocate(struct airo_info *ai)
         if (ai->networks)
                 return 0;
 
-        ai->networks =
-            kzalloc(AIRO_MAX_NETWORK_COUNT * sizeof(BSSListElement),
-                    GFP_KERNEL);
+        ai->networks = kcalloc(AIRO_MAX_NETWORK_COUNT, sizeof(BSSListElement),
+                               GFP_KERNEL);
         if (!ai->networks) {
                 airo_print_warn("", "Out of memory allocating beacons");
                 return -ENOMEM;
@@ -5024,7 +5023,7 @@ static void proc_config_on_close(struct inode *inode, struct file *file)
         airo_config_commit(dev, NULL, NULL, NULL);
 }
 
-static char *get_rmode(__le16 mode)
+static const char *get_rmode(__le16 mode)
 {
         switch(mode & RXMODE_MASK) {
         case RXMODE_RFMON:  return "rfmon";
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 1128fa8c9ed5..91c5f73b5ba3 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -2061,11 +2061,12 @@ static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         int i;
 
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
+        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->cipher %d key->keyidx %d "
                  "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+                 __func__, cmd, key->cipher, key->keyidx, key->keylen);
 
-        if (key->alg != ALG_WEP)
+        if ((key->cipher != WLAN_CIPHER_SUITE_WEP40) &&
+            (key->cipher != WLAN_CIPHER_SUITE_WEP104))
                 return -EOPNOTSUPP;
 
         key->hw_key_idx = key->keyidx;
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 0a75be027afa..92c216263ee9 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -25,5 +25,6 @@ config ATH_DEBUG
 source "drivers/net/wireless/ath/ath5k/Kconfig"
 source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/ar9170/Kconfig"
+source "drivers/net/wireless/ath/carl9170/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 8113a5042afa..6d711ec97ec2 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -1,11 +1,13 @@
 obj-$(CONFIG_ATH5K)             += ath5k/
 obj-$(CONFIG_ATH9K_HW)          += ath9k/
 obj-$(CONFIG_AR9170_USB)        += ar9170/
+obj-$(CONFIG_CARL9170)          += carl9170/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
 ath-objs :=     main.o \
                 regd.o \
-                hw.o
+                hw.o \
+                key.o
 
 ath-$(CONFIG_ATH_DEBUG) += debug.o
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index debfb0fbc7c5..32bf79e6a320 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1190,14 +1190,13 @@ static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
         if (info->control.hw_key) {
                 icv = info->control.hw_key->icv_len;
 
-                switch (info->control.hw_key->alg) {
-                case ALG_WEP:
+                switch (info->control.hw_key->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                case WLAN_CIPHER_SUITE_TKIP:
                         keytype = AR9170_TX_MAC_ENCR_RC4;
                         break;
-                case ALG_TKIP:
-                        keytype = AR9170_TX_MAC_ENCR_RC4;
-                        break;
-                case ALG_CCMP:
+                case WLAN_CIPHER_SUITE_CCMP:
                         keytype = AR9170_TX_MAC_ENCR_AES;
                         break;
                 default:
@@ -1778,17 +1777,17 @@ static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if ((!ar->vif) || (ar->disable_offload))
                 return -EOPNOTSUPP;
 
-        switch (key->alg) {
-        case ALG_WEP:
-                if (key->keylen == WLAN_KEY_LEN_WEP40)
-                        ktype = AR9170_ENC_ALG_WEP64;
-                else
-                        ktype = AR9170_ENC_ALG_WEP128;
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                ktype = AR9170_ENC_ALG_WEP64;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                ktype = AR9170_ENC_ALG_WEP128;
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 ktype = AR9170_ENC_ALG_TKIP;
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 ktype = AR9170_ENC_ALG_AESCCMP;
                 break;
         default:
@@ -1827,7 +1826,7 @@ static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 if (err)
                         goto out;
 
-                if (key->alg == ALG_TKIP) {
+                if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
                                                 ktype, 1, key->key + 16, 16);
                         if (err)
@@ -1864,7 +1863,7 @@ static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         if (err)
                                 goto out;
 
-                        if (key->alg == ALG_TKIP) {
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                                 err = ar9170_upload_key(ar, key->hw_key_idx,
                                                         NULL,
                                                         AR9170_ENC_ALG_NONE, 1,
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index d32f2828b098..dd236c3b52f6 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -71,6 +71,32 @@ struct ath_regulatory {
         struct reg_dmn_pair_mapping *regpair;
 };
 
+enum ath_crypt_caps {
+        ATH_CRYPT_CAP_CIPHER_AESCCM             = BIT(0),
+        ATH_CRYPT_CAP_MIC_COMBINED              = BIT(1),
+};
+
+struct ath_keyval {
+        u8 kv_type;
+        u8 kv_pad;
+        u16 kv_len;
+        u8 kv_val[16]; /* TK */
+        u8 kv_mic[8]; /* Michael MIC key */
+        u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware
+                         * supports both MIC keys in the same key cache entry;
+                         * in that case, kv_mic is the RX key) */
+};
+
+enum ath_cipher {
+        ATH_CIPHER_WEP = 0,
+        ATH_CIPHER_AES_OCB = 1,
+        ATH_CIPHER_AES_CCM = 2,
+        ATH_CIPHER_CKIP = 3,
+        ATH_CIPHER_TKIP = 4,
+        ATH_CIPHER_CLR = 5,
+        ATH_CIPHER_MIC = 127
+};
+
 /**
  * struct ath_ops - Register read/write operations
  *
@@ -119,7 +145,8 @@ struct ath_common {
 
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
-        u8 splitmic;
+        DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+        enum ath_crypt_caps crypt_caps;
 
         struct ath_regulatory regulatory;
         const struct ath_ops *ops;
@@ -131,5 +158,11 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 gfp_t gfp_mask);
 
 void ath_hw_setbssidmask(struct ath_common *common);
+void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key);
+int ath_key_config(struct ath_common *common,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key);
+bool ath_hw_keyreset(struct ath_common *common, u16 entry);
 
 #endif /* ATH_H */
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
index 26dbe65fedb0..e4a5f046bba4 100644
--- a/drivers/net/wireless/ath/ath5k/ani.c
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -552,9 +552,9 @@ ath5k_ani_mib_intr(struct ath5k_hw *ah)
         if (ah->ah_sc->ani_state.ani_mode != ATH5K_ANI_MODE_AUTO)
                 return;
 
-        /* if one of the errors triggered, we can get a superfluous second
-         * interrupt, even though we have already reset the register. the
-         * function detects that so we can return early */
+        /* If one of the errors triggered, we can get a superfluous second
+         * interrupt, even though we have already reset the register. The
+         * function detects that so we can return early. */
         if (ath5k_ani_save_and_clear_phy_errors(ah, as) == 0)
                 return;
 
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index ea6362a8988d..b96bb985b56d 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -175,7 +175,7 @@
 #define AR5K_TUNE_ADDITIONAL_SWBA_BACKOFF       0
 #define AR5K_TUNE_RADAR_ALERT                   false
 #define AR5K_TUNE_MIN_TX_FIFO_THRES             1
-#define AR5K_TUNE_MAX_TX_FIFO_THRES             ((IEEE80211_MAX_LEN / 64) + 1)
+#define AR5K_TUNE_MAX_TX_FIFO_THRES     ((IEEE80211_MAX_FRAME_LEN / 64) + 1)
 #define AR5K_TUNE_REGISTER_TIMEOUT              20000
 /* Register for RSSI threshold has a mask of 0xff, so 255 seems to
  * be the max value. */
@@ -206,6 +206,8 @@
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_ANI     1000    /* 1 sec */
 #define ATH5K_TUNE_CALIBRATION_INTERVAL_NF      60000   /* 60 sec */
 
+#define ATH5K_TX_COMPLETE_POLL_INT              3000    /* 3 sec */
+
 #define AR5K_INIT_CARR_SENSE_EN                 1
 
 /*Swap RX/TX Descriptor for big endian archs*/
@@ -256,8 +258,6 @@
         (AR5K_INIT_PROG_IFS_TURBO)                                      \
 )
 
-/* token to use for aifs, cwmin, cwmax in MadWiFi */
-#define AR5K_TXQ_USEDEFAULT     ((u32) -1)
 
 /* GENERIC CHIPSET DEFINITIONS */
 
@@ -343,9 +343,6 @@ struct ath5k_srev_name {
 #define AR5K_SREV_PHY_5413      0x61
 #define AR5K_SREV_PHY_2425      0x70
 
-/* IEEE defs */
-#define IEEE80211_MAX_LEN       2500
-
 /* TODO add support to mac80211 for vendor-specific rates and modes */
 
 /*
@@ -531,9 +528,9 @@ struct ath5k_txq_info {
         enum ath5k_tx_queue tqi_type;
         enum ath5k_tx_queue_subtype tqi_subtype;
         u16     tqi_flags;      /* Tx queue flags (see above) */
-        u32     tqi_aifs;       /* Arbitrated Interframe Space */
-        s32     tqi_cw_min;     /* Minimum Contention Window */
-        s32     tqi_cw_max;     /* Maximum Contention Window */
+        u8      tqi_aifs;       /* Arbitrated Interframe Space */
+        u16     tqi_cw_min;     /* Minimum Contention Window */
+        u16     tqi_cw_max;     /* Maximum Contention Window */
         u32     tqi_cbr_period; /* Constant bit rate period */
         u32     tqi_cbr_overflow_limit;
         u32     tqi_burst_time;
@@ -1031,8 +1028,6 @@ struct ath5k_hw {
         bool                    ah_turbo;
         bool                    ah_calibration;
         bool                    ah_single_chip;
-        bool                    ah_aes_support;
-        bool                    ah_combined_mic;
 
         enum ath5k_version      ah_version;
         enum ath5k_radio        ah_radio;
@@ -1047,9 +1042,6 @@ struct ath5k_hw {
 #define ah_ee_version           ah_capabilities.cap_eeprom.ee_version
 
         u32                     ah_atim_window;
-        u32                     ah_aifs;
-        u32                     ah_cw_min;
-        u32                     ah_cw_max;
         u32                     ah_limit_tx_retries;
         u8                      ah_coverage_class;
 
@@ -1190,7 +1182,7 @@ extern int ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype opmode);
 void ath5k_hw_set_coverage_class(struct ath5k_hw *ah, u8 coverage_class);
 /* BSSID Functions */
 int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac);
-void ath5k_hw_set_associd(struct ath5k_hw *ah);
+void ath5k_hw_set_bssid(struct ath5k_hw *ah);
 void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask);
 /* Receive start/stop functions */
 void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah);
@@ -1210,11 +1202,6 @@ void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high);
 unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec);
 unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock);
 unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah);
-/* Key table (WEP) functions */
-int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry);
-int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
-                     const struct ieee80211_key_conf *key, const u8 *mac);
-int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac);
 
 /* Queue Control Unit, DFS Control Unit Functions */
 int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index b32e28caeee2..6e02de311cdd 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -119,8 +119,6 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         ah->ah_txpower.txp_tpc = AR5K_TUNE_TPC_TXPOWER;
         ah->ah_imr = 0;
         ah->ah_atim_window = 0;
-        ah->ah_aifs = AR5K_TUNE_AIFS;
-        ah->ah_cw_min = AR5K_TUNE_CWMIN;
         ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
         ah->ah_software_retry = false;
         ah->ah_ant_mode = AR5K_ANTMODE_DEFAULT;
@@ -139,12 +137,12 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         else
                 ah->ah_version = AR5K_AR5212;
 
-        /*Fill the ath5k_hw struct with the needed functions*/
+        /* Fill the ath5k_hw struct with the needed functions */
         ret = ath5k_hw_init_desc_functions(ah);
         if (ret)
                 goto err_free;
 
-        /* Bring device out of sleep and reset it's units */
+        /* Bring device out of sleep and reset its units */
         ret = ath5k_hw_nic_wakeup(ah, 0, true);
         if (ret)
                 goto err_free;
@@ -158,7 +156,7 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
                         CHANNEL_5GHZ);
         ah->ah_phy = AR5K_PHY(0);
 
-        /* Try to identify radio chip based on it's srev */
+        /* Try to identify radio chip based on its srev */
         switch (ah->ah_radio_5ghz_revision & 0xf0) {
         case AR5K_SREV_RAD_5111:
                 ah->ah_radio = AR5K_RF5111;
@@ -314,12 +312,16 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         }
 
         /* Crypto settings */
-        ah->ah_aes_support = srev >= AR5K_SREV_AR5212_V4 &&
-                (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
-                 !AR5K_EEPROM_AES_DIS(ee->ee_misc5));
+        common->keymax = (sc->ah->ah_version == AR5K_AR5210 ?
+                          AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211);
+
+        if (srev >= AR5K_SREV_AR5212_V4 &&
+            (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
+            !AR5K_EEPROM_AES_DIS(ee->ee_misc5)))
+                common->crypt_caps |= ATH_CRYPT_CAP_CIPHER_AESCCM;
 
         if (srev >= AR5K_SREV_AR2414) {
-                ah->ah_combined_mic = true;
+                common->crypt_caps |= ATH_CRYPT_CAP_MIC_COMBINED;
                 AR5K_REG_ENABLE_BITS(ah, AR5K_MISC_MODE,
                         AR5K_MISC_MODE_COMBINED_MIC);
         }
@@ -329,7 +331,7 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
 
         /* Set BSSID to bcast address: ff:ff:ff:ff:ff:ff for now */
         memcpy(common->curbssid, ath_bcast_mac, ETH_ALEN);
-        ath5k_hw_set_associd(ah);
+        ath5k_hw_set_bssid(ah);
         ath5k_hw_set_opmode(ah, sc->opmode);
 
         ath5k_hw_rfgain_opt_init(ah);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index d77ce9906b6c..95072db0ec21 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -70,11 +70,6 @@ static int modparam_all_channels;
 module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
 MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
 
-
-/******************\
-* Internal defines *
-\******************/
-
 /* Module info */
 MODULE_AUTHOR("Jiri Slaby");
 MODULE_AUTHOR("Nick Kossifidis");
@@ -83,6 +78,10 @@ MODULE_SUPPORTED_DEVICE("Atheros 5xxx WLAN cards");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION("0.6.0 (EXPERIMENTAL)");
 
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
+static int ath5k_beacon_update(struct ieee80211_hw *hw,
+                struct ieee80211_vif *vif);
+static void ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
 
 /* Known PCI ids */
 static DEFINE_PCI_DEVICE_TABLE(ath5k_pci_id_table) = {
@@ -190,129 +189,6 @@ static const struct ieee80211_rate ath5k_rates[] = {
         /* XR missing */
 };
 
-/*
- * Prototypes - PCI stack related functions
- */
-static int __devinit    ath5k_pci_probe(struct pci_dev *pdev,
-                                const struct pci_device_id *id);
-static void __devexit   ath5k_pci_remove(struct pci_dev *pdev);
-#ifdef CONFIG_PM_SLEEP
-static int              ath5k_pci_suspend(struct device *dev);
-static int              ath5k_pci_resume(struct device *dev);
-
-static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
-#define ATH5K_PM_OPS    (&ath5k_pm_ops)
-#else
-#define ATH5K_PM_OPS    NULL
-#endif /* CONFIG_PM_SLEEP */
-
-static struct pci_driver ath5k_pci_driver = {
-        .name           = KBUILD_MODNAME,
-        .id_table       = ath5k_pci_id_table,
-        .probe          = ath5k_pci_probe,
-        .remove         = __devexit_p(ath5k_pci_remove),
-        .driver.pm      = ATH5K_PM_OPS,
-};
-
-
-
-/*
- * Prototypes - MAC 802.11 stack related functions
- */
-static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
-                struct ath5k_txq *txq);
-static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
-static int ath5k_start(struct ieee80211_hw *hw);
-static void ath5k_stop(struct ieee80211_hw *hw);
-static int ath5k_add_interface(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static void ath5k_remove_interface(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static int ath5k_config(struct ieee80211_hw *hw, u32 changed);
-static u64 ath5k_prepare_multicast(struct ieee80211_hw *hw,
-                                   struct netdev_hw_addr_list *mc_list);
-static void ath5k_configure_filter(struct ieee80211_hw *hw,
-                unsigned int changed_flags,
-                unsigned int *new_flags,
-                u64 multicast);
-static int ath5k_set_key(struct ieee80211_hw *hw,
-                enum set_key_cmd cmd,
-                struct ieee80211_vif *vif, struct ieee80211_sta *sta,
-                struct ieee80211_key_conf *key);
-static int ath5k_get_stats(struct ieee80211_hw *hw,
-                struct ieee80211_low_level_stats *stats);
-static int ath5k_get_survey(struct ieee80211_hw *hw,
-                int idx, struct survey_info *survey);
-static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
-static void ath5k_set_tsf(struct ieee80211_hw *hw, u64 tsf);
-static void ath5k_reset_tsf(struct ieee80211_hw *hw);
-static int ath5k_beacon_update(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif);
-static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif,
-                struct ieee80211_bss_conf *bss_conf,
-                u32 changes);
-static void ath5k_sw_scan_start(struct ieee80211_hw *hw);
-static void ath5k_sw_scan_complete(struct ieee80211_hw *hw);
-static void ath5k_set_coverage_class(struct ieee80211_hw *hw,
-                u8 coverage_class);
-
-static const struct ieee80211_ops ath5k_hw_ops = {
-        .tx             = ath5k_tx,
-        .start          = ath5k_start,
-        .stop           = ath5k_stop,
-        .add_interface  = ath5k_add_interface,
-        .remove_interface = ath5k_remove_interface,
-        .config         = ath5k_config,
-        .prepare_multicast = ath5k_prepare_multicast,
-        .configure_filter = ath5k_configure_filter,
-        .set_key        = ath5k_set_key,
-        .get_stats      = ath5k_get_stats,
-        .get_survey     = ath5k_get_survey,
-        .conf_tx        = NULL,
-        .get_tsf        = ath5k_get_tsf,
-        .set_tsf        = ath5k_set_tsf,
-        .reset_tsf      = ath5k_reset_tsf,
-        .bss_info_changed = ath5k_bss_info_changed,
-        .sw_scan_start  = ath5k_sw_scan_start,
-        .sw_scan_complete = ath5k_sw_scan_complete,
-        .set_coverage_class = ath5k_set_coverage_class,
-};
-
-/*
- * Prototypes - Internal functions
- */
-/* Attach detach */
-static int      ath5k_attach(struct pci_dev *pdev,
-                        struct ieee80211_hw *hw);
-static void     ath5k_detach(struct pci_dev *pdev,
-                        struct ieee80211_hw *hw);
-/* Channel/mode setup */
-static inline short ath5k_ieee2mhz(short chan);
-static unsigned int ath5k_copy_channels(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channels,
-                                unsigned int mode,
-                                unsigned int max);
-static int      ath5k_setup_bands(struct ieee80211_hw *hw);
-static int      ath5k_chan_set(struct ath5k_softc *sc,
-                                struct ieee80211_channel *chan);
-static void     ath5k_setcurmode(struct ath5k_softc *sc,
-                                unsigned int mode);
-static void     ath5k_mode_setup(struct ath5k_softc *sc);
-
-/* Descriptor setup */
-static int      ath5k_desc_alloc(struct ath5k_softc *sc,
-                                struct pci_dev *pdev);
-static void     ath5k_desc_free(struct ath5k_softc *sc,
-                                struct pci_dev *pdev);
-/* Buffers setup */
-static int      ath5k_rxbuf_setup(struct ath5k_softc *sc,
-                                struct ath5k_buf *bf);
-static int      ath5k_txbuf_setup(struct ath5k_softc *sc,
-                                struct ath5k_buf *bf,
-                                struct ath5k_txq *txq, int padsize);
-
 static inline void ath5k_txbuf_free_skb(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
@@ -345,35 +221,6 @@ static inline void ath5k_rxbuf_free_skb(struct ath5k_softc *sc,
 }
 
 
-/* Queues setup */
-static struct   ath5k_txq *ath5k_txq_setup(struct ath5k_softc *sc,
-                                int qtype, int subtype);
-static int      ath5k_beaconq_setup(struct ath5k_hw *ah);
-static int      ath5k_beaconq_config(struct ath5k_softc *sc);
-static void     ath5k_txq_drainq(struct ath5k_softc *sc,
-                                struct ath5k_txq *txq);
-static void     ath5k_txq_cleanup(struct ath5k_softc *sc);
-static void     ath5k_txq_release(struct ath5k_softc *sc);
-/* Rx handling */
-static int      ath5k_rx_start(struct ath5k_softc *sc);
-static void     ath5k_rx_stop(struct ath5k_softc *sc);
-static unsigned int ath5k_rx_decrypted(struct ath5k_softc *sc,
-                                        struct sk_buff *skb,
-                                        struct ath5k_rx_status *rs);
-static void     ath5k_tasklet_rx(unsigned long data);
-/* Tx handling */
-static void     ath5k_tx_processq(struct ath5k_softc *sc,
-                                struct ath5k_txq *txq);
-static void     ath5k_tasklet_tx(unsigned long data);
-/* Beacon handling */
-static int      ath5k_beacon_setup(struct ath5k_softc *sc,
-                                        struct ath5k_buf *bf);
-static void     ath5k_beacon_send(struct ath5k_softc *sc);
-static void     ath5k_beacon_config(struct ath5k_softc *sc);
-static void     ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
-static void     ath5k_tasklet_beacon(unsigned long data);
-static void     ath5k_tasklet_ani(unsigned long data);
-
 static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
 {
         u64 tsf = ath5k_hw_get_tsf64(ah);
@@ -384,50 +231,6 @@ static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
         return (tsf & ~0x7fff) | rstamp;
 }
 
-/* Interrupt handling */
-static int      ath5k_init(struct ath5k_softc *sc);
-static int      ath5k_stop_locked(struct ath5k_softc *sc);
-static int      ath5k_stop_hw(struct ath5k_softc *sc);
-static irqreturn_t ath5k_intr(int irq, void *dev_id);
-static void ath5k_reset_work(struct work_struct *work);
-
-static void     ath5k_tasklet_calibrate(unsigned long data);
-
-/*
- * Module init/exit functions
- */
-static int __init
-init_ath5k_pci(void)
-{
-        int ret;
-
-        ath5k_debug_init();
-
-        ret = pci_register_driver(&ath5k_pci_driver);
-        if (ret) {
-                printk(KERN_ERR "ath5k_pci: can't register pci driver\n");
-                return ret;
-        }
-
-        return 0;
-}
-
-static void __exit
-exit_ath5k_pci(void)
-{
-        pci_unregister_driver(&ath5k_pci_driver);
-
-        ath5k_debug_finish();
-}
-
-module_init(init_ath5k_pci);
-module_exit(exit_ath5k_pci);
-
-
-/********************\
-* PCI Initialization *
-\********************/
-
 static const char *
 ath5k_chip_name(enum ath5k_srev_type type, u_int16_t val)
 {
@@ -466,299 +269,6 @@ static const struct ath_ops ath5k_common_ops = {
         .write = ath5k_iowrite32,
 };
 
-static int __devinit
-ath5k_pci_probe(struct pci_dev *pdev,
-                const struct pci_device_id *id)
-{
-        void __iomem *mem;
-        struct ath5k_softc *sc;
-        struct ath_common *common;
-        struct ieee80211_hw *hw;
-        int ret;
-        u8 csz;
-
-        /*
-         * L0s needs to be disabled on all ath5k cards.
-         *
-         * For distributions shipping with CONFIG_PCIEASPM (this will be enabled
-         * by default in the future in 2.6.36) this will also mean both L1 and
-         * L0s will be disabled when a pre 1.1 PCIe device is detected. We do
-         * know L1 works correctly even for all ath5k pre 1.1 PCIe devices
-         * though but cannot currently undue the effect of a blacklist, for
-         * details you can read pcie_aspm_sanity_check() and see how it adjusts
-         * the device link capability.
-         *
-         * It may be possible in the future to implement some PCI API to allow
-         * drivers to override blacklists for pre 1.1 PCIe but for now it is
-         * best to accept that both L0s and L1 will be disabled completely for
-         * distributions shipping with CONFIG_PCIEASPM rather than having this
-         * issue present. Motivation for adding this new API will be to help
-         * with power consumption for some of these devices.
-         */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S);
-
-        ret = pci_enable_device(pdev);
-        if (ret) {
-                dev_err(&pdev->dev, "can't enable device\n");
-                goto err;
-        }
-
-        /* XXX 32-bit addressing only */
-        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-        if (ret) {
-                dev_err(&pdev->dev, "32-bit DMA not available\n");
-                goto err_dis;
-        }
-
-        /*
-         * Cache line size is used to size and align various
-         * structures used to communicate with the hardware.
-         */
-        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE, &csz);
-        if (csz == 0) {
-                /*
-                 * Linux 2.4.18 (at least) writes the cache line size
-                 * register as a 16-bit wide register which is wrong.
-                 * We must have this setup properly for rx buffer
-                 * DMA to work so force a reasonable value here if it
-                 * comes up zero.
-                 */
-                csz = L1_CACHE_BYTES >> 2;
-                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, csz);
-        }
-        /*
-         * The default setting of latency timer yields poor results,
-         * set it to the value used by other systems.  It may be worth
-         * tweaking this setting more.
-         */
-        pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 0xa8);
-
-        /* Enable bus mastering */
-        pci_set_master(pdev);
-
-        /*
-         * Disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state.
-         */
-        pci_write_config_byte(pdev, 0x41, 0);
-
-        ret = pci_request_region(pdev, 0, "ath5k");
-        if (ret) {
-                dev_err(&pdev->dev, "cannot reserve PCI memory region\n");
-                goto err_dis;
-        }
-
-        mem = pci_iomap(pdev, 0, 0);
-        if (!mem) {
-                dev_err(&pdev->dev, "cannot remap PCI memory region\n") ;
-                ret = -EIO;
-                goto err_reg;
-        }
-
-        /*
-         * Allocate hw (mac80211 main struct)
-         * and hw->priv (driver private data)
-         */
-        hw = ieee80211_alloc_hw(sizeof(*sc), &ath5k_hw_ops);
-        if (hw == NULL) {
-                dev_err(&pdev->dev, "cannot allocate ieee80211_hw\n");
-                ret = -ENOMEM;
-                goto err_map;
-        }
-
-        dev_info(&pdev->dev, "registered as '%s'\n", wiphy_name(hw->wiphy));
-
-        /* Initialize driver private data */
-        SET_IEEE80211_DEV(hw, &pdev->dev);
-        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                    IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-                    IEEE80211_HW_SIGNAL_DBM;
-
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_AP) |
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC) |
-                BIT(NL80211_IFTYPE_MESH_POINT);
-
-        hw->extra_tx_headroom = 2;
-        hw->channel_change_time = 5000;
-        sc = hw->priv;
-        sc->hw = hw;
-        sc->pdev = pdev;
-
-        ath5k_debug_init_device(sc);
-
-        /*
-         * Mark the device as detached to avoid processing
-         * interrupts until setup is complete.
-         */
-        __set_bit(ATH_STAT_INVALID, sc->status);
-
-        sc->iobase = mem; /* So we can unmap it on detach */
-        sc->opmode = NL80211_IFTYPE_STATION;
-        sc->bintval = 1000;
-        mutex_init(&sc->lock);
-        spin_lock_init(&sc->rxbuflock);
-        spin_lock_init(&sc->txbuflock);
-        spin_lock_init(&sc->block);
-
-        /* Set private data */
-        pci_set_drvdata(pdev, sc);
-
-        /* Setup interrupt handler */
-        ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
-        if (ret) {
-                ATH5K_ERR(sc, "request_irq failed\n");
-                goto err_free;
-        }
-
-        /*If we passed the test malloc a ath5k_hw struct*/
-        sc->ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
-        if (!sc->ah) {
-                ret = -ENOMEM;
-                ATH5K_ERR(sc, "out of memory\n");
-                goto err_irq;
-        }
-
-        sc->ah->ah_sc = sc;
-        sc->ah->ah_iobase = sc->iobase;
-        common = ath5k_hw_common(sc->ah);
-        common->ops = &ath5k_common_ops;
-        common->ah = sc->ah;
-        common->hw = hw;
-        common->cachelsz = csz << 2; /* convert to bytes */
-
-        /* Initialize device */
-        ret = ath5k_hw_attach(sc);
-        if (ret) {
-                goto err_free_ah;
-        }
-
-        /* set up multi-rate retry capabilities */
-        if (sc->ah->ah_version == AR5K_AR5212) {
-                hw->max_rates = 4;
-                hw->max_rate_tries = 11;
-        }
-
-        /* Finish private driver data initialization */
-        ret = ath5k_attach(pdev, hw);
-        if (ret)
-                goto err_ah;
-
-        ATH5K_INFO(sc, "Atheros AR%s chip found (MAC: 0x%x, PHY: 0x%x)\n",
-                        ath5k_chip_name(AR5K_VERSION_MAC, sc->ah->ah_mac_srev),
-                                        sc->ah->ah_mac_srev,
-                                        sc->ah->ah_phy_revision);
-
-        if (!sc->ah->ah_single_chip) {
-                /* Single chip radio (!RF5111) */
-                if (sc->ah->ah_radio_5ghz_revision &&
-                        !sc->ah->ah_radio_2ghz_revision) {
-                        /* No 5GHz support -> report 2GHz radio */
-                        if (!test_bit(AR5K_MODE_11A,
-                                sc->ah->ah_capabilities.cap_mode)) {
-                                ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        /* No 2GHz support (5110 and some
-                         * 5Ghz only cards) -> report 5Ghz radio */
-                        } else if (!test_bit(AR5K_MODE_11B,
-                                sc->ah->ah_capabilities.cap_mode)) {
-                                ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        /* Multiband radio */
-                        } else {
-                                ATH5K_INFO(sc, "RF%s multiband radio found"
-                                        " (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,
-                                                sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
-                        }
-                }
-                /* Multi chip radio (RF5111 - RF2111) ->
-                 * report both 2GHz/5GHz radios */
-                else if (sc->ah->ah_radio_5ghz_revision &&
-                                sc->ah->ah_radio_2ghz_revision){
-                        ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,
-                                        sc->ah->ah_radio_5ghz_revision),
-                                        sc->ah->ah_radio_5ghz_revision);
-                        ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,
-                                        sc->ah->ah_radio_2ghz_revision),
-                                        sc->ah->ah_radio_2ghz_revision);
-                }
-        }
-
-
-        /* ready to process interrupts */
-        __clear_bit(ATH_STAT_INVALID, sc->status);
-
-        return 0;
-err_ah:
-        ath5k_hw_detach(sc->ah);
-err_irq:
-        free_irq(pdev->irq, sc);
-err_free_ah:
-        kfree(sc->ah);
-err_free:
-        ieee80211_free_hw(hw);
-err_map:
-        pci_iounmap(pdev, mem);
-err_reg:
-        pci_release_region(pdev, 0);
-err_dis:
-        pci_disable_device(pdev);
-err:
-        return ret;
-}
-
-static void __devexit
-ath5k_pci_remove(struct pci_dev *pdev)
-{
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
-
-        ath5k_debug_finish_device(sc);
-        ath5k_detach(pdev, sc->hw);
-        ath5k_hw_detach(sc->ah);
-        kfree(sc->ah);
-        free_irq(pdev->irq, sc);
-        pci_iounmap(pdev, sc->iobase);
-        pci_release_region(pdev, 0);
-        pci_disable_device(pdev);
-        ieee80211_free_hw(sc->hw);
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int ath5k_pci_suspend(struct device *dev)
-{
-        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
-
-        ath5k_led_off(sc);
-        return 0;
-}
-
-static int ath5k_pci_resume(struct device *dev)
-{
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
-
-        /*
-         * Suspend/Resume resets the PCI configuration space, so we have to
-         * re-disable the RETRY_TIMEOUT register (0x41) to keep
-         * PCI Tx retries from interfering with C3 CPU state
-         */
-        pci_write_config_byte(pdev, 0x41, 0);
-
-        ath5k_led_enable(sc);
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-
-
 /***********************\
 * Driver Initialization *
 \***********************/
@@ -772,170 +282,6 @@ static int ath5k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *re
         return ath_reg_notifier_apply(wiphy, request, regulatory);
 }
 
-static int
-ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
-{
-        struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
-        struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
-        u8 mac[ETH_ALEN] = {};
-        int ret;
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
-
-        /*
-         * Check if the MAC has multi-rate retry support.
-         * We do this by trying to setup a fake extended
-         * descriptor.  MAC's that don't have support will
-         * return false w/o doing anything.  MAC's that do
-         * support it will return true w/o doing anything.
-         */
-        ret = ath5k_hw_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
-
-        if (ret < 0)
-                goto err;
-        if (ret > 0)
-                __set_bit(ATH_STAT_MRRETRY, sc->status);
-
-        /*
-         * Collect the channel list.  The 802.11 layer
-         * is resposible for filtering this list based
-         * on settings like the phy mode and regulatory
-         * domain restrictions.
-         */
-        ret = ath5k_setup_bands(hw);
-        if (ret) {
-                ATH5K_ERR(sc, "can't get channels\n");
-                goto err;
-        }
-
-        /* NB: setup here so ath5k_rate_update is happy */
-        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
-                ath5k_setcurmode(sc, AR5K_MODE_11A);
-        else
-                ath5k_setcurmode(sc, AR5K_MODE_11B);
-
-        /*
-         * Allocate tx+rx descriptors and populate the lists.
-         */
-        ret = ath5k_desc_alloc(sc, pdev);
-        if (ret) {
-                ATH5K_ERR(sc, "can't allocate descriptors\n");
-                goto err;
-        }
-
-        /*
-         * Allocate hardware transmit queues: one queue for
-         * beacon frames and one data queue for each QoS
-         * priority.  Note that hw functions handle reseting
-         * these queues at the needed time.
-         */
-        ret = ath5k_beaconq_setup(ah);
-        if (ret < 0) {
-                ATH5K_ERR(sc, "can't setup a beacon xmit queue\n");
-                goto err_desc;
-        }
-        sc->bhalq = ret;
-        sc->cabq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_CAB, 0);
-        if (IS_ERR(sc->cabq)) {
-                ATH5K_ERR(sc, "can't setup cab queue\n");
-                ret = PTR_ERR(sc->cabq);
-                goto err_bhal;
-        }
-
-        sc->txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BK);
-        if (IS_ERR(sc->txq)) {
-                ATH5K_ERR(sc, "can't setup xmit queue\n");
-                ret = PTR_ERR(sc->txq);
-                goto err_queues;
-        }
-
-        tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
-        tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
-        tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
-        tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
-        tasklet_init(&sc->ani_tasklet, ath5k_tasklet_ani, (unsigned long)sc);
-
-        INIT_WORK(&sc->reset_work, ath5k_reset_work);
-
-        ret = ath5k_eeprom_read_mac(ah, mac);
-        if (ret) {
-                ATH5K_ERR(sc, "unable to read address from EEPROM: 0x%04x\n",
-                        sc->pdev->device);
-                goto err_queues;
-        }
-
-        SET_IEEE80211_PERM_ADDR(hw, mac);
-        /* All MAC address bits matter for ACKs */
-        memcpy(sc->bssidmask, ath_bcast_mac, ETH_ALEN);
-        ath5k_hw_set_bssid_mask(sc->ah, sc->bssidmask);
-
-        regulatory->current_rd = ah->ah_capabilities.cap_eeprom.ee_regdomain;
-        ret = ath_regd_init(regulatory, hw->wiphy, ath5k_reg_notifier);
-        if (ret) {
-                ATH5K_ERR(sc, "can't initialize regulatory system\n");
-                goto err_queues;
-        }
-
-        ret = ieee80211_register_hw(hw);
-        if (ret) {
-                ATH5K_ERR(sc, "can't register ieee80211 hw\n");
-                goto err_queues;
-        }
-
-        if (!ath_is_world_regd(regulatory))
-                regulatory_hint(hw->wiphy, regulatory->alpha2);
-
-        ath5k_init_leds(sc);
-
-        ath5k_sysfs_register(sc);
-
-        return 0;
-err_queues:
-        ath5k_txq_release(sc);
-err_bhal:
-        ath5k_hw_release_tx_queue(ah, sc->bhalq);
-err_desc:
-        ath5k_desc_free(sc, pdev);
-err:
-        return ret;
-}
-
-static void
-ath5k_detach(struct pci_dev *pdev, struct ieee80211_hw *hw)
-{
-        struct ath5k_softc *sc = hw->priv;
-
-        /*
-         * NB: the order of these is important:
-         * o call the 802.11 layer before detaching ath5k_hw to
-         *   insure callbacks into the driver to delete global
-         *   key cache entries can be handled
-         * o reclaim the tx queue data structures after calling
-         *   the 802.11 layer as we'll get called back to reclaim
-         *   node state and potentially want to use them
-         * o to cleanup the tx queues the hal is called, so detach
-         *   it last
-         * XXX: ??? detach ath5k_hw ???
-         * Other than that, it's straightforward...
-         */
-        ieee80211_unregister_hw(hw);
-        ath5k_desc_free(sc, pdev);
-        ath5k_txq_release(sc);
-        ath5k_hw_release_tx_queue(sc->ah, sc->bhalq);
-        ath5k_unregister_leds(sc);
-
-        ath5k_sysfs_unregister(sc);
-        /*
-         * NB: can't reclaim these until after ieee80211_ifdetach
-         * returns because we'll get called back to reclaim node
-         * state and potentially want to use them.
-         */
-}
-
-
-
-
 /********************\
 * Channel/mode setup *
 \********************/
@@ -1391,6 +737,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 
         spin_lock_bh(&txq->lock);
         list_add_tail(&bf->list, &txq->q);
+        txq->txq_len++;
         if (txq->link == NULL) /* is this first packet? */
                 ath5k_hw_set_txdp(ah, txq->qnum, bf->daddr);
         else /* no, so only link it */
@@ -1494,9 +841,6 @@ ath5k_desc_free(struct ath5k_softc *sc, struct pci_dev *pdev)
 }
 
 
-
-
-
 /**************\
 * Queues setup *
 \**************/
@@ -1509,16 +853,18 @@ ath5k_txq_setup(struct ath5k_softc *sc,
         struct ath5k_txq *txq;
         struct ath5k_txq_info qi = {
                 .tqi_subtype = subtype,
-                .tqi_aifs = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_min = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_max = AR5K_TXQ_USEDEFAULT
+                /* XXX: default values not correct for B and XR channels,
+                 * but who cares? */
+                .tqi_aifs = AR5K_TUNE_AIFS,
+                .tqi_cw_min = AR5K_TUNE_CWMIN,
+                .tqi_cw_max = AR5K_TUNE_CWMAX
         };
         int qnum;
 
         /*
          * Enable interrupts only for EOL and DESC conditions.
          * We mark tx descriptors to receive a DESC interrupt
-         * when a tx queue gets deep; otherwise waiting for the
+         * when a tx queue gets deep; otherwise we wait for the
          * EOL to reap descriptors.  Note that this is done to
          * reduce interrupt load and this only defers reaping
          * descriptors, never transmitting frames.  Aside from
@@ -1550,6 +896,9 @@ ath5k_txq_setup(struct ath5k_softc *sc,
                 INIT_LIST_HEAD(&txq->q);
                 spin_lock_init(&txq->lock);
                 txq->setup = true;
+                txq->txq_len = 0;
+                txq->txq_poll_mark = false;
+                txq->txq_stuck = 0;
         }
         return &sc->txqs[qnum];
 }
@@ -1558,9 +907,11 @@ static int
 ath5k_beaconq_setup(struct ath5k_hw *ah)
 {
         struct ath5k_txq_info qi = {
-                .tqi_aifs = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_min = AR5K_TXQ_USEDEFAULT,
-                .tqi_cw_max = AR5K_TXQ_USEDEFAULT,
+                /* XXX: default values not correct for B and XR channels,
+                 * but who cares? */
+                .tqi_aifs = AR5K_TUNE_AIFS,
+                .tqi_cw_min = AR5K_TUNE_CWMIN,
+                .tqi_cw_max = AR5K_TUNE_CWMAX,
                 /* NB: for dynamic turbo, don't enable any other interrupts */
                 .tqi_flags = AR5K_TXQ_FLAG_TXDESCINT_ENABLE
         };
@@ -1594,7 +945,7 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
                  */
                 qi.tqi_aifs = 0;
                 qi.tqi_cw_min = 0;
-                qi.tqi_cw_max = 2 * ah->ah_cw_min;
+                qi.tqi_cw_max = 2 * AR5K_TUNE_CWMIN;
         }
 
         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
@@ -1644,9 +995,11 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 spin_lock_bh(&sc->txbuflock);
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
+                txq->txq_len--;
                 spin_unlock_bh(&sc->txbuflock);
         }
         txq->link = NULL;
+        txq->txq_poll_mark = false;
         spin_unlock_bh(&txq->lock);
 }
 
@@ -1696,8 +1049,6 @@ ath5k_txq_release(struct ath5k_softc *sc)
 }
 
 
-
-
 /*************\
 * RX Handling *
 \*************/
@@ -1713,7 +1064,7 @@ ath5k_rx_start(struct ath5k_softc *sc)
         struct ath5k_buf *bf;
         int ret;
 
-        common->rx_bufsize = roundup(IEEE80211_MAX_LEN, common->cachelsz);
+        common->rx_bufsize = roundup(IEEE80211_MAX_FRAME_LEN, common->cachelsz);
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "cachelsz %u rx_bufsize %u\n",
                   common->cachelsz, common->rx_bufsize);
@@ -1863,7 +1214,7 @@ ath5k_update_beacon_rssi(struct ath5k_softc *sc, struct sk_buff *skb, int rssi)
 }
 
 /*
- * Compute padding position. skb must contains an IEEE 802.11 frame
+ * Compute padding position. skb must contain an IEEE 802.11 frame
  */
 static int ath5k_common_padpos(struct sk_buff *skb)
 {
@@ -1882,10 +1233,9 @@ static int ath5k_common_padpos(struct sk_buff *skb)
 }
 
 /*
- * This function expects a 802.11 frame and returns the number of
- * bytes added, or -1 if we don't have enought header room.
+ * This function expects an 802.11 frame and returns the number of
+ * bytes added, or -1 if we don't have enough header room.
  */
-
 static int ath5k_add_padding(struct sk_buff *skb)
 {
         int padpos = ath5k_common_padpos(skb);
@@ -1905,10 +1255,18 @@ static int ath5k_add_padding(struct sk_buff *skb)
 }
 
 /*
- * This function expects a 802.11 frame and returns the number of
- * bytes removed
+ * The MAC header is padded to have 32-bit boundary if the
+ * packet payload is non-zero. The general calculation for
+ * padsize would take into account odd header lengths:
+ * padsize = 4 - (hdrlen & 3); however, since only
+ * even-length headers are used, padding can only be 0 or 2
+ * bytes and we can optimize this a bit.  We must not try to
+ * remove padding from short control frames that do not have a
+ * payload.
+ *
+ * This function expects an 802.11 frame and returns the number of
+ * bytes removed.
  */
-
 static int ath5k_remove_padding(struct sk_buff *skb)
 {
         int padpos = ath5k_common_padpos(skb);
@@ -1929,14 +1287,6 @@ ath5k_receive_frame(struct ath5k_softc *sc, struct sk_buff *skb,
 {
         struct ieee80211_rx_status *rxs;
 
-        /* The MAC header is padded to have 32-bit boundary if the
-         * packet payload is non-zero. The general calculation for
-         * padsize would take into account odd header lengths:
-         * padsize = (4 - hdrlen % 4) % 4; However, since only
-         * even-length headers are used, padding can only be 0 or 2
-         * bytes and we can optimize this a bit. In addition, we must
-         * not try to remove padding from short control frames that do
-         * not have payload. */
         ath5k_remove_padding(skb);
 
         rxs = IEEE80211_SKB_RXCB(skb);
@@ -2040,9 +1390,8 @@ ath5k_receive_frame_ok(struct ath5k_softc *sc, struct ath5k_rx_status *rs)
                         return true;
                 }
 
-                /* let crypto-error packets fall through in MNTR */
-                if ((rs->rs_status & ~(AR5K_RXERR_DECRYPT|AR5K_RXERR_MIC)) ||
-                    sc->opmode != NL80211_IFTYPE_MONITOR)
+                /* reject any frames with non-crypto errors */
+                if (rs->rs_status & ~(AR5K_RXERR_DECRYPT))
                         return false;
         }
 
@@ -2123,6 +1472,117 @@ unlock:
 * TX Handling *
 \*************/
 
+static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
+                          struct ath5k_txq *txq)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_buf *bf;
+        unsigned long flags;
+        int padsize;
+
+        ath5k_debug_dump_skb(sc, skb, "TX  ", 1);
+
+        /*
+         * The hardware expects the header padded to 4 byte boundaries.
+         * If this is not the case, we add the padding after the header.
+         */
+        padsize = ath5k_add_padding(skb);
+        if (padsize < 0) {
+                ATH5K_ERR(sc, "tx hdrlen not %%4: not enough"
+                          " headroom to pad");
+                goto drop_packet;
+        }
+
+        if (txq->txq_len >= ATH5K_TXQ_LEN_MAX)
+                ieee80211_stop_queue(hw, txq->qnum);
+
+        spin_lock_irqsave(&sc->txbuflock, flags);
+        if (list_empty(&sc->txbuf)) {
+                ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
+                spin_unlock_irqrestore(&sc->txbuflock, flags);
+                ieee80211_stop_queues(hw);
+                goto drop_packet;
+        }
+        bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
+        list_del(&bf->list);
+        sc->txbuf_len--;
+        if (list_empty(&sc->txbuf))
+                ieee80211_stop_queues(hw);
+        spin_unlock_irqrestore(&sc->txbuflock, flags);
+
+        bf->skb = skb;
+
+        if (ath5k_txbuf_setup(sc, bf, txq, padsize)) {
+                bf->skb = NULL;
+                spin_lock_irqsave(&sc->txbuflock, flags);
+                list_add_tail(&bf->list, &sc->txbuf);
+                sc->txbuf_len++;
+                spin_unlock_irqrestore(&sc->txbuflock, flags);
+                goto drop_packet;
+        }
+        return NETDEV_TX_OK;
+
+drop_packet:
+        dev_kfree_skb_any(skb);
+        return NETDEV_TX_OK;
+}
+
+static void
+ath5k_tx_frame_completed(struct ath5k_softc *sc, struct sk_buff *skb,
+                         struct ath5k_tx_status *ts)
+{
+        struct ieee80211_tx_info *info;
+        int i;
+
+        sc->stats.tx_all_count++;
+        info = IEEE80211_SKB_CB(skb);
+
+        ieee80211_tx_info_clear_status(info);
+        for (i = 0; i < 4; i++) {
+                struct ieee80211_tx_rate *r =
+                        &info->status.rates[i];
+
+                if (ts->ts_rate[i]) {
+                        r->idx = ath5k_hw_to_driver_rix(sc, ts->ts_rate[i]);
+                        r->count = ts->ts_retry[i];
+                } else {
+                        r->idx = -1;
+                        r->count = 0;
+                }
+        }
+
+        /* count the successful attempt as well */
+        info->status.rates[ts->ts_final_idx].count++;
+
+        if (unlikely(ts->ts_status)) {
+                sc->stats.ack_fail++;
+                if (ts->ts_status & AR5K_TXERR_FILT) {
+                        info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                        sc->stats.txerr_filt++;
+                }
+                if (ts->ts_status & AR5K_TXERR_XRETRY)
+                        sc->stats.txerr_retry++;
+                if (ts->ts_status & AR5K_TXERR_FIFO)
+                        sc->stats.txerr_fifo++;
+        } else {
+                info->flags |= IEEE80211_TX_STAT_ACK;
+                info->status.ack_signal = ts->ts_rssi;
+        }
+
+        /*
+        * Remove MAC header padding before giving the frame
+        * back to mac80211.
+        */
+        ath5k_remove_padding(skb);
+
+        if (ts->ts_antenna > 0 && ts->ts_antenna < 5)
+                sc->stats.antenna_tx[ts->ts_antenna]++;
+        else
+                sc->stats.antenna_tx[0]++; /* invalid */
+
+        ieee80211_tx_status(sc->hw, skb);
+}
+
 static void
 ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
 {
@@ -2130,96 +1590,51 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
         struct ath5k_buf *bf, *bf0;
         struct ath5k_desc *ds;
         struct sk_buff *skb;
-        struct ieee80211_tx_info *info;
-        int i, ret;
+        int ret;
 
         spin_lock(&txq->lock);
         list_for_each_entry_safe(bf, bf0, &txq->q, list) {
-                ds = bf->desc;
-
-                /*
-                 * It's possible that the hardware can say the buffer is
-                 * completed when it hasn't yet loaded the ds_link from
-                 * host memory and moved on.  If there are more TX
-                 * descriptors in the queue, wait for TXDP to change
-                 * before processing this one.
-                 */
-                if (ath5k_hw_get_txdp(sc->ah, txq->qnum) == bf->daddr &&
-                    !list_is_last(&bf->list, &txq->q))
-                        break;
-
-                ret = sc->ah->ah_proc_tx_desc(sc->ah, ds, &ts);
-                if (unlikely(ret == -EINPROGRESS))
-                        break;
-                else if (unlikely(ret)) {
-                        ATH5K_ERR(sc, "error %d while processing queue %u\n",
-                                ret, txq->qnum);
-                        break;
-                }
 
-                sc->stats.tx_all_count++;
-                skb = bf->skb;
-                info = IEEE80211_SKB_CB(skb);
-                bf->skb = NULL;
+                txq->txq_poll_mark = false;
 
-                pci_unmap_single(sc->pdev, bf->skbaddr, skb->len,
-                                PCI_DMA_TODEVICE);
+                /* skb might already have been processed last time. */
+                if (bf->skb != NULL) {
+                        ds = bf->desc;
 
-                ieee80211_tx_info_clear_status(info);
-                for (i = 0; i < 4; i++) {
-                        struct ieee80211_tx_rate *r =
-                                &info->status.rates[i];
-
-                        if (ts.ts_rate[i]) {
-                                r->idx = ath5k_hw_to_driver_rix(sc, ts.ts_rate[i]);
-                                r->count = ts.ts_retry[i];
-                        } else {
-                                r->idx = -1;
-                                r->count = 0;
+                        ret = sc->ah->ah_proc_tx_desc(sc->ah, ds, &ts);
+                        if (unlikely(ret == -EINPROGRESS))
+                                break;
+                        else if (unlikely(ret)) {
+                                ATH5K_ERR(sc,
+                                        "error %d while processing "
+                                        "queue %u\n", ret, txq->qnum);
+                                break;
                         }
-                }
 
-                /* count the successful attempt as well */
-                info->status.rates[ts.ts_final_idx].count++;
-
-                if (unlikely(ts.ts_status)) {
-                        sc->stats.ack_fail++;
-                        if (ts.ts_status & AR5K_TXERR_FILT) {
-                                info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
-                                sc->stats.txerr_filt++;
-                        }
-                        if (ts.ts_status & AR5K_TXERR_XRETRY)
-                                sc->stats.txerr_retry++;
-                        if (ts.ts_status & AR5K_TXERR_FIFO)
-                                sc->stats.txerr_fifo++;
-                } else {
-                        info->flags |= IEEE80211_TX_STAT_ACK;
-                        info->status.ack_signal = ts.ts_rssi;
+                        skb = bf->skb;
+                        bf->skb = NULL;
+                        pci_unmap_single(sc->pdev, bf->skbaddr, skb->len,
+                                        PCI_DMA_TODEVICE);
+                        ath5k_tx_frame_completed(sc, skb, &ts);
                 }
 
                 /*
-                 * Remove MAC header padding before giving the frame
-                 * back to mac80211.
+                 * It's possible that the hardware can say the buffer is
+                 * completed when it hasn't yet loaded the ds_link from
+                 * host memory and moved on.
+                 * Always keep the last descriptor to avoid HW races...
                  */
-                ath5k_remove_padding(skb);
-
-                if (ts.ts_antenna > 0 && ts.ts_antenna < 5)
-                        sc->stats.antenna_tx[ts.ts_antenna]++;
-                else
-                        sc->stats.antenna_tx[0]++; /* invalid */
-
-                ieee80211_tx_status(sc->hw, skb);
-
-                spin_lock(&sc->txbuflock);
-                list_move_tail(&bf->list, &sc->txbuf);
-                sc->txbuf_len++;
-                spin_unlock(&sc->txbuflock);
+                if (ath5k_hw_get_txdp(sc->ah, txq->qnum) != bf->daddr) {
+                        spin_lock(&sc->txbuflock);
+                        list_move_tail(&bf->list, &sc->txbuf);
+                        sc->txbuf_len++;
+                        txq->txq_len--;
+                        spin_unlock(&sc->txbuflock);
+                }
         }
-        if (likely(list_empty(&txq->q)))
-                txq->link = NULL;
         spin_unlock(&txq->lock);
-        if (sc->txbuf_len > ATH_TXBUF / 5)
-                ieee80211_wake_queues(sc->hw);
+        if (txq->txq_len < ATH5K_TXQ_LEN_LOW)
+                ieee80211_wake_queue(sc->hw, txq->qnum);
 }
 
 static void
@@ -2285,10 +1700,11 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
          * default antenna which is supposed to be an omni.
          *
          * Note2: On sectored scenarios it's possible to have
-         * multiple antennas (1omni -the default- and 14 sectors)
-         * so if we choose to actually support this mode we need
-         * to allow user to set how many antennas we have and tweak
-         * the code below to send beacons on all of them.
+         * multiple antennas (1 omni -- the default -- and 14
+         * sectors), so if we choose to actually support this
+         * mode, we need to allow the user to set how many antennas
+         * we have and tweak the code below to send beacons
+         * on all of them.
          */
         if (ah->ah_ant_mode == AR5K_ANTMODE_SECTOR_AP)
                 antenna = sc->bsent & 4 ? 2 : 1;
@@ -2314,6 +1730,43 @@ err_unmap:
 }
 
 /*
+ * Updates the beacon that is sent by ath5k_beacon_send.  For adhoc,
+ * this is called only once at config_bss time, for AP we do it every
+ * SWBA interrupt so that the TIM will reflect buffered frames.
+ *
+ * Called with the beacon lock.
+ */
+static int
+ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+{
+        int ret;
+        struct ath5k_softc *sc = hw->priv;
+        struct sk_buff *skb;
+
+        if (WARN_ON(!vif)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        skb = ieee80211_beacon_get(hw, vif);
+
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
+
+        ath5k_txbuf_free_skb(sc, sc->bbuf);
+        sc->bbuf->skb = skb;
+        ret = ath5k_beacon_setup(sc, sc->bbuf);
+        if (ret)
+                sc->bbuf->skb = NULL;
+out:
+        return ret;
+}
+
+/*
  * Transmit a beacon frame at SWBA.  Dynamic updates to the
  * frame contents are done as needed and the slot time is
  * also adjusted based on current state.
@@ -2330,14 +1783,13 @@ ath5k_beacon_send(struct ath5k_softc *sc)
 
         ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON, "in beacon_send\n");
 
-        if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
-                        sc->opmode == NL80211_IFTYPE_MONITOR)) {
+        if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION)) {
                 ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
                 return;
         }
         /*
          * Check if the previous beacon has gone out.  If
-         * not don't don't try to post another, skip this
+         * not, don't don't try to post another: skip this
          * period and wait for the next.  Missed beacons
          * indicate a problem and should not occur.  If we
          * miss too many consecutive beacons reset the device.
@@ -2391,7 +1843,6 @@ ath5k_beacon_send(struct ath5k_softc *sc)
         sc->bsent++;
 }
 
-
 /**
  * ath5k_beacon_update_timers - update beacon timers
  *
@@ -2493,7 +1944,6 @@ ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf)
                 intval & AR5K_BEACON_RESET_TSF ? "AR5K_BEACON_RESET_TSF" : "");
 }
 
-
 /**
  * ath5k_beacon_config - Configure the beacon queues and interrupts
  *
@@ -2572,155 +2022,6 @@ static void ath5k_tasklet_beacon(unsigned long data)
 * Interrupt handling *
 \********************/
 
-static int
-ath5k_init(struct ath5k_softc *sc)
-{
-        struct ath5k_hw *ah = sc->ah;
-        int ret, i;
-
-        mutex_lock(&sc->lock);
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
-
-        /*
-         * Stop anything previously setup.  This is safe
-         * no matter this is the first time through or not.
-         */
-        ath5k_stop_locked(sc);
-
-        /*
-         * The basic interface to setting the hardware in a good
-         * state is ``reset''.  On return the hardware is known to
-         * be powered up and with interrupts disabled.  This must
-         * be followed by initialization of the appropriate bits
-         * and then setup of the interrupt mask.
-         */
-        sc->curchan = sc->hw->conf.channel;
-        sc->curband = &sc->sbands[sc->curchan->band];
-        sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
-                AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
-                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
-
-        ret = ath5k_reset(sc, NULL);
-        if (ret)
-                goto done;
-
-        ath5k_rfkill_hw_start(ah);
-
-        /*
-         * Reset the key cache since some parts do not reset the
-         * contents on initial power up or resume from suspend.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
-        ath5k_hw_set_ack_bitrate_high(ah, true);
-        ret = 0;
-done:
-        mmiowb();
-        mutex_unlock(&sc->lock);
-        return ret;
-}
-
-static int
-ath5k_stop_locked(struct ath5k_softc *sc)
-{
-        struct ath5k_hw *ah = sc->ah;
-
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "invalid %u\n",
-                        test_bit(ATH_STAT_INVALID, sc->status));
-
-        /*
-         * Shutdown the hardware and driver:
-         *    stop output from above
-         *    disable interrupts
-         *    turn off timers
-         *    turn off the radio
-         *    clear transmit machinery
-         *    clear receive machinery
-         *    drain and release tx queues
-         *    reclaim beacon resources
-         *    power down hardware
-         *
-         * Note that some of this work is not possible if the
-         * hardware is gone (invalid).
-         */
-        ieee80211_stop_queues(sc->hw);
-
-        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
-                ath5k_led_off(sc);
-                ath5k_hw_set_imr(ah, 0);
-                synchronize_irq(sc->pdev->irq);
-        }
-        ath5k_txq_cleanup(sc);
-        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
-                ath5k_rx_stop(sc);
-                ath5k_hw_phy_disable(ah);
-        }
-
-        return 0;
-}
-
-static void stop_tasklets(struct ath5k_softc *sc)
-{
-        tasklet_kill(&sc->rxtq);
-        tasklet_kill(&sc->txtq);
-        tasklet_kill(&sc->calib);
-        tasklet_kill(&sc->beacontq);
-        tasklet_kill(&sc->ani_tasklet);
-}
-
-/*
- * Stop the device, grabbing the top-level lock to protect
- * against concurrent entry through ath5k_init (which can happen
- * if another thread does a system call and the thread doing the
- * stop is preempted).
- */
-static int
-ath5k_stop_hw(struct ath5k_softc *sc)
-{
-        int ret;
-
-        mutex_lock(&sc->lock);
-        ret = ath5k_stop_locked(sc);
-        if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
-                /*
-                 * Don't set the card in full sleep mode!
-                 *
-                 * a) When the device is in this state it must be carefully
-                 * woken up or references to registers in the PCI clock
-                 * domain may freeze the bus (and system).  This varies
-                 * by chip and is mostly an issue with newer parts
-                 * (madwifi sources mentioned srev >= 0x78) that go to
-                 * sleep more quickly.
-                 *
-                 * b) On older chips full sleep results a weird behaviour
-                 * during wakeup. I tested various cards with srev < 0x78
-                 * and they don't wake up after module reload, a second
-                 * module reload is needed to bring the card up again.
-                 *
-                 * Until we figure out what's going on don't enable
-                 * full chip reset on any chip (this is what Legacy HAL
-                 * and Sam's HAL do anyway). Instead Perform a full reset
-                 * on the device (same as initial state after attach) and
-                 * leave it idle (keep MAC/BB on warm reset) */
-                ret = ath5k_hw_on_hold(sc->ah);
-
-                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
-                                "putting device to sleep\n");
-        }
-        ath5k_txbuf_free_skb(sc, sc->bbuf);
-
-        mmiowb();
-        mutex_unlock(&sc->lock);
-
-        stop_tasklets(sc);
-
-        ath5k_rfkill_hw_stop(sc->ah);
-
-        return ret;
-}
-
 static void
 ath5k_intr_calibration_poll(struct ath5k_hw *ah)
 {
@@ -2857,14 +2158,13 @@ ath5k_tasklet_calibrate(unsigned long data)
                                 sc->curchan->center_freq));
 
         /* Noise floor calibration interrupts rx/tx path while I/Q calibration
-         * doesn't. We stop the queues so that calibration doesn't interfere
-         * with TX and don't run it as often */
+         * doesn't.
+         * TODO: We should stop TX here, so that it doesn't interfere.
+         * Note that stopping the queues is not enough to stop TX! */
         if (time_is_before_eq_jiffies(ah->ah_cal_next_nf)) {
                 ah->ah_cal_next_nf = jiffies +
                         msecs_to_jiffies(ATH5K_TUNE_CALIBRATION_INTERVAL_NF);
-                ieee80211_stop_queues(sc->hw);
                 ath5k_hw_update_noise_floor(ah);
-                ieee80211_wake_queues(sc->hw);
         }
 
         ah->ah_cal_mask &= ~AR5K_CALIBRATION_FULL;
@@ -2883,71 +2183,205 @@ ath5k_tasklet_ani(unsigned long data)
 }
 
 
-/********************\
-* Mac80211 functions *
-\********************/
+static void
+ath5k_tx_complete_poll_work(struct work_struct *work)
+{
+        struct ath5k_softc *sc = container_of(work, struct ath5k_softc,
+                        tx_complete_work.work);
+        struct ath5k_txq *txq;
+        int i;
+        bool needreset = false;
+
+        for (i = 0; i < ARRAY_SIZE(sc->txqs); i++) {
+                if (sc->txqs[i].setup) {
+                        txq = &sc->txqs[i];
+                        spin_lock_bh(&txq->lock);
+                        if (txq->txq_len > 1) {
+                                if (txq->txq_poll_mark) {
+                                        ATH5K_DBG(sc, ATH5K_DEBUG_XMIT,
+                                                  "TX queue stuck %d\n",
+                                                  txq->qnum);
+                                        needreset = true;
+                                        txq->txq_stuck++;
+                                        spin_unlock_bh(&txq->lock);
+                                        break;
+                                } else {
+                                        txq->txq_poll_mark = true;
+                                }
+                        }
+                        spin_unlock_bh(&txq->lock);
+                }
+        }
+
+        if (needreset) {
+                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                          "TX queues stuck, resetting\n");
+                ath5k_reset(sc, sc->curchan);
+        }
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+                msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
+}
+
+
+/*************************\
+* Initialization routines *
+\*************************/
 
 static int
-ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+ath5k_stop_locked(struct ath5k_softc *sc)
 {
-        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
 
-        return ath5k_tx_queue(hw, skb, sc->txq);
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "invalid %u\n",
+                        test_bit(ATH_STAT_INVALID, sc->status));
+
+        /*
+         * Shutdown the hardware and driver:
+         *    stop output from above
+         *    disable interrupts
+         *    turn off timers
+         *    turn off the radio
+         *    clear transmit machinery
+         *    clear receive machinery
+         *    drain and release tx queues
+         *    reclaim beacon resources
+         *    power down hardware
+         *
+         * Note that some of this work is not possible if the
+         * hardware is gone (invalid).
+         */
+        ieee80211_stop_queues(sc->hw);
+
+        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
+                ath5k_led_off(sc);
+                ath5k_hw_set_imr(ah, 0);
+                synchronize_irq(sc->pdev->irq);
+        }
+        ath5k_txq_cleanup(sc);
+        if (!test_bit(ATH_STAT_INVALID, sc->status)) {
+                ath5k_rx_stop(sc);
+                ath5k_hw_phy_disable(ah);
+        }
+
+        return 0;
 }
 
-static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
-                          struct ath5k_txq *txq)
+static int
+ath5k_init(struct ath5k_softc *sc)
 {
-        struct ath5k_softc *sc = hw->priv;
-        struct ath5k_buf *bf;
-        unsigned long flags;
-        int padsize;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
+        int ret, i;
 
-        ath5k_debug_dump_skb(sc, skb, "TX  ", 1);
+        mutex_lock(&sc->lock);
 
-        if (sc->opmode == NL80211_IFTYPE_MONITOR)
-                ATH5K_DBG(sc, ATH5K_DEBUG_XMIT, "tx in monitor (scan?)\n");
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
 
         /*
-         * the hardware expects the header padded to 4 byte boundaries
-         * if this is not the case we add the padding after the header
+         * Stop anything previously setup.  This is safe
+         * no matter this is the first time through or not.
          */
-        padsize = ath5k_add_padding(skb);
-        if (padsize < 0) {
-                ATH5K_ERR(sc, "tx hdrlen not %%4: not enough"
-                          " headroom to pad");
-                goto drop_packet;
-        }
+        ath5k_stop_locked(sc);
 
-        spin_lock_irqsave(&sc->txbuflock, flags);
-        if (list_empty(&sc->txbuf)) {
-                ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
-                spin_unlock_irqrestore(&sc->txbuflock, flags);
-                ieee80211_stop_queue(hw, skb_get_queue_mapping(skb));
-                goto drop_packet;
-        }
-        bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
-        list_del(&bf->list);
-        sc->txbuf_len--;
-        if (list_empty(&sc->txbuf))
-                ieee80211_stop_queues(hw);
-        spin_unlock_irqrestore(&sc->txbuflock, flags);
+        /*
+         * The basic interface to setting the hardware in a good
+         * state is ``reset''.  On return the hardware is known to
+         * be powered up and with interrupts disabled.  This must
+         * be followed by initialization of the appropriate bits
+         * and then setup of the interrupt mask.
+         */
+        sc->curchan = sc->hw->conf.channel;
+        sc->curband = &sc->sbands[sc->curchan->band];
+        sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
+                AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
+                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
 
-        bf->skb = skb;
+        ret = ath5k_reset(sc, NULL);
+        if (ret)
+                goto done;
 
-        if (ath5k_txbuf_setup(sc, bf, txq, padsize)) {
-                bf->skb = NULL;
-                spin_lock_irqsave(&sc->txbuflock, flags);
-                list_add_tail(&bf->list, &sc->txbuf);
-                sc->txbuf_len++;
-                spin_unlock_irqrestore(&sc->txbuflock, flags);
-                goto drop_packet;
+        ath5k_rfkill_hw_start(ah);
+
+        /*
+         * Reset the key cache since some parts do not reset the
+         * contents on initial power up or resume from suspend.
+         */
+        for (i = 0; i < common->keymax; i++)
+                ath_hw_keyreset(common, (u16) i);
+
+        ath5k_hw_set_ack_bitrate_high(ah, true);
+        ret = 0;
+done:
+        mmiowb();
+        mutex_unlock(&sc->lock);
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+                        msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
+
+        return ret;
+}
+
+static void stop_tasklets(struct ath5k_softc *sc)
+{
+        tasklet_kill(&sc->rxtq);
+        tasklet_kill(&sc->txtq);
+        tasklet_kill(&sc->calib);
+        tasklet_kill(&sc->beacontq);
+        tasklet_kill(&sc->ani_tasklet);
+}
+
+/*
+ * Stop the device, grabbing the top-level lock to protect
+ * against concurrent entry through ath5k_init (which can happen
+ * if another thread does a system call and the thread doing the
+ * stop is preempted).
+ */
+static int
+ath5k_stop_hw(struct ath5k_softc *sc)
+{
+        int ret;
+
+        mutex_lock(&sc->lock);
+        ret = ath5k_stop_locked(sc);
+        if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
+                /*
+                 * Don't set the card in full sleep mode!
+                 *
+                 * a) When the device is in this state it must be carefully
+                 * woken up or references to registers in the PCI clock
+                 * domain may freeze the bus (and system).  This varies
+                 * by chip and is mostly an issue with newer parts
+                 * (madwifi sources mentioned srev >= 0x78) that go to
+                 * sleep more quickly.
+                 *
+                 * b) On older chips full sleep results a weird behaviour
+                 * during wakeup. I tested various cards with srev < 0x78
+                 * and they don't wake up after module reload, a second
+                 * module reload is needed to bring the card up again.
+                 *
+                 * Until we figure out what's going on don't enable
+                 * full chip reset on any chip (this is what Legacy HAL
+                 * and Sam's HAL do anyway). Instead Perform a full reset
+                 * on the device (same as initial state after attach) and
+                 * leave it idle (keep MAC/BB on warm reset) */
+                ret = ath5k_hw_on_hold(sc->ah);
+
+                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                "putting device to sleep\n");
         }
-        return NETDEV_TX_OK;
+        ath5k_txbuf_free_skb(sc, sc->bbuf);
 
-drop_packet:
-        dev_kfree_skb_any(skb);
-        return NETDEV_TX_OK;
+        mmiowb();
+        mutex_unlock(&sc->lock);
+
+        stop_tasklets(sc);
+
+        cancel_delayed_work_sync(&sc->tx_complete_work);
+
+        ath5k_rfkill_hw_stop(sc->ah);
+
+        return ret;
 }
 
 /*
@@ -3024,6 +2458,208 @@ static void ath5k_reset_work(struct work_struct *work)
         mutex_unlock(&sc->lock);
 }
 
+static int
+ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
+        struct ath5k_txq *txq;
+        u8 mac[ETH_ALEN] = {};
+        int ret;
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
+
+        /*
+         * Check if the MAC has multi-rate retry support.
+         * We do this by trying to setup a fake extended
+         * descriptor.  MACs that don't have support will
+         * return false w/o doing anything.  MACs that do
+         * support it will return true w/o doing anything.
+         */
+        ret = ath5k_hw_setup_mrr_tx_desc(ah, NULL, 0, 0, 0, 0, 0, 0);
+
+        if (ret < 0)
+                goto err;
+        if (ret > 0)
+                __set_bit(ATH_STAT_MRRETRY, sc->status);
+
+        /*
+         * Collect the channel list.  The 802.11 layer
+         * is resposible for filtering this list based
+         * on settings like the phy mode and regulatory
+         * domain restrictions.
+         */
+        ret = ath5k_setup_bands(hw);
+        if (ret) {
+                ATH5K_ERR(sc, "can't get channels\n");
+                goto err;
+        }
+
+        /* NB: setup here so ath5k_rate_update is happy */
+        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
+                ath5k_setcurmode(sc, AR5K_MODE_11A);
+        else
+                ath5k_setcurmode(sc, AR5K_MODE_11B);
+
+        /*
+         * Allocate tx+rx descriptors and populate the lists.
+         */
+        ret = ath5k_desc_alloc(sc, pdev);
+        if (ret) {
+                ATH5K_ERR(sc, "can't allocate descriptors\n");
+                goto err;
+        }
+
+        /*
+         * Allocate hardware transmit queues: one queue for
+         * beacon frames and one data queue for each QoS
+         * priority.  Note that hw functions handle resetting
+         * these queues at the needed time.
+         */
+        ret = ath5k_beaconq_setup(ah);
+        if (ret < 0) {
+                ATH5K_ERR(sc, "can't setup a beacon xmit queue\n");
+                goto err_desc;
+        }
+        sc->bhalq = ret;
+        sc->cabq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_CAB, 0);
+        if (IS_ERR(sc->cabq)) {
+                ATH5K_ERR(sc, "can't setup cab queue\n");
+                ret = PTR_ERR(sc->cabq);
+                goto err_bhal;
+        }
+
+        /* This order matches mac80211's queue priority, so we can
+         * directly use the mac80211 queue number without any mapping */
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_VO);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_VI);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BE);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        txq = ath5k_txq_setup(sc, AR5K_TX_QUEUE_DATA, AR5K_WME_AC_BK);
+        if (IS_ERR(txq)) {
+                ATH5K_ERR(sc, "can't setup xmit queue\n");
+                ret = PTR_ERR(txq);
+                goto err_queues;
+        }
+        hw->queues = 4;
+
+        tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
+        tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
+        tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
+        tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
+        tasklet_init(&sc->ani_tasklet, ath5k_tasklet_ani, (unsigned long)sc);
+
+        INIT_WORK(&sc->reset_work, ath5k_reset_work);
+        INIT_DELAYED_WORK(&sc->tx_complete_work, ath5k_tx_complete_poll_work);
+
+        ret = ath5k_eeprom_read_mac(ah, mac);
+        if (ret) {
+                ATH5K_ERR(sc, "unable to read address from EEPROM: 0x%04x\n",
+                        sc->pdev->device);
+                goto err_queues;
+        }
+
+        SET_IEEE80211_PERM_ADDR(hw, mac);
+        /* All MAC address bits matter for ACKs */
+        memcpy(sc->bssidmask, ath_bcast_mac, ETH_ALEN);
+        ath5k_hw_set_bssid_mask(sc->ah, sc->bssidmask);
+
+        regulatory->current_rd = ah->ah_capabilities.cap_eeprom.ee_regdomain;
+        ret = ath_regd_init(regulatory, hw->wiphy, ath5k_reg_notifier);
+        if (ret) {
+                ATH5K_ERR(sc, "can't initialize regulatory system\n");
+                goto err_queues;
+        }
+
+        ret = ieee80211_register_hw(hw);
+        if (ret) {
+                ATH5K_ERR(sc, "can't register ieee80211 hw\n");
+                goto err_queues;
+        }
+
+        if (!ath_is_world_regd(regulatory))
+                regulatory_hint(hw->wiphy, regulatory->alpha2);
+
+        ath5k_init_leds(sc);
+
+        ath5k_sysfs_register(sc);
+
+        return 0;
+err_queues:
+        ath5k_txq_release(sc);
+err_bhal:
+        ath5k_hw_release_tx_queue(ah, sc->bhalq);
+err_desc:
+        ath5k_desc_free(sc, pdev);
+err:
+        return ret;
+}
+
+static void
+ath5k_detach(struct pci_dev *pdev, struct ieee80211_hw *hw)
+{
+        struct ath5k_softc *sc = hw->priv;
+
+        /*
+         * NB: the order of these is important:
+         * o call the 802.11 layer before detaching ath5k_hw to
+         *   ensure callbacks into the driver to delete global
+         *   key cache entries can be handled
+         * o reclaim the tx queue data structures after calling
+         *   the 802.11 layer as we'll get called back to reclaim
+         *   node state and potentially want to use them
+         * o to cleanup the tx queues the hal is called, so detach
+         *   it last
+         * XXX: ??? detach ath5k_hw ???
+         * Other than that, it's straightforward...
+         */
+        ieee80211_unregister_hw(hw);
+        ath5k_desc_free(sc, pdev);
+        ath5k_txq_release(sc);
+        ath5k_hw_release_tx_queue(sc->ah, sc->bhalq);
+        ath5k_unregister_leds(sc);
+
+        ath5k_sysfs_unregister(sc);
+        /*
+         * NB: can't reclaim these until after ieee80211_ifdetach
+         * returns because we'll get called back to reclaim node
+         * state and potentially want to use them.
+         */
+}
+
+/********************\
+* Mac80211 functions *
+\********************/
+
+static int
+ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ath5k_softc *sc = hw->priv;
+        u16 qnum = skb_get_queue_mapping(skb);
+
+        if (WARN_ON(qnum >= sc->ah->ah_capabilities.cap_queues.q_tx_num)) {
+                dev_kfree_skb_any(skb);
+                return 0;
+        }
+
+        return ath5k_tx_queue(hw, skb, &sc->txqs[qnum]);
+}
+
 static int ath5k_start(struct ieee80211_hw *hw)
 {
         return ath5k_init(hw->priv);
@@ -3053,7 +2689,6 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_MESH_POINT:
-        case NL80211_IFTYPE_MONITOR:
                 sc->opmode = vif->type;
                 break;
         default:
@@ -3237,9 +2872,9 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
                 rfilt |= AR5K_RX_FILTER_PHYERR;
 
         /* FIF_BCN_PRBRESP_PROMISC really means to enable beacons
-        * and probes for any BSSID, this needs testing */
+        * and probes for any BSSID */
         if (*new_flags & FIF_BCN_PRBRESP_PROMISC)
-                rfilt |= AR5K_RX_FILTER_BEACON | AR5K_RX_FILTER_PROBEREQ;
+                rfilt |= AR5K_RX_FILTER_BEACON;
 
         /* FIF_CONTROL doc says that if FIF_PROMISC_IN_BSS is not
          * set we should only pass on control frames for this
@@ -3255,7 +2890,6 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
 
         switch (sc->opmode) {
         case NL80211_IFTYPE_MESH_POINT:
-        case NL80211_IFTYPE_MONITOR:
                 rfilt |= AR5K_RX_FILTER_CONTROL |
                          AR5K_RX_FILTER_BEACON |
                          AR5K_RX_FILTER_PROBEREQ |
@@ -3278,7 +2912,7 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
 
         /* Set multicast bits */
         ath5k_hw_set_mcast_filter(ah, mfilt[0], mfilt[1]);
-        /* Set the cached hw filter flags, this will alter actually
+        /* Set the cached hw filter flags, this will later actually
          * be set in HW */
         sc->filter_flags = rfilt;
 
@@ -3298,17 +2932,14 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (modparam_nohwcrypt)
                 return -EOPNOTSUPP;
 
-        if (sc->opmode == NL80211_IFTYPE_AP)
-                return -EOPNOTSUPP;
-
-        switch (key->alg) {
-        case ALG_WEP:
-        case ALG_TKIP:
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+        case WLAN_CIPHER_SUITE_TKIP:
                 break;
-        case ALG_CCMP:
-                if (sc->ah->ah_aes_support)
+        case WLAN_CIPHER_SUITE_CCMP:
+                if (common->crypt_caps & ATH_CRYPT_CAP_CIPHER_AESCCM)
                         break;
-
                 return -EOPNOTSUPP;
         default:
                 WARN_ON(1);
@@ -3319,27 +2950,25 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath5k_hw_set_key(sc->ah, key->keyidx, key,
-                                       sta ? sta->addr : NULL);
-                if (ret) {
-                        ATH5K_ERR(sc, "can't set the key\n");
-                        goto unlock;
+                ret = ath_key_config(common, vif, sta, key);
+                if (ret >= 0) {
+                        key->hw_key_idx = ret;
+                        /* push IV and Michael MIC generation to stack */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                                key->flags |= IEEE80211_KEY_FLAG_SW_MGMT;
+                        ret = 0;
                 }
-                __set_bit(key->keyidx, common->keymap);
-                key->hw_key_idx = key->keyidx;
-                key->flags |= (IEEE80211_KEY_FLAG_GENERATE_IV |
-                               IEEE80211_KEY_FLAG_GENERATE_MMIC);
                 break;
         case DISABLE_KEY:
-                ath5k_hw_reset_key(sc->ah, key->keyidx);
-                __clear_bit(key->keyidx, common->keymap);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
-                goto unlock;
         }
 
-unlock:
         mmiowb();
         mutex_unlock(&sc->lock);
         return ret;
@@ -3409,43 +3038,6 @@ ath5k_reset_tsf(struct ieee80211_hw *hw)
                 ath5k_hw_reset_tsf(sc->ah);
 }
 
-/*
- * Updates the beacon that is sent by ath5k_beacon_send.  For adhoc,
- * this is called only once at config_bss time, for AP we do it every
- * SWBA interrupt so that the TIM will reflect buffered frames.
- *
- * Called with the beacon lock.
- */
-static int
-ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
-{
-        int ret;
-        struct ath5k_softc *sc = hw->priv;
-        struct sk_buff *skb;
-
-        if (WARN_ON(!vif)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        skb = ieee80211_beacon_get(hw, vif);
-
-        if (!skb) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
-
-        ath5k_txbuf_free_skb(sc, sc->bbuf);
-        sc->bbuf->skb = skb;
-        ret = ath5k_beacon_setup(sc, sc->bbuf);
-        if (ret)
-                sc->bbuf->skb = NULL;
-out:
-        return ret;
-}
-
 static void
 set_beacon_filter(struct ieee80211_hw *hw, bool enable)
 {
@@ -3479,7 +3071,7 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                 /* Cache for later use during resets */
                 memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
                 common->curaid = 0;
-                ath5k_hw_set_associd(ah);
+                ath5k_hw_set_bssid(ah);
                 mmiowb();
         }
 
@@ -3497,7 +3089,7 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                                   "Bss Info ASSOC %d, bssid: %pM\n",
                                   bss_conf->aid, common->curbssid);
                         common->curaid = bss_conf->aid;
-                        ath5k_hw_set_associd(ah);
+                        ath5k_hw_set_bssid(ah);
                         /* Once ANI is available you would start it here */
                 }
         }
@@ -3551,3 +3143,402 @@ static void ath5k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
         ath5k_hw_set_coverage_class(sc->ah, coverage_class);
         mutex_unlock(&sc->lock);
 }
+
+static int ath5k_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                         const struct ieee80211_tx_queue_params *params)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath5k_txq_info qi;
+        int ret = 0;
+
+        if (queue >= ah->ah_capabilities.cap_queues.q_tx_num)
+                return 0;
+
+        mutex_lock(&sc->lock);
+
+        ath5k_hw_get_tx_queueprops(ah, queue, &qi);
+
+        qi.tqi_aifs = params->aifs;
+        qi.tqi_cw_min = params->cw_min;
+        qi.tqi_cw_max = params->cw_max;
+        qi.tqi_burst_time = params->txop;
+
+        ATH5K_DBG(sc, ATH5K_DEBUG_ANY,
+                  "Configure tx [queue %d],  "
+                  "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
+                  queue, params->aifs, params->cw_min,
+                  params->cw_max, params->txop);
+
+        if (ath5k_hw_set_tx_queueprops(ah, queue, &qi)) {
+                ATH5K_ERR(sc,
+                          "Unable to update hardware queue %u!\n", queue);
+                ret = -EIO;
+        } else
+                ath5k_hw_reset_tx_queue(ah, queue);
+
+        mutex_unlock(&sc->lock);
+
+        return ret;
+}
+
+static const struct ieee80211_ops ath5k_hw_ops = {
+        .tx             = ath5k_tx,
+        .start          = ath5k_start,
+        .stop           = ath5k_stop,
+        .add_interface  = ath5k_add_interface,
+        .remove_interface = ath5k_remove_interface,
+        .config         = ath5k_config,
+        .prepare_multicast = ath5k_prepare_multicast,
+        .configure_filter = ath5k_configure_filter,
+        .set_key        = ath5k_set_key,
+        .get_stats      = ath5k_get_stats,
+        .get_survey     = ath5k_get_survey,
+        .conf_tx        = ath5k_conf_tx,
+        .get_tsf        = ath5k_get_tsf,
+        .set_tsf        = ath5k_set_tsf,
+        .reset_tsf      = ath5k_reset_tsf,
+        .bss_info_changed = ath5k_bss_info_changed,
+        .sw_scan_start  = ath5k_sw_scan_start,
+        .sw_scan_complete = ath5k_sw_scan_complete,
+        .set_coverage_class = ath5k_set_coverage_class,
+};
+
+/********************\
+* PCI Initialization *
+\********************/
+
+static int __devinit
+ath5k_pci_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
+{
+        void __iomem *mem;
+        struct ath5k_softc *sc;
+        struct ath_common *common;
+        struct ieee80211_hw *hw;
+        int ret;
+        u8 csz;
+
+        /*
+         * L0s needs to be disabled on all ath5k cards.
+         *
+         * For distributions shipping with CONFIG_PCIEASPM (this will be enabled
+         * by default in the future in 2.6.36) this will also mean both L1 and
+         * L0s will be disabled when a pre 1.1 PCIe device is detected. We do
+         * know L1 works correctly even for all ath5k pre 1.1 PCIe devices
+         * though but cannot currently undue the effect of a blacklist, for
+         * details you can read pcie_aspm_sanity_check() and see how it adjusts
+         * the device link capability.
+         *
+         * It may be possible in the future to implement some PCI API to allow
+         * drivers to override blacklists for pre 1.1 PCIe but for now it is
+         * best to accept that both L0s and L1 will be disabled completely for
+         * distributions shipping with CONFIG_PCIEASPM rather than having this
+         * issue present. Motivation for adding this new API will be to help
+         * with power consumption for some of these devices.
+         */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S);
+
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "can't enable device\n");
+                goto err;
+        }
+
+        /* XXX 32-bit addressing only */
+        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (ret) {
+                dev_err(&pdev->dev, "32-bit DMA not available\n");
+                goto err_dis;
+        }
+
+        /*
+         * Cache line size is used to size and align various
+         * structures used to communicate with the hardware.
+         */
+        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE, &csz);
+        if (csz == 0) {
+                /*
+                 * Linux 2.4.18 (at least) writes the cache line size
+                 * register as a 16-bit wide register which is wrong.
+                 * We must have this setup properly for rx buffer
+                 * DMA to work so force a reasonable value here if it
+                 * comes up zero.
+                 */
+                csz = L1_CACHE_BYTES >> 2;
+                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, csz);
+        }
+        /*
+         * The default setting of latency timer yields poor results,
+         * set it to the value used by other systems.  It may be worth
+         * tweaking this setting more.
+         */
+        pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 0xa8);
+
+        /* Enable bus mastering */
+        pci_set_master(pdev);
+
+        /*
+         * Disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state.
+         */
+        pci_write_config_byte(pdev, 0x41, 0);
+
+        ret = pci_request_region(pdev, 0, "ath5k");
+        if (ret) {
+                dev_err(&pdev->dev, "cannot reserve PCI memory region\n");
+                goto err_dis;
+        }
+
+        mem = pci_iomap(pdev, 0, 0);
+        if (!mem) {
+                dev_err(&pdev->dev, "cannot remap PCI memory region\n") ;
+                ret = -EIO;
+                goto err_reg;
+        }
+
+        /*
+         * Allocate hw (mac80211 main struct)
+         * and hw->priv (driver private data)
+         */
+        hw = ieee80211_alloc_hw(sizeof(*sc), &ath5k_hw_ops);
+        if (hw == NULL) {
+                dev_err(&pdev->dev, "cannot allocate ieee80211_hw\n");
+                ret = -ENOMEM;
+                goto err_map;
+        }
+
+        dev_info(&pdev->dev, "registered as '%s'\n", wiphy_name(hw->wiphy));
+
+        /* Initialize driver private data */
+        SET_IEEE80211_DEV(hw, &pdev->dev);
+        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+                    IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+                    IEEE80211_HW_SIGNAL_DBM;
+
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        hw->extra_tx_headroom = 2;
+        hw->channel_change_time = 5000;
+        sc = hw->priv;
+        sc->hw = hw;
+        sc->pdev = pdev;
+
+        ath5k_debug_init_device(sc);
+
+        /*
+         * Mark the device as detached to avoid processing
+         * interrupts until setup is complete.
+         */
+        __set_bit(ATH_STAT_INVALID, sc->status);
+
+        sc->iobase = mem; /* So we can unmap it on detach */
+        sc->opmode = NL80211_IFTYPE_STATION;
+        sc->bintval = 1000;
+        mutex_init(&sc->lock);
+        spin_lock_init(&sc->rxbuflock);
+        spin_lock_init(&sc->txbuflock);
+        spin_lock_init(&sc->block);
+
+        /* Set private data */
+        pci_set_drvdata(pdev, sc);
+
+        /* Setup interrupt handler */
+        ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
+        if (ret) {
+                ATH5K_ERR(sc, "request_irq failed\n");
+                goto err_free;
+        }
+
+        /* If we passed the test, malloc an ath5k_hw struct */
+        sc->ah = kzalloc(sizeof(struct ath5k_hw), GFP_KERNEL);
+        if (!sc->ah) {
+                ret = -ENOMEM;
+                ATH5K_ERR(sc, "out of memory\n");
+                goto err_irq;
+        }
+
+        sc->ah->ah_sc = sc;
+        sc->ah->ah_iobase = sc->iobase;
+        common = ath5k_hw_common(sc->ah);
+        common->ops = &ath5k_common_ops;
+        common->ah = sc->ah;
+        common->hw = hw;
+        common->cachelsz = csz << 2; /* convert to bytes */
+
+        /* Initialize device */
+        ret = ath5k_hw_attach(sc);
+        if (ret) {
+                goto err_free_ah;
+        }
+
+        /* set up multi-rate retry capabilities */
+        if (sc->ah->ah_version == AR5K_AR5212) {
+                hw->max_rates = 4;
+                hw->max_rate_tries = 11;
+        }
+
+        /* Finish private driver data initialization */
+        ret = ath5k_attach(pdev, hw);
+        if (ret)
+                goto err_ah;
+
+        ATH5K_INFO(sc, "Atheros AR%s chip found (MAC: 0x%x, PHY: 0x%x)\n",
+                        ath5k_chip_name(AR5K_VERSION_MAC, sc->ah->ah_mac_srev),
+                                        sc->ah->ah_mac_srev,
+                                        sc->ah->ah_phy_revision);
+
+        if (!sc->ah->ah_single_chip) {
+                /* Single chip radio (!RF5111) */
+                if (sc->ah->ah_radio_5ghz_revision &&
+                        !sc->ah->ah_radio_2ghz_revision) {
+                        /* No 5GHz support -> report 2GHz radio */
+                        if (!test_bit(AR5K_MODE_11A,
+                                sc->ah->ah_capabilities.cap_mode)) {
+                                ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        /* No 2GHz support (5110 and some
+                         * 5Ghz only cards) -> report 5Ghz radio */
+                        } else if (!test_bit(AR5K_MODE_11B,
+                                sc->ah->ah_capabilities.cap_mode)) {
+                                ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        /* Multiband radio */
+                        } else {
+                                ATH5K_INFO(sc, "RF%s multiband radio found"
+                                        " (0x%x)\n",
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        }
+                }
+                /* Multi chip radio (RF5111 - RF2111) ->
+                 * report both 2GHz/5GHz radios */
+                else if (sc->ah->ah_radio_5ghz_revision &&
+                                sc->ah->ah_radio_2ghz_revision){
+                        ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_5ghz_revision),
+                                        sc->ah->ah_radio_5ghz_revision);
+                        ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_2ghz_revision),
+                                        sc->ah->ah_radio_2ghz_revision);
+                }
+        }
+
+
+        /* ready to process interrupts */
+        __clear_bit(ATH_STAT_INVALID, sc->status);
+
+        return 0;
+err_ah:
+        ath5k_hw_detach(sc->ah);
+err_free_ah:
+        kfree(sc->ah);
+err_irq:
+        free_irq(pdev->irq, sc);
+err_free:
+        ieee80211_free_hw(hw);
+err_map:
+        pci_iounmap(pdev, mem);
+err_reg:
+        pci_release_region(pdev, 0);
+err_dis:
+        pci_disable_device(pdev);
+err:
+        return ret;
+}
+
+static void __devexit
+ath5k_pci_remove(struct pci_dev *pdev)
+{
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+
+        ath5k_debug_finish_device(sc);
+        ath5k_detach(pdev, sc->hw);
+        ath5k_hw_detach(sc->ah);
+        kfree(sc->ah);
+        free_irq(pdev->irq, sc);
+        pci_iounmap(pdev, sc->iobase);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+        ieee80211_free_hw(sc->hw);
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int ath5k_pci_suspend(struct device *dev)
+{
+        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
+
+        ath5k_led_off(sc);
+        return 0;
+}
+
+static int ath5k_pci_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+
+        /*
+         * Suspend/Resume resets the PCI configuration space, so we have to
+         * re-disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state
+         */
+        pci_write_config_byte(pdev, 0x41, 0);
+
+        ath5k_led_enable(sc);
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
+#define ATH5K_PM_OPS    (&ath5k_pm_ops)
+#else
+#define ATH5K_PM_OPS    NULL
+#endif /* CONFIG_PM_SLEEP */
+
+static struct pci_driver ath5k_pci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = ath5k_pci_id_table,
+        .probe          = ath5k_pci_probe,
+        .remove         = __devexit_p(ath5k_pci_remove),
+        .driver.pm      = ATH5K_PM_OPS,
+};
+
+/*
+ * Module init/exit functions
+ */
+static int __init
+init_ath5k_pci(void)
+{
+        int ret;
+
+        ath5k_debug_init();
+
+        ret = pci_register_driver(&ath5k_pci_driver);
+        if (ret) {
+                printk(KERN_ERR "ath5k_pci: can't register pci driver\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static void __exit
+exit_ath5k_pci(void)
+{
+        pci_unregister_driver(&ath5k_pci_driver);
+
+        ath5k_debug_finish();
+}
+
+module_init(init_ath5k_pci);
+module_exit(exit_ath5k_pci);
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index dc1241f9c4e8..7f9d0d3018e8 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -60,6 +60,9 @@
 #define ATH_TXBUF       200             /* number of TX buffers */
 #define ATH_BCBUF       1               /* number of beacon buffers */
 
+#define ATH5K_TXQ_LEN_MAX       (ATH_TXBUF / 4)         /* bufs per queue */
+#define ATH5K_TXQ_LEN_LOW       (ATH5K_TXQ_LEN_MAX / 2) /* low mark */
+
 struct ath5k_buf {
         struct list_head        list;
         struct ath5k_desc       *desc;  /* virtual addr of desc */
@@ -83,6 +86,9 @@ struct ath5k_txq {
         struct list_head        q;      /* transmit queue */
         spinlock_t              lock;   /* lock on q and link */
         bool                    setup;
+        int                     txq_len; /* number of queued buffers */
+        bool                    txq_poll_mark;
+        unsigned int            txq_stuck;      /* informational counter */
 };
 
 #define ATH5K_LED_MAX_NAME_LEN 31
@@ -204,7 +210,6 @@ struct ath5k_softc {
         spinlock_t              txbuflock;
         unsigned int            txbuf_len;      /* buf count in txbuf list */
         struct ath5k_txq        txqs[AR5K_NUM_TX_QUEUES];       /* tx queues */
-        struct ath5k_txq        *txq;           /* main tx queue */
         struct tasklet_struct   txtq;           /* tx intr tasklet */
         struct ath5k_led        tx_led;         /* tx led */
 
@@ -230,6 +235,8 @@ struct ath5k_softc {
 
         struct ath5k_ani_state  ani_state;
         struct tasklet_struct   ani_tasklet;    /* ANI calibration */
+
+        struct delayed_work     tx_complete_work;
 };
 
 #define ath5k_hw_hasbssidmask(_ah) \
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 4cccc29964f6..6583a82a0783 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -312,6 +312,7 @@ static const struct {
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
         { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
         { ATH5K_DEBUG_ANI,      "ani",          "adaptive noise immunity" },
+        { ATH5K_DEBUG_DESC,     "desc",         "descriptor chains" },
         { ATH5K_DEBUG_ANY,      "all",          "show all debug levels" },
 };
 
@@ -762,7 +763,7 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
 
         struct ath5k_txq *txq;
         struct ath5k_buf *bf, *bf0;
-        int i, n = 0;
+        int i, n;
 
         len += snprintf(buf+len, sizeof(buf)-len,
                         "available txbuffers: %d\n", sc->txbuf_len);
@@ -776,9 +777,16 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
                 if (!txq->setup)
                         continue;
 
+                n = 0;
+                spin_lock_bh(&txq->lock);
                 list_for_each_entry_safe(bf, bf0, &txq->q, list)
                         n++;
-                len += snprintf(buf+len, sizeof(buf)-len, "  len: %d\n", n);
+                spin_unlock_bh(&txq->lock);
+
+                len += snprintf(buf+len, sizeof(buf)-len,
+                                "  len: %d bufs: %d\n", txq->txq_len, n);
+                len += snprintf(buf+len, sizeof(buf)-len,
+                                "  stuck: %d\n", txq->txq_stuck);
         }
 
         if (len > sizeof(buf))
@@ -955,7 +963,7 @@ ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah)
         struct ath5k_rx_status rs = {};
         int status;
 
-        if (likely(!(sc->debug.level & ATH5K_DEBUG_RESET)))
+        if (likely(!(sc->debug.level & ATH5K_DEBUG_DESC)))
                 return;
 
         printk(KERN_DEBUG "rxdp %x, rxlink %p\n",
@@ -997,7 +1005,7 @@ ath5k_debug_printtxbuf(struct ath5k_softc *sc, struct ath5k_buf *bf)
         struct ath5k_tx_status ts = {};
         int done;
 
-        if (likely(!(sc->debug.level & ATH5K_DEBUG_RESET)))
+        if (likely(!(sc->debug.level & ATH5K_DEBUG_DESC)))
                 return;
 
         done = sc->ah->ah_proc_tx_desc(sc->ah, bf->desc, &ts);
diff --git a/drivers/net/wireless/ath/ath5k/debug.h b/drivers/net/wireless/ath/ath5k/debug.h
index 606ae94a9157..9b22722a95f0 100644
--- a/drivers/net/wireless/ath/ath5k/debug.h
+++ b/drivers/net/wireless/ath/ath5k/debug.h
@@ -95,6 +95,7 @@ struct ath5k_dbg_info {
  * @ATH5K_DEBUG_DUMP_TX: print transmit skb content
  * @ATH5K_DEBUG_DUMPBANDS: dump bands
  * @ATH5K_DEBUG_TRACE: trace function calls
+ * @ATH5K_DEBUG_DESC: descriptor setup
  * @ATH5K_DEBUG_ANY: show at any debug level
  *
  * The debug level is used to control the amount and type of debugging output
@@ -117,6 +118,7 @@ enum ath5k_debug_level {
         ATH5K_DEBUG_DUMP_TX     = 0x00000200,
         ATH5K_DEBUG_DUMPBANDS   = 0x00000400,
         ATH5K_DEBUG_ANI         = 0x00002000,
+        ATH5K_DEBUG_DESC        = 0x00004000,
         ATH5K_DEBUG_ANY         = 0xffffffff
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 484f31870ba8..58bb6c5dda7b 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -377,11 +377,11 @@ int ath5k_hw_set_txdp(struct ath5k_hw *ah, unsigned int queue, u32 phys_addr)
  *
  * This function increases/decreases the tx trigger level for the tx fifo
  * buffer (aka FIFO threshold) that is used to indicate when PCU flushes
- * the buffer and transmits it's data. Lowering this results sending small
+ * the buffer and transmits its data. Lowering this results sending small
  * frames more quickly but can lead to tx underruns, raising it a lot can
  * result other problems (i think bmiss is related). Right now we start with
  * the lowest possible (64Bytes) and if we get tx underrun we increase it using
- * the increase flag. Returns -EIO if we have have reached maximum/minimum.
+ * the increase flag. Returns -EIO if we have reached maximum/minimum.
  *
  * XXX: Link this with tx DMA size ?
  * XXX: Use it to save interrupts ?
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index ae316fec4a6a..39722dd73e43 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -661,7 +661,7 @@ ath5k_eeprom_init_11bg_2413(struct ath5k_hw *ah, unsigned int mode, int offset)
  * (eeprom versions < 4). For RF5111 we have 11 pre-defined PCDAC
  * steps that match with the power values we read from eeprom. On
  * older eeprom versions (< 3.2) these steps are equaly spaced at
- * 10% of the pcdac curve -until the curve reaches it's maximum-
+ * 10% of the pcdac curve -until the curve reaches its maximum-
  * (11 steps from 0 to 100%) but on newer eeprom versions (>= 3.2)
  * these 11 steps are spaced in a different way. This function returns
  * the pcdac steps based on eeprom version and curve min/max so that we
@@ -1113,7 +1113,7 @@ ath5k_eeprom_read_pcal_info_5112(struct ath5k_hw *ah, int mode)
  */
 
 /* For RF2413 power calibration data doesn't start on a fixed location and
- * if a mode is not supported, it's section is missing -not zeroed-.
+ * if a mode is not supported, its section is missing -not zeroed-.
  * So we need to calculate the starting offset for each section by using
  * these two functions */
 
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 86fdb6ddfaaa..6a891c4484a0 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -137,11 +137,11 @@ void ath5k_hw_update_mib_counters(struct ath5k_hw *ah)
  * ath5k_hw_set_ack_bitrate - set bitrate for ACKs
  *
  * @ah: The &struct ath5k_hw
- * @high: Flag to determine if we want to use high transmition rate
+ * @high: Flag to determine if we want to use high transmission rate
  * for ACKs or not
  *
  * If high flag is set, we tell hw to use a set of control rates based on
- * the current transmition rate (check out control_rates array inside reset.c).
+ * the current transmission rate (check out control_rates array inside reset.c).
  * If not hw just uses the lowest rate available for the current modulation
  * scheme being used (1Mbit for CCK and 6Mbits for OFDM).
  */
@@ -308,27 +308,26 @@ int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac)
 }
 
 /**
- * ath5k_hw_set_associd - Set BSSID for association
+ * ath5k_hw_set_bssid - Set current BSSID on hw
  *
  * @ah: The &struct ath5k_hw
- * @bssid: BSSID
- * @assoc_id: Assoc id
  *
- * Sets the BSSID which trigers the "SME Join" operation
+ * Sets the current BSSID and BSSID mask we have from the
+ * common struct into the hardware
  */
-void ath5k_hw_set_associd(struct ath5k_hw *ah)
+void ath5k_hw_set_bssid(struct ath5k_hw *ah)
 {
         struct ath_common *common = ath5k_hw_common(ah);
         u16 tim_offset = 0;
 
         /*
-         * Set simple BSSID mask on 5212
+         * Set BSSID mask on 5212
          */
         if (ah->ah_version == AR5K_AR5212)
                 ath_hw_setbssidmask(common);
 
         /*
-         * Set BSSID which triggers the "SME Join" operation
+         * Set BSSID
          */
         ath5k_hw_reg_write(ah,
                            get_unaligned_le32(common->curbssid),
@@ -641,200 +640,6 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
 
 }
 
-
-/*********************\
-* Key table functions *
-\*********************/
-
-/*
- * Reset a key entry on the table
- */
-int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
-{
-        unsigned int i, type;
-        u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
-
-        AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
-
-        type = ath5k_hw_reg_read(ah, AR5K_KEYTABLE_TYPE(entry));
-
-        for (i = 0; i < AR5K_KEYCACHE_SIZE; i++)
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_OFF(entry, i));
-
-        /* Reset associated MIC entry if TKIP
-         * is enabled located at offset (entry + 64) */
-        if (type == AR5K_KEYTABLE_TYPE_TKIP) {
-                AR5K_ASSERT_ENTRY(micentry, AR5K_KEYTABLE_SIZE);
-                for (i = 0; i < AR5K_KEYCACHE_SIZE / 2 ; i++)
-                        ath5k_hw_reg_write(ah, 0,
-                                AR5K_KEYTABLE_OFF(micentry, i));
-        }
-
-        /*
-         * Set NULL encryption on AR5212+
-         *
-         * Note: AR5K_KEYTABLE_TYPE -> AR5K_KEYTABLE_OFF(entry, 5)
-         *       AR5K_KEYTABLE_TYPE_NULL -> 0x00000007
-         *
-         * Note2: Windows driver (ndiswrapper) sets this to
-         *        0x00000714 instead of 0x00000007
-         */
-        if (ah->ah_version >= AR5K_AR5211) {
-                ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                                AR5K_KEYTABLE_TYPE(entry));
-
-                if (type == AR5K_KEYTABLE_TYPE_TKIP) {
-                        ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                                AR5K_KEYTABLE_TYPE(micentry));
-                }
-        }
-
-        return 0;
-}
-
-static
-int ath5k_keycache_type(const struct ieee80211_key_conf *key)
-{
-        switch (key->alg) {
-        case ALG_TKIP:
-                return AR5K_KEYTABLE_TYPE_TKIP;
-        case ALG_CCMP:
-                return AR5K_KEYTABLE_TYPE_CCM;
-        case ALG_WEP:
-                if (key->keylen == WLAN_KEY_LEN_WEP40)
-                        return AR5K_KEYTABLE_TYPE_40;
-                else if (key->keylen == WLAN_KEY_LEN_WEP104)
-                        return AR5K_KEYTABLE_TYPE_104;
-                return -EINVAL;
-        default:
-                return -EINVAL;
-        }
-        return -EINVAL;
-}
-
-/*
- * Set a key entry on the table
- */
-int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
-                const struct ieee80211_key_conf *key, const u8 *mac)
-{
-        unsigned int i;
-        int keylen;
-        __le32 key_v[5] = {};
-        __le32 key0 = 0, key1 = 0;
-        __le32 *rxmic, *txmic;
-        int keytype;
-        u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
-        bool is_tkip;
-        const u8 *key_ptr;
-
-        is_tkip = (key->alg == ALG_TKIP);
-
-        /*
-         * key->keylen comes in from mac80211 in bytes.
-         * TKIP is 128 bit + 128 bit mic
-         */
-        keylen = (is_tkip) ? (128 / 8) : key->keylen;
-
-        if (entry > AR5K_KEYTABLE_SIZE ||
-                (is_tkip && micentry > AR5K_KEYTABLE_SIZE))
-                return -EOPNOTSUPP;
-
-        if (unlikely(keylen > 16))
-                return -EOPNOTSUPP;
-
-        keytype = ath5k_keycache_type(key);
-        if (keytype < 0)
-                return keytype;
-
-        /*
-         * each key block is 6 bytes wide, written as pairs of
-         * alternating 32 and 16 bit le values.
-         */
-        key_ptr = key->key;
-        for (i = 0; keylen >= 6; keylen -= 6) {
-                memcpy(&key_v[i], key_ptr, 6);
-                i += 2;
-                key_ptr += 6;
-        }
-        if (keylen)
-                memcpy(&key_v[i], key_ptr, keylen);
-
-        /* intentionally corrupt key until mic is installed */
-        if (is_tkip) {
-                key0 = key_v[0] = ~key_v[0];
-                key1 = key_v[1] = ~key_v[1];
-        }
-
-        for (i = 0; i < ARRAY_SIZE(key_v); i++)
-                ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
-                                AR5K_KEYTABLE_OFF(entry, i));
-
-        ath5k_hw_reg_write(ah, keytype, AR5K_KEYTABLE_TYPE(entry));
-
-        if (is_tkip) {
-                /* Install rx/tx MIC */
-                rxmic = (__le32 *) &key->key[16];
-                txmic = (__le32 *) &key->key[24];
-
-                if (ah->ah_combined_mic) {
-                        key_v[0] = rxmic[0];
-                        key_v[1] = cpu_to_le32(le32_to_cpu(txmic[0]) >> 16);
-                        key_v[2] = rxmic[1];
-                        key_v[3] = cpu_to_le32(le32_to_cpu(txmic[0]) & 0xffff);
-                        key_v[4] = txmic[1];
-                } else {
-                        key_v[0] = rxmic[0];
-                        key_v[1] = 0;
-                        key_v[2] = rxmic[1];
-                        key_v[3] = 0;
-                        key_v[4] = 0;
-                }
-                for (i = 0; i < ARRAY_SIZE(key_v); i++)
-                        ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
-                                AR5K_KEYTABLE_OFF(micentry, i));
-
-                ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
-                        AR5K_KEYTABLE_TYPE(micentry));
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC0(micentry));
-                ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC1(micentry));
-
-                /* restore first 2 words of key */
-                ath5k_hw_reg_write(ah, le32_to_cpu(~key0),
-                        AR5K_KEYTABLE_OFF(entry, 0));
-                ath5k_hw_reg_write(ah, le32_to_cpu(~key1),
-                        AR5K_KEYTABLE_OFF(entry, 1));
-        }
-
-        return ath5k_hw_set_key_lladdr(ah, entry, mac);
-}
-
-int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
-{
-        u32 low_id, high_id;
-
-         /* Invalid entry (key table overflow) */
-        AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
-
-        /*
-         * MAC may be NULL if it's a broadcast key. In this case no need to
-         * to compute get_unaligned_le32 and get_unaligned_le16 as we
-         * already know it.
-         */
-        if (!mac) {
-                low_id = 0xffffffff;
-                high_id = 0xffff | AR5K_KEYTABLE_VALID;
-        } else {
-                low_id = get_unaligned_le32(mac);
-                high_id = get_unaligned_le16(mac + 4) | AR5K_KEYTABLE_VALID;
-        }
-
-        ath5k_hw_reg_write(ah, low_id, AR5K_KEYTABLE_MAC0(entry));
-        ath5k_hw_reg_write(ah, high_id, AR5K_KEYTABLE_MAC1(entry));
-
-        return 0;
-}
-
 /**
  * ath5k_hw_set_coverage_class - Set IEEE 802.11 coverage class
  *
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 6284c389ba18..4932bf2f35eb 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -115,7 +115,7 @@ static unsigned int ath5k_hw_rfb_op(struct ath5k_hw *ah,
 \**********************/
 
 /*
- * This code is used to optimize rf gain on different environments
+ * This code is used to optimize RF gain on different environments
  * (temperature mostly) based on feedback from a power detector.
  *
  * It's only used on RF5111 and RF5112, later RF chips seem to have
@@ -302,7 +302,7 @@ static bool ath5k_hw_rf_check_gainf_readback(struct ath5k_hw *ah)
 }
 
 /* Perform gain_F adjustment by choosing the right set
- * of parameters from rf gain optimization ladder */
+ * of parameters from RF gain optimization ladder */
 static s8 ath5k_hw_rf_gainf_adjust(struct ath5k_hw *ah)
 {
         const struct ath5k_gain_opt *go;
@@ -367,7 +367,7 @@ done:
         return ret;
 }
 
-/* Main callback for thermal rf gain calibration engine
+/* Main callback for thermal RF gain calibration engine
  * Check for a new gain reading and schedule an adjustment
  * if needed.
  *
@@ -433,7 +433,7 @@ done:
         return ah->ah_gain.g_state;
 }
 
-/* Write initial rf gain table to set the RF sensitivity
+/* Write initial RF gain table to set the RF sensitivity
  * this one works on all RF chips and has nothing to do
  * with gain_F calibration */
 int ath5k_hw_rfgain_init(struct ath5k_hw *ah, unsigned int freq)
@@ -496,7 +496,7 @@ int ath5k_hw_rfgain_init(struct ath5k_hw *ah, unsigned int freq)
 
 
 /*
- * Setup RF registers by writing rf buffer on hw
+ * Setup RF registers by writing RF buffer on hw
  */
 int ath5k_hw_rfregs_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 unsigned int mode)
@@ -571,7 +571,7 @@ int ath5k_hw_rfregs_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 return -EINVAL;
         }
 
-        /* If it's the first time we set rf buffer, allocate
+        /* If it's the first time we set RF buffer, allocate
          * ah->ah_rf_banks based on ah->ah_rf_banks_size
          * we set above */
         if (ah->ah_rf_banks == NULL) {
@@ -1377,7 +1377,7 @@ ath5k_hw_rf511x_iq_calibrate(struct ath5k_hw *ah)
 
         /* protect against divide by 0 and loss of sign bits */
         if (i_coffd == 0 || q_coffd < 2)
-                return -1;
+                return 0;
 
         i_coff = (-iq_corr) / i_coffd;
         i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
@@ -1582,7 +1582,7 @@ ath5k_hw_set_spur_mitigation_filter(struct ath5k_hw *ah,
                         else if (curr_sym_off >= 31 && curr_sym_off <= 46)
                                 mag_mask[2] |=
                                         plt_mag_map << (curr_sym_off - 31) * 2;
-                        else if (curr_sym_off >= 46 && curr_sym_off <= 53)
+                        else if (curr_sym_off >= 47 && curr_sym_off <= 53)
                                 mag_mask[3] |=
                                         plt_mag_map << (curr_sym_off - 47) * 2;
 
@@ -2987,7 +2987,7 @@ ath5k_setup_rate_powertable(struct ath5k_hw *ah, u16 max_pwr,
 
 
 /*
- * Set transmition power
+ * Set transmission power
  */
 int
 ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
@@ -3035,9 +3035,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
         /* Limit max power if we have a CTL available */
         ath5k_get_max_ctl_power(ah, channel);
 
-        /* FIXME: Tx power limit for this regdomain
-         * XXX: Mac80211/CRDA will do that anyway ? */
-
         /* FIXME: Antenna reduction stuff */
 
         /* FIXME: Limit power on turbo modes */
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 4186ff4c6e9c..84c717ded1c5 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -36,24 +36,58 @@ int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
 }
 
 /*
+ * Make sure cw is a power of 2 minus 1 and smaller than 1024
+ */
+static u16 ath5k_cw_validate(u16 cw_req)
+{
+        u32 cw = 1;
+        cw_req = min(cw_req, (u16)1023);
+
+        while (cw < cw_req)
+                cw = (cw << 1) | 1;
+
+        return cw;
+}
+
+/*
  * Set properties for a transmit queue
  */
 int ath5k_hw_set_tx_queueprops(struct ath5k_hw *ah, int queue,
-                                const struct ath5k_txq_info *queue_info)
+                                const struct ath5k_txq_info *qinfo)
 {
+        struct ath5k_txq_info *qi;
+
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
 
-        if (ah->ah_txq[queue].tqi_type == AR5K_TX_QUEUE_INACTIVE)
+        qi = &ah->ah_txq[queue];
+
+        if (qi->tqi_type == AR5K_TX_QUEUE_INACTIVE)
                 return -EIO;
 
-        memcpy(&ah->ah_txq[queue], queue_info, sizeof(struct ath5k_txq_info));
+        /* copy and validate values */
+        qi->tqi_type = qinfo->tqi_type;
+        qi->tqi_subtype = qinfo->tqi_subtype;
+        qi->tqi_flags = qinfo->tqi_flags;
+        /*
+         * According to the docs: Although the AIFS field is 8 bit wide,
+         * the maximum supported value is 0xFC. Setting it higher than that
+         * will cause the DCU to hang.
+         */
+        qi->tqi_aifs = min(qinfo->tqi_aifs, (u8)0xFC);
+        qi->tqi_cw_min = ath5k_cw_validate(qinfo->tqi_cw_min);
+        qi->tqi_cw_max = ath5k_cw_validate(qinfo->tqi_cw_max);
+        qi->tqi_cbr_period = qinfo->tqi_cbr_period;
+        qi->tqi_cbr_overflow_limit = qinfo->tqi_cbr_overflow_limit;
+        qi->tqi_burst_time = qinfo->tqi_burst_time;
+        qi->tqi_ready_time = qinfo->tqi_ready_time;
 
         /*XXX: Is this supported on 5210 ?*/
-        if ((queue_info->tqi_type == AR5K_TX_QUEUE_DATA &&
-                        ((queue_info->tqi_subtype == AR5K_WME_AC_VI) ||
-                        (queue_info->tqi_subtype == AR5K_WME_AC_VO))) ||
-                        queue_info->tqi_type == AR5K_TX_QUEUE_UAPSD)
-                ah->ah_txq[queue].tqi_flags |= AR5K_TXQ_FLAG_POST_FR_BKOFF_DIS;
+        /*XXX: Is this correct for AR5K_WME_AC_VI,VO ???*/
+        if ((qinfo->tqi_type == AR5K_TX_QUEUE_DATA &&
+                ((qinfo->tqi_subtype == AR5K_WME_AC_VI) ||
+                 (qinfo->tqi_subtype == AR5K_WME_AC_VO))) ||
+             qinfo->tqi_type == AR5K_TX_QUEUE_UAPSD)
+                qi->tqi_flags |= AR5K_TXQ_FLAG_POST_FR_BKOFF_DIS;
 
         return 0;
 }
@@ -186,7 +220,7 @@ void ath5k_hw_release_tx_queue(struct ath5k_hw *ah, unsigned int queue)
  */
 int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
 {
-        u32 cw_min, cw_max, retry_lg, retry_sh;
+        u32 retry_lg, retry_sh;
         struct ath5k_txq_info *tq = &ah->ah_txq[queue];
 
         AR5K_ASSERT_ENTRY(queue, ah->ah_capabilities.cap_queues.q_tx_num);
@@ -217,14 +251,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
                 /* Set IFS0 */
                 if (ah->ah_turbo) {
                          ath5k_hw_reg_write(ah, ((AR5K_INIT_SIFS_TURBO +
-                                (ah->ah_aifs + tq->tqi_aifs) *
-                                AR5K_INIT_SLOT_TIME_TURBO) <<
+                                tq->tqi_aifs * AR5K_INIT_SLOT_TIME_TURBO) <<
                                 AR5K_IFS0_DIFS_S) | AR5K_INIT_SIFS_TURBO,
                                 AR5K_IFS0);
                 } else {
                         ath5k_hw_reg_write(ah, ((AR5K_INIT_SIFS +
-                                (ah->ah_aifs + tq->tqi_aifs) *
-                                AR5K_INIT_SLOT_TIME) << AR5K_IFS0_DIFS_S) |
+                                tq->tqi_aifs * AR5K_INIT_SLOT_TIME) <<
+                                AR5K_IFS0_DIFS_S) |
                                 AR5K_INIT_SIFS, AR5K_IFS0);
                 }
 
@@ -248,35 +281,6 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         }
 
         /*
-         * Calculate cwmin/max by channel mode
-         */
-        cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN;
-        cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX;
-        ah->ah_aifs = AR5K_TUNE_AIFS;
-        /*XR is only supported on 5212*/
-        if (IS_CHAN_XR(ah->ah_current_channel) &&
-                        ah->ah_version == AR5K_AR5212) {
-                cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN_XR;
-                cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX_XR;
-                ah->ah_aifs = AR5K_TUNE_AIFS_XR;
-        /*B mode is not supported on 5210*/
-        } else if (IS_CHAN_B(ah->ah_current_channel) &&
-                        ah->ah_version != AR5K_AR5210) {
-                cw_min = ah->ah_cw_min = AR5K_TUNE_CWMIN_11B;
-                cw_max = ah->ah_cw_max = AR5K_TUNE_CWMAX_11B;
-                ah->ah_aifs = AR5K_TUNE_AIFS_11B;
-        }
-
-        cw_min = 1;
-        while (cw_min < ah->ah_cw_min)
-                cw_min = (cw_min << 1) | 1;
-
-        cw_min = tq->tqi_cw_min < 0 ? (cw_min >> (-tq->tqi_cw_min)) :
-                ((cw_min << tq->tqi_cw_min) + (1 << tq->tqi_cw_min) - 1);
-        cw_max = tq->tqi_cw_max < 0 ? (cw_max >> (-tq->tqi_cw_max)) :
-                ((cw_max << tq->tqi_cw_max) + (1 << tq->tqi_cw_max) - 1);
-
-        /*
          * Calculate and set retry limits
          */
         if (ah->ah_software_retry) {
@@ -292,7 +296,7 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         /*No QCU/DCU [5210]*/
         if (ah->ah_version == AR5K_AR5210) {
                 ath5k_hw_reg_write(ah,
-                        (cw_min << AR5K_NODCU_RETRY_LMT_CW_MIN_S)
+                        (tq->tqi_cw_min << AR5K_NODCU_RETRY_LMT_CW_MIN_S)
                         | AR5K_REG_SM(AR5K_INIT_SLG_RETRY,
                                 AR5K_NODCU_RETRY_LMT_SLG_RETRY)
                         | AR5K_REG_SM(AR5K_INIT_SSH_RETRY,
@@ -314,14 +318,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
         /*===Rest is also for QCU/DCU only [5211+]===*/
 
                 /*
-                 * Set initial content window (cw_min/cw_max)
+                 * Set contention window (cw_min/cw_max)
                  * and arbitrated interframe space (aifs)...
                  */
                 ath5k_hw_reg_write(ah,
-                        AR5K_REG_SM(cw_min, AR5K_DCU_LCL_IFS_CW_MIN) |
-                        AR5K_REG_SM(cw_max, AR5K_DCU_LCL_IFS_CW_MAX) |
-                        AR5K_REG_SM(ah->ah_aifs + tq->tqi_aifs,
-                                AR5K_DCU_LCL_IFS_AIFS),
+                        AR5K_REG_SM(tq->tqi_cw_min, AR5K_DCU_LCL_IFS_CW_MIN) |
+                        AR5K_REG_SM(tq->tqi_cw_max, AR5K_DCU_LCL_IFS_CW_MAX) |
+                        AR5K_REG_SM(tq->tqi_aifs, AR5K_DCU_LCL_IFS_AIFS),
                         AR5K_QUEUE_DFS_LOCAL_IFS(queue));
 
                 /*
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 55b4ac6d236f..67d63081705a 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -1822,50 +1822,8 @@
 
 /*===5212 end===*/
 
-/*
- * Key table (WEP) register
- */
-#define AR5K_KEYTABLE_0_5210            0x9000
-#define AR5K_KEYTABLE_0_5211            0x8800
-#define AR5K_KEYTABLE_5210(_n)          (AR5K_KEYTABLE_0_5210 + ((_n) << 5))
-#define AR5K_KEYTABLE_5211(_n)          (AR5K_KEYTABLE_0_5211 + ((_n) << 5))
-#define AR5K_KEYTABLE(_n)               (ah->ah_version == AR5K_AR5210 ? \
-                                        AR5K_KEYTABLE_5210(_n) : AR5K_KEYTABLE_5211(_n))
-#define AR5K_KEYTABLE_OFF(_n, x)        (AR5K_KEYTABLE(_n) + (x << 2))
-#define AR5K_KEYTABLE_TYPE(_n)          AR5K_KEYTABLE_OFF(_n, 5)
-#define AR5K_KEYTABLE_TYPE_40           0x00000000
-#define AR5K_KEYTABLE_TYPE_104          0x00000001
-#define AR5K_KEYTABLE_TYPE_128          0x00000003
-#define AR5K_KEYTABLE_TYPE_TKIP         0x00000004      /* [5212+] */
-#define AR5K_KEYTABLE_TYPE_AES          0x00000005      /* [5211+] */
-#define AR5K_KEYTABLE_TYPE_CCM          0x00000006      /* [5212+] */
-#define AR5K_KEYTABLE_TYPE_NULL         0x00000007      /* [5211+] */
-#define AR5K_KEYTABLE_ANTENNA           0x00000008      /* [5212+] */
-#define AR5K_KEYTABLE_MAC0(_n)          AR5K_KEYTABLE_OFF(_n, 6)
-#define AR5K_KEYTABLE_MAC1(_n)          AR5K_KEYTABLE_OFF(_n, 7)
-#define AR5K_KEYTABLE_VALID             0x00008000
-
-/* If key type is TKIP and MIC is enabled
- * MIC key goes in offset entry + 64 */
-#define AR5K_KEYTABLE_MIC_OFFSET        64
-
-/* WEP 40-bit   = 40-bit  entered key + 24 bit IV = 64-bit
- * WEP 104-bit  = 104-bit entered key + 24-bit IV = 128-bit
- * WEP 128-bit  = 128-bit entered key + 24 bit IV = 152-bit
- *
- * Some vendors have introduced bigger WEP keys to address
- * security vulnerabilities in WEP. This includes:
- *
- * WEP 232-bit = 232-bit entered key + 24 bit IV = 256-bit
- *
- * We can expand this if we find ar5k Atheros cards with a larger
- * key table size.
- */
 #define AR5K_KEYTABLE_SIZE_5210         64
 #define AR5K_KEYTABLE_SIZE_5211         128
-#define AR5K_KEYTABLE_SIZE              (ah->ah_version == AR5K_AR5210 ? \
-                                        AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211)
-
 
 /*===PHY REGISTERS===*/
 
@@ -1911,7 +1869,7 @@
 #define AR5K_PHY_TURBO                  0x9804                  /* Register Address */
 #define AR5K_PHY_TURBO_MODE             0x00000001      /* Enable turbo mode */
 #define AR5K_PHY_TURBO_SHORT            0x00000002      /* Set short symbols to turbo mode */
-#define AR5K_PHY_TURBO_MIMO             0x00000004      /* Set turbo for mimo mimo */
+#define AR5K_PHY_TURBO_MIMO             0x00000004      /* Set turbo for mimo */
 
 /*
  * PHY agility command register
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 498aa28ea9e6..58912cd762d9 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -326,7 +326,7 @@ commit:
  * register). After this MAC and Baseband are
  * disabled and a full reset is needed to come
  * back. This way we save as much power as possible
- * without puting the card on full sleep.
+ * without putting the card on full sleep.
  */
 int ath5k_hw_on_hold(struct ath5k_hw *ah)
 {
@@ -344,7 +344,7 @@ int ath5k_hw_on_hold(struct ath5k_hw *ah)
         /*
          * Put chipset on warm reset...
          *
-         * Note: puting PCI core on warm reset on PCI-E cards
+         * Note: putting PCI core on warm reset on PCI-E cards
          * results card to hang and always return 0xffff... so
          * we ingore that flag for PCI-E cards. On PCI cards
          * this flag gets cleared after 64 PCI clocks.
@@ -400,7 +400,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
         /*
          * Put chipset on warm reset...
          *
-         * Note: puting PCI core on warm reset on PCI-E cards
+         * Note: putting PCI core on warm reset on PCI-E cards
          * results card to hang and always return 0xffff... so
          * we ingore that flag for PCI-E cards. On PCI cards
          * this flag gets cleared after 64 PCI clocks.
@@ -959,7 +959,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                                                 AR5K_QUEUE_DCU_SEQNUM(0));
                         }
 
-                        /* TSF accelerates on AR5211 durring reset
+                        /* TSF accelerates on AR5211 during reset
                          * As a workaround save it here and restore
                          * it later so that it's back in time after
                          * reset. This way it'll get re-synced on the
@@ -1080,7 +1080,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                                 return ret;
 
                         /* Spur info is available only from EEPROM versions
-                         * bigger than 5.3 but but the EEPOM routines will use
+                         * greater than 5.3, but the EEPROM routines will use
                          * static values for older versions */
                         if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
                                 ath5k_hw_set_spur_mitigation_filter(ah,
@@ -1160,7 +1160,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          */
 
         /* Restore bssid and bssid mask */
-        ath5k_hw_set_associd(ah);
+        ath5k_hw_set_bssid(ah);
 
         /* Set PCU config */
         ath5k_hw_set_opmode(ah, op_mode);
@@ -1173,11 +1173,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         /* Set RSSI/BRSSI thresholds
          *
          * Note: If we decide to set this value
-         * dynamicaly, have in mind that when AR5K_RSSI_THR
-         * register is read it might return 0x40 if we haven't
-         * wrote anything to it plus BMISS RSSI threshold is zeroed.
+         * dynamically, keep in mind that when AR5K_RSSI_THR
+         * register is read, it might return 0x40 if we haven't
+         * written anything to it.  Also, BMISS RSSI threshold is zeroed.
          * So doing a save/restore procedure here isn't the right
-         * choice. Instead store it on ath5k_hw */
+         * choice. Instead, store it in ath5k_hw */
         ath5k_hw_reg_write(ah, (AR5K_TUNE_RSSI_THRES |
                                 AR5K_TUNE_BMISS_THRES <<
                                 AR5K_RSSI_THR_BMISS_S),
@@ -1235,7 +1235,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
 
         /*
          * Perform ADC test to see if baseband is ready
-         * Set tx hold and check adc test register
+         * Set TX hold and check ADC test register
          */
         phy_tst1 = ath5k_hw_reg_read(ah, AR5K_PHY_TST1);
         ath5k_hw_reg_write(ah, AR5K_PHY_TST1_TXHOLD, AR5K_PHY_TST1);
@@ -1254,15 +1254,15 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          *
          * This method is used to calibrate some static offsets
          * used together with on-the fly I/Q calibration (the
-         * one performed via ath5k_hw_phy_calibrate), that doesn't
+         * one performed via ath5k_hw_phy_calibrate), which doesn't
          * interrupt rx path.
          *
          * While rx path is re-routed to the power detector we also
-         * start a noise floor calibration, to measure the
+         * start a noise floor calibration to measure the
          * card's noise floor (the noise we measure when we are not
-         * transmiting or receiving anything).
+         * transmitting or receiving anything).
          *
-         * If we are in a noisy environment AGC calibration may time
+         * If we are in a noisy environment, AGC calibration may time
          * out and/or noise floor calibration might timeout.
          */
         AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
diff --git a/drivers/net/wireless/ath/ath5k/rfbuffer.h b/drivers/net/wireless/ath/ath5k/rfbuffer.h
index e50baff66175..3ac4cff4239d 100644
--- a/drivers/net/wireless/ath/ath5k/rfbuffer.h
+++ b/drivers/net/wireless/ath/ath5k/rfbuffer.h
@@ -25,10 +25,10 @@
  *
  * We don't write on those registers directly but
  * we send a data packet on the chip, using a special register,
- * that holds all the settings we need. After we 've sent the
+ * that holds all the settings we need. After we've sent the
  * data packet, we write on another special register to notify hw
  * to apply the settings. This is done so that control registers
- * can be dynamicaly programmed during operation and the settings
+ * can be dynamically programmed during operation and the settings
  * are applied faster on the hw.
  *
  * We call each data packet an "RF Bank" and all the data we write
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 35f23bdc442f..ad57a6d23110 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -32,6 +32,14 @@ config ATH9K_DEBUGFS
 
           Also required for changing debug message flags at run time.
 
+config ATH9K_RATE_CONTROL
+        bool "Atheros ath9k rate control"
+        depends on ATH9K
+        default y
+        ---help---
+          Say Y, if you want to use the ath9k specific rate control
+          module instead of minstrel_ht.
+
 config ATH9K_HTC
        tristate "Atheros HTC based wireless cards support"
        depends on USB && MAC80211
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 973ae4f49f35..aca01621c205 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -5,8 +5,8 @@ ath9k-y +=	beacon.o \
                 recv.o \
                 xmit.o \
                 virtual.o \
-                rc.o
 
+ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o
 ath9k-$(CONFIG_PCI) += pci.o
 ath9k-$(CONFIG_ATHEROS_AR71XX) += ahb.o
 ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
@@ -46,6 +46,7 @@ ath9k_htc-y +=	htc_hst.o \
                 htc_drv_txrx.o \
                 htc_drv_main.o \
                 htc_drv_beacon.o \
-                htc_drv_init.o
+                htc_drv_init.o \
+                htc_drv_gpio.o
 
 obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..0496f965314f 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -14,6 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/kernel.h>
 #include "hw.h"
 #include "hw-ops.h"
 
@@ -48,7 +49,7 @@ static const struct ani_ofdm_level_entry ofdm_level_table[] = {
         {  7,  8,  0  }  /* lvl 9 */
 };
 #define ATH9K_ANI_OFDM_NUM_LEVEL \
-        (sizeof(ofdm_level_table)/sizeof(ofdm_level_table[0]))
+        ARRAY_SIZE(ofdm_level_table)
 #define ATH9K_ANI_OFDM_MAX_LEVEL \
         (ATH9K_ANI_OFDM_NUM_LEVEL-1)
 #define ATH9K_ANI_OFDM_DEF_LEVEL \
@@ -94,7 +95,7 @@ static const struct ani_cck_level_entry cck_level_table[] = {
 };
 
 #define ATH9K_ANI_CCK_NUM_LEVEL \
-        (sizeof(cck_level_table)/sizeof(cck_level_table[0]))
+        ARRAY_SIZE(cck_level_table)
 #define ATH9K_ANI_CCK_MAX_LEVEL \
         (ATH9K_ANI_CCK_NUM_LEVEL-1)
 #define ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI \
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 303c63da5ea3..94392daebaa0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -580,3 +580,53 @@ void ar9002_hw_attach_ops(struct ath_hw *ah)
         else
                 ath9k_hw_attach_ani_ops_old(ah);
 }
+
+void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        u32 modesIndex;
+        int i;
+
+        switch (chan->chanmode) {
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+                modesIndex = 1;
+                break;
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                modesIndex = 2;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_B:
+                modesIndex = 4;
+                break;
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                modesIndex = 3;
+                break;
+
+        default:
+                return;
+        }
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        for (i = 0; i < ah->iniModes_9271_ANI_reg.ia_rows; i++) {
+                u32 reg = INI_RA(&ah->iniModes_9271_ANI_reg, i, 0);
+                u32 val = INI_RA(&ah->iniModes_9271_ANI_reg, i, modesIndex);
+                u32 val_orig;
+
+                if (reg == AR_PHY_CCK_DETECT) {
+                        val_orig = REG_READ(ah, reg);
+                        val &= AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK;
+                        val_orig &= ~AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK;
+
+                        REG_WRITE(ah, reg, val|val_orig);
+                } else
+                        REG_WRITE(ah, reg, val);
+        }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index adbf031fbc5a..cd56c8692705 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -530,3 +530,38 @@ void ar9002_hw_attach_phy_ops(struct ath_hw *ah)
 
         ar9002_hw_set_nf_limits(ah);
 }
+
+void ath9k_hw_antdiv_comb_conf_get(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf)
+{
+        u32 regval;
+
+        regval = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+        antconf->main_lna_conf = (regval & AR_PHY_9285_ANT_DIV_MAIN_LNACONF) >>
+                                  AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S;
+        antconf->alt_lna_conf = (regval & AR_PHY_9285_ANT_DIV_ALT_LNACONF) >>
+                                 AR_PHY_9285_ANT_DIV_ALT_LNACONF_S;
+        antconf->fast_div_bias = (regval & AR_PHY_9285_FAST_DIV_BIAS) >>
+                                  AR_PHY_9285_FAST_DIV_BIAS_S;
+}
+EXPORT_SYMBOL(ath9k_hw_antdiv_comb_conf_get);
+
+void ath9k_hw_antdiv_comb_conf_set(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf)
+{
+        u32 regval;
+
+        regval = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+        regval &= ~(AR_PHY_9285_ANT_DIV_MAIN_LNACONF |
+                    AR_PHY_9285_ANT_DIV_ALT_LNACONF |
+                    AR_PHY_9285_FAST_DIV_BIAS);
+        regval |= ((antconf->main_lna_conf << AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S)
+                   & AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+        regval |= ((antconf->alt_lna_conf << AR_PHY_9285_ANT_DIV_ALT_LNACONF_S)
+                   & AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+        regval |= ((antconf->fast_div_bias << AR_PHY_9285_FAST_DIV_BIAS_S)
+                   & AR_PHY_9285_FAST_DIV_BIAS);
+
+        REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regval);
+}
+EXPORT_SYMBOL(ath9k_hw_antdiv_comb_conf_set);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.h b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
index c5151a4dd10b..37663dbbcf57 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
@@ -302,6 +302,8 @@
 #define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
 
 #define AR_PHY_MULTICHAIN_GAIN_CTL          0x99ac
+#define AR_PHY_9285_FAST_DIV_BIAS           0x00007E00
+#define AR_PHY_9285_FAST_DIV_BIAS_S         9
 #define AR_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
 #define AR_PHY_9285_ANT_DIV_CTL             0x01000000
 #define AR_PHY_9285_ANT_DIV_CTL_S           24
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 057fb69ddf7f..c4182359bee4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -968,7 +968,7 @@ static int ath9k_hw_ar9300_get_eeprom_rev(struct ath_hw *ah)
 }
 
 static u8 ath9k_hw_ar9300_get_num_ant_config(struct ath_hw *ah,
-                                             enum ieee80211_band freq_band)
+                                             enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 5b995bee70ae..3b424ca1ba84 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -185,7 +185,7 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                         ath_print(common, ATH_DBG_INTERRUPT,
                                   "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
 
-                        REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
+                REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
                 (void) REG_READ(ah, AR_INTR_SYNC_CAUSE_CLR);
 
         }
@@ -616,7 +616,8 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
                         rxs->rs_status |= ATH9K_RXERR_DECRYPT;
                 } else if (rxsp->status11 & AR_MichaelErr) {
                         rxs->rs_status |= ATH9K_RXERR_MIC;
-                }
+                } else if (rxsp->status11 & AR_KeyMiss)
+                        rxs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 07f26ee7a723..9f8e542ef47e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -254,7 +254,7 @@ struct ath_atx_tid {
         struct list_head buf_q;
         struct ath_node *an;
         struct ath_atx_ac *ac;
-        struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
+        unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
         u16 seq_start;
         u16 seq_next;
         u16 baw_size;
@@ -345,9 +345,8 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
-bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno);
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn);
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath9k_enable_ps(struct ath_softc *sc);
@@ -423,6 +422,7 @@ int ath_beaconq_config(struct ath_softc *sc);
 #define ATH_AP_SHORT_CALINTERVAL  100     /* 100 ms */
 #define ATH_ANI_POLLINTERVAL_OLD  100     /* 100 ms */
 #define ATH_ANI_POLLINTERVAL_NEW  1000    /* 1000 ms */
+#define ATH_LONG_CALINTERVAL_INT  1000    /* 1000 ms */
 #define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
@@ -436,14 +436,6 @@ void ath_ani_calibrate(unsigned long data);
 /* BTCOEX */
 /**********/
 
-/* Defines the BT AR_BT_COEX_WGHT used */
-enum ath_stomp_type {
-        ATH_BTCOEX_NO_STOMP,
-        ATH_BTCOEX_STOMP_ALL,
-        ATH_BTCOEX_STOMP_LOW,
-        ATH_BTCOEX_STOMP_NONE
-};
-
 struct ath_btcoex {
         bool hw_timer_enabled;
         spinlock_t btcoex_lock;
@@ -488,6 +480,60 @@ struct ath_led {
 void ath_init_leds(struct ath_softc *sc);
 void ath_deinit_leds(struct ath_softc *sc);
 
+/* Antenna diversity/combining */
+#define ATH_ANT_RX_CURRENT_SHIFT 4
+#define ATH_ANT_RX_MAIN_SHIFT 2
+#define ATH_ANT_RX_MASK 0x3
+
+#define ATH_ANT_DIV_COMB_SHORT_SCAN_INTR 50
+#define ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT 0x100
+#define ATH_ANT_DIV_COMB_MAX_PKTCOUNT 0x200
+#define ATH_ANT_DIV_COMB_INIT_COUNT 95
+#define ATH_ANT_DIV_COMB_MAX_COUNT 100
+#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO 30
+#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2 20
+
+#define ATH_ANT_DIV_COMB_LNA1_LNA2_DELTA -3
+#define ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA -1
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_HI -4
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_MID -2
+#define ATH_ANT_DIV_COMB_LNA1_DELTA_LOW 2
+
+enum ath9k_ant_div_comb_lna_conf {
+        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2,
+        ATH_ANT_DIV_COMB_LNA2,
+        ATH_ANT_DIV_COMB_LNA1,
+        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2,
+};
+
+struct ath_ant_comb {
+        u16 count;
+        u16 total_pkt_count;
+        bool scan;
+        bool scan_not_start;
+        int main_total_rssi;
+        int alt_total_rssi;
+        int alt_recv_cnt;
+        int main_recv_cnt;
+        int rssi_lna1;
+        int rssi_lna2;
+        int rssi_add;
+        int rssi_sub;
+        int rssi_first;
+        int rssi_second;
+        int rssi_third;
+        bool alt_good;
+        int quick_scan_cnt;
+        int main_conf;
+        enum ath9k_ant_div_comb_lna_conf first_quick_scan_conf;
+        enum ath9k_ant_div_comb_lna_conf second_quick_scan_conf;
+        int first_bias;
+        int second_bias;
+        bool first_ratio;
+        bool second_ratio;
+        unsigned long scan_start_time;
+};
+
 /********************/
 /* Main driver core */
 /********************/
@@ -516,7 +562,6 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_RXFLUSH                BIT(7)
 #define SC_OP_LED_ASSOCIATED         BIT(8)
 #define SC_OP_LED_ON                 BIT(9)
-#define SC_OP_SCANNING               BIT(10)
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
@@ -604,6 +649,8 @@ struct ath_softc {
         struct ath_btcoex btcoex;
 
         struct ath_descdma txsdma;
+
+        struct ath_ant_comb ant_comb;
 };
 
 struct ath_wiphy {
@@ -670,7 +717,7 @@ static inline void ath_ahb_exit(void) {};
 void ath9k_ps_wakeup(struct ath_softc *sc);
 void ath9k_ps_restore(struct ath_softc *sc);
 
-void ath9k_set_bssid_mask(struct ieee80211_hw *hw);
+void ath9k_set_bssid_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 int ath9k_wiphy_add(struct ath_softc *sc);
 int ath9k_wiphy_del(struct ath_wiphy *aphy);
 void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 4d4b22d52dfd..081192e78a46 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -359,11 +359,12 @@ void ath_beacon_tasklet(unsigned long data)
                 sc->beacon.bmisscnt++;
 
                 if (sc->beacon.bmisscnt < BSTUCK_THRESH) {
-                        ath_print(common, ATH_DBG_BEACON,
+                        ath_print(common, ATH_DBG_BSTUCK,
                                   "missed %u consecutive beacons\n",
                                   sc->beacon.bmisscnt);
+                        ath9k_hw_bstuck_nfcal(ah);
                 } else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
-                        ath_print(common, ATH_DBG_BEACON,
+                        ath_print(common, ATH_DBG_BSTUCK,
                                   "beacon is officially stuck\n");
                         sc->sc_flags |= SC_OP_TSF_RESET;
                         ath_reset(sc, false);
@@ -373,7 +374,7 @@ void ath_beacon_tasklet(unsigned long data)
         }
 
         if (sc->beacon.bmisscnt != 0) {
-                ath_print(common, ATH_DBG_BEACON,
+                ath_print(common, ATH_DBG_BSTUCK,
                           "resume beacon xmit after %u misses\n",
                           sc->beacon.bmisscnt);
                 sc->beacon.bmisscnt = 0;
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.c b/drivers/net/wireless/ath/ath9k/btcoex.c
index fb4ac15f3b93..6a92e57fddf0 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.c
+++ b/drivers/net/wireless/ath/ath9k/btcoex.c
@@ -168,6 +168,7 @@ EXPORT_SYMBOL(ath9k_hw_btcoex_set_weight);
 static void ath9k_hw_btcoex_enable_3wire(struct ath_hw *ah)
 {
         struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
+        u32  val;
 
         /*
          * Program coex mode and weight registers to
@@ -177,6 +178,12 @@ static void ath9k_hw_btcoex_enable_3wire(struct ath_hw *ah)
         REG_WRITE(ah, AR_BT_COEX_WEIGHT, btcoex_hw->bt_coex_weights);
         REG_WRITE(ah, AR_BT_COEX_MODE2, btcoex_hw->bt_coex_mode2);
 
+        if (AR_SREV_9271(ah)) {
+                val = REG_READ(ah, 0x50040);
+                val &= 0xFFFFFEFF;
+                REG_WRITE(ah, 0x50040, val);
+        }
+
         REG_RMW_FIELD(ah, AR_QUIET1, AR_QUIET1_QUIET_ACK_CTS_ENABLE, 1);
         REG_RMW_FIELD(ah, AR_PCU_MISC, AR_PCU_BT_ANT_PREVENT_RX, 0);
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 45208690c0ec..67ee5d735cc1 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -19,8 +19,7 @@
 
 /* Common calibration code */
 
-/* We can tune this as we go by monitoring really low values */
-#define ATH9K_NF_TOO_LOW        -60
+#define ATH9K_NF_TOO_HIGH       -60
 
 static int16_t ath9k_hw_get_nf_hist_mid(int16_t *nfCalBuffer)
 {
@@ -45,11 +44,39 @@ static int16_t ath9k_hw_get_nf_hist_mid(int16_t *nfCalBuffer)
         return nfval;
 }
 
-static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
+static struct ath_nf_limits *ath9k_hw_get_nf_limits(struct ath_hw *ah,
+                                                    struct ath9k_channel *chan)
+{
+        struct ath_nf_limits *limit;
+
+        if (!chan || IS_CHAN_2GHZ(chan))
+                limit = &ah->nf_2g;
+        else
+                limit = &ah->nf_5g;
+
+        return limit;
+}
+
+static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+        return ath9k_hw_get_nf_limits(ah, chan)->nominal;
+}
+
+
+static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
+                                              struct ath9k_hw_cal_data *cal,
                                               int16_t *nfarray)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_nf_limits *limit;
+        struct ath9k_nfcal_hist *h;
+        bool high_nf_mid = false;
         int i;
 
+        h = cal->nfCalHist;
+        limit = ath9k_hw_get_nf_limits(ah, ah->curchan);
+
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 h[i].nfCalBuffer[h[i].currIndex] = nfarray[i];
 
@@ -63,7 +90,39 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
                         h[i].privNF =
                                 ath9k_hw_get_nf_hist_mid(h[i].nfCalBuffer);
                 }
+
+                if (!h[i].privNF)
+                        continue;
+
+                if (h[i].privNF > limit->max) {
+                        high_nf_mid = true;
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "NFmid[%d] (%d) > MAX (%d), %s\n",
+                                  i, h[i].privNF, limit->max,
+                                  (cal->nfcal_interference ?
+                                   "not corrected (due to interference)" :
+                                   "correcting to MAX"));
+
+                        /*
+                         * Normally we limit the average noise floor by the
+                         * hardware specific maximum here. However if we have
+                         * encountered stuck beacons because of interference,
+                         * we bypass this limit here in order to better deal
+                         * with our environment.
+                         */
+                        if (!cal->nfcal_interference)
+                                h[i].privNF = limit->max;
+                }
         }
+
+        /*
+         * If the noise floor seems normal for all chains, assume that
+         * there is no significant interference in the environment anymore.
+         * Re-enable the enforcement of the NF maximum again.
+         */
+        if (!high_nf_mid)
+                cal->nfcal_interference = false;
 }
 
 static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
@@ -104,19 +163,6 @@ void ath9k_hw_reset_calibration(struct ath_hw *ah,
         ah->cal_samples = 0;
 }
 
-static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
-                                   struct ath9k_channel *chan)
-{
-        struct ath_nf_limits *limit;
-
-        if (!chan || IS_CHAN_2GHZ(chan))
-                limit = &ah->nf_2g;
-        else
-                limit = &ah->nf_5g;
-
-        return limit->nominal;
-}
-
 /* This is done for the currently configured channel */
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
@@ -277,10 +323,10 @@ static void ath9k_hw_nf_sanitize(struct ath_hw *ah, s16 *nf)
                           "NF calibrated [%s] [chain %d] is %d\n",
                           (i >= 3 ? "ext" : "ctl"), i % 3, nf[i]);
 
-                if (nf[i] > limit->max) {
+                if (nf[i] > ATH9K_NF_TOO_HIGH) {
                         ath_print(common, ATH_DBG_CALIBRATE,
                                   "NF[%d] (%d) > MAX (%d), correcting to MAX",
-                                  i, nf[i], limit->max);
+                                  i, nf[i], ATH9K_NF_TOO_HIGH);
                         nf[i] = limit->max;
                 } else if (nf[i] < limit->min) {
                         ath_print(common, ATH_DBG_CALIBRATE,
@@ -326,7 +372,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
 
         h = caldata->nfCalHist;
         caldata->nfcal_pending = false;
-        ath9k_hw_update_nfcal_hist_buffer(h, nfarray);
+        ath9k_hw_update_nfcal_hist_buffer(ah, caldata, nfarray);
         caldata->rawNoiseFloor = h[0].privNF;
         return true;
 }
@@ -361,3 +407,28 @@ s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
         return ah->caldata->rawNoiseFloor;
 }
 EXPORT_SYMBOL(ath9k_hw_getchan_noise);
+
+void ath9k_hw_bstuck_nfcal(struct ath_hw *ah)
+{
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+
+        if (unlikely(!caldata))
+                return;
+
+        /*
+         * If beacons are stuck, the most likely cause is interference.
+         * Triggering a noise floor calibration at this point helps the
+         * hardware adapt to a noisy environment much faster.
+         * To ensure that we recover from stuck beacons quickly, let
+         * the baseband update the internal NF value itself, similar to
+         * what is being done after a full reset.
+         */
+        if (!caldata->nfcal_pending)
+                ath9k_hw_start_nfcal(ah, true);
+        else if (!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
+                ath9k_hw_getnf(ah, ah->curchan);
+
+        caldata->nfcal_interference = true;
+}
+EXPORT_SYMBOL(ath9k_hw_bstuck_nfcal);
+
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index 0a304b3eeeb6..5b053a6260b2 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -113,6 +113,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
 bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
                                   struct ath9k_channel *chan);
+void ath9k_hw_bstuck_nfcal(struct ath_hw *ah);
 s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_hw_reset_calibration(struct ath_hw *ah,
                                 struct ath9k_cal_list *currCal);
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c86f7d3593ab..f43a2d98421c 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -46,12 +46,17 @@ int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 
         if (tx_info->control.hw_key) {
-                if (tx_info->control.hw_key->alg == ALG_WEP)
+                switch (tx_info->control.hw_key->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
                         return ATH9K_KEY_TYPE_WEP;
-                else if (tx_info->control.hw_key->alg == ALG_TKIP)
+                case WLAN_CIPHER_SUITE_TKIP:
                         return ATH9K_KEY_TYPE_TKIP;
-                else if (tx_info->control.hw_key->alg == ALG_CCMP)
+                case WLAN_CIPHER_SUITE_CCMP:
                         return ATH9K_KEY_TYPE_AES;
+                default:
+                        break;
+                }
         }
 
         return ATH9K_KEY_TYPE_CLEAR;
@@ -143,276 +148,49 @@ struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ath9k_cmn_get_curchannel);
 
-static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
-                           struct ath9k_keyval *hk, const u8 *addr,
-                           bool authenticator)
-{
-        struct ath_hw *ah = common->ah;
-        const u8 *key_rxmic;
-        const u8 *key_txmic;
-
-        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
-        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
-
-        if (addr == NULL) {
-                /*
-                 * Group key installation - only two key cache entries are used
-                 * regardless of splitmic capability since group key is only
-                 * used either for TX or RX.
-                 */
-                if (authenticator) {
-                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
-                } else {
-                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
-                }
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-        if (!common->splitmic) {
-                /* TX and RX keys share the same key cache entry. */
-                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
-                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
-        }
-
-        /* Separate key cache entries for TX and RX */
-
-        /* TX key goes at first index, RX key at +32. */
-        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
-        if (!ath9k_hw_set_keycache_entry(ah, keyix, hk, NULL)) {
-                /* TX MIC entry failed. No need to proceed further */
-                ath_print(common, ATH_DBG_FATAL,
-                          "Setting TX MIC Key Failed\n");
-                return 0;
-        }
-
-        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
-        /* XXX delete tx key on failure? */
-        return ath9k_hw_set_keycache_entry(ah, keyix + 32, hk, addr);
-}
-
-static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
-{
-        int i;
-
-        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                if (test_bit(i, common->keymap) ||
-                    test_bit(i + 64, common->keymap))
-                        continue; /* At least one part of TKIP key allocated */
-                if (common->splitmic &&
-                    (test_bit(i + 32, common->keymap) ||
-                     test_bit(i + 64 + 32, common->keymap)))
-                        continue; /* At least one part of TKIP key allocated */
-
-                /* Found a free slot for a TKIP key */
-                return i;
-        }
-        return -1;
-}
-
-static int ath_reserve_key_cache_slot(struct ath_common *common,
-                                      enum ieee80211_key_alg alg)
+int ath9k_cmn_count_streams(unsigned int chainmask, int max)
 {
-        int i;
-
-        if (alg == ALG_TKIP)
-                return ath_reserve_key_cache_slot_tkip(common);
-
-        /* First, try to find slots that would not be available for TKIP. */
-        if (common->splitmic) {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            (test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i;
-                        if (!test_bit(i + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 64, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 32;
-                        if (!test_bit(i + 64, common->keymap) &&
-                            (test_bit(i , common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64 + 32, common->keymap)))
-                                return i + 64;
-                        if (!test_bit(i + 64 + 32, common->keymap) &&
-                            (test_bit(i, common->keymap) ||
-                             test_bit(i + 32, common->keymap) ||
-                             test_bit(i + 64, common->keymap)))
-                                return i + 64 + 32;
-                }
-        } else {
-                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
-                        if (!test_bit(i, common->keymap) &&
-                            test_bit(i + 64, common->keymap))
-                                return i;
-                        if (test_bit(i, common->keymap) &&
-                            !test_bit(i + 64, common->keymap))
-                                return i + 64;
-                }
-        }
-
-        /* No partially used TKIP slots, pick any available slot */
-        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
-                /* Do not allow slots that could be needed for TKIP group keys
-                 * to be used. This limitation could be removed if we know that
-                 * TKIP will not be used. */
-                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
-                        continue;
-                if (common->splitmic) {
-                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
-                                continue;
-                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
-                                continue;
-                }
+        int streams = 0;
 
-                if (!test_bit(i, common->keymap))
-                        return i; /* Found a free slot for a key */
-        }
+        do {
+                if (++streams == max)
+                        break;
+        } while ((chainmask = chainmask & (chainmask - 1)));
 
-        /* No free slot found */
-        return -1;
+        return streams;
 }
+EXPORT_SYMBOL(ath9k_cmn_count_streams);
 
 /*
- * Configure encryption in the HW.
+ * Configures appropriate weight based on stomp type.
  */
-int ath9k_cmn_key_config(struct ath_common *common,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         struct ieee80211_key_conf *key)
+void ath9k_cmn_btcoex_bt_stomp(struct ath_common *common,
+                                  enum ath_stomp_type stomp_type)
 {
         struct ath_hw *ah = common->ah;
-        struct ath9k_keyval hk;
-        const u8 *mac = NULL;
-        u8 gmac[ETH_ALEN];
-        int ret = 0;
-        int idx;
 
-        memset(&hk, 0, sizeof(hk));
-
-        switch (key->alg) {
-        case ALG_WEP:
-                hk.kv_type = ATH9K_CIPHER_WEP;
+        switch (stomp_type) {
+        case ATH_BTCOEX_STOMP_ALL:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_ALL_WLAN_WGHT);
                 break;
-        case ALG_TKIP:
-                hk.kv_type = ATH9K_CIPHER_TKIP;
+        case ATH_BTCOEX_STOMP_LOW:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_LOW_WLAN_WGHT);
                 break;
-        case ALG_CCMP:
-                hk.kv_type = ATH9K_CIPHER_AES_CCM;
+        case ATH_BTCOEX_STOMP_NONE:
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_NONE_WLAN_WGHT);
                 break;
         default:
-                return -EOPNOTSUPP;
-        }
-
-        hk.kv_len = key->keylen;
-        memcpy(hk.kv_val, key->key, key->keylen);
-
-        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
-                switch (vif->type) {
-                case NL80211_IFTYPE_AP:
-                        memcpy(gmac, vif->addr, ETH_ALEN);
-                        gmac[0] |= 0x01;
-                        mac = gmac;
-                        idx = ath_reserve_key_cache_slot(common, key->alg);
-                        break;
-                case NL80211_IFTYPE_ADHOC:
-                        if (!sta) {
-                                idx = key->keyidx;
-                                break;
-                        }
-                        memcpy(gmac, sta->addr, ETH_ALEN);
-                        gmac[0] |= 0x01;
-                        mac = gmac;
-                        idx = ath_reserve_key_cache_slot(common, key->alg);
-                        break;
-                default:
-                        idx = key->keyidx;
-                        break;
-                }
-        } else if (key->keyidx) {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                if (vif->type != NL80211_IFTYPE_AP) {
-                        /* Only keyidx 0 should be used with unicast key, but
-                         * allow this for client mode for now. */
-                        idx = key->keyidx;
-                } else
-                        return -EIO;
-        } else {
-                if (WARN_ON(!sta))
-                        return -EOPNOTSUPP;
-                mac = sta->addr;
-
-                idx = ath_reserve_key_cache_slot(common, key->alg);
-        }
-
-        if (idx < 0)
-                return -ENOSPC; /* no free key cache entries */
-
-        if (key->alg == ALG_TKIP)
-                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
-                                      vif->type == NL80211_IFTYPE_AP);
-        else
-                ret = ath9k_hw_set_keycache_entry(ah, idx, &hk, mac);
-
-        if (!ret)
-                return -EIO;
-
-        set_bit(idx, common->keymap);
-        if (key->alg == ALG_TKIP) {
-                set_bit(idx + 64, common->keymap);
-                if (common->splitmic) {
-                        set_bit(idx + 32, common->keymap);
-                        set_bit(idx + 64 + 32, common->keymap);
-                }
-        }
-
-        return idx;
-}
-EXPORT_SYMBOL(ath9k_cmn_key_config);
-
-/*
- * Delete Key.
- */
-void ath9k_cmn_key_delete(struct ath_common *common,
-                          struct ieee80211_key_conf *key)
-{
-        struct ath_hw *ah = common->ah;
-
-        ath9k_hw_keyreset(ah, key->hw_key_idx);
-        if (key->hw_key_idx < IEEE80211_WEP_NKID)
-                return;
-
-        clear_bit(key->hw_key_idx, common->keymap);
-        if (key->alg != ALG_TKIP)
-                return;
-
-        clear_bit(key->hw_key_idx + 64, common->keymap);
-        if (common->splitmic) {
-                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
-                clear_bit(key->hw_key_idx + 32, common->keymap);
-                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+                ath_print(common, ATH_DBG_BTCOEX,
+                          "Invalid Stomptype\n");
+                break;
         }
-}
-EXPORT_SYMBOL(ath9k_cmn_key_delete);
-
-int ath9k_cmn_count_streams(unsigned int chainmask, int max)
-{
-        int streams = 0;
-
-        do {
-                if (++streams == max)
-                        break;
-        } while ((chainmask = chainmask & (chainmask - 1)));
 
-        return streams;
+        ath9k_hw_btcoex_enable(ah);
 }
-EXPORT_SYMBOL(ath9k_cmn_count_streams);
+EXPORT_SYMBOL(ath9k_cmn_btcoex_bt_stomp);
 
 static int __init ath9k_cmn_init(void)
 {
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 97809d39c73f..fea3b3315391 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -52,16 +52,20 @@
 #define ATH_EP_RND(x, mul)                                              \
         ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
 
+/* Defines the BT AR_BT_COEX_WGHT used */
+enum ath_stomp_type {
+        ATH_BTCOEX_NO_STOMP,
+        ATH_BTCOEX_STOMP_ALL,
+        ATH_BTCOEX_STOMP_LOW,
+        ATH_BTCOEX_STOMP_NONE
+};
+
 int ath9k_cmn_padpos(__le16 frame_control);
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
 void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
                                struct ath9k_channel *ichan);
 struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
                                                struct ath_hw *ah);
-int ath9k_cmn_key_config(struct ath_common *common,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         struct ieee80211_key_conf *key);
-void ath9k_cmn_key_delete(struct ath_common *common,
-                          struct ieee80211_key_conf *key);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
+void ath9k_cmn_btcoex_bt_stomp(struct ath_common *common,
+                                  enum ath_stomp_type stomp_type);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 54aae931424e..d65a896a421d 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -492,12 +492,55 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
         unsigned int len = 0;
         int i;
         u8 addr[ETH_ALEN];
+        u32 tmp;
 
         len += snprintf(buf + len, sizeof(buf) - len,
                         "primary: %s (%s chan=%d ht=%d)\n",
                         wiphy_name(sc->pri_wiphy->hw->wiphy),
                         ath_wiphy_state_str(sc->pri_wiphy->state),
                         sc->pri_wiphy->chan_idx, sc->pri_wiphy->chan_is_ht);
+
+        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_STA_ID0), addr);
+        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_STA_ID1) & 0xffff, addr + 4);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "addr: %pM\n", addr);
+        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_BSSMSKL), addr);
+        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_BSSMSKU) & 0xffff, addr + 4);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "addrmask: %pM\n", addr);
+        tmp = ath9k_hw_getrxfilter(sc->sc_ah);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "rfilt: 0x%x", tmp);
+        if (tmp & ATH9K_RX_FILTER_UCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " UCAST");
+        if (tmp & ATH9K_RX_FILTER_MCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " MCAST");
+        if (tmp & ATH9K_RX_FILTER_BCAST)
+                len += snprintf(buf + len, sizeof(buf) - len, " BCAST");
+        if (tmp & ATH9K_RX_FILTER_CONTROL)
+                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL");
+        if (tmp & ATH9K_RX_FILTER_BEACON)
+                len += snprintf(buf + len, sizeof(buf) - len, " BEACON");
+        if (tmp & ATH9K_RX_FILTER_PROM)
+                len += snprintf(buf + len, sizeof(buf) - len, " PROM");
+        if (tmp & ATH9K_RX_FILTER_PROBEREQ)
+                len += snprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
+        if (tmp & ATH9K_RX_FILTER_PHYERR)
+                len += snprintf(buf + len, sizeof(buf) - len, " PHYERR");
+        if (tmp & ATH9K_RX_FILTER_MYBEACON)
+                len += snprintf(buf + len, sizeof(buf) - len, " MYBEACON");
+        if (tmp & ATH9K_RX_FILTER_COMP_BAR)
+                len += snprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
+        if (tmp & ATH9K_RX_FILTER_PSPOLL)
+                len += snprintf(buf + len, sizeof(buf) - len, " PSPOLL");
+        if (tmp & ATH9K_RX_FILTER_PHYRADAR)
+                len += snprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
+        if (tmp & ATH9K_RX_FILTER_MCAST_BCAST_ALL)
+                len += snprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL\n");
+        else
+                len += snprintf(buf + len, sizeof(buf) - len, "\n");
+
+        /* Put variable-length stuff down here, and check for overflows. */
         for (i = 0; i < sc->num_sec_wiphy; i++) {
                 struct ath_wiphy *aphy = sc->sec_wiphy[i];
                 if (aphy == NULL)
@@ -508,16 +551,6 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
                                 ath_wiphy_state_str(aphy->state),
                                 aphy->chan_idx, aphy->chan_is_ht);
         }
-
-        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_STA_ID0), addr);
-        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_STA_ID1) & 0xffff, addr + 4);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "addr: %pM\n", addr);
-        put_unaligned_le32(REG_READ_D(sc->sc_ah, AR_BSSMSKL), addr);
-        put_unaligned_le16(REG_READ_D(sc->sc_ah, AR_BSSMSKU) & 0xffff, addr + 4);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "addrmask: %pM\n", addr);
-
         if (len > sizeof(buf))
                 len = sizeof(buf);
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 0b09db0f8e7d..3030564a0f21 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -266,6 +266,8 @@ enum eeprom_param {
         EEP_INTERNAL_REGULATOR,
         EEP_SWREG,
         EEP_PAPRD,
+        EEP_MODAL_VER,
+        EEP_ANT_DIV_CTL1,
 };
 
 enum ar5416_rates {
@@ -670,7 +672,8 @@ struct eeprom_ops {
         bool (*fill_eeprom)(struct ath_hw *hw);
         int (*get_eeprom_ver)(struct ath_hw *hw);
         int (*get_eeprom_rev)(struct ath_hw *hw);
-        u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band);
+        u8 (*get_num_ant_config)(struct ath_hw *hw,
+                                 enum ath9k_hal_freq_band band);
         u32 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
                                       struct ath9k_channel *chan);
         void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 9cccd12e8f21..ead8b0dd3b53 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -213,6 +213,10 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
                 return 0;
         case EEP_PWR_TABLE_OFFSET:
                 return AR5416_PWR_TABLE_OFFSET_DB;
+        case EEP_MODAL_VER:
+                return pModal->version;
+        case EEP_ANT_DIV_CTL1:
+                return pModal->antdiv_ctl1;
         default:
                 return 0;
         }
@@ -1157,7 +1161,7 @@ static u32 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
-                                         enum ieee80211_band freq_band)
+                                         enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index dff2da777312..e6186515d05b 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -1126,7 +1126,7 @@ static void ath9k_hw_ar9287_set_board_values(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_ar9287_get_num_ant_config(struct ath_hw *ah,
-                                             enum ieee80211_band freq_band)
+                                             enum ath9k_hal_freq_band freq_band)
 {
         return 1;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index afa2b73ddbdd..23f480d4c770 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1418,11 +1418,11 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
 }
 
 static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
-                                          enum ieee80211_band freq_band)
+                                          enum ath9k_hal_freq_band freq_band)
 {
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         struct modal_eep_header *pModal =
-                &(eep->modalHeader[ATH9K_HAL_FREQ_BAND_2GHZ == freq_band]);
+                &(eep->modalHeader[freq_band]);
         struct base_eep_header *pBase = &eep->baseEepHeader;
         u8 num_ant_config;
 
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 3a8ee999da5d..4a9a68bba324 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -251,36 +251,6 @@ static void ath_detect_bt_priority(struct ath_softc *sc)
         }
 }
 
-/*
- * Configures appropriate weight based on stomp type.
- */
-static void ath9k_btcoex_bt_stomp(struct ath_softc *sc,
-                                  enum ath_stomp_type stomp_type)
-{
-        struct ath_hw *ah = sc->sc_ah;
-
-        switch (stomp_type) {
-        case ATH_BTCOEX_STOMP_ALL:
-                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
-                                           AR_STOMP_ALL_WLAN_WGHT);
-                break;
-        case ATH_BTCOEX_STOMP_LOW:
-                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
-                                           AR_STOMP_LOW_WLAN_WGHT);
-                break;
-        case ATH_BTCOEX_STOMP_NONE:
-                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
-                                           AR_STOMP_NONE_WLAN_WGHT);
-                break;
-        default:
-                ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
-                          "Invalid Stomptype\n");
-                break;
-        }
-
-        ath9k_hw_btcoex_enable(ah);
-}
-
 static void ath9k_gen_timer_start(struct ath_hw *ah,
                                   struct ath_gen_timer *timer,
                                   u32 timer_next,
@@ -319,6 +289,7 @@ static void ath_btcoex_period_timer(unsigned long data)
         struct ath_softc *sc = (struct ath_softc *) data;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 timer_period;
         bool is_btscan;
 
@@ -328,7 +299,7 @@ static void ath_btcoex_period_timer(unsigned long data)
 
         spin_lock_bh(&btcoex->btcoex_lock);
 
-        ath9k_btcoex_bt_stomp(sc, is_btscan ? ATH_BTCOEX_STOMP_ALL :
+        ath9k_cmn_btcoex_bt_stomp(common, is_btscan ? ATH_BTCOEX_STOMP_ALL :
                               btcoex->bt_stomp_type);
 
         spin_unlock_bh(&btcoex->btcoex_lock);
@@ -359,17 +330,18 @@ static void ath_btcoex_no_stomp_timer(void *arg)
         struct ath_softc *sc = (struct ath_softc *)arg;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_common *common = ath9k_hw_common(ah);
         bool is_btscan = sc->sc_flags & SC_OP_BT_SCAN;
 
-        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+        ath_print(common, ATH_DBG_BTCOEX,
                   "no stomp timer running\n");
 
         spin_lock_bh(&btcoex->btcoex_lock);
 
         if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_LOW || is_btscan)
-                ath9k_btcoex_bt_stomp(sc, ATH_BTCOEX_STOMP_NONE);
+                ath9k_cmn_btcoex_bt_stomp(common, ATH_BTCOEX_STOMP_NONE);
          else if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_ALL)
-                ath9k_btcoex_bt_stomp(sc, ATH_BTCOEX_STOMP_LOW);
+                ath9k_cmn_btcoex_bt_stomp(common, ATH_BTCOEX_STOMP_LOW);
 
         spin_unlock_bh(&btcoex->btcoex_lock);
 }
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 17e7a9a367e7..728d904c74d7 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -92,10 +92,10 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
         cmd->skb = skb;
         cmd->hif_dev = hif_dev;
 
-        usb_fill_int_urb(urb, hif_dev->udev,
-                         usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
+        usb_fill_bulk_urb(urb, hif_dev->udev,
+                         usb_sndbulkpipe(hif_dev->udev, USB_REG_OUT_PIPE),
                          skb->data, skb->len,
-                         hif_usb_regout_cb, cmd, 1);
+                         hif_usb_regout_cb, cmd);
 
         usb_anchor_urb(urb, &hif_dev->regout_submitted);
         ret = usb_submit_urb(urb, GFP_KERNEL);
@@ -541,7 +541,8 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                 }
 
                 usb_fill_int_urb(urb, hif_dev->udev,
-                                 usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                                 usb_rcvbulkpipe(hif_dev->udev,
+                                                 USB_REG_IN_PIPE),
                                  nskb->data, MAX_REG_IN_BUF_SIZE,
                                  ath9k_hif_usb_reg_in_cb, nskb, 1);
 
@@ -720,7 +721,8 @@ static int ath9k_hif_usb_alloc_reg_in_urb(struct hif_device_usb *hif_dev)
                 goto err;
 
         usb_fill_int_urb(hif_dev->reg_in_urb, hif_dev->udev,
-                         usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                         usb_rcvbulkpipe(hif_dev->udev,
+                                         USB_REG_IN_PIPE),
                          skb->data, MAX_REG_IN_BUF_SIZE,
                          ath9k_hif_usb_reg_in_cb, skb, 1);
 
@@ -822,7 +824,9 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
 {
-        int ret;
+        int ret, idx;
+        struct usb_host_interface *alt = &hif_dev->interface->altsetting[0];
+        struct usb_endpoint_descriptor *endp;
 
         /* Request firmware */
         ret = request_firmware(&hif_dev->firmware, hif_dev->fw_name,
@@ -850,6 +854,22 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
                 goto err_fw_download;
         }
 
+        /* On downloading the firmware to the target, the USB descriptor of EP4
+         * is 'patched' to change the type of the endpoint to Bulk. This will
+         * bring down CPU usage during the scan period.
+         */
+        for (idx = 0; idx < alt->desc.bNumEndpoints; idx++) {
+                endp = &alt->endpoint[idx].desc;
+                if (((endp->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK)
+                                == 0x04) &&
+                    ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                == USB_ENDPOINT_XFER_INT)) {
+                        endp->bmAttributes &= ~USB_ENDPOINT_XFERTYPE_MASK;
+                        endp->bmAttributes |= USB_ENDPOINT_XFER_BULK;
+                        endp->bInterval = 0;
+                }
+        }
+
         return 0;
 
 err_fw_download:
@@ -920,7 +940,8 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         }
 
         ret = ath9k_htc_hw_init(hif_dev->htc_handle,
-                                &hif_dev->udev->dev, hif_dev->device_id);
+                                &hif_dev->udev->dev, hif_dev->device_id,
+                                hif_dev->udev->product);
         if (ret) {
                 ret = -EINVAL;
                 goto err_htc_hw_init;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 43b9e21bc562..75ecf6a30d25 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -316,17 +316,32 @@ struct htc_beacon_config {
         u8 dtim_count;
 };
 
-#define OP_INVALID        BIT(0)
-#define OP_SCANNING       BIT(1)
-#define OP_FULL_RESET     BIT(2)
-#define OP_LED_ASSOCIATED BIT(3)
-#define OP_LED_ON         BIT(4)
-#define OP_PREAMBLE_SHORT BIT(5)
-#define OP_PROTECT_ENABLE BIT(6)
-#define OP_ASSOCIATED     BIT(7)
-#define OP_ENABLE_BEACON  BIT(8)
-#define OP_LED_DEINIT     BIT(9)
-#define OP_UNPLUGGED      BIT(10)
+struct ath_btcoex {
+        u32 bt_priority_cnt;
+        unsigned long bt_priority_time;
+        int bt_stomp_type; /* Types of BT stomping */
+        u32 btcoex_no_stomp;
+        u32 btcoex_period;
+        u32 btscan_no_stomp;
+};
+
+void ath_htc_init_btcoex_work(struct ath9k_htc_priv *priv);
+void ath_htc_resume_btcoex_work(struct ath9k_htc_priv *priv);
+void ath_htc_cancel_btcoex_work(struct ath9k_htc_priv *priv);
+
+#define OP_INVALID                 BIT(0)
+#define OP_SCANNING                BIT(1)
+#define OP_FULL_RESET              BIT(2)
+#define OP_LED_ASSOCIATED          BIT(3)
+#define OP_LED_ON                  BIT(4)
+#define OP_PREAMBLE_SHORT          BIT(5)
+#define OP_PROTECT_ENABLE          BIT(6)
+#define OP_ASSOCIATED              BIT(7)
+#define OP_ENABLE_BEACON           BIT(8)
+#define OP_LED_DEINIT              BIT(9)
+#define OP_UNPLUGGED               BIT(10)
+#define OP_BT_PRIORITY_DETECTED    BIT(11)
+#define OP_BT_SCAN                 BIT(12)
 
 struct ath9k_htc_priv {
         struct device *dev;
@@ -391,6 +406,9 @@ struct ath9k_htc_priv {
         int cabq;
         int hwq_map[WME_NUM_AC];
 
+        struct ath_btcoex btcoex;
+        struct delayed_work coex_period_work;
+        struct delayed_work duty_cycle_work;
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
         struct ath9k_debug debug;
 #endif
@@ -443,7 +461,7 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv);
 void ath9k_deinit_leds(struct ath9k_htc_priv *priv);
 
 int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
-                           u16 devid);
+                           u16 devid, char *product);
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
 #ifdef CONFIG_PM
 int ath9k_htc_resume(struct htc_target *htc_handle);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
new file mode 100644
index 000000000000..50eec9a3b88c
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -0,0 +1,134 @@
+#include "htc.h"
+
+/******************/
+/*     BTCOEX     */
+/******************/
+
+/*
+ * Detects if there is any priority bt traffic
+ */
+static void ath_detect_bt_priority(struct ath9k_htc_priv *priv)
+{
+        struct ath_btcoex *btcoex = &priv->btcoex;
+        struct ath_hw *ah = priv->ah;
+
+        if (ath9k_hw_gpio_get(ah, ah->btcoex_hw.btpriority_gpio))
+                btcoex->bt_priority_cnt++;
+
+        if (time_after(jiffies, btcoex->bt_priority_time +
+                        msecs_to_jiffies(ATH_BT_PRIORITY_TIME_THRESHOLD))) {
+                priv->op_flags &= ~(OP_BT_PRIORITY_DETECTED | OP_BT_SCAN);
+                /* Detect if colocated bt started scanning */
+                if (btcoex->bt_priority_cnt >= ATH_BT_CNT_SCAN_THRESHOLD) {
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                                  "BT scan detected");
+                        priv->op_flags |= (OP_BT_SCAN |
+                                         OP_BT_PRIORITY_DETECTED);
+                } else if (btcoex->bt_priority_cnt >= ATH_BT_CNT_THRESHOLD) {
+                        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                                    "BT priority traffic detected");
+                        priv->op_flags |= OP_BT_PRIORITY_DETECTED;
+                }
+
+                btcoex->bt_priority_cnt = 0;
+                btcoex->bt_priority_time = jiffies;
+        }
+}
+
+/*
+ * This is the master bt coex work which runs for every
+ * 45ms, bt traffic will be given priority during 55% of this
+ * period while wlan gets remaining 45%
+ */
+static void ath_btcoex_period_work(struct work_struct *work)
+{
+        struct ath9k_htc_priv *priv = container_of(work, struct ath9k_htc_priv,
+                                                   coex_period_work.work);
+        struct ath_btcoex *btcoex = &priv->btcoex;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        u32 timer_period;
+        bool is_btscan;
+        int ret;
+        u8 cmd_rsp, aggr;
+
+        ath_detect_bt_priority(priv);
+
+        is_btscan = !!(priv->op_flags & OP_BT_SCAN);
+
+        aggr = priv->op_flags & OP_BT_PRIORITY_DETECTED;
+
+        WMI_CMD_BUF(WMI_AGGR_LIMIT_CMD, &aggr);
+
+        ath9k_cmn_btcoex_bt_stomp(common, is_btscan ? ATH_BTCOEX_STOMP_ALL :
+                        btcoex->bt_stomp_type);
+
+        timer_period = is_btscan ? btcoex->btscan_no_stomp :
+                btcoex->btcoex_no_stomp;
+        ieee80211_queue_delayed_work(priv->hw, &priv->duty_cycle_work,
+                                     msecs_to_jiffies(timer_period));
+        ieee80211_queue_delayed_work(priv->hw, &priv->coex_period_work,
+                                     msecs_to_jiffies(btcoex->btcoex_period));
+}
+
+/*
+ * Work to time slice between wlan and bt traffic and
+ * configure weight registers
+ */
+static void ath_btcoex_duty_cycle_work(struct work_struct *work)
+{
+        struct ath9k_htc_priv *priv = container_of(work, struct ath9k_htc_priv,
+                                                   duty_cycle_work.work);
+        struct ath_hw *ah = priv->ah;
+        struct ath_btcoex *btcoex = &priv->btcoex;
+        struct ath_common *common = ath9k_hw_common(ah);
+        bool is_btscan = priv->op_flags & OP_BT_SCAN;
+
+        ath_print(common, ATH_DBG_BTCOEX,
+                  "time slice work for bt and wlan\n");
+
+        if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_LOW || is_btscan)
+                ath9k_cmn_btcoex_bt_stomp(common, ATH_BTCOEX_STOMP_NONE);
+        else if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_ALL)
+                ath9k_cmn_btcoex_bt_stomp(common, ATH_BTCOEX_STOMP_LOW);
+}
+
+void ath_htc_init_btcoex_work(struct ath9k_htc_priv *priv)
+{
+        struct ath_btcoex *btcoex = &priv->btcoex;
+
+        btcoex->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD;
+        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) *
+                btcoex->btcoex_period / 100;
+        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) *
+                                   btcoex->btcoex_period / 100;
+        INIT_DELAYED_WORK(&priv->coex_period_work, ath_btcoex_period_work);
+        INIT_DELAYED_WORK(&priv->duty_cycle_work, ath_btcoex_duty_cycle_work);
+}
+
+/*
+ * (Re)start btcoex work
+ */
+
+void ath_htc_resume_btcoex_work(struct ath9k_htc_priv *priv)
+{
+        struct ath_btcoex *btcoex = &priv->btcoex;
+        struct ath_hw *ah = priv->ah;
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_BTCOEX,
+                  "Starting btcoex work");
+
+        btcoex->bt_priority_cnt = 0;
+        btcoex->bt_priority_time = jiffies;
+        priv->op_flags &= ~(OP_BT_PRIORITY_DETECTED | OP_BT_SCAN);
+        ieee80211_queue_delayed_work(priv->hw, &priv->coex_period_work, 0);
+}
+
+
+/*
+ * Cancel btcoex and bt duty cycle work.
+ */
+void ath_htc_cancel_btcoex_work(struct ath9k_htc_priv *priv)
+{
+        cancel_delayed_work_sync(&priv->coex_period_work);
+        cancel_delayed_work_sync(&priv->duty_cycle_work);
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 2d4279191d7a..33850c952314 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -41,6 +41,8 @@ MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
         .max_power = 20, \
 }
 
+#define ATH_HTC_BTCOEX_PRODUCT_ID "wb193"
+
 static struct ieee80211_channel ath9k_2ghz_channels[] = {
         CHAN2G(2412, 0), /* Channel 1 */
         CHAN2G(2417, 1), /* Channel 2 */
@@ -564,7 +566,7 @@ static void ath9k_init_crypto(struct ath9k_htc_priv *priv)
          * reset the contents on initial power up.
          */
         for (i = 0; i < common->keymax; i++)
-                ath9k_hw_keyreset(priv->ah, (u16) i);
+                ath_hw_keyreset(common, (u16) i);
 }
 
 static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
@@ -599,13 +601,36 @@ static void ath9k_init_misc(struct ath9k_htc_priv *priv)
         common->tx_chainmask = priv->ah->caps.tx_chainmask;
         common->rx_chainmask = priv->ah->caps.rx_chainmask;
 
-        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+        memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
 
         priv->ah->opmode = NL80211_IFTYPE_STATION;
 }
 
-static int ath9k_init_priv(struct ath9k_htc_priv *priv, u16 devid)
+static void ath9k_init_btcoex(struct ath9k_htc_priv *priv)
+{
+        int qnum;
+
+        switch (priv->ah->btcoex_hw.scheme) {
+        case ATH_BTCOEX_CFG_NONE:
+                break;
+        case ATH_BTCOEX_CFG_3WIRE:
+                priv->ah->btcoex_hw.btactive_gpio = 7;
+                priv->ah->btcoex_hw.btpriority_gpio = 6;
+                priv->ah->btcoex_hw.wlanactive_gpio = 8;
+                priv->btcoex.bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
+                ath9k_hw_btcoex_init_3wire(priv->ah);
+                ath_htc_init_btcoex_work(priv);
+                qnum = priv->hwq_map[WME_AC_BE];
+                ath9k_hw_init_btcoex_hw(priv->ah, qnum);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+
+static int ath9k_init_priv(struct ath9k_htc_priv *priv,
+                           u16 devid, char *product)
 {
         struct ath_hw *ah = NULL;
         struct ath_common *common;
@@ -672,6 +697,11 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv, u16 devid)
         ath9k_init_channels_rates(priv);
         ath9k_init_misc(priv);
 
+        if (product && strncmp(product, ATH_HTC_BTCOEX_PRODUCT_ID, 5) == 0) {
+                ah->btcoex_hw.scheme = ATH_BTCOEX_CFG_3WIRE;
+                ath9k_init_btcoex(priv);
+        }
+
         return 0;
 
 err_queues:
@@ -734,7 +764,8 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
         SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
 }
 
-static int ath9k_init_device(struct ath9k_htc_priv *priv, u16 devid)
+static int ath9k_init_device(struct ath9k_htc_priv *priv,
+                             u16 devid, char *product)
 {
         struct ieee80211_hw *hw = priv->hw;
         struct ath_common *common;
@@ -743,7 +774,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv, u16 devid)
         struct ath_regulatory *reg;
 
         /* Bring up device */
-        error = ath9k_init_priv(priv, devid);
+        error = ath9k_init_priv(priv, devid, product);
         if (error != 0)
                 goto err_init;
 
@@ -801,7 +832,7 @@ err_init:
 }
 
 int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
-                           u16 devid)
+                           u16 devid, char *product)
 {
         struct ieee80211_hw *hw;
         struct ath9k_htc_priv *priv;
@@ -835,7 +866,7 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
         /* The device may have been unplugged earlier. */
         priv->op_flags &= ~OP_UNPLUGGED;
 
-        ret = ath9k_init_device(priv, devid);
+        ret = ath9k_init_device(priv, devid, product);
         if (ret)
                 goto err_init;
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 7d09b4b17bbd..5124d04b240b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -137,8 +137,6 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         if (priv->op_flags & OP_FULL_RESET)
                 fastcc = false;
 
-        /* Fiddle around with fastcc later on, for now just use full reset */
-        fastcc = false;
         ath9k_htc_ps_wakeup(priv);
         htc_stop(priv->htc);
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
@@ -146,9 +144,10 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
         ath_print(common, ATH_DBG_CONFIG,
-                  "(%u MHz) -> (%u MHz), HT: %d, HT40: %d\n",
+                  "(%u MHz) -> (%u MHz), HT: %d, HT40: %d fastcc: %d\n",
                   priv->ah->curchan->channel,
-                  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf));
+                  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf),
+                  fastcc);
 
         caldata = &priv->caldata[channel->hw_value];
         ret = ath9k_hw_reset(ah, hchan, caldata, fastcc);
@@ -1210,6 +1209,12 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
 
         ieee80211_wake_queues(hw);
 
+        if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE) {
+                ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
+                                           AR_STOMP_LOW_WLAN_WGHT);
+                ath9k_hw_btcoex_enable(ah);
+                ath_htc_resume_btcoex_work(priv);
+        }
         mutex_unlock(&priv->mutex);
 
         return ret;
@@ -1233,7 +1238,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
 
         /* Cancel all the running timers/work .. */
         cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_ani_work);
         cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
         ath9k_led_stop_brightness(priv);
 
@@ -1254,6 +1258,12 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
                                   "Monitor interface removed\n");
         }
 
+        if (ah->btcoex_hw.enabled) {
+                ath9k_hw_btcoex_disable(ah);
+                if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
+                        ath_htc_cancel_btcoex_work(priv);
+        }
+
         ath9k_hw_phy_disable(ah);
         ath9k_hw_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
@@ -1580,20 +1590,21 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath9k_cmn_key_config(common, vif, sta, key);
+                ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                        if (key->alg == ALG_TKIP)
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
                                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        if (priv->ah->sw_mgmt_crypto && key->alg == ALG_CCMP)
+                        if (priv->ah->sw_mgmt_crypto &&
+                            key->cipher == WLAN_CIPHER_SUITE_CCMP)
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT;
                         ret = 0;
                 }
                 break;
         case DISABLE_KEY:
-                ath9k_cmn_key_delete(common, key);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
@@ -1774,7 +1785,8 @@ static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
         priv->op_flags |= OP_SCANNING;
         spin_unlock_bh(&priv->beacon_lock);
         cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_ani_work);
+        if (priv->op_flags & OP_ASSOCIATED)
+                cancel_delayed_work_sync(&priv->ath9k_ani_work);
         mutex_unlock(&priv->mutex);
 }
 
@@ -1788,9 +1800,10 @@ static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
         priv->op_flags &= ~OP_SCANNING;
         spin_unlock_bh(&priv->beacon_lock);
         priv->op_flags |= OP_FULL_RESET;
-        if (priv->op_flags & OP_ASSOCIATED)
+        if (priv->op_flags & OP_ASSOCIATED) {
                 ath9k_htc_beacon_config(priv, priv->vif);
-        ath_start_ani(priv);
+                ath_start_ani(priv);
+        }
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 2a6e45a293a9..c99600aff76d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -415,8 +415,7 @@ static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
         ath9k_hw_setrxfilter(ah, rfilt);
 
         /* configure bssid mask */
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath_hw_setbssidmask(common);
+        ath_hw_setbssidmask(common);
 
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 705c0f342e1c..861ec9269309 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -462,9 +462,9 @@ void ath9k_htc_hw_free(struct htc_target *htc)
 }
 
 int ath9k_htc_hw_init(struct htc_target *target,
-                      struct device *dev, u16 devid)
+                      struct device *dev, u16 devid, char *product)
 {
-        if (ath9k_htc_probe_device(target, dev, devid)) {
+        if (ath9k_htc_probe_device(target, dev, devid, product)) {
                 printk(KERN_ERR "Failed to initialize the device\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
index faba6790328b..07b6509d5896 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.h
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -239,7 +239,7 @@ struct htc_target *ath9k_htc_hw_alloc(void *hif_handle,
                                       struct device *dev);
 void ath9k_htc_hw_free(struct htc_target *htc);
 int ath9k_htc_hw_init(struct htc_target *target,
-                      struct device *dev, u16 devid);
+                      struct device *dev, u16 devid, char *product);
 void ath9k_htc_hw_deinit(struct htc_target *target, bool hot_unplug);
 
 #endif /* HTC_HST_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 3384ca164562..0b2ff98b6f33 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1258,11 +1258,13 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
             (chan->channel != ah->curchan->channel) &&
             ((chan->channelFlags & CHANNEL_ALL) ==
              (ah->curchan->channelFlags & CHANNEL_ALL)) &&
-            !AR_SREV_9280(ah)) {
+            (!AR_SREV_9280(ah) || AR_DEVID_7010(ah))) {
 
                 if (ath9k_hw_channel_change(ah, chan)) {
                         ath9k_hw_loadnf(ah, ah->curchan);
                         ath9k_hw_start_nfcal(ah, true);
+                        if (AR_SREV_9271(ah))
+                                ar9002_hw_load_ani_reg(ah, chan);
                         return 0;
                 }
         }
@@ -1474,283 +1476,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 }
 EXPORT_SYMBOL(ath9k_hw_reset);
 
-/************************/
-/* Key Cache Management */
-/************************/
-
-bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry)
-{
-        u32 keyType;
-
-        if (entry >= ah->caps.keycache_size) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "keychache entry %u out of range\n", entry);
-                return false;
-        }
-
-        keyType = REG_READ(ah, AR_KEYTABLE_TYPE(entry));
-
-        REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), AR_KEYTABLE_TYPE_CLR);
-        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), 0);
-        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), 0);
-
-        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
-                u16 micentry = entry + 64;
-
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
-
-        }
-
-        return true;
-}
-EXPORT_SYMBOL(ath9k_hw_keyreset);
-
-static bool ath9k_hw_keysetmac(struct ath_hw *ah, u16 entry, const u8 *mac)
-{
-        u32 macHi, macLo;
-        u32 unicast_flag = AR_KEYTABLE_VALID;
-
-        if (entry >= ah->caps.keycache_size) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "keychache entry %u out of range\n", entry);
-                return false;
-        }
-
-        if (mac != NULL) {
-                /*
-                 * AR_KEYTABLE_VALID indicates that the address is a unicast
-                 * address, which must match the transmitter address for
-                 * decrypting frames.
-                 * Not setting this bit allows the hardware to use the key
-                 * for multicast frame decryption.
-                 */
-                if (mac[0] & 0x01)
-                        unicast_flag = 0;
-
-                macHi = (mac[5] << 8) | mac[4];
-                macLo = (mac[3] << 24) |
-                        (mac[2] << 16) |
-                        (mac[1] << 8) |
-                        mac[0];
-                macLo >>= 1;
-                macLo |= (macHi & 1) << 31;
-                macHi >>= 1;
-        } else {
-                macLo = macHi = 0;
-        }
-        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), macLo);
-        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | unicast_flag);
-
-        return true;
-}
-
-bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
-                                 const struct ath9k_keyval *k,
-                                 const u8 *mac)
-{
-        const struct ath9k_hw_capabilities *pCap = &ah->caps;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 key0, key1, key2, key3, key4;
-        u32 keyType;
-
-        if (entry >= pCap->keycache_size) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "keycache entry %u out of range\n", entry);
-                return false;
-        }
-
-        switch (k->kv_type) {
-        case ATH9K_CIPHER_AES_OCB:
-                keyType = AR_KEYTABLE_TYPE_AES;
-                break;
-        case ATH9K_CIPHER_AES_CCM:
-                if (!(pCap->hw_caps & ATH9K_HW_CAP_CIPHER_AESCCM)) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "AES-CCM not supported by mac rev 0x%x\n",
-                                  ah->hw_version.macRev);
-                        return false;
-                }
-                keyType = AR_KEYTABLE_TYPE_CCM;
-                break;
-        case ATH9K_CIPHER_TKIP:
-                keyType = AR_KEYTABLE_TYPE_TKIP;
-                if (ATH9K_IS_MIC_ENABLED(ah)
-                    && entry + 64 >= pCap->keycache_size) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "entry %u inappropriate for TKIP\n", entry);
-                        return false;
-                }
-                break;
-        case ATH9K_CIPHER_WEP:
-                if (k->kv_len < WLAN_KEY_LEN_WEP40) {
-                        ath_print(common, ATH_DBG_ANY,
-                                  "WEP key length %u too small\n", k->kv_len);
-                        return false;
-                }
-                if (k->kv_len <= WLAN_KEY_LEN_WEP40)
-                        keyType = AR_KEYTABLE_TYPE_40;
-                else if (k->kv_len <= WLAN_KEY_LEN_WEP104)
-                        keyType = AR_KEYTABLE_TYPE_104;
-                else
-                        keyType = AR_KEYTABLE_TYPE_128;
-                break;
-        case ATH9K_CIPHER_CLR:
-                keyType = AR_KEYTABLE_TYPE_CLR;
-                break;
-        default:
-                ath_print(common, ATH_DBG_FATAL,
-                          "cipher %u not supported\n", k->kv_type);
-                return false;
-        }
-
-        key0 = get_unaligned_le32(k->kv_val + 0);
-        key1 = get_unaligned_le16(k->kv_val + 4);
-        key2 = get_unaligned_le32(k->kv_val + 6);
-        key3 = get_unaligned_le16(k->kv_val + 10);
-        key4 = get_unaligned_le32(k->kv_val + 12);
-        if (k->kv_len <= WLAN_KEY_LEN_WEP104)
-                key4 &= 0xff;
-
-        /*
-         * Note: Key cache registers access special memory area that requires
-         * two 32-bit writes to actually update the values in the internal
-         * memory. Consequently, the exact order and pairs used here must be
-         * maintained.
-         */
-
-        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
-                u16 micentry = entry + 64;
-
-                /*
-                 * Write inverted key[47:0] first to avoid Michael MIC errors
-                 * on frames that could be sent or received at the same time.
-                 * The correct key will be written in the end once everything
-                 * else is ready.
-                 */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), ~key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), ~key1);
-
-                /* Write key[95:48] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
-
-                /* Write key[127:96] and key type */
-                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
-                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
-
-                /* Write MAC address for the entry */
-                (void) ath9k_hw_keysetmac(ah, entry, mac);
-
-                if (ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA) {
-                        /*
-                         * TKIP uses two key cache entries:
-                         * Michael MIC TX/RX keys in the same key cache entry
-                         * (idx = main index + 64):
-                         * key0 [31:0] = RX key [31:0]
-                         * key1 [15:0] = TX key [31:16]
-                         * key1 [31:16] = reserved
-                         * key2 [31:0] = RX key [63:32]
-                         * key3 [15:0] = TX key [15:0]
-                         * key3 [31:16] = reserved
-                         * key4 [31:0] = TX key [63:32]
-                         */
-                        u32 mic0, mic1, mic2, mic3, mic4;
-
-                        mic0 = get_unaligned_le32(k->kv_mic + 0);
-                        mic2 = get_unaligned_le32(k->kv_mic + 4);
-                        mic1 = get_unaligned_le16(k->kv_txmic + 2) & 0xffff;
-                        mic3 = get_unaligned_le16(k->kv_txmic + 0) & 0xffff;
-                        mic4 = get_unaligned_le32(k->kv_txmic + 4);
-
-                        /* Write RX[31:0] and TX[31:16] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), mic1);
-
-                        /* Write RX[63:32] and TX[15:0] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), mic3);
-
-                        /* Write TX[63:32] and keyType(reserved) */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), mic4);
-                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
-                                  AR_KEYTABLE_TYPE_CLR);
-
-                } else {
-                        /*
-                         * TKIP uses four key cache entries (two for group
-                         * keys):
-                         * Michael MIC TX/RX keys are in different key cache
-                         * entries (idx = main index + 64 for TX and
-                         * main index + 32 + 96 for RX):
-                         * key0 [31:0] = TX/RX MIC key [31:0]
-                         * key1 [31:0] = reserved
-                         * key2 [31:0] = TX/RX MIC key [63:32]
-                         * key3 [31:0] = reserved
-                         * key4 [31:0] = reserved
-                         *
-                         * Upper layer code will call this function separately
-                         * for TX and RX keys when these registers offsets are
-                         * used.
-                         */
-                        u32 mic0, mic2;
-
-                        mic0 = get_unaligned_le32(k->kv_mic + 0);
-                        mic2 = get_unaligned_le32(k->kv_mic + 4);
-
-                        /* Write MIC key[31:0] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
-
-                        /* Write MIC key[63:32] */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
-                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
-
-                        /* Write TX[63:32] and keyType(reserved) */
-                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
-                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
-                                  AR_KEYTABLE_TYPE_CLR);
-                }
-
-                /* MAC address registers are reserved for the MIC entry */
-                REG_WRITE(ah, AR_KEYTABLE_MAC0(micentry), 0);
-                REG_WRITE(ah, AR_KEYTABLE_MAC1(micentry), 0);
-
-                /*
-                 * Write the correct (un-inverted) key[47:0] last to enable
-                 * TKIP now that all other registers are set with correct
-                 * values.
-                 */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
-        } else {
-                /* Write key[47:0] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
-                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
-
-                /* Write key[95:48] */
-                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
-                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
-
-                /* Write key[127:96] and key type */
-                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
-                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
-
-                /* Write MAC address for the entry */
-                (void) ath9k_hw_keysetmac(ah, entry, mac);
-        }
-
-        return true;
-}
-EXPORT_SYMBOL(ath9k_hw_set_keycache_entry);
-
 /******************************/
 /* Power Management (Chipset) */
 /******************************/
@@ -2056,6 +1781,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         struct ath_btcoex_hw *btcoex_hw = &ah->btcoex_hw;
 
         u16 capField = 0, eeval;
+        u8 ant_div_ctl1;
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
         regulatory->current_rd = eeval;
@@ -2140,24 +1866,13 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         pCap->low_5ghz_chan = 4920;
         pCap->high_5ghz_chan = 6100;
 
-        pCap->hw_caps &= ~ATH9K_HW_CAP_CIPHER_CKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_CIPHER_TKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_CIPHER_AESCCM;
-
-        pCap->hw_caps &= ~ATH9K_HW_CAP_MIC_CKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_MIC_TKIP;
-        pCap->hw_caps |= ATH9K_HW_CAP_MIC_AESCCM;
+        common->crypt_caps |= ATH_CRYPT_CAP_CIPHER_AESCCM;
 
         if (ah->config.ht_enable)
                 pCap->hw_caps |= ATH9K_HW_CAP_HT;
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        pCap->hw_caps |= ATH9K_HW_CAP_GTT;
-        pCap->hw_caps |= ATH9K_HW_CAP_VEOL;
-        pCap->hw_caps |= ATH9K_HW_CAP_BSSIDMASK;
-        pCap->hw_caps &= ~ATH9K_HW_CAP_MCAST_KEYSEARCH;
-
         if (capField & AR_EEPROM_EEPCAP_MAXQCU)
                 pCap->total_queues =
                         MS(capField, AR_EEPROM_EEPCAP_MAXQCU);
@@ -2170,8 +1885,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->keycache_size = AR_KEYTABLE_SIZE;
 
-        pCap->hw_caps |= ATH9K_HW_CAP_FASTCC;
-
         if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
                 pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD >> 1;
         else
@@ -2280,6 +1993,14 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9287_10_OR_LATER(ah) || AR_SREV_9271(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_SGI_20;
 
+        if (AR_SREV_9285(ah))
+                if (ah->eep_ops->get_eeprom(ah, EEP_MODAL_VER) >= 3) {
+                        ant_div_ctl1 =
+                                ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
+                        if ((ant_div_ctl1 & 0x1) && ((ant_div_ctl1 >> 3) & 0x1))
+                                pCap->hw_caps |= ATH9K_HW_CAP_ANT_DIV_COMB;
+                }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 399f7c1283cd..df47f792cf4e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -181,29 +181,19 @@ enum wireless_mode {
 };
 
 enum ath9k_hw_caps {
-        ATH9K_HW_CAP_MIC_AESCCM                 = BIT(0),
-        ATH9K_HW_CAP_MIC_CKIP                   = BIT(1),
-        ATH9K_HW_CAP_MIC_TKIP                   = BIT(2),
-        ATH9K_HW_CAP_CIPHER_AESCCM              = BIT(3),
-        ATH9K_HW_CAP_CIPHER_CKIP                = BIT(4),
-        ATH9K_HW_CAP_CIPHER_TKIP                = BIT(5),
-        ATH9K_HW_CAP_VEOL                       = BIT(6),
-        ATH9K_HW_CAP_BSSIDMASK                  = BIT(7),
-        ATH9K_HW_CAP_MCAST_KEYSEARCH            = BIT(8),
-        ATH9K_HW_CAP_HT                         = BIT(9),
-        ATH9K_HW_CAP_GTT                        = BIT(10),
-        ATH9K_HW_CAP_FASTCC                     = BIT(11),
-        ATH9K_HW_CAP_RFSILENT                   = BIT(12),
-        ATH9K_HW_CAP_CST                        = BIT(13),
-        ATH9K_HW_CAP_ENHANCEDPM                 = BIT(14),
-        ATH9K_HW_CAP_AUTOSLEEP                  = BIT(15),
-        ATH9K_HW_CAP_4KB_SPLITTRANS             = BIT(16),
-        ATH9K_HW_CAP_EDMA                       = BIT(17),
-        ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(18),
-        ATH9K_HW_CAP_LDPC                       = BIT(19),
-        ATH9K_HW_CAP_FASTCLOCK                  = BIT(20),
-        ATH9K_HW_CAP_SGI_20                     = BIT(21),
-        ATH9K_HW_CAP_PAPRD                      = BIT(22),
+        ATH9K_HW_CAP_HT                         = BIT(0),
+        ATH9K_HW_CAP_RFSILENT                   = BIT(1),
+        ATH9K_HW_CAP_CST                        = BIT(2),
+        ATH9K_HW_CAP_ENHANCEDPM                 = BIT(3),
+        ATH9K_HW_CAP_AUTOSLEEP                  = BIT(4),
+        ATH9K_HW_CAP_4KB_SPLITTRANS             = BIT(5),
+        ATH9K_HW_CAP_EDMA                       = BIT(6),
+        ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(7),
+        ATH9K_HW_CAP_LDPC                       = BIT(8),
+        ATH9K_HW_CAP_FASTCLOCK                  = BIT(9),
+        ATH9K_HW_CAP_SGI_20                     = BIT(10),
+        ATH9K_HW_CAP_PAPRD                      = BIT(11),
+        ATH9K_HW_CAP_ANT_DIV_COMB               = BIT(12),
 };
 
 struct ath9k_hw_capabilities {
@@ -355,6 +345,7 @@ struct ath9k_hw_cal_data {
         int16_t rawNoiseFloor;
         bool paprd_done;
         bool nfcal_pending;
+        bool nfcal_interference;
         u16 small_signal_gain[AR9300_MAX_CHAINS];
         u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
         struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
@@ -494,6 +485,12 @@ struct ath_gen_timer_table {
         } timer_mask;
 };
 
+struct ath_hw_antcomb_conf {
+        u8 main_lna_conf;
+        u8 alt_lna_conf;
+        u8 fast_div_bias;
+};
+
 /**
  * struct ath_hw_private_ops - callbacks used internally by hardware code
  *
@@ -873,12 +870,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 int ath9k_hw_fill_cap_info(struct ath_hw *ah);
 u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
 
-/* Key Cache Management */
-bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry);
-bool ath9k_hw_set_keycache_entry(struct ath_hw *ah, u16 entry,
-                                 const struct ath9k_keyval *k,
-                                 const u8 *mac);
-
 /* GPIO / RFKILL / Antennae */
 void ath9k_hw_cfg_gpio_input(struct ath_hw *ah, u32 gpio);
 u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio);
@@ -887,6 +878,10 @@ void ath9k_hw_cfg_output(struct ath_hw *ah, u32 gpio,
 void ath9k_hw_set_gpio(struct ath_hw *ah, u32 gpio, u32 val);
 u32 ath9k_hw_getdefantenna(struct ath_hw *ah);
 void ath9k_hw_setantenna(struct ath_hw *ah, u32 antenna);
+void ath9k_hw_antdiv_comb_conf_get(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf);
+void ath9k_hw_antdiv_comb_conf_set(struct ath_hw *ah,
+                                   struct ath_hw_antcomb_conf *antconf);
 
 /* General Operation */
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
@@ -984,6 +979,7 @@ void ar9003_hw_attach_calib_ops(struct ath_hw *ah);
 void ar9002_hw_attach_ops(struct ath_hw *ah);
 void ar9003_hw_attach_ops(struct ath_hw *ah);
 
+void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan);
 /*
  * ANI work can be shared between all families but a next
  * generation implementation of ANI will be used only for AR9003 only
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 243c1775f343..573899e27b3d 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -33,7 +33,7 @@ int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
 
-int led_blink = 1;
+int led_blink;
 module_param_named(blink, led_blink, int, 0444);
 MODULE_PARM_DESC(blink, "Enable LED blink on activity");
 
@@ -381,7 +381,7 @@ static void ath9k_init_crypto(struct ath_softc *sc)
          * reset the contents on initial power up.
          */
         for (i = 0; i < common->keymax; i++)
-                ath9k_hw_keyreset(sc->sc_ah, (u16) i);
+                ath_hw_keyreset(common, (u16) i);
 
         /*
          * Check whether the separate key cache entries
@@ -389,8 +389,8 @@ static void ath9k_init_crypto(struct ath_softc *sc)
          * With split mic keys the number of stations is limited
          * to 27 otherwise 59.
          */
-        if (!(sc->sc_ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA))
-                common->splitmic = 1;
+        if (sc->sc_ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA)
+                common->crypt_caps |= ATH_CRYPT_CAP_MIC_COMBINED;
 }
 
 static int ath9k_init_btcoex(struct ath_softc *sc)
@@ -522,8 +522,7 @@ static void ath9k_init_misc(struct ath_softc *sc)
         ath9k_hw_set_diversity(sc->sc_ah, true);
         sc->rx.defant = ath9k_hw_getdefantenna(sc->sc_ah);
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+        memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
 
         sc->beacon.slottime = ATH9K_SLOT_TIME_9;
 
@@ -531,6 +530,9 @@ static void ath9k_init_misc(struct ath_softc *sc)
                 sc->beacon.bslot[i] = NULL;
                 sc->beacon.bslot_aphy[i] = NULL;
         }
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
+                sc->ant_comb.count = ATH_ANT_DIV_COMB_INIT_COUNT;
 }
 
 static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
@@ -641,7 +643,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
 
-        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        if (AR_SREV_5416(sc->sc_ah))
+                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->queues = 4;
         hw->max_rates = 4;
@@ -651,7 +654,9 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->sta_data_size = sizeof(struct ath_node);
         hw->vif_data_size = sizeof(struct ath_vif);
 
+#ifdef CONFIG_ATH9K_RATE_CONTROL
         hw->rate_control_algorithm = "ath9k_rate_control";
+#endif
 
         if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index e955bb9d98cb..3efda8a8a3c1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -711,8 +711,11 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         rs->rs_phyerr = phyerr;
                 } else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
                         rs->rs_status |= ATH9K_RXERR_DECRYPT;
-                else if (ads.ds_rxstatus8 & AR_MichaelErr)
+                else if ((ads.ds_rxstatus8 & AR_MichaelErr) &&
+                         rs->rs_keyix != ATH9K_RXKEYIX_INVALID)
                         rs->rs_status |= ATH9K_RXERR_MIC;
+                else if (ads.ds_rxstatus8 & AR_KeyMiss)
+                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 2633896d3998..7c1a34d64f6d 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -660,17 +660,6 @@ struct ath9k_11n_rate_series {
         u32 RateFlags;
 };
 
-struct ath9k_keyval {
-        u8 kv_type;
-        u8 kv_pad;
-        u16 kv_len;
-        u8 kv_val[16]; /* TK */
-        u8 kv_mic[8]; /* Michael MIC key */
-        u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware
-                         * supports both MIC keys in the same key cache entry;
-                         * in that case, kv_mic is the RX key) */
-};
-
 enum ath9k_key_type {
         ATH9K_KEY_TYPE_CLEAR,
         ATH9K_KEY_TYPE_WEP,
@@ -678,16 +667,6 @@ enum ath9k_key_type {
         ATH9K_KEY_TYPE_TKIP,
 };
 
-enum ath9k_cipher {
-        ATH9K_CIPHER_WEP = 0,
-        ATH9K_CIPHER_AES_OCB = 1,
-        ATH9K_CIPHER_AES_CCM = 2,
-        ATH9K_CIPHER_CKIP = 3,
-        ATH9K_CIPHER_TKIP = 4,
-        ATH9K_CIPHER_CLR = 5,
-        ATH9K_CIPHER_MIC = 127
-};
-
 struct ath_hw;
 struct ath9k_channel;
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 3caa32316e7b..8b327bcad695 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -226,9 +226,10 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                 caldata = &aphy->caldata;
 
         ath_print(common, ATH_DBG_CONFIG,
-                  "(%u MHz) -> (%u MHz), conf_is_ht40: %d\n",
+                  "(%u MHz) -> (%u MHz), conf_is_ht40: %d fastcc: %d\n",
                   sc->sc_ah->curchan->channel,
-                  channel->center_freq, conf_is_ht40(conf));
+                  channel->center_freq, conf_is_ht40(conf),
+                  fastcc);
 
         spin_lock_bh(&sc->sc_resetlock);
 
@@ -254,10 +255,10 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
-        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
-                ath_start_ani(common);
-                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
                 ath_beacon_config(sc, NULL);
+                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+                ath_start_ani(common);
         }
 
  ps_restore:
@@ -395,7 +396,12 @@ void ath_ani_calibrate(unsigned long data)
         bool shortcal = false;
         bool aniflag = false;
         unsigned int timestamp = jiffies_to_msecs(jiffies);
-        u32 cal_interval, short_cal_interval;
+        u32 cal_interval, short_cal_interval, long_cal_interval;
+
+        if (ah->caldata && ah->caldata->nfcal_interference)
+                long_cal_interval = ATH_LONG_CALINTERVAL_INT;
+        else
+                long_cal_interval = ATH_LONG_CALINTERVAL;
 
         short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
                 ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
@@ -407,7 +413,7 @@ void ath_ani_calibrate(unsigned long data)
         ath9k_ps_wakeup(sc);
 
         /* Long calibration runs independently of short calibration. */
-        if ((timestamp - common->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
+        if ((timestamp - common->ani.longcal_timer) >= long_cal_interval) {
                 longcal = true;
                 ath_print(common, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
                 common->ani.longcal_timer = timestamp;
@@ -951,7 +957,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         ath_update_txpow(sc);
 
-        if (sc->sc_flags & SC_OP_BEACONS)
+        if ((sc->sc_flags & SC_OP_BEACONS) || !(sc->sc_flags & (SC_OP_OFFCHANNEL)))
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -1150,8 +1156,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
         else
                 ah->imask |= ATH9K_INT_RX;
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
-                ah->imask |= ATH9K_INT_GTT;
+        ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 ah->imask |= ATH9K_INT_CST;
@@ -1373,12 +1378,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
 
-        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK) &&
-            sc->nvifs > 0) {
-                ret = -ENOBUFS;
-                goto out;
-        }
-
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 ic_opmode = NL80211_IFTYPE_STATION;
@@ -1408,8 +1407,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         sc->nvifs++;
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath9k_set_bssid_mask(hw);
+        ath9k_set_bssid_mask(hw, vif);
 
         if (sc->nvifs > 1)
                 goto out; /* skip global settings for secondary vif */
@@ -1556,6 +1554,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
          * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode.
          */
         if (changed & IEEE80211_CONF_CHANGE_PS) {
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (conf->flags & IEEE80211_CONF_PS) {
                         sc->ps_flags |= PS_ENABLED;
                         /*
@@ -1570,7 +1570,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                         sc->ps_enabled = false;
                         sc->ps_flags &= ~(PS_ENABLED |
                                           PS_NULLFUNC_COMPLETED);
-                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
+                        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
                         if (!(ah->caps.hw_caps &
                               ATH9K_HW_CAP_AUTOSLEEP)) {
                                 ath9k_hw_setrxabort(sc->sc_ah, 0);
@@ -1585,6 +1585,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                 }
                         }
                 }
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
@@ -1771,20 +1772,21 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         switch (cmd) {
         case SET_KEY:
-                ret = ath9k_cmn_key_config(common, vif, sta, key);
+                ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
                         /* push IV and Michael MIC generation to stack */
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                        if (key->alg == ALG_TKIP)
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
                                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        if (sc->sc_ah->sw_mgmt_crypto && key->alg == ALG_CCMP)
+                        if (sc->sc_ah->sw_mgmt_crypto &&
+                            key->cipher == WLAN_CIPHER_SUITE_CCMP)
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT;
                         ret = 0;
                 }
                 break;
         case DISABLE_KEY:
-                ath9k_cmn_key_delete(common, key);
+                ath_key_delete(common, key);
                 break;
         default:
                 ret = -EINVAL;
@@ -1968,8 +1970,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 break;
         case IEEE80211_AMPDU_TX_START:
                 ath9k_ps_wakeup(sc);
-                ath_tx_aggr_start(sc, sta, tid, ssn);
-                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ret = ath_tx_aggr_start(sc, sta, tid, ssn);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
@@ -2032,7 +2035,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
-        sc->sc_flags |= SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
@@ -2047,7 +2049,6 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 
         mutex_lock(&sc->mutex);
         aphy->state = ATH_WIPHY_ACTIVE;
-        sc->sc_flags &= ~SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index e724c2c1ae2a..17969af842f6 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -45,9 +45,6 @@
                 }                                                       \
         } while (0)
 
-#define ATH9K_IS_MIC_ENABLED(ah)                                        \
-        ((ah)->sta_id1_defaults & AR_STA_ID1_CRPT_MIC_ENABLE)
-
 #define ANTSWAP_AB 0x0001
 #define REDUCE_CHAIN_0 0x00000050
 #define REDUCE_CHAIN_1 0x00000051
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index e49be733d546..ce1cd6d85847 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1320,6 +1320,22 @@ static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta,
         return caps;
 }
 
+static bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an,
+                              u8 tidno)
+{
+        struct ath_atx_tid *txtid;
+
+        if (!(sc->sc_flags & SC_OP_TXAGGR))
+                return false;
+
+        txtid = ATH_AN_2_TID(an, tidno);
+
+        if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
+                        return true;
+        return false;
+}
+
+
 /***********************************/
 /* mac80211 Rate Control callbacks */
 /***********************************/
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index dc1082654501..268072fd3c1c 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -224,7 +224,18 @@ enum ath9k_internal_frame_type {
         ATH9K_IFT_UNPAUSE
 };
 
+#ifdef CONFIG_ATH9K_RATE_CONTROL
 int ath_rate_control_register(void);
 void ath_rate_control_unregister(void);
+#else
+static inline int ath_rate_control_register(void)
+{
+        return 0;
+}
+
+static inline void ath_rate_control_unregister(void)
+{
+}
+#endif
 
 #endif /* RC_H */
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a3fc987ebab0..c5e7af4f51ab 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -19,6 +19,15 @@
 
 #define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
 
+static inline bool ath_is_alt_ant_ratio_better(int alt_ratio, int maxdelta,
+                                               int mindelta, int main_rssi_avg,
+                                               int alt_rssi_avg, int pkt_count)
+{
+        return (((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                (alt_rssi_avg > main_rssi_avg + maxdelta)) ||
+                (alt_rssi_avg > main_rssi_avg + mindelta)) && (pkt_count > 50);
+}
+
 static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
 {
         return sc->ps_enabled &&
@@ -110,8 +119,7 @@ static void ath_opmode_init(struct ath_softc *sc)
         ath9k_hw_setrxfilter(ah, rfilt);
 
         /* configure bssid mask */
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
-                ath_hw_setbssidmask(common);
+        ath_hw_setbssidmask(common);
 
         /* configure operational mode */
         ath9k_hw_setopmode(ah);
@@ -292,7 +300,7 @@ static void ath_edma_start_recv(struct ath_softc *sc)
 
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -440,6 +448,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_CONTROL;
 
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) &&
+            (sc->nvifs <= 1) &&
             !(sc->rx.rxfilter & FIF_BCN_PRBRESP_PROMISC))
                 rfilt |= ATH9K_RX_FILTER_MYBEACON;
         else
@@ -454,9 +463,8 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         if (conf_is_ht(&sc->hw->conf))
                 rfilt |= ATH9K_RX_FILTER_COMP_BAR;
 
-        if (sc->sec_wiphy || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
-                /* TODO: only needed if more than one BSSID is in use in
-                 * station/adhoc mode */
+        if (sc->sec_wiphy || (sc->nvifs > 1) ||
+            (sc->rx.rxfilter & FIF_OTHER_BSS)) {
                 /* The following may also be needed for other older chips */
                 if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
                         rfilt |= ATH9K_RX_FILTER_PROM;
@@ -498,7 +506,7 @@ int ath_startrecv(struct ath_softc *sc)
 start_recv:
         spin_unlock_bh(&sc->rx.rxbuflock);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
 
         return 0;
 }
@@ -631,7 +639,7 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
                  * No more broadcast/multicast frames to be received at this
                  * point.
                  */
-                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                sc->ps_flags &= ~(PS_WAIT_FOR_CAB | PS_WAIT_FOR_BEACON);
                 ath_print(common, ATH_DBG_PS,
                           "All PS CAB frames received, back to sleep\n");
         } else if ((sc->ps_flags & PS_WAIT_FOR_PSPOLL_DATA) &&
@@ -870,15 +878,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
                 if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
                         *decrypt_error = true;
                 } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
-                        if (ieee80211_is_ctl(fc))
-                                /*
-                                 * Sometimes, we get invalid
-                                 * MIC failures on valid control frames.
-                                 * Remove these mic errors.
-                                 */
-                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
-                        else
+                        /*
+                         * The MIC error bit is only valid if the frame
+                         * is not a control frame or fragment, and it was
+                         * decrypted using a valid TKIP key.
+                         */
+                        if (!ieee80211_is_ctl(fc) &&
+                            !ieee80211_has_morefrags(fc) &&
+                            !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
+                            test_bit(rx_stats->rs_keyix, common->tkip_keymap))
                                 rxs->flag |= RX_FLAG_MMIC_ERROR;
+                        else
+                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
                 }
                 /*
                  * Reject error frames with the exception of
@@ -1073,6 +1084,539 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
                 rxs->flag &= ~RX_FLAG_DECRYPTED;
 }
 
+static void ath_lnaconf_alt_good_scan(struct ath_ant_comb *antcomb,
+                                      struct ath_hw_antcomb_conf ant_conf,
+                                      int main_rssi_avg)
+{
+        antcomb->quick_scan_cnt = 0;
+
+        if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
+                antcomb->rssi_lna2 = main_rssi_avg;
+        else if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA1)
+                antcomb->rssi_lna1 = main_rssi_avg;
+
+        switch ((ant_conf.main_lna_conf << 4) | ant_conf.alt_lna_conf) {
+        case (0x10): /* LNA2 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case (0x20): /* LNA1 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        case (0x21): /* LNA1 LNA2 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case (0x12): /* LNA2 LNA1 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case (0x13): /* LNA2 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case (0x23): /* LNA1 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
+                                struct ath_hw_antcomb_conf *div_ant_conf,
+                                int main_rssi_avg, int alt_rssi_avg,
+                                int alt_ratio)
+{
+        /* alt_good */
+        switch (antcomb->quick_scan_cnt) {
+        case 0:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->first_quick_scan_conf;
+                break;
+        case 1:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->second_quick_scan_conf;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_second = alt_rssi_avg;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        /* main is LNA1 */
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                            (alt_rssi_avg > main_rssi_avg +
+                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                            (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                }
+                break;
+        case 2:
+                antcomb->alt_good = false;
+                antcomb->scan_not_start = false;
+                antcomb->scan = false;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_third = alt_rssi_avg;
+
+                if (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1)
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA2)
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2) {
+                        if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2)
+                                antcomb->rssi_lna2 = main_rssi_avg;
+                        else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1)
+                                antcomb->rssi_lna1 = main_rssi_avg;
+                }
+
+                if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
+                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                else
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                            (alt_rssi_avg > main_rssi_avg +
+                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                            (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                }
+
+                /* set alt to the conf with maximun ratio */
+                if (antcomb->first_ratio && antcomb->second_ratio) {
+                        if (antcomb->rssi_second > antcomb->rssi_third) {
+                                /* first alt*/
+                                if ((antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA1) ||
+                                    (antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2*/
+                                        if (div_ant_conf->main_lna_conf ==
+                                            ATH_ANT_DIV_COMB_LNA2)
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                        else
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                                else
+                                        /* Set alt to A+B or A-B */
+                                        div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                        } else if ((antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA1) ||
+                                   (antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA2)) {
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        } else {
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                        antcomb->second_quick_scan_conf;
+                        }
+                } else if (antcomb->first_ratio) {
+                        /* first alt */
+                        if ((antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                } else if (antcomb->second_ratio) {
+                                /* second alt */
+                        if ((antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->second_quick_scan_conf;
+                } else {
+                        /* main is largest */
+                        if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf = antcomb->main_conf;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf)
+{
+        /* Adjust the fast_div_bias based on main and alt lna conf */
+        switch ((ant_conf->main_lna_conf << 4) | ant_conf->alt_lna_conf) {
+        case (0x01): /* A-B LNA2 */
+                ant_conf->fast_div_bias = 0x3b;
+                break;
+        case (0x02): /* A-B LNA1 */
+                ant_conf->fast_div_bias = 0x3d;
+                break;
+        case (0x03): /* A-B A+B */
+                ant_conf->fast_div_bias = 0x1;
+                break;
+        case (0x10): /* LNA2 A-B */
+                ant_conf->fast_div_bias = 0x7;
+                break;
+        case (0x12): /* LNA2 LNA1 */
+                ant_conf->fast_div_bias = 0x2;
+                break;
+        case (0x13): /* LNA2 A+B */
+                ant_conf->fast_div_bias = 0x7;
+                break;
+        case (0x20): /* LNA1 A-B */
+                ant_conf->fast_div_bias = 0x6;
+                break;
+        case (0x21): /* LNA1 LNA2 */
+                ant_conf->fast_div_bias = 0x0;
+                break;
+        case (0x23): /* LNA1 A+B */
+                ant_conf->fast_div_bias = 0x6;
+                break;
+        case (0x30): /* A+B A-B */
+                ant_conf->fast_div_bias = 0x1;
+                break;
+        case (0x31): /* A+B LNA2 */
+                ant_conf->fast_div_bias = 0x3b;
+                break;
+        case (0x32): /* A+B LNA1 */
+                ant_conf->fast_div_bias = 0x3d;
+                break;
+        default:
+                break;
+        }
+}
+
+/* Antenna diversity and combining */
+static void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
+{
+        struct ath_hw_antcomb_conf div_ant_conf;
+        struct ath_ant_comb *antcomb = &sc->ant_comb;
+        int alt_ratio = 0, alt_rssi_avg = 0, main_rssi_avg = 0, curr_alt_set;
+        int curr_main_set, curr_bias;
+        int main_rssi = rs->rs_rssi_ctl0;
+        int alt_rssi = rs->rs_rssi_ctl1;
+        int rx_ant_conf,  main_ant_conf;
+        bool short_scan = false;
+
+        rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
+                       ATH_ANT_RX_MASK;
+        main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
+                         ATH_ANT_RX_MASK;
+
+        /* Record packet only when alt_rssi is positive */
+        if (alt_rssi > 0) {
+                antcomb->total_pkt_count++;
+                antcomb->main_total_rssi += main_rssi;
+                antcomb->alt_total_rssi  += alt_rssi;
+                if (main_ant_conf == rx_ant_conf)
+                        antcomb->main_recv_cnt++;
+                else
+                        antcomb->alt_recv_cnt++;
+        }
+
+        /* Short scan check */
+        if (antcomb->scan && antcomb->alt_good) {
+                if (time_after(jiffies, antcomb->scan_start_time +
+                    msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
+                        short_scan = true;
+                else
+                        if (antcomb->total_pkt_count ==
+                            ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
+                                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                                            antcomb->total_pkt_count);
+                                if (alt_ratio < ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
+                                        short_scan = true;
+                        }
+        }
+
+        if (((antcomb->total_pkt_count < ATH_ANT_DIV_COMB_MAX_PKTCOUNT) ||
+            rs->rs_moreaggr) && !short_scan)
+                return;
+
+        if (antcomb->total_pkt_count) {
+                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                             antcomb->total_pkt_count);
+                main_rssi_avg = (antcomb->main_total_rssi /
+                                 antcomb->total_pkt_count);
+                alt_rssi_avg = (antcomb->alt_total_rssi /
+                                 antcomb->total_pkt_count);
+        }
+
+
+        ath9k_hw_antdiv_comb_conf_get(sc->sc_ah, &div_ant_conf);
+        curr_alt_set = div_ant_conf.alt_lna_conf;
+        curr_main_set = div_ant_conf.main_lna_conf;
+        curr_bias = div_ant_conf.fast_div_bias;
+
+        antcomb->count++;
+
+        if (antcomb->count == ATH_ANT_DIV_COMB_MAX_COUNT) {
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
+                        ath_lnaconf_alt_good_scan(antcomb, div_ant_conf,
+                                                  main_rssi_avg);
+                        antcomb->alt_good = true;
+                } else {
+                        antcomb->alt_good = false;
+                }
+
+                antcomb->count = 0;
+                antcomb->scan = true;
+                antcomb->scan_not_start = true;
+        }
+
+        if (!antcomb->scan) {
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
+                        if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
+                                /* Switch main and alt LNA */
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+
+                        goto div_comb_done;
+                } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
+                           (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+
+                        goto div_comb_done;
+                }
+
+                if ((alt_rssi_avg < (main_rssi_avg +
+                    ATH_ANT_DIV_COMB_LNA1_LNA2_DELTA)))
+                        goto div_comb_done;
+        }
+
+        if (!antcomb->scan_not_start) {
+                switch (curr_alt_set) {
+                case ATH_ANT_DIV_COMB_LNA2:
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                        antcomb->rssi_lna1 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1:
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                        antcomb->rssi_lna2 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
+                        antcomb->rssi_add = alt_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A-B */
+                        div_ant_conf.alt_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
+                        antcomb->rssi_sub = alt_rssi_avg;
+                        antcomb->scan = false;
+                        if (antcomb->rssi_lna2 >
+                            (antcomb->rssi_lna1 +
+                            ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
+                                /* use LNA2 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA1 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                }
+                        } else {
+                                /* use LNA1 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA2 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                }
+                        }
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                if (!antcomb->alt_good) {
+                        antcomb->scan_not_start = false;
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+                        goto div_comb_done;
+                }
+        }
+
+        ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
+                                           main_rssi_avg, alt_rssi_avg,
+                                           alt_ratio);
+
+        antcomb->quick_scan_cnt++;
+
+div_comb_done:
+        ath_ant_div_conf_fast_divbias(&div_ant_conf);
+
+        ath9k_hw_antdiv_comb_conf_set(sc->sc_ah, &div_ant_conf);
+
+        antcomb->scan_start_time = jiffies;
+        antcomb->total_pkt_count = 0;
+        antcomb->main_total_rssi = 0;
+        antcomb->alt_total_rssi = 0;
+        antcomb->main_recv_cnt = 0;
+        antcomb->alt_recv_cnt = 0;
+}
+
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
         struct ath_buf *bf;
@@ -1096,6 +1640,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u8 rx_status_len = ah->caps.rx_status_len;
         u64 tsf = 0;
         u32 tsf_lower = 0;
+        unsigned long flags;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1204,11 +1749,16 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (unlikely(ath9k_check_auto_sleep(sc) ||
                              (sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                               PS_WAIT_FOR_CAB |
                                               PS_WAIT_FOR_PSPOLL_DATA))))
                         ath_rx_ps(sc, skb);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+
+                if (ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
+                        ath_ant_comb_scan(sc, &rs);
 
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index fd20241f57d8..ec7cf5ee56bc 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -19,45 +19,36 @@
 #include "ath9k.h"
 
 struct ath9k_vif_iter_data {
-        int count;
-        u8 *addr;
+        const u8 *hw_macaddr;
+        u8 mask[ETH_ALEN];
 };
 
 static void ath9k_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
 {
         struct ath9k_vif_iter_data *iter_data = data;
-        u8 *nbuf;
-
-        nbuf = krealloc(iter_data->addr, (iter_data->count + 1) * ETH_ALEN,
-                        GFP_ATOMIC);
-        if (nbuf == NULL)
-                return;
+        int i;
 
-        memcpy(nbuf + iter_data->count * ETH_ALEN, mac, ETH_ALEN);
-        iter_data->addr = nbuf;
-        iter_data->count++;
+        for (i = 0; i < ETH_ALEN; i++)
+                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
 }
 
-void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
+void ath9k_set_bssid_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
-        int i, j;
-        u8 mask[ETH_ALEN];
+        int i;
 
         /*
-         * Add primary MAC address even if it is not in active use since it
-         * will be configured to the hardware as the starting point and the
-         * BSSID mask will need to be changed if another address is active.
+         * Use the hardware MAC address as reference, the hardware uses it
+         * together with the BSSID mask when matching addresses.
          */
-        iter_data.addr = kmalloc(ETH_ALEN, GFP_ATOMIC);
-        if (iter_data.addr) {
-                memcpy(iter_data.addr, common->macaddr, ETH_ALEN);
-                iter_data.count = 1;
-        } else
-                iter_data.count = 0;
+        iter_data.hw_macaddr = common->macaddr;
+        memset(&iter_data.mask, 0xff, ETH_ALEN);
+
+        if (vif)
+                ath9k_vif_iter(&iter_data, vif->addr, vif);
 
         /* Get list of all active MAC addresses */
         spin_lock_bh(&sc->wiphy_lock);
@@ -71,31 +62,7 @@ void ath9k_set_bssid_mask(struct ieee80211_hw *hw)
         }
         spin_unlock_bh(&sc->wiphy_lock);
 
-        /* Generate an address mask to cover all active addresses */
-        memset(mask, 0, ETH_ALEN);
-        for (i = 0; i < iter_data.count; i++) {
-                u8 *a1 = iter_data.addr + i * ETH_ALEN;
-                for (j = i + 1; j < iter_data.count; j++) {
-                        u8 *a2 = iter_data.addr + j * ETH_ALEN;
-                        mask[0] |= a1[0] ^ a2[0];
-                        mask[1] |= a1[1] ^ a2[1];
-                        mask[2] |= a1[2] ^ a2[2];
-                        mask[3] |= a1[3] ^ a2[3];
-                        mask[4] |= a1[4] ^ a2[4];
-                        mask[5] |= a1[5] ^ a2[5];
-                }
-        }
-
-        kfree(iter_data.addr);
-
-        /* Invert the mask and configure hardware */
-        common->bssidmask[0] = ~mask[0];
-        common->bssidmask[1] = ~mask[1];
-        common->bssidmask[2] = ~mask[2];
-        common->bssidmask[3] = ~mask[3];
-        common->bssidmask[4] = ~mask[4];
-        common->bssidmask[5] = ~mask[5];
-
+        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 6260faa658a2..93a8bda09c25 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -85,6 +85,8 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
                 return "WMI_TGT_DETACH_CMDID";
         case WMI_TGT_TXQ_ENABLE_CMDID:
                 return "WMI_TGT_TXQ_ENABLE_CMDID";
+        case WMI_AGGR_LIMIT_CMD:
+                return "WMI_AGGR_LIMIT_CMD";
         }
 
         return "Bogus";
@@ -122,55 +124,11 @@ void ath9k_wmi_tasklet(unsigned long data)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct wmi_cmd_hdr *hdr;
-        struct wmi_swba *swba_hdr;
-        enum wmi_event_id event;
-        struct sk_buff *skb;
-        void *wmi_event;
-        unsigned long flags;
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-        __be32 txrate;
-#endif
 
-        spin_lock_irqsave(&priv->wmi->wmi_lock, flags);
-        skb = priv->wmi->wmi_skb;
-        spin_unlock_irqrestore(&priv->wmi->wmi_lock, flags);
+        ath_print(common, ATH_DBG_WMI, "SWBA Event received\n");
 
-        hdr = (struct wmi_cmd_hdr *) skb->data;
-        event = be16_to_cpu(hdr->command_id);
-        wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+        ath9k_htc_swba(priv, priv->wmi->beacon_pending);
 
-        ath_print(common, ATH_DBG_WMI,
-                  "WMI Event: 0x%x\n", event);
-
-        switch (event) {
-        case WMI_TGT_RDY_EVENTID:
-                break;
-        case WMI_SWBA_EVENTID:
-                swba_hdr = (struct wmi_swba *) wmi_event;
-                ath9k_htc_swba(priv, swba_hdr->beacon_pending);
-                break;
-        case WMI_FATAL_EVENTID:
-                break;
-        case WMI_TXTO_EVENTID:
-                break;
-        case WMI_BMISS_EVENTID:
-                break;
-        case WMI_WLAN_TXCOMP_EVENTID:
-                break;
-        case WMI_DELBA_EVENTID:
-                break;
-        case WMI_TXRATE_EVENTID:
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-                txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
-                priv->debug.txrate = be32_to_cpu(txrate);
-#endif
-                break;
-        default:
-                break;
-        }
-
-        kfree_skb(skb);
 }
 
 static void ath9k_wmi_rsp_callback(struct wmi *wmi, struct sk_buff *skb)
@@ -189,6 +147,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         struct wmi *wmi = (struct wmi *) priv;
         struct wmi_cmd_hdr *hdr;
         u16 cmd_id;
+        void *wmi_event;
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+        __be32 txrate;
+#endif
 
         if (unlikely(wmi->stopped))
                 goto free_skb;
@@ -197,10 +159,22 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         cmd_id = be16_to_cpu(hdr->command_id);
 
         if (cmd_id & 0x1000) {
-                spin_lock(&wmi->wmi_lock);
-                wmi->wmi_skb = skb;
-                spin_unlock(&wmi->wmi_lock);
-                tasklet_schedule(&wmi->drv_priv->wmi_tasklet);
+                wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+                switch (cmd_id) {
+                case WMI_SWBA_EVENTID:
+                        wmi->beacon_pending = *(u8 *)wmi_event;
+                        tasklet_schedule(&wmi->drv_priv->wmi_tasklet);
+                        break;
+                case WMI_TXRATE_EVENTID:
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+                        txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
+                        wmi->drv_priv->debug.txrate = be32_to_cpu(txrate);
+#endif
+                        break;
+                default:
+                        break;
+                }
+                kfree_skb(skb);
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 765db5faa2d3..ac61074af8ac 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -31,10 +31,6 @@ struct wmi_cmd_hdr {
         __be16 seq_no;
 } __packed;
 
-struct wmi_swba {
-        u8 beacon_pending;
-} __packed;
-
 enum wmi_cmd_id {
         WMI_ECHO_CMDID = 0x0001,
         WMI_ACCESS_MEMORY_CMDID,
@@ -71,6 +67,7 @@ enum wmi_cmd_id {
         WMI_TX_AGGR_ENABLE_CMDID,
         WMI_TGT_DETACH_CMDID,
         WMI_TGT_TXQ_ENABLE_CMDID,
+        WMI_AGGR_LIMIT_CMD = 0x0026,
 };
 
 enum wmi_event_id {
@@ -103,7 +100,7 @@ struct wmi {
         u32 cmd_rsp_len;
         bool stopped;
 
-        struct sk_buff *wmi_skb;
+        u8 beacon_pending;
         spinlock_t wmi_lock;
 
         atomic_t mwrite_cnt;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 4dda14e36227..85a7323a04ef 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -61,6 +61,8 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
                               struct ath_tx_status *ts, int txok);
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
+static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+                              int seqno);
 
 enum {
         MCS_HT20,
@@ -143,18 +145,23 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
         struct ath_buf *bf;
         struct list_head bf_head;
-        INIT_LIST_HEAD(&bf_head);
+        struct ath_tx_status ts;
 
-        WARN_ON(!tid->paused);
+        INIT_LIST_HEAD(&bf_head);
 
+        memset(&ts, 0, sizeof(ts));
         spin_lock_bh(&txq->axq_lock);
-        tid->paused = false;
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-                BUG_ON(bf_isretried(bf));
                 list_move_tail(&bf->list, &bf_head);
-                ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+
+                if (bf_isretried(bf)) {
+                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
+                } else {
+                        ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+                }
         }
 
         spin_unlock_bh(&txq->axq_lock);
@@ -168,9 +175,9 @@ static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
         index  = ATH_BA_INDEX(tid->seq_start, seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 
-        tid->tx_buf[cindex] = NULL;
+        __clear_bit(cindex, tid->tx_buf);
 
-        while (tid->baw_head != tid->baw_tail && !tid->tx_buf[tid->baw_head]) {
+        while (tid->baw_head != tid->baw_tail && !test_bit(tid->baw_head, tid->tx_buf)) {
                 INCR(tid->seq_start, IEEE80211_SEQ_MAX);
                 INCR(tid->baw_head, ATH_TID_MAX_BUFS);
         }
@@ -186,9 +193,7 @@ static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 
         index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
-
-        BUG_ON(tid->tx_buf[cindex] != NULL);
-        tid->tx_buf[cindex] = bf;
+        __set_bit(cindex, tid->tx_buf);
 
         if (index >= ((tid->baw_tail - tid->baw_head) &
                 (ATH_TID_MAX_BUFS - 1))) {
@@ -431,7 +436,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         list_move_tail(&bf->list, &bf_head);
                 }
 
-                if (!txpending) {
+                if (!txpending || (tid->state & AGGR_CLEANUP)) {
                         /*
                          * complete the acked-ones/xretried ones; update
                          * block-ack window
@@ -510,15 +515,12 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         if (tid->state & AGGR_CLEANUP) {
+                ath_tx_flush_tid(sc, tid);
+
                 if (tid->baw_head == tid->baw_tail) {
                         tid->state &= ~AGGR_ADDBA_COMPLETE;
                         tid->state &= ~AGGR_CLEANUP;
-
-                        /* send buffered frames as singles */
-                        ath_tx_flush_tid(sc, tid);
                 }
-                rcu_read_unlock();
-                return;
         }
 
         rcu_read_unlock();
@@ -785,17 +787,23 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  status != ATH_AGGR_BAW_CLOSED);
 }
 
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn)
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
         struct ath_node *an;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+
+        if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
+                return -EAGAIN;
+
         txtid->state |= AGGR_ADDBA_PROGRESS;
         txtid->paused = true;
         *ssn = txtid->seq_start;
+
+        return 0;
 }
 
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -803,12 +811,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
         struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
-        struct ath_tx_status ts;
-        struct ath_buf *bf;
-        struct list_head bf_head;
-
-        memset(&ts, 0, sizeof(ts));
-        INIT_LIST_HEAD(&bf_head);
 
         if (txtid->state & AGGR_CLEANUP)
                 return;
@@ -818,31 +820,22 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 return;
         }
 
-        /* drop all software retried frames and mark this TID */
         spin_lock_bh(&txq->axq_lock);
         txtid->paused = true;
-        while (!list_empty(&txtid->buf_q)) {
-                bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
-                if (!bf_isretried(bf)) {
-                        /*
-                         * NB: it's based on the assumption that
-                         * software retried frame will always stay
-                         * at the head of software queue.
-                         */
-                        break;
-                }
-                list_move_tail(&bf->list, &bf_head);
-                ath_tx_update_baw(sc, txtid, bf->bf_seqno);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
-        }
-        spin_unlock_bh(&txq->axq_lock);
 
-        if (txtid->baw_head != txtid->baw_tail) {
+        /*
+         * If frames are still being transmitted for this TID, they will be
+         * cleaned up during tx completion. To prevent race conditions, this
+         * TID can only be reused after all in-progress subframes have been
+         * completed.
+         */
+        if (txtid->baw_head != txtid->baw_tail)
                 txtid->state |= AGGR_CLEANUP;
-        } else {
+        else
                 txtid->state &= ~AGGR_ADDBA_COMPLETE;
-                ath_tx_flush_tid(sc, txtid);
-        }
+        spin_unlock_bh(&txq->axq_lock);
+
+        ath_tx_flush_tid(sc, txtid);
 }
 
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -862,20 +855,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid
         }
 }
 
-bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno)
-{
-        struct ath_atx_tid *txtid;
-
-        if (!(sc->sc_flags & SC_OP_TXAGGR))
-                return false;
-
-        txtid = ATH_AN_2_TID(an, tidno);
-
-        if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
-                        return true;
-        return false;
-}
-
 /********************/
 /* Queue Management */
 /********************/
@@ -1407,22 +1386,6 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
         return htype;
 }
 
-static int get_hw_crypto_keytype(struct sk_buff *skb)
-{
-        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-
-        if (tx_info->control.hw_key) {
-                if (tx_info->control.hw_key->alg == ALG_WEP)
-                        return ATH9K_KEY_TYPE_WEP;
-                else if (tx_info->control.hw_key->alg == ALG_TKIP)
-                        return ATH9K_KEY_TYPE_TKIP;
-                else if (tx_info->control.hw_key->alg == ALG_CCMP)
-                        return ATH9K_KEY_TYPE_AES;
-        }
-
-        return ATH9K_KEY_TYPE_CLEAR;
-}
-
 static void assign_aggr_tid_seqno(struct sk_buff *skb,
                                   struct ath_buf *bf)
 {
@@ -1661,7 +1624,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_state.bfs_paprd_timestamp = jiffies;
         bf->bf_flags = setup_tx_flags(skb, use_ldpc);
 
-        bf->bf_keytype = get_hw_crypto_keytype(skb);
+        bf->bf_keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
         if (bf->bf_keytype != ATH9K_KEY_TYPE_CLEAR) {
                 bf->bf_frmlen += tx_info->control.hw_key->icv_len;
                 bf->bf_keyix = tx_info->control.hw_key->hw_key_idx;
diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig
new file mode 100644
index 000000000000..c5d3a3f2e55b
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/Kconfig
@@ -0,0 +1,41 @@
+config CARL9170
+        tristate "Linux Community AR9170 802.11n USB support"
+        depends on USB && MAC80211 && EXPERIMENTAL
+        select FW_LOADER
+        select CRC32
+        help
+          This is another driver for the Atheros "otus" 802.11n USB devices.
+
+          This driver provides more features than the original,
+          but it needs a special firmware (carl9170-1.fw) to do that.
+
+          The firmware can be downloaded from our wiki here:
+          http://wireless.kernel.org/en/users/Drivers/carl9170
+
+          If you choose to build a module, it'll be called carl9170.
+
+config CARL9170_LEDS
+        bool "SoftLED Support"
+        depends on CARL9170
+        select MAC80211_LEDS
+        select LEDS_CLASS
+        select NEW_LEDS
+        default y
+        help
+          This option is necessary, if you want your device' LEDs to blink
+
+          Say Y, unless you need the LEDs for firmware debugging.
+
+config CARL9170_DEBUGFS
+        bool "DebugFS Support"
+        depends on CARL9170 && DEBUG_FS && MAC80211_DEBUGFS
+        default n
+        help
+          Export several driver and device internals to user space.
+
+          Say N.
+
+config CARL9170_WPC
+        bool
+        depends on CARL9170 && (INPUT = y || INPUT = CARL9170)
+        default y
diff --git a/drivers/net/wireless/ath/carl9170/Makefile b/drivers/net/wireless/ath/carl9170/Makefile
new file mode 100644
index 000000000000..f64ed76af8ad
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/Makefile
@@ -0,0 +1,4 @@
+carl9170-objs := main.o usb.o cmd.o mac.o phy.o led.o fw.o tx.o rx.o
+carl9170-$(CONFIG_CARL9170_DEBUGFS) += debug.o
+
+obj-$(CONFIG_CARL9170) += carl9170.o
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
new file mode 100644
index 000000000000..d7c5482d74ce
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -0,0 +1,627 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Driver specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CARL9170_H
+#define __CARL9170_H
+
+#include <linux/kernel.h>
+#include <linux/firmware.h>
+#include <linux/completion.h>
+#include <linux/spinlock.h>
+#include <net/cfg80211.h>
+#include <net/mac80211.h>
+#include <linux/usb.h>
+#ifdef CONFIG_CARL9170_LEDS
+#include <linux/leds.h>
+#endif /* CONFIG_CARL170_LEDS */
+#ifdef CONFIG_CARL9170_WPC
+#include <linux/input.h>
+#endif /* CONFIG_CARL9170_WPC */
+#include "eeprom.h"
+#include "wlan.h"
+#include "hw.h"
+#include "fwdesc.h"
+#include "fwcmd.h"
+#include "../regd.h"
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+#include "debug.h"
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+#define CARL9170FW_NAME "carl9170-1.fw"
+
+#define PAYLOAD_MAX     (CARL9170_MAX_CMD_LEN / 4 - 1)
+
+enum carl9170_rf_init_mode {
+        CARL9170_RFI_NONE,
+        CARL9170_RFI_WARM,
+        CARL9170_RFI_COLD,
+};
+
+#define CARL9170_MAX_RX_BUFFER_SIZE             8192
+
+enum carl9170_device_state {
+        CARL9170_UNKNOWN_STATE,
+        CARL9170_STOPPED,
+        CARL9170_IDLE,
+        CARL9170_STARTED,
+};
+
+#define CARL9170_NUM_TID                16
+#define WME_BA_BMP_SIZE                 64
+#define CARL9170_TX_USER_RATE_TRIES     3
+
+#define WME_AC_BE   2
+#define WME_AC_BK   3
+#define WME_AC_VI   1
+#define WME_AC_VO   0
+
+#define TID_TO_WME_AC(_tid)                             \
+        ((((_tid) == 0) || ((_tid) == 3)) ? WME_AC_BE : \
+         (((_tid) == 1) || ((_tid) == 2)) ? WME_AC_BK : \
+         (((_tid) == 4) || ((_tid) == 5)) ? WME_AC_VI : \
+         WME_AC_VO)
+
+#define SEQ_DIFF(_start, _seq) \
+        (((_start) - (_seq)) & 0x0fff)
+#define SEQ_PREV(_seq) \
+        (((_seq) - 1) & 0x0fff)
+#define SEQ_NEXT(_seq) \
+        (((_seq) + 1) & 0x0fff)
+#define BAW_WITHIN(_start, _bawsz, _seqno) \
+        ((((_seqno) - (_start)) & 0xfff) < (_bawsz))
+
+enum carl9170_tid_state {
+        CARL9170_TID_STATE_INVALID,
+        CARL9170_TID_STATE_KILLED,
+        CARL9170_TID_STATE_SHUTDOWN,
+        CARL9170_TID_STATE_SUSPEND,
+        CARL9170_TID_STATE_PROGRESS,
+        CARL9170_TID_STATE_IDLE,
+        CARL9170_TID_STATE_XMIT,
+};
+
+#define CARL9170_BAW_BITS (2 * WME_BA_BMP_SIZE)
+#define CARL9170_BAW_SIZE (BITS_TO_LONGS(CARL9170_BAW_BITS))
+#define CARL9170_BAW_LEN (DIV_ROUND_UP(CARL9170_BAW_BITS, BITS_PER_BYTE))
+
+struct carl9170_sta_tid {
+        /* must be the first entry! */
+        struct list_head list;
+
+        /* temporary list for RCU unlink procedure */
+        struct list_head tmp_list;
+
+        /* lock for the following data structures */
+        spinlock_t lock;
+
+        unsigned int counter;
+        enum carl9170_tid_state state;
+        u8 tid;         /* TID number ( 0 - 15 ) */
+        u16 max;        /* max. AMPDU size */
+
+        u16 snx;        /* awaiting _next_ frame */
+        u16 hsn;        /* highest _queued_ sequence */
+        u16 bsn;        /* base of the tx/agg bitmap */
+        unsigned long bitmap[CARL9170_BAW_SIZE];
+
+        /* Preaggregation reorder queue */
+        struct sk_buff_head queue;
+};
+
+#define CARL9170_QUEUE_TIMEOUT          256
+#define CARL9170_BUMP_QUEUE             1000
+#define CARL9170_TX_TIMEOUT             2500
+#define CARL9170_JANITOR_DELAY          128
+#define CARL9170_QUEUE_STUCK_TIMEOUT    5500
+
+#define CARL9170_NUM_TX_AGG_MAX         30
+
+/*
+ * Tradeoff between stability/latency and speed.
+ *
+ * AR9170_TXQ_DEPTH is devised by dividing the amount of available
+ * tx buffers with the size of a full ethernet frame + overhead.
+ *
+ * Naturally: The higher the limit, the faster the device CAN send.
+ * However, even a slight over-commitment at the wrong time and the
+ * hardware is doomed to send all already-queued frames at suboptimal
+ * rates. This in turn leads to an enourmous amount of unsuccessful
+ * retries => Latency goes up, whereas the throughput goes down. CRASH!
+ */
+#define CARL9170_NUM_TX_LIMIT_HARD      ((AR9170_TXQ_DEPTH * 3) / 2)
+#define CARL9170_NUM_TX_LIMIT_SOFT      (AR9170_TXQ_DEPTH)
+
+struct carl9170_tx_queue_stats {
+        unsigned int count;
+        unsigned int limit;
+        unsigned int len;
+};
+
+struct carl9170_vif {
+        unsigned int id;
+        struct ieee80211_vif *vif;
+};
+
+struct carl9170_vif_info {
+        struct list_head list;
+        bool active;
+        unsigned int id;
+        struct sk_buff *beacon;
+        bool enable_beacon;
+};
+
+#define AR9170_NUM_RX_URBS      16
+#define AR9170_NUM_RX_URBS_MUL  2
+#define AR9170_NUM_TX_URBS      8
+#define AR9170_NUM_RX_URBS_POOL (AR9170_NUM_RX_URBS_MUL * AR9170_NUM_RX_URBS)
+
+enum carl9170_device_features {
+        CARL9170_WPS_BUTTON             = BIT(0),
+        CARL9170_ONE_LED                = BIT(1),
+};
+
+#ifdef CONFIG_CARL9170_LEDS
+struct ar9170;
+
+struct carl9170_led {
+        struct ar9170 *ar;
+        struct led_classdev l;
+        char name[32];
+        unsigned int toggled;
+        bool last_state;
+        bool registered;
+};
+#endif /* CONFIG_CARL9170_LEDS */
+
+enum carl9170_restart_reasons {
+        CARL9170_RR_NO_REASON = 0,
+        CARL9170_RR_FATAL_FIRMWARE_ERROR,
+        CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS,
+        CARL9170_RR_WATCHDOG,
+        CARL9170_RR_STUCK_TX,
+        CARL9170_RR_SLOW_SYSTEM,
+        CARL9170_RR_COMMAND_TIMEOUT,
+        CARL9170_RR_TOO_MANY_PHY_ERRORS,
+        CARL9170_RR_LOST_RSP,
+        CARL9170_RR_INVALID_RSP,
+        CARL9170_RR_USER_REQUEST,
+
+        __CARL9170_RR_LAST,
+};
+
+enum carl9170_erp_modes {
+        CARL9170_ERP_INVALID,
+        CARL9170_ERP_AUTO,
+        CARL9170_ERP_MAC80211,
+        CARL9170_ERP_OFF,
+        CARL9170_ERP_CTS,
+        CARL9170_ERP_RTS,
+        __CARL9170_ERP_NUM,
+};
+
+struct ar9170 {
+        struct ath_common common;
+        struct ieee80211_hw *hw;
+        struct mutex mutex;
+        enum carl9170_device_state state;
+        spinlock_t state_lock;
+        enum carl9170_restart_reasons last_reason;
+        bool registered;
+
+        /* USB */
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct usb_anchor rx_anch;
+        struct usb_anchor rx_work;
+        struct usb_anchor rx_pool;
+        struct usb_anchor tx_wait;
+        struct usb_anchor tx_anch;
+        struct usb_anchor tx_cmd;
+        struct usb_anchor tx_err;
+        struct tasklet_struct usb_tasklet;
+        atomic_t tx_cmd_urbs;
+        atomic_t tx_anch_urbs;
+        atomic_t rx_anch_urbs;
+        atomic_t rx_work_urbs;
+        atomic_t rx_pool_urbs;
+        kernel_ulong_t features;
+
+        /* firmware settings */
+        struct completion fw_load_wait;
+        struct completion fw_boot_wait;
+        struct {
+                const struct carl9170fw_desc_head *desc;
+                const struct firmware *fw;
+                unsigned int offset;
+                unsigned int address;
+                unsigned int cmd_bufs;
+                unsigned int api_version;
+                unsigned int vif_num;
+                unsigned int err_counter;
+                unsigned int bug_counter;
+                u32 beacon_addr;
+                unsigned int beacon_max_len;
+                bool rx_stream;
+                bool tx_stream;
+                unsigned int mem_blocks;
+                unsigned int mem_block_size;
+                unsigned int rx_size;
+        } fw;
+
+        /* reset / stuck frames/queue detection */
+        struct work_struct restart_work;
+        unsigned int restart_counter;
+        unsigned long queue_stop_timeout[__AR9170_NUM_TXQ];
+        unsigned long max_queue_stop_timeout[__AR9170_NUM_TXQ];
+        bool needs_full_reset;
+        atomic_t pending_restarts;
+
+        /* interface mode settings */
+        struct list_head vif_list;
+        unsigned long vif_bitmap;
+        unsigned int vifs;
+        struct carl9170_vif vif_priv[AR9170_MAX_VIRTUAL_MAC];
+
+        /* beaconing */
+        spinlock_t beacon_lock;
+        unsigned int global_pretbtt;
+        unsigned int global_beacon_int;
+        struct carl9170_vif_info *beacon_iter;
+        unsigned int beacon_enabled;
+
+        /* cryptographic engine */
+        u64 usedkeys;
+        bool rx_software_decryption;
+        bool disable_offload;
+
+        /* filter settings */
+        u64 cur_mc_hash;
+        u32 cur_filter;
+        unsigned int filter_state;
+        bool sniffer_enabled;
+
+        /* MAC */
+        enum carl9170_erp_modes erp_mode;
+
+        /* PHY */
+        struct ieee80211_channel *channel;
+        int noise[4];
+        unsigned int chan_fail;
+        unsigned int total_chan_fail;
+        u8 heavy_clip;
+        u8 ht_settings;
+
+        /* power calibration data */
+        u8 power_5G_leg[4];
+        u8 power_2G_cck[4];
+        u8 power_2G_ofdm[4];
+        u8 power_5G_ht20[8];
+        u8 power_5G_ht40[8];
+        u8 power_2G_ht20[8];
+        u8 power_2G_ht40[8];
+
+#ifdef CONFIG_CARL9170_LEDS
+        /* LED */
+        struct delayed_work led_work;
+        struct carl9170_led leds[AR9170_NUM_LEDS];
+#endif /* CONFIG_CARL9170_LEDS */
+
+        /* qos queue settings */
+        spinlock_t tx_stats_lock;
+        struct carl9170_tx_queue_stats tx_stats[__AR9170_NUM_TXQ];
+        struct ieee80211_tx_queue_params edcf[5];
+        struct completion tx_flush;
+
+        /* CMD */
+        int cmd_seq;
+        int readlen;
+        u8 *readbuf;
+        spinlock_t cmd_lock;
+        struct completion cmd_wait;
+        union {
+                __le32 cmd_buf[PAYLOAD_MAX + 1];
+                struct carl9170_cmd cmd;
+                struct carl9170_rsp rsp;
+        };
+
+        /* statistics */
+        unsigned int tx_dropped;
+        unsigned int tx_ack_failures;
+        unsigned int tx_fcs_errors;
+        unsigned int tx_ampdu_timeout;
+        unsigned int rx_dropped;
+
+        /* EEPROM */
+        struct ar9170_eeprom eeprom;
+
+        /* tx queuing */
+        struct sk_buff_head tx_pending[__AR9170_NUM_TXQ];
+        struct sk_buff_head tx_status[__AR9170_NUM_TXQ];
+        struct delayed_work tx_janitor;
+        unsigned long tx_janitor_last_run;
+        bool tx_schedule;
+
+        /* tx ampdu */
+        struct work_struct ampdu_work;
+        spinlock_t tx_ampdu_list_lock;
+        struct carl9170_sta_tid *tx_ampdu_iter;
+        struct list_head tx_ampdu_list;
+        atomic_t tx_ampdu_upload;
+        atomic_t tx_ampdu_scheduler;
+        atomic_t tx_total_pending;
+        atomic_t tx_total_queued;
+        unsigned int tx_ampdu_list_len;
+        int current_density;
+        int current_factor;
+        bool tx_ampdu_schedule;
+
+        /* internal memory management */
+        spinlock_t mem_lock;
+        unsigned long *mem_bitmap;
+        atomic_t mem_free_blocks;
+        atomic_t mem_allocs;
+
+        /* rxstream mpdu merge */
+        struct ar9170_rx_head rx_plcp;
+        bool rx_has_plcp;
+        struct sk_buff *rx_failover;
+        int rx_failover_missing;
+
+#ifdef CONFIG_CARL9170_WPC
+        struct {
+                bool pbc_state;
+                struct input_dev *pbc;
+                char name[32];
+                char phys[32];
+        } wps;
+#endif /* CONFIG_CARL9170_WPC */
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        struct carl9170_debug debug;
+        struct dentry *debug_dir;
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+        /* PSM */
+        struct work_struct ps_work;
+        struct {
+                unsigned int dtim_counter;
+                unsigned long last_beacon;
+                unsigned long last_action;
+                unsigned long last_slept;
+                unsigned int sleep_ms;
+                unsigned int off_override;
+                bool state;
+        } ps;
+};
+
+enum carl9170_ps_off_override_reasons {
+        PS_OFF_VIF      = BIT(0),
+        PS_OFF_BCN      = BIT(1),
+        PS_OFF_5GHZ     = BIT(2),
+};
+
+struct carl9170_ba_stats {
+        u8 ampdu_len;
+        u8 ampdu_ack_len;
+        bool clear;
+};
+
+struct carl9170_sta_info {
+        bool ht_sta;
+        unsigned int ampdu_max_len;
+        struct carl9170_sta_tid *agg[CARL9170_NUM_TID];
+        struct carl9170_ba_stats stats[CARL9170_NUM_TID];
+};
+
+struct carl9170_tx_info {
+        unsigned long timeout;
+        struct ar9170 *ar;
+        struct kref ref;
+};
+
+#define CHK_DEV_STATE(a, s)     (((struct ar9170 *)a)->state >= (s))
+#define IS_INITIALIZED(a)       (CHK_DEV_STATE(a, CARL9170_STOPPED))
+#define IS_ACCEPTING_CMD(a)     (CHK_DEV_STATE(a, CARL9170_IDLE))
+#define IS_STARTED(a)           (CHK_DEV_STATE(a, CARL9170_STARTED))
+
+static inline void __carl9170_set_state(struct ar9170 *ar,
+        enum carl9170_device_state newstate)
+{
+        ar->state = newstate;
+}
+
+static inline void carl9170_set_state(struct ar9170 *ar,
+        enum carl9170_device_state newstate)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ar->state_lock, flags);
+        __carl9170_set_state(ar, newstate);
+        spin_unlock_irqrestore(&ar->state_lock, flags);
+}
+
+static inline void carl9170_set_state_when(struct ar9170 *ar,
+        enum carl9170_device_state min, enum carl9170_device_state newstate)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ar->state_lock, flags);
+        if (CHK_DEV_STATE(ar, min))
+                __carl9170_set_state(ar, newstate);
+        spin_unlock_irqrestore(&ar->state_lock, flags);
+}
+
+/* exported interface */
+void *carl9170_alloc(size_t priv_size);
+int carl9170_register(struct ar9170 *ar);
+void carl9170_unregister(struct ar9170 *ar);
+void carl9170_free(struct ar9170 *ar);
+void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r);
+void carl9170_ps_check(struct ar9170 *ar);
+
+/* USB back-end */
+int carl9170_usb_open(struct ar9170 *ar);
+void carl9170_usb_stop(struct ar9170 *ar);
+void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_usb_handle_tx_err(struct ar9170 *ar);
+int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids,
+                      u32 plen, void *payload, u32 rlen, void *resp);
+int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
+                        const bool free_buf);
+int carl9170_usb_restart(struct ar9170 *ar);
+void carl9170_usb_reset(struct ar9170 *ar);
+
+/* MAC */
+int carl9170_init_mac(struct ar9170 *ar);
+int carl9170_set_qos(struct ar9170 *ar);
+int carl9170_update_multicast(struct ar9170 *ar, const u64 mc_hast);
+int carl9170_mod_virtual_mac(struct ar9170 *ar, const unsigned int id,
+                             const u8 *mac);
+int carl9170_set_operating_mode(struct ar9170 *ar);
+int carl9170_set_beacon_timers(struct ar9170 *ar);
+int carl9170_set_dyn_sifs_ack(struct ar9170 *ar);
+int carl9170_set_rts_cts_rate(struct ar9170 *ar);
+int carl9170_set_ampdu_settings(struct ar9170 *ar);
+int carl9170_set_slot_time(struct ar9170 *ar);
+int carl9170_set_mac_rates(struct ar9170 *ar);
+int carl9170_set_hwretry_limit(struct ar9170 *ar, const u32 max_retry);
+int carl9170_update_beacon(struct ar9170 *ar, const bool submit);
+int carl9170_upload_key(struct ar9170 *ar, const u8 id, const u8 *mac,
+        const u8 ktype, const u8 keyidx, const u8 *keydata, const int keylen);
+int carl9170_disable_key(struct ar9170 *ar, const u8 id);
+
+/* RX */
+void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len);
+void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len);
+
+/* TX */
+int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+void carl9170_tx_janitor(struct work_struct *work);
+void carl9170_tx_process_status(struct ar9170 *ar,
+                                const struct carl9170_rsp *cmd);
+void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                        const bool success);
+void carl9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_tx_drop(struct ar9170 *ar, struct sk_buff *skb);
+void carl9170_tx_scheduler(struct ar9170 *ar);
+void carl9170_tx_get_skb(struct sk_buff *skb);
+int carl9170_tx_put_skb(struct sk_buff *skb);
+
+/* LEDs */
+#ifdef CONFIG_CARL9170_LEDS
+int carl9170_led_register(struct ar9170 *ar);
+void carl9170_led_unregister(struct ar9170 *ar);
+#endif /* CONFIG_CARL9170_LEDS */
+int carl9170_led_init(struct ar9170 *ar);
+int carl9170_led_set_state(struct ar9170 *ar, const u32 led_state);
+
+/* PHY / RF */
+int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+        enum nl80211_channel_type bw, enum carl9170_rf_init_mode rfi);
+int carl9170_get_noisefloor(struct ar9170 *ar);
+
+/* FW */
+int carl9170_parse_firmware(struct ar9170 *ar);
+int carl9170_fw_fix_eeprom(struct ar9170 *ar);
+
+extern struct ieee80211_rate __carl9170_ratetable[];
+extern int modparam_noht;
+
+static inline struct ar9170 *carl9170_get_priv(struct carl9170_vif *carl_vif)
+{
+        return container_of(carl_vif, struct ar9170,
+                            vif_priv[carl_vif->id]);
+}
+
+static inline struct ieee80211_hdr *carl9170_get_hdr(struct sk_buff *skb)
+{
+        return (void *)((struct _carl9170_tx_superframe *)
+                skb->data)->frame_data;
+}
+
+static inline u16 get_seq_h(struct ieee80211_hdr *hdr)
+{
+        return le16_to_cpu(hdr->seq_ctrl) >> 4;
+}
+
+static inline u16 carl9170_get_seq(struct sk_buff *skb)
+{
+        return get_seq_h(carl9170_get_hdr(skb));
+}
+
+static inline u16 get_tid_h(struct ieee80211_hdr *hdr)
+{
+        return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
+}
+
+static inline u16 carl9170_get_tid(struct sk_buff *skb)
+{
+        return get_tid_h(carl9170_get_hdr(skb));
+}
+
+static inline struct ieee80211_vif *
+carl9170_get_vif(struct carl9170_vif_info *priv)
+{
+        return container_of((void *)priv, struct ieee80211_vif, drv_priv);
+}
+
+/* Protected by ar->mutex or RCU */
+static inline struct ieee80211_vif *carl9170_get_main_vif(struct ar9170 *ar)
+{
+        struct carl9170_vif_info *cvif;
+
+        list_for_each_entry_rcu(cvif, &ar->vif_list, list) {
+                if (cvif->active)
+                        return carl9170_get_vif(cvif);
+        }
+
+        return NULL;
+}
+
+static inline bool is_main_vif(struct ar9170 *ar, struct ieee80211_vif *vif)
+{
+        bool ret;
+
+        rcu_read_lock();
+        ret = (carl9170_get_main_vif(ar) == vif);
+        rcu_read_unlock();
+        return ret;
+}
+
+#endif /* __CARL9170_H */
diff --git a/drivers/net/wireless/ath/carl9170/cmd.c b/drivers/net/wireless/ath/carl9170/cmd.c
new file mode 100644
index 000000000000..c21f3364bfec
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/cmd.c
@@ -0,0 +1,188 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
+{
+        __le32 buf[2] = {
+                cpu_to_le32(reg),
+                cpu_to_le32(val),
+        };
+        int err;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_WREG, sizeof(buf),
+                                (u8 *) buf, 0, NULL);
+        if (err) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "writing reg %#x "
+                                "(val %#x) failed (%d)\n", reg, val, err);
+                }
+        }
+        return err;
+}
+
+int carl9170_read_mreg(struct ar9170 *ar, const int nregs,
+                       const u32 *regs, u32 *out)
+{
+        int i, err;
+        __le32 *offs, *res;
+
+        /* abuse "out" for the register offsets, must be same length */
+        offs = (__le32 *)out;
+        for (i = 0; i < nregs; i++)
+                offs[i] = cpu_to_le32(regs[i]);
+
+        /* also use the same buffer for the input */
+        res = (__le32 *)out;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
+                                4 * nregs, (u8 *)offs,
+                                4 * nregs, (u8 *)res);
+        if (err) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "reading regs failed (%d)\n",
+                                  err);
+                }
+                return err;
+        }
+
+        /* convert result to cpu endian */
+        for (i = 0; i < nregs; i++)
+                out[i] = le32_to_cpu(res[i]);
+
+        return 0;
+}
+
+int carl9170_read_reg(struct ar9170 *ar, u32 reg, u32 *val)
+{
+        return carl9170_read_mreg(ar, 1, &reg, val);
+}
+
+int carl9170_echo_test(struct ar9170 *ar, const u32 v)
+{
+        u32 echores;
+        int err;
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_ECHO,
+                                4, (u8 *)&v,
+                                4, (u8 *)&echores);
+        if (err)
+                return err;
+
+        if (v != echores) {
+                wiphy_info(ar->hw->wiphy, "wrong echo %x != %x", v, echores);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+struct carl9170_cmd *carl9170_cmd_buf(struct ar9170 *ar,
+        const enum carl9170_cmd_oids cmd, const unsigned int len)
+{
+        struct carl9170_cmd *tmp;
+
+        tmp = kzalloc(sizeof(struct carl9170_cmd_head) + len, GFP_ATOMIC);
+        if (tmp) {
+                tmp->hdr.cmd = cmd;
+                tmp->hdr.len = len;
+        }
+
+        return tmp;
+}
+
+int carl9170_reboot(struct ar9170 *ar)
+{
+        struct carl9170_cmd *cmd;
+        int err;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_REBOOT_ASYNC, 0);
+        if (!cmd)
+                return -ENOMEM;
+
+        err = __carl9170_exec_cmd(ar, (struct carl9170_cmd *)cmd, true);
+        return err;
+}
+
+int carl9170_mac_reset(struct ar9170 *ar)
+{
+        return carl9170_exec_cmd(ar, CARL9170_CMD_SWRST,
+                                 0, NULL, 0, NULL);
+}
+
+int carl9170_bcn_ctrl(struct ar9170 *ar, const unsigned int vif_id,
+                       const u32 mode, const u32 addr, const u32 len)
+{
+        struct carl9170_cmd *cmd;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_BCN_CTRL_ASYNC,
+                               sizeof(struct carl9170_bcn_ctrl_cmd));
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->bcn_ctrl.vif_id = cpu_to_le32(vif_id);
+        cmd->bcn_ctrl.mode = cpu_to_le32(mode);
+        cmd->bcn_ctrl.bcn_addr = cpu_to_le32(addr);
+        cmd->bcn_ctrl.bcn_len = cpu_to_le32(len);
+
+        return __carl9170_exec_cmd(ar, cmd, true);
+}
+
+int carl9170_powersave(struct ar9170 *ar, const bool ps)
+{
+        struct carl9170_cmd *cmd;
+        u32 state;
+
+        cmd = carl9170_cmd_buf(ar, CARL9170_CMD_PSM_ASYNC,
+                               sizeof(struct carl9170_psm));
+        if (!cmd)
+                return -ENOMEM;
+
+        if (ps) {
+                /* Sleep until next TBTT */
+                state = CARL9170_PSM_SLEEP | 1;
+        } else {
+                /* wake up immediately */
+                state = 1;
+        }
+
+        cmd->psm.state = cpu_to_le32(state);
+        return __carl9170_exec_cmd(ar, cmd, true);
+}
diff --git a/drivers/net/wireless/ath/carl9170/cmd.h b/drivers/net/wireless/ath/carl9170/cmd.h
new file mode 100644
index 000000000000..0fc83d2336fd
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/cmd.h
@@ -0,0 +1,158 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * Basic HW register/memory/command access functions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CMD_H
+#define __CMD_H
+
+#include "carl9170.h"
+
+/* basic HW access */
+int carl9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val);
+int carl9170_read_reg(struct ar9170 *ar, const u32 reg, u32 *val);
+int carl9170_read_mreg(struct ar9170 *ar, const int nregs,
+                       const u32 *regs, u32 *out);
+int carl9170_echo_test(struct ar9170 *ar, u32 v);
+int carl9170_reboot(struct ar9170 *ar);
+int carl9170_mac_reset(struct ar9170 *ar);
+int carl9170_powersave(struct ar9170 *ar, const bool power_on);
+int carl9170_bcn_ctrl(struct ar9170 *ar, const unsigned int vif_id,
+                       const u32 mode, const u32 addr, const u32 len);
+
+static inline int carl9170_flush_cab(struct ar9170 *ar,
+                                     const unsigned int vif_id)
+{
+        return carl9170_bcn_ctrl(ar, vif_id, CARL9170_BCN_CTRL_DRAIN, 0, 0);
+}
+
+struct carl9170_cmd *carl9170_cmd_buf(struct ar9170 *ar,
+        const enum carl9170_cmd_oids cmd, const unsigned int len);
+
+/*
+ * Macros to facilitate writing multiple registers in a single
+ * write-combining USB command. Note that when the first group
+ * fails the whole thing will fail without any others attempted,
+ * but you won't know which write in the group failed.
+ */
+#define carl9170_regwrite_begin(ar)                                     \
+do {                                                                    \
+        int __nreg = 0, __err = 0;                                      \
+        struct ar9170 *__ar = ar;
+
+#define carl9170_regwrite(r, v) do {                                    \
+        __ar->cmd_buf[2 * __nreg + 1] = cpu_to_le32(r);                 \
+        __ar->cmd_buf[2 * __nreg + 2] = cpu_to_le32(v);                 \
+        __nreg++;                                                       \
+        if ((__nreg >= PAYLOAD_MAX/2)) {                                \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = carl9170_exec_cmd(__ar,                 \
+                                CARL9170_CMD_WREG, 8 * __nreg,          \
+                                (u8 *) &__ar->cmd_buf[1], 0, NULL);     \
+                else                                                    \
+                        goto __regwrite_out;                            \
+                                                                        \
+                __nreg = 0;                                             \
+                if (__err)                                              \
+                        goto __regwrite_out;                            \
+        }                                                               \
+} while (0)
+
+#define carl9170_regwrite_finish()                                      \
+__regwrite_out :                                                        \
+        if (__err == 0 && __nreg) {                                     \
+                if (IS_ACCEPTING_CMD(__ar))                             \
+                        __err = carl9170_exec_cmd(__ar,                 \
+                                CARL9170_CMD_WREG, 8 * __nreg,          \
+                                (u8 *) &__ar->cmd_buf[1], 0, NULL);     \
+                __nreg = 0;                                             \
+        }
+
+#define carl9170_regwrite_result()                                      \
+        __err;                                                          \
+} while (0);
+
+
+#define carl9170_async_get_buf()                                        \
+do {                                                                    \
+        __cmd = carl9170_cmd_buf(__carl, CARL9170_CMD_WREG_ASYNC,       \
+                                 CARL9170_MAX_CMD_PAYLOAD_LEN);         \
+        if (__cmd == NULL) {                                            \
+                __err = -ENOMEM;                                        \
+                goto __async_regwrite_out;                              \
+        }                                                               \
+} while (0);
+
+#define carl9170_async_regwrite_begin(carl)                             \
+do {                                                                    \
+        int __nreg = 0, __err = 0;                                      \
+        struct ar9170 *__carl = carl;                                   \
+        struct carl9170_cmd *__cmd;                                     \
+        carl9170_async_get_buf();                                       \
+
+#define carl9170_async_regwrite(r, v) do {                              \
+        __cmd->wreg.regs[__nreg].addr = cpu_to_le32(r);                 \
+        __cmd->wreg.regs[__nreg].val = cpu_to_le32(v);                  \
+        __nreg++;                                                       \
+        if ((__nreg >= PAYLOAD_MAX/2)) {                                \
+                if (IS_ACCEPTING_CMD(__carl)) {                         \
+                        __cmd->hdr.len = 8 * __nreg;                    \
+                        __err = __carl9170_exec_cmd(__carl, __cmd, true);\
+                        __cmd = NULL;                                   \
+                        carl9170_async_get_buf();                       \
+                } else {                                                \
+                        goto __async_regwrite_out;                      \
+                }                                                       \
+                __nreg = 0;                                             \
+                if (__err)                                              \
+                        goto __async_regwrite_out;                      \
+        }                                                               \
+} while (0)
+
+#define carl9170_async_regwrite_finish()                                \
+__async_regwrite_out :                                                  \
+        if (__err == 0 && __nreg) {                                     \
+                __cmd->hdr.len = 8 * __nreg;                            \
+                if (IS_ACCEPTING_CMD(__carl))                           \
+                        __err = __carl9170_exec_cmd(__carl, __cmd, true);\
+                __nreg = 0;                                             \
+        }
+
+#define carl9170_async_regwrite_result()                                \
+        __err;                                                          \
+} while (0);
+
+#endif /* __CMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
new file mode 100644
index 000000000000..19b48369ffed
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/debug.c
@@ -0,0 +1,906 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * debug(fs) probing
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2008-2009 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/vmalloc.h>
+#include "carl9170.h"
+#include "cmd.h"
+
+#define ADD(buf, off, max, fmt, args...)                                \
+        off += snprintf(&buf[off], max - off, fmt, ##args);
+
+static int carl9170_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+struct carl9170_debugfs_fops {
+        unsigned int read_bufsize;
+        mode_t attr;
+        char *(*read)(struct ar9170 *ar, char *buf, size_t bufsize,
+                      ssize_t *len);
+        ssize_t (*write)(struct ar9170 *aru, const char *buf, size_t size);
+        const struct file_operations fops;
+
+        enum carl9170_device_state req_dev_state;
+};
+
+static ssize_t carl9170_debugfs_read(struct file *file, char __user *userbuf,
+                                     size_t count, loff_t *ppos)
+{
+        struct carl9170_debugfs_fops *dfops;
+        struct ar9170 *ar;
+        char *buf = NULL, *res_buf = NULL;
+        ssize_t ret = 0;
+        int err = 0;
+
+        if (!count)
+                return 0;
+
+        ar = file->private_data;
+
+        if (!ar)
+                return -ENODEV;
+        dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+
+        if (!dfops->read)
+                return -ENOSYS;
+
+        if (dfops->read_bufsize) {
+                buf = vmalloc(dfops->read_bufsize);
+                if (!buf)
+                        return -ENOMEM;
+        }
+
+        mutex_lock(&ar->mutex);
+        if (!CHK_DEV_STATE(ar, dfops->req_dev_state)) {
+                err = -ENODEV;
+                res_buf = buf;
+                goto out_free;
+        }
+
+        res_buf = dfops->read(ar, buf, dfops->read_bufsize, &ret);
+
+        if (ret > 0)
+                err = simple_read_from_buffer(userbuf, count, ppos,
+                                              res_buf, ret);
+        else
+                err = ret;
+
+        WARN_ON_ONCE(dfops->read_bufsize && (res_buf != buf));
+
+out_free:
+        vfree(res_buf);
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static ssize_t carl9170_debugfs_write(struct file *file,
+        const char __user *userbuf, size_t count, loff_t *ppos)
+{
+        struct carl9170_debugfs_fops *dfops;
+        struct ar9170 *ar;
+        char *buf = NULL;
+        int err = 0;
+
+        if (!count)
+                return 0;
+
+        if (count > PAGE_SIZE)
+                return -E2BIG;
+
+        ar = file->private_data;
+
+        if (!ar)
+                return -ENODEV;
+        dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+
+        if (!dfops->write)
+                return -ENOSYS;
+
+        buf = vmalloc(count);
+        if (!buf)
+                return -ENOMEM;
+
+        if (copy_from_user(buf, userbuf, count)) {
+                err = -EFAULT;
+                goto out_free;
+        }
+
+        if (mutex_trylock(&ar->mutex) == 0) {
+                err = -EAGAIN;
+                goto out_free;
+        }
+
+        if (!CHK_DEV_STATE(ar, dfops->req_dev_state)) {
+                err = -ENODEV;
+                goto out_unlock;
+        }
+
+        err = dfops->write(ar, buf, count);
+        if (err)
+                goto out_unlock;
+
+out_unlock:
+        mutex_unlock(&ar->mutex);
+
+out_free:
+        vfree(buf);
+        return err;
+}
+
+#define __DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize,      \
+                               _attr, _dstate)                          \
+static const struct carl9170_debugfs_fops carl_debugfs_##name ##_ops = {\
+        .read_bufsize = _read_bufsize,                                  \
+        .read = _read,                                                  \
+        .write = _write,                                                \
+        .attr = _attr,                                                  \
+        .req_dev_state = _dstate,                                       \
+        .fops = {                                                       \
+                .open   = carl9170_debugfs_open,                        \
+                .read   = carl9170_debugfs_read,                        \
+                .write  = carl9170_debugfs_write,                       \
+                .owner  = THIS_MODULE                                   \
+        },                                                              \
+}
+
+#define DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize, _attr) \
+        __DEBUGFS_DECLARE_FILE(name, _read, _write, _read_bufsize,      \
+                               _attr, CARL9170_STARTED)                 \
+
+#define DEBUGFS_DECLARE_RO_FILE(name, _read_bufsize)                    \
+        DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,     \
+                             NULL, _read_bufsize, S_IRUSR)
+
+#define DEBUGFS_DECLARE_WO_FILE(name)                                   \
+        DEBUGFS_DECLARE_FILE(name, NULL, carl9170_debugfs_##name ##_write,\
+                             0, S_IWUSR)
+
+#define DEBUGFS_DECLARE_RW_FILE(name, _read_bufsize)                    \
+        DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,     \
+                             carl9170_debugfs_##name ##_write,          \
+                             _read_bufsize, S_IRUSR | S_IWUSR)
+
+#define __DEBUGFS_DECLARE_RW_FILE(name, _read_bufsize, _dstate)         \
+        __DEBUGFS_DECLARE_FILE(name, carl9170_debugfs_##name ##_read,   \
+                             carl9170_debugfs_##name ##_write,          \
+                             _read_bufsize, S_IRUSR | S_IWUSR, _dstate)
+
+#define DEBUGFS_READONLY_FILE(name, _read_bufsize, fmt, value...)       \
+static char *carl9170_debugfs_ ##name ## _read(struct ar9170 *ar,       \
+                                             char *buf, size_t buf_size,\
+                                             ssize_t *len)              \
+{                                                                       \
+        ADD(buf, *len, buf_size, fmt "\n", ##value);                    \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, _read_bufsize)
+
+static char *carl9170_debugfs_mem_usage_read(struct ar9170 *ar, char *buf,
+                                             size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "jar: [");
+
+        spin_lock_bh(&ar->mem_lock);
+
+        *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                                  ar->mem_bitmap, ar->fw.mem_blocks);
+
+        ADD(buf, *len, bufsize, "]\n");
+
+        ADD(buf, *len, bufsize, "cookies: used:%3d / total:%3d, allocs:%d\n",
+            bitmap_weight(ar->mem_bitmap, ar->fw.mem_blocks),
+            ar->fw.mem_blocks, atomic_read(&ar->mem_allocs));
+
+        ADD(buf, *len, bufsize, "memory: free:%3d (%3d KiB) / total:%3d KiB)\n",
+            atomic_read(&ar->mem_free_blocks),
+            (atomic_read(&ar->mem_free_blocks) * ar->fw.mem_block_size) / 1024,
+            (ar->fw.mem_blocks * ar->fw.mem_block_size) / 1024);
+
+        spin_unlock_bh(&ar->mem_lock);
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(mem_usage, 512);
+
+static char *carl9170_debugfs_qos_stat_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "%s QoS AC\n", modparam_noht ? "Hardware" :
+            "Software");
+
+        ADD(buf, *len, bufsize, "[     VO            VI       "
+                                 "     BE            BK      ]\n");
+
+        spin_lock_bh(&ar->tx_stats_lock);
+        ADD(buf, *len, bufsize, "[length/limit  length/limit  "
+                                 "length/limit  length/limit ]\n"
+                                "[   %3d/%3d       %3d/%3d    "
+                                 "   %3d/%3d       %3d/%3d   ]\n\n",
+            ar->tx_stats[0].len, ar->tx_stats[0].limit,
+            ar->tx_stats[1].len, ar->tx_stats[1].limit,
+            ar->tx_stats[2].len, ar->tx_stats[2].limit,
+            ar->tx_stats[3].len, ar->tx_stats[3].limit);
+
+        ADD(buf, *len, bufsize, "[    total         total     "
+                                 "    total         total    ]\n"
+                                "[%10d    %10d    %10d    %10d   ]\n\n",
+            ar->tx_stats[0].count, ar->tx_stats[1].count,
+            ar->tx_stats[2].count, ar->tx_stats[3].count);
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+
+        ADD(buf, *len, bufsize, "[  pend/waittx   pend/waittx "
+                                 "  pend/waittx   pend/waittx]\n"
+                                "[   %3d/%3d       %3d/%3d    "
+                                 "   %3d/%3d       %3d/%3d   ]\n\n",
+            skb_queue_len(&ar->tx_pending[0]),
+            skb_queue_len(&ar->tx_status[0]),
+            skb_queue_len(&ar->tx_pending[1]),
+            skb_queue_len(&ar->tx_status[1]),
+            skb_queue_len(&ar->tx_pending[2]),
+            skb_queue_len(&ar->tx_status[2]),
+            skb_queue_len(&ar->tx_pending[3]),
+            skb_queue_len(&ar->tx_status[3]));
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(qos_stat, 512);
+
+static void carl9170_debugfs_format_frame(struct ar9170 *ar,
+        struct sk_buff *skb, const char *prefix, char *buf,
+        ssize_t *off, ssize_t bufsize)
+{
+        struct _carl9170_tx_superframe *txc = (void *) skb->data;
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+        struct carl9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
+        struct ieee80211_hdr *hdr = (void *) txc->frame_data;
+
+        ADD(buf, *off, bufsize, "%s %p, c:%2x, DA:%pM, sq:%4d, mc:%.4x, "
+            "pc:%.8x, to:%d ms\n", prefix, skb, txc->s.cookie,
+            ieee80211_get_DA(hdr), get_seq_h(hdr),
+            le16_to_cpu(txc->f.mac_control), le32_to_cpu(txc->f.phy_control),
+            jiffies_to_msecs(jiffies - arinfo->timeout));
+}
+
+
+static char *carl9170_debugfs_ampdu_state_read(struct ar9170 *ar, char *buf,
+                                               size_t bufsize, ssize_t *len)
+{
+        struct carl9170_sta_tid *iter;
+        struct sk_buff *skb;
+        int cnt = 0, fc;
+        int offset;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->tx_ampdu_list, list) {
+
+                spin_lock_bh(&iter->lock);
+                ADD(buf, *len, bufsize, "Entry: #%2d TID:%1d, BSN:%4d, "
+                    "SNX:%4d, HSN:%4d, BAW:%2d, state:%1d, toggles:%d\n",
+                    cnt, iter->tid, iter->bsn, iter->snx, iter->hsn,
+                    iter->max, iter->state, iter->counter);
+
+                ADD(buf, *len, bufsize, "\tWindow:  [");
+
+                *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                        iter->bitmap, CARL9170_BAW_BITS);
+
+#define BM_STR_OFF(offset)                                      \
+        ((CARL9170_BAW_BITS - (offset) - 1) / 4 +               \
+         (CARL9170_BAW_BITS - (offset) - 1) / 32 + 1)
+
+                ADD(buf, *len, bufsize, ",W]\n");
+
+                offset = BM_STR_OFF(0);
+                ADD(buf, *len, bufsize, "\tBase Seq: %*s\n", offset, "T");
+
+                offset = BM_STR_OFF(SEQ_DIFF(iter->snx, iter->bsn));
+                ADD(buf, *len, bufsize, "\tNext Seq: %*s\n", offset, "W");
+
+                offset = BM_STR_OFF(((int)iter->hsn - (int)iter->bsn) %
+                                     CARL9170_BAW_BITS);
+                ADD(buf, *len, bufsize, "\tLast Seq: %*s\n", offset, "N");
+
+                ADD(buf, *len, bufsize, "\tPre-Aggregation reorder buffer: "
+                    " currently queued:%d\n", skb_queue_len(&iter->queue));
+
+                fc = 0;
+                skb_queue_walk(&iter->queue, skb) {
+                        char prefix[32];
+
+                        snprintf(prefix, sizeof(prefix), "\t\t%3d :", fc);
+                        carl9170_debugfs_format_frame(ar, skb, prefix, buf,
+                                                      len, bufsize);
+
+                        fc++;
+                }
+                spin_unlock_bh(&iter->lock);
+                cnt++;
+        }
+        rcu_read_unlock();
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(ampdu_state, 8000);
+
+static void carl9170_debugfs_queue_dump(struct ar9170 *ar, char *buf,
+        ssize_t *len, size_t bufsize, struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+        char prefix[16];
+        int fc = 0;
+
+        spin_lock_bh(&queue->lock);
+        skb_queue_walk(queue, skb) {
+                snprintf(prefix, sizeof(prefix), "%3d :", fc);
+                carl9170_debugfs_format_frame(ar, skb, prefix, buf,
+                                              len, bufsize);
+                fc++;
+        }
+        spin_unlock_bh(&queue->lock);
+}
+
+#define DEBUGFS_QUEUE_DUMP(q, qi)                                       \
+static char *carl9170_debugfs_##q ##_##qi ##_read(struct ar9170 *ar,    \
+        char *buf, size_t bufsize, ssize_t *len)                        \
+{                                                                       \
+        carl9170_debugfs_queue_dump(ar, buf, len, bufsize, &ar->q[qi]); \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(q##_##qi, 8000);
+
+static char *carl9170_debugfs_sta_psm_read(struct ar9170 *ar, char *buf,
+                                           size_t bufsize, ssize_t *len)
+{
+        ADD(buf, *len, bufsize, "psm state: %s\n", (ar->ps.off_override ?
+            "FORCE CAM" : (ar->ps.state ? "PSM" : "CAM")));
+
+        ADD(buf, *len, bufsize, "sleep duration: %d ms.\n", ar->ps.sleep_ms);
+        ADD(buf, *len, bufsize, "last power-state transition: %d ms ago.\n",
+            jiffies_to_msecs(jiffies - ar->ps.last_action));
+        ADD(buf, *len, bufsize, "last CAM->PSM transition: %d ms ago.\n",
+            jiffies_to_msecs(jiffies - ar->ps.last_slept));
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(sta_psm, 160);
+
+static char *carl9170_debugfs_tx_stuck_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        int i;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                ADD(buf, *len, bufsize, "TX queue [%d]: %10d max:%10d ms.\n",
+                    i, ieee80211_queue_stopped(ar->hw, i) ?
+                    jiffies_to_msecs(jiffies - ar->queue_stop_timeout[i]) : 0,
+                    jiffies_to_msecs(ar->max_queue_stop_timeout[i]));
+
+                ar->max_queue_stop_timeout[i] = 0;
+        }
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(tx_stuck, 180);
+
+static char *carl9170_debugfs_phy_noise_read(struct ar9170 *ar, char *buf,
+                                             size_t bufsize, ssize_t *len)
+{
+        int err;
+
+        err = carl9170_get_noisefloor(ar);
+        if (err) {
+                *len = err;
+                return buf;
+        }
+
+        ADD(buf, *len, bufsize, "Chain 0: %10d dBm, ext. chan.:%10d dBm\n",
+            ar->noise[0], ar->noise[2]);
+        ADD(buf, *len, bufsize, "Chain 2: %10d dBm, ext. chan.:%10d dBm\n",
+            ar->noise[1], ar->noise[3]);
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(phy_noise, 180);
+
+static char *carl9170_debugfs_vif_dump_read(struct ar9170 *ar, char *buf,
+                                            size_t bufsize, ssize_t *len)
+{
+        struct carl9170_vif_info *iter;
+        int i = 0;
+
+        ADD(buf, *len, bufsize, "registered VIFs:%d \\ %d\n",
+            ar->vifs, ar->fw.vif_num);
+
+        ADD(buf, *len, bufsize, "VIF bitmap: [");
+
+        *len += bitmap_scnprintf(&buf[*len], bufsize - *len,
+                                 &ar->vif_bitmap, ar->fw.vif_num);
+
+        ADD(buf, *len, bufsize, "]\n");
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->vif_list, list) {
+                struct ieee80211_vif *vif = carl9170_get_vif(iter);
+                ADD(buf, *len, bufsize, "\t%d = [%s VIF, id:%d, type:%x "
+                    " mac:%pM %s]\n", i, (carl9170_get_main_vif(ar) == vif ?
+                    "Master" : " Slave"), iter->id, vif->type, vif->addr,
+                    iter->enable_beacon ? "beaconing " : "");
+                i++;
+        }
+        rcu_read_unlock();
+
+        return buf;
+}
+DEBUGFS_DECLARE_RO_FILE(vif_dump, 8000);
+
+#define UPDATE_COUNTER(ar, name)        ({                              \
+        u32 __tmp[ARRAY_SIZE(name##_regs)];                             \
+        unsigned int __i, __err = -ENODEV;                              \
+                                                                        \
+        for (__i = 0; __i < ARRAY_SIZE(name##_regs); __i++) {           \
+                __tmp[__i] = name##_regs[__i].reg;                      \
+                ar->debug.stats.name##_counter[__i] = 0;                \
+        }                                                               \
+                                                                        \
+        if (IS_STARTED(ar))                                             \
+                __err = carl9170_read_mreg(ar, ARRAY_SIZE(name##_regs), \
+                        __tmp, ar->debug.stats.name##_counter);         \
+        (__err); })
+
+#define TALLY_SUM_UP(ar, name)  do {                                    \
+        unsigned int __i;                                               \
+                                                                        \
+        for (__i = 0; __i < ARRAY_SIZE(name##_regs); __i++) {           \
+                ar->debug.stats.name##_sum[__i] +=                      \
+                        ar->debug.stats.name##_counter[__i];            \
+        }                                                               \
+} while (0)
+
+#define DEBUGFS_HW_TALLY_FILE(name, f)                                  \
+static char *carl9170_debugfs_##name ## _read(struct ar9170 *ar,        \
+         char *dum, size_t bufsize, ssize_t *ret)                       \
+{                                                                       \
+        char *buf;                                                      \
+        int i, max_len, err;                                            \
+                                                                        \
+        max_len = ARRAY_SIZE(name##_regs) * 80;                         \
+        buf = vmalloc(max_len);                                         \
+        if (!buf)                                                       \
+                return NULL;                                            \
+                                                                        \
+        err = UPDATE_COUNTER(ar, name);                                 \
+        if (err) {                                                      \
+                *ret = err;                                             \
+                return buf;                                             \
+        }                                                               \
+                                                                        \
+        TALLY_SUM_UP(ar, name);                                         \
+                                                                        \
+        for (i = 0; i < ARRAY_SIZE(name##_regs); i++) {                 \
+                ADD(buf, *ret, max_len, "%22s = %" f "[+%" f "]\n",     \
+                    name##_regs[i].nreg, ar->debug.stats.name ##_sum[i],\
+                    ar->debug.stats.name ##_counter[i]);                \
+        }                                                               \
+                                                                        \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, 0);
+
+#define DEBUGFS_HW_REG_FILE(name, f)                                    \
+static char *carl9170_debugfs_##name ## _read(struct ar9170 *ar,        \
+        char *dum, size_t bufsize, ssize_t *ret)                        \
+{                                                                       \
+        char *buf;                                                      \
+        int i, max_len, err;                                            \
+                                                                        \
+        max_len = ARRAY_SIZE(name##_regs) * 80;                         \
+        buf = vmalloc(max_len);                                         \
+        if (!buf)                                                       \
+                return NULL;                                            \
+                                                                        \
+        err = UPDATE_COUNTER(ar, name);                                 \
+        if (err) {                                                      \
+                *ret = err;                                             \
+                return buf;                                             \
+        }                                                               \
+                                                                        \
+        for (i = 0; i < ARRAY_SIZE(name##_regs); i++) {                 \
+                ADD(buf, *ret, max_len, "%22s = %" f "\n",              \
+                    name##_regs[i].nreg,                                \
+                    ar->debug.stats.name##_counter[i]);                 \
+        }                                                               \
+                                                                        \
+        return buf;                                                     \
+}                                                                       \
+DEBUGFS_DECLARE_RO_FILE(name, 0);
+
+static ssize_t carl9170_debugfs_hw_ioread32_write(struct ar9170 *ar,
+        const char *buf, size_t count)
+{
+        int err = 0, i, n = 0, max_len = 32, res;
+        unsigned int reg, tmp;
+
+        if (!count)
+                return 0;
+
+        if (count > max_len)
+                return -E2BIG;
+
+        res = sscanf(buf, "0x%X %d", &reg, &n);
+        if (res < 1) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (res == 1)
+                n = 1;
+
+        if (n > 15) {
+                err = -EMSGSIZE;
+                goto out;
+        }
+
+        if ((reg >= 0x280000) || ((reg + (n << 2)) >= 0x280000)) {
+                err = -EADDRNOTAVAIL;
+                goto out;
+        }
+
+        if (reg & 3) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        for (i = 0; i < n; i++) {
+                err = carl9170_read_reg(ar, reg + (i << 2), &tmp);
+                if (err)
+                        goto out;
+
+                ar->debug.ring[ar->debug.ring_tail].reg = reg + (i << 2);
+                ar->debug.ring[ar->debug.ring_tail].value = tmp;
+                ar->debug.ring_tail++;
+                ar->debug.ring_tail %= CARL9170_DEBUG_RING_SIZE;
+        }
+
+out:
+        return err ? err : count;
+}
+
+static char *carl9170_debugfs_hw_ioread32_read(struct ar9170 *ar, char *buf,
+                                               size_t bufsize, ssize_t *ret)
+{
+        int i = 0;
+
+        while (ar->debug.ring_head != ar->debug.ring_tail) {
+                ADD(buf, *ret, bufsize, "%.8x = %.8x\n",
+                    ar->debug.ring[ar->debug.ring_head].reg,
+                    ar->debug.ring[ar->debug.ring_head].value);
+
+                ar->debug.ring_head++;
+                ar->debug.ring_head %= CARL9170_DEBUG_RING_SIZE;
+
+                if (i++ == 64)
+                        break;
+        }
+        ar->debug.ring_head = ar->debug.ring_tail;
+        return buf;
+}
+DEBUGFS_DECLARE_RW_FILE(hw_ioread32, CARL9170_DEBUG_RING_SIZE * 40);
+
+static ssize_t carl9170_debugfs_bug_write(struct ar9170 *ar, const char *buf,
+                                          size_t count)
+{
+        int err;
+
+        if (count < 1)
+                return -EINVAL;
+
+        switch (buf[0]) {
+        case 'F':
+                ar->needs_full_reset = true;
+                break;
+
+        case 'R':
+                if (!IS_STARTED(ar)) {
+                        err = -EAGAIN;
+                        goto out;
+                }
+
+                ar->needs_full_reset = false;
+                break;
+
+        case 'M':
+                err = carl9170_mac_reset(ar);
+                if (err < 0)
+                        count = err;
+
+                goto out;
+
+        case 'P':
+                err = carl9170_set_channel(ar, ar->hw->conf.channel,
+                        ar->hw->conf.channel_type, CARL9170_RFI_COLD);
+                if (err < 0)
+                        count = err;
+
+                goto out;
+
+        default:
+                return -EINVAL;
+        }
+
+        carl9170_restart(ar, CARL9170_RR_USER_REQUEST);
+
+out:
+        return count;
+}
+
+static char *carl9170_debugfs_bug_read(struct ar9170 *ar, char *buf,
+                                       size_t bufsize, ssize_t *ret)
+{
+        ADD(buf, *ret, bufsize, "[P]hy reinit, [R]estart, [F]ull usb reset, "
+            "[M]ac reset\n");
+        ADD(buf, *ret, bufsize, "firmware restarts:%d, last reason:%d\n",
+                ar->restart_counter, ar->last_reason);
+        ADD(buf, *ret, bufsize, "phy reinit errors:%d (%d)\n",
+                ar->total_chan_fail, ar->chan_fail);
+        ADD(buf, *ret, bufsize, "reported firmware errors:%d\n",
+                ar->fw.err_counter);
+        ADD(buf, *ret, bufsize, "reported firmware BUGs:%d\n",
+                ar->fw.bug_counter);
+        ADD(buf, *ret, bufsize, "pending restart requests:%d\n",
+                atomic_read(&ar->pending_restarts));
+        return buf;
+}
+__DEBUGFS_DECLARE_RW_FILE(bug, 400, CARL9170_STOPPED);
+
+static const char *erp_modes[] = {
+        [CARL9170_ERP_INVALID] = "INVALID",
+        [CARL9170_ERP_AUTO] = "Automatic",
+        [CARL9170_ERP_MAC80211] = "Set by MAC80211",
+        [CARL9170_ERP_OFF] = "Force Off",
+        [CARL9170_ERP_RTS] = "Force RTS",
+        [CARL9170_ERP_CTS] = "Force CTS"
+};
+
+static char *carl9170_debugfs_erp_read(struct ar9170 *ar, char *buf,
+                                       size_t bufsize, ssize_t *ret)
+{
+        ADD(buf, *ret, bufsize, "ERP Setting: (%d) -> %s\n", ar->erp_mode,
+            erp_modes[ar->erp_mode]);
+        return buf;
+}
+
+static ssize_t carl9170_debugfs_erp_write(struct ar9170 *ar, const char *buf,
+                                          size_t count)
+{
+        int res, val;
+
+        if (count < 1)
+                return -EINVAL;
+
+        res = sscanf(buf, "%d", &val);
+        if (res != 1)
+                return -EINVAL;
+
+        if (!((val > CARL9170_ERP_INVALID) &&
+              (val < __CARL9170_ERP_NUM)))
+                return -EINVAL;
+
+        ar->erp_mode = val;
+        return count;
+}
+
+DEBUGFS_DECLARE_RW_FILE(erp, 80);
+
+static ssize_t carl9170_debugfs_hw_iowrite32_write(struct ar9170 *ar,
+        const char *buf, size_t count)
+{
+        int err = 0, max_len = 22, res;
+        u32 reg, val;
+
+        if (!count)
+                return 0;
+
+        if (count > max_len)
+                return -E2BIG;
+
+        res = sscanf(buf, "0x%X 0x%X", &reg, &val);
+        if (res != 2) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (reg <= 0x100000 || reg >= 0x280000) {
+                err = -EADDRNOTAVAIL;
+                goto out;
+        }
+
+        if (reg & 3) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        err = carl9170_write_reg(ar, reg, val);
+        if (err)
+                goto out;
+
+out:
+        return err ? err : count;
+}
+DEBUGFS_DECLARE_WO_FILE(hw_iowrite32);
+
+DEBUGFS_HW_TALLY_FILE(hw_tx_tally, "u");
+DEBUGFS_HW_TALLY_FILE(hw_rx_tally, "u");
+DEBUGFS_HW_TALLY_FILE(hw_phy_errors, "u");
+DEBUGFS_HW_REG_FILE(hw_wlan_queue, ".8x");
+DEBUGFS_HW_REG_FILE(hw_pta_queue, ".8x");
+DEBUGFS_HW_REG_FILE(hw_ampdu_info, ".8x");
+DEBUGFS_QUEUE_DUMP(tx_status, 0);
+DEBUGFS_QUEUE_DUMP(tx_status, 1);
+DEBUGFS_QUEUE_DUMP(tx_status, 2);
+DEBUGFS_QUEUE_DUMP(tx_status, 3);
+DEBUGFS_QUEUE_DUMP(tx_pending, 0);
+DEBUGFS_QUEUE_DUMP(tx_pending, 1);
+DEBUGFS_QUEUE_DUMP(tx_pending, 2);
+DEBUGFS_QUEUE_DUMP(tx_pending, 3);
+DEBUGFS_READONLY_FILE(usb_tx_anch_urbs, 20, "%d",
+                      atomic_read(&ar->tx_anch_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_anch_urbs, 20, "%d",
+                      atomic_read(&ar->rx_anch_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_work_urbs, 20, "%d",
+                      atomic_read(&ar->rx_work_urbs));
+DEBUGFS_READONLY_FILE(usb_rx_pool_urbs, 20, "%d",
+                      atomic_read(&ar->rx_pool_urbs));
+
+DEBUGFS_READONLY_FILE(tx_total_queued, 20, "%d",
+                      atomic_read(&ar->tx_total_queued));
+DEBUGFS_READONLY_FILE(tx_ampdu_scheduler, 20, "%d",
+                      atomic_read(&ar->tx_ampdu_scheduler));
+DEBUGFS_READONLY_FILE(tx_ampdu_timeout, 20, "%d",
+                      ar->tx_ampdu_timeout);
+
+DEBUGFS_READONLY_FILE(tx_total_pending, 20, "%d",
+                      atomic_read(&ar->tx_total_pending));
+
+DEBUGFS_READONLY_FILE(tx_ampdu_list_len, 20, "%d",
+                      ar->tx_ampdu_list_len);
+
+DEBUGFS_READONLY_FILE(tx_ampdu_upload, 20, "%d",
+                      atomic_read(&ar->tx_ampdu_upload));
+
+DEBUGFS_READONLY_FILE(tx_janitor_last_run, 64, "last run:%d ms ago",
+        jiffies_to_msecs(jiffies - ar->tx_janitor_last_run));
+
+DEBUGFS_READONLY_FILE(tx_dropped, 20, "%d", ar->tx_dropped);
+
+DEBUGFS_READONLY_FILE(rx_dropped, 20, "%d", ar->rx_dropped);
+
+DEBUGFS_READONLY_FILE(sniffer_enabled, 20, "%d", ar->sniffer_enabled);
+DEBUGFS_READONLY_FILE(rx_software_decryption, 20, "%d",
+                      ar->rx_software_decryption);
+DEBUGFS_READONLY_FILE(ampdu_factor, 20, "%d",
+                      ar->current_factor);
+DEBUGFS_READONLY_FILE(ampdu_density, 20, "%d",
+                      ar->current_density);
+
+DEBUGFS_READONLY_FILE(beacon_int, 20, "%d TU", ar->global_beacon_int);
+DEBUGFS_READONLY_FILE(pretbtt, 20, "%d TU", ar->global_pretbtt);
+
+void carl9170_debugfs_register(struct ar9170 *ar)
+{
+        ar->debug_dir = debugfs_create_dir(KBUILD_MODNAME,
+                ar->hw->wiphy->debugfsdir);
+
+#define DEBUGFS_ADD(name)                                               \
+        debugfs_create_file(#name, carl_debugfs_##name ##_ops.attr,     \
+                            ar->debug_dir, ar,                          \
+                            &carl_debugfs_##name ## _ops.fops);
+
+        DEBUGFS_ADD(usb_tx_anch_urbs);
+        DEBUGFS_ADD(usb_rx_pool_urbs);
+        DEBUGFS_ADD(usb_rx_anch_urbs);
+        DEBUGFS_ADD(usb_rx_work_urbs);
+
+        DEBUGFS_ADD(tx_total_queued);
+        DEBUGFS_ADD(tx_total_pending);
+        DEBUGFS_ADD(tx_dropped);
+        DEBUGFS_ADD(tx_stuck);
+        DEBUGFS_ADD(tx_ampdu_upload);
+        DEBUGFS_ADD(tx_ampdu_scheduler);
+        DEBUGFS_ADD(tx_ampdu_list_len);
+
+        DEBUGFS_ADD(rx_dropped);
+        DEBUGFS_ADD(sniffer_enabled);
+        DEBUGFS_ADD(rx_software_decryption);
+
+        DEBUGFS_ADD(mem_usage);
+        DEBUGFS_ADD(qos_stat);
+        DEBUGFS_ADD(sta_psm);
+        DEBUGFS_ADD(ampdu_state);
+
+        DEBUGFS_ADD(hw_tx_tally);
+        DEBUGFS_ADD(hw_rx_tally);
+        DEBUGFS_ADD(hw_phy_errors);
+        DEBUGFS_ADD(phy_noise);
+
+        DEBUGFS_ADD(hw_wlan_queue);
+        DEBUGFS_ADD(hw_pta_queue);
+        DEBUGFS_ADD(hw_ampdu_info);
+
+        DEBUGFS_ADD(ampdu_density);
+        DEBUGFS_ADD(ampdu_factor);
+
+        DEBUGFS_ADD(tx_ampdu_timeout);
+
+        DEBUGFS_ADD(tx_janitor_last_run);
+
+        DEBUGFS_ADD(tx_status_0);
+        DEBUGFS_ADD(tx_status_1);
+        DEBUGFS_ADD(tx_status_2);
+        DEBUGFS_ADD(tx_status_3);
+
+        DEBUGFS_ADD(tx_pending_0);
+        DEBUGFS_ADD(tx_pending_1);
+        DEBUGFS_ADD(tx_pending_2);
+        DEBUGFS_ADD(tx_pending_3);
+
+        DEBUGFS_ADD(hw_ioread32);
+        DEBUGFS_ADD(hw_iowrite32);
+        DEBUGFS_ADD(bug);
+
+        DEBUGFS_ADD(erp);
+
+        DEBUGFS_ADD(vif_dump);
+
+        DEBUGFS_ADD(beacon_int);
+        DEBUGFS_ADD(pretbtt);
+
+#undef DEBUGFS_ADD
+}
+
+void carl9170_debugfs_unregister(struct ar9170 *ar)
+{
+        debugfs_remove_recursive(ar->debug_dir);
+}
diff --git a/drivers/net/wireless/ath/carl9170/debug.h b/drivers/net/wireless/ath/carl9170/debug.h
new file mode 100644
index 000000000000..ea4b97524122
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/debug.h
@@ -0,0 +1,134 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * debug header
+ *
+ * Copyright 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __DEBUG_H
+#define __DEBUG_H
+
+#include "eeprom.h"
+#include "wlan.h"
+#include "hw.h"
+#include "fwdesc.h"
+#include "fwcmd.h"
+#include "../regd.h"
+
+struct hw_stat_reg_entry {
+        u32 reg;
+        char nreg[32];
+};
+
+#define STAT_MAC_REG(reg)       \
+        { (AR9170_MAC_REG_##reg), #reg }
+
+#define STAT_PTA_REG(reg)       \
+        { (AR9170_PTA_REG_##reg), #reg }
+
+#define STAT_USB_REG(reg)       \
+        { (AR9170_USB_REG_##reg), #reg }
+
+static const struct hw_stat_reg_entry hw_rx_tally_regs[] = {
+        STAT_MAC_REG(RX_CRC32),         STAT_MAC_REG(RX_CRC16),
+        STAT_MAC_REG(RX_TIMEOUT_COUNT), STAT_MAC_REG(RX_ERR_DECRYPTION_UNI),
+        STAT_MAC_REG(RX_ERR_DECRYPTION_MUL), STAT_MAC_REG(RX_MPDU),
+        STAT_MAC_REG(RX_DROPPED_MPDU),  STAT_MAC_REG(RX_DEL_MPDU),
+};
+
+static const struct hw_stat_reg_entry hw_phy_errors_regs[] = {
+        STAT_MAC_REG(RX_PHY_MISC_ERROR), STAT_MAC_REG(RX_PHY_XR_ERROR),
+        STAT_MAC_REG(RX_PHY_OFDM_ERROR), STAT_MAC_REG(RX_PHY_CCK_ERROR),
+        STAT_MAC_REG(RX_PHY_HT_ERROR), STAT_MAC_REG(RX_PHY_TOTAL),
+};
+
+static const struct hw_stat_reg_entry hw_tx_tally_regs[] = {
+        STAT_MAC_REG(TX_TOTAL),         STAT_MAC_REG(TX_UNDERRUN),
+        STAT_MAC_REG(TX_RETRY),
+};
+
+static const struct hw_stat_reg_entry hw_wlan_queue_regs[] = {
+        STAT_MAC_REG(DMA_STATUS),       STAT_MAC_REG(DMA_TRIGGER),
+        STAT_MAC_REG(DMA_TXQ0_ADDR),    STAT_MAC_REG(DMA_TXQ0_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ1_ADDR),    STAT_MAC_REG(DMA_TXQ1_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ2_ADDR),    STAT_MAC_REG(DMA_TXQ2_CURR_ADDR),
+        STAT_MAC_REG(DMA_TXQ3_ADDR),    STAT_MAC_REG(DMA_TXQ3_CURR_ADDR),
+        STAT_MAC_REG(DMA_RXQ_ADDR),     STAT_MAC_REG(DMA_RXQ_CURR_ADDR),
+};
+
+static const struct hw_stat_reg_entry hw_ampdu_info_regs[] = {
+        STAT_MAC_REG(AMPDU_DENSITY),    STAT_MAC_REG(AMPDU_FACTOR),
+};
+
+static const struct hw_stat_reg_entry hw_pta_queue_regs[] = {
+        STAT_PTA_REG(DN_CURR_ADDRH),    STAT_PTA_REG(DN_CURR_ADDRL),
+        STAT_PTA_REG(UP_CURR_ADDRH),    STAT_PTA_REG(UP_CURR_ADDRL),
+        STAT_PTA_REG(DMA_STATUS),       STAT_PTA_REG(DMA_MODE_CTRL),
+};
+
+#define DEFINE_TALLY(name)                                      \
+        u32 name##_sum[ARRAY_SIZE(name##_regs)],                \
+            name##_counter[ARRAY_SIZE(name##_regs)]             \
+
+#define DEFINE_STAT(name)                                       \
+        u32 name##_counter[ARRAY_SIZE(name##_regs)]             \
+
+struct ath_stats {
+        DEFINE_TALLY(hw_tx_tally);
+        DEFINE_TALLY(hw_rx_tally);
+        DEFINE_TALLY(hw_phy_errors);
+        DEFINE_STAT(hw_wlan_queue);
+        DEFINE_STAT(hw_pta_queue);
+        DEFINE_STAT(hw_ampdu_info);
+};
+
+struct carl9170_debug_mem_rbe {
+        u32 reg;
+        u32 value;
+};
+
+#define CARL9170_DEBUG_RING_SIZE                        64
+
+struct carl9170_debug {
+        struct ath_stats stats;
+        struct carl9170_debug_mem_rbe ring[CARL9170_DEBUG_RING_SIZE];
+        struct mutex ring_lock;
+        unsigned int ring_head, ring_tail;
+        struct delayed_work update_tally;
+};
+
+struct ar9170;
+
+void carl9170_debugfs_register(struct ar9170 *ar);
+void carl9170_debugfs_unregister(struct ar9170 *ar);
+#endif /* __DEBUG_H */
diff --git a/drivers/net/wireless/ath/carl9170/eeprom.h b/drivers/net/wireless/ath/carl9170/eeprom.h
new file mode 100644
index 000000000000..7cff40ac7759
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/eeprom.h
@@ -0,0 +1,216 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * EEPROM layout
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __CARL9170_SHARED_EEPROM_H
+#define __CARL9170_SHARED_EEPROM_H
+
+#define AR9170_EEPROM_START             0x1600
+
+#define AR5416_MAX_CHAINS               2
+#define AR5416_MODAL_SPURS              5
+
+struct ar9170_eeprom_modal {
+        __le32  antCtrlChain[AR5416_MAX_CHAINS];
+        __le32  antCtrlCommon;
+        s8      antennaGainCh[AR5416_MAX_CHAINS];
+        u8      switchSettling;
+        u8      txRxAttenCh[AR5416_MAX_CHAINS];
+        u8      rxTxMarginCh[AR5416_MAX_CHAINS];
+        s8      adcDesiredSize;
+        s8      pgaDesiredSize;
+        u8      xlnaGainCh[AR5416_MAX_CHAINS];
+        u8      txEndToXpaOff;
+        u8      txEndToRxOn;
+        u8      txFrameToXpaOn;
+        u8      thresh62;
+        s8      noiseFloorThreshCh[AR5416_MAX_CHAINS];
+        u8      xpdGain;
+        u8      xpd;
+        s8      iqCalICh[AR5416_MAX_CHAINS];
+        s8      iqCalQCh[AR5416_MAX_CHAINS];
+        u8      pdGainOverlap;
+        u8      ob;
+        u8      db;
+        u8      xpaBiasLvl;
+        u8      pwrDecreaseFor2Chain;
+        u8      pwrDecreaseFor3Chain;
+        u8      txFrameToDataStart;
+        u8      txFrameToPaOn;
+        u8      ht40PowerIncForPdadc;
+        u8      bswAtten[AR5416_MAX_CHAINS];
+        u8      bswMargin[AR5416_MAX_CHAINS];
+        u8      swSettleHt40;
+        u8      reserved[22];
+        struct spur_channel {
+                __le16 spurChan;
+                u8      spurRangeLow;
+                u8      spurRangeHigh;
+        } __packed spur_channels[AR5416_MODAL_SPURS];
+} __packed;
+
+#define AR5416_NUM_PD_GAINS             4
+#define AR5416_PD_GAIN_ICEPTS           5
+
+struct ar9170_calibration_data_per_freq {
+        u8      pwr_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+        u8      vpd_pdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+} __packed;
+
+#define AR5416_NUM_5G_CAL_PIERS         8
+#define AR5416_NUM_2G_CAL_PIERS         4
+
+#define AR5416_NUM_5G_TARGET_PWRS       8
+#define AR5416_NUM_2G_CCK_TARGET_PWRS   3
+#define AR5416_NUM_2G_OFDM_TARGET_PWRS  4
+#define AR5416_MAX_NUM_TGT_PWRS         8
+
+struct ar9170_calibration_target_power_legacy {
+        u8      freq;
+        u8      power[4];
+} __packed;
+
+struct ar9170_calibration_target_power_ht {
+        u8      freq;
+        u8      power[8];
+} __packed;
+
+#define AR5416_NUM_CTLS                 24
+
+struct ar9170_calctl_edges {
+        u8      channel;
+#define AR9170_CALCTL_EDGE_FLAGS        0xC0
+        u8      power_flags;
+} __packed;
+
+#define AR5416_NUM_BAND_EDGES           8
+
+struct ar9170_calctl_data {
+        struct ar9170_calctl_edges
+                control_edges[AR5416_MAX_CHAINS][AR5416_NUM_BAND_EDGES];
+} __packed;
+
+struct ar9170_eeprom {
+        __le16  length;
+        __le16  checksum;
+        __le16  version;
+        u8      operating_flags;
+#define AR9170_OPFLAG_5GHZ              1
+#define AR9170_OPFLAG_2GHZ              2
+        u8      misc;
+        __le16  reg_domain[2];
+        u8      mac_address[6];
+        u8      rx_mask;
+        u8      tx_mask;
+        __le16  rf_silent;
+        __le16  bluetooth_options;
+        __le16  device_capabilities;
+        __le32  build_number;
+        u8      deviceType;
+        u8      reserved[33];
+
+        u8      customer_data[64];
+
+        struct ar9170_eeprom_modal
+                modal_header[2];
+
+        u8      cal_freq_pier_5G[AR5416_NUM_5G_CAL_PIERS];
+        u8      cal_freq_pier_2G[AR5416_NUM_2G_CAL_PIERS];
+
+        struct ar9170_calibration_data_per_freq
+                cal_pier_data_5G[AR5416_MAX_CHAINS][AR5416_NUM_5G_CAL_PIERS],
+                cal_pier_data_2G[AR5416_MAX_CHAINS][AR5416_NUM_2G_CAL_PIERS];
+
+        /* power calibration data */
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_5G[AR5416_NUM_5G_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_5G_ht20[AR5416_NUM_5G_TARGET_PWRS],
+                cal_tgt_pwr_5G_ht40[AR5416_NUM_5G_TARGET_PWRS];
+
+        struct ar9170_calibration_target_power_legacy
+                cal_tgt_pwr_2G_cck[AR5416_NUM_2G_CCK_TARGET_PWRS],
+                cal_tgt_pwr_2G_ofdm[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+        struct ar9170_calibration_target_power_ht
+                cal_tgt_pwr_2G_ht20[AR5416_NUM_2G_OFDM_TARGET_PWRS],
+                cal_tgt_pwr_2G_ht40[AR5416_NUM_2G_OFDM_TARGET_PWRS];
+
+        /* conformance testing limits */
+        u8      ctl_index[AR5416_NUM_CTLS];
+        struct ar9170_calctl_data
+                ctl_data[AR5416_NUM_CTLS];
+
+        u8      pad;
+        __le16  subsystem_id;
+} __packed;
+
+#define AR9170_LED_MODE_POWER_ON                0x0001
+#define AR9170_LED_MODE_RESERVED                0x0002
+#define AR9170_LED_MODE_DISABLE_STATE           0x0004
+#define AR9170_LED_MODE_OFF_IN_PSM              0x0008
+
+/* AR9170_LED_MODE BIT is set */
+#define AR9170_LED_MODE_FREQUENCY_S             4
+#define AR9170_LED_MODE_FREQUENCY               0x0030
+#define AR9170_LED_MODE_FREQUENCY_1HZ           0x0000
+#define AR9170_LED_MODE_FREQUENCY_0_5HZ         0x0010
+#define AR9170_LED_MODE_FREQUENCY_0_25HZ        0x0020
+#define AR9170_LED_MODE_FREQUENCY_0_125HZ       0x0030
+
+/* AR9170_LED_MODE BIT is not set */
+#define AR9170_LED_MODE_CONN_STATE_S            4
+#define AR9170_LED_MODE_CONN_STATE              0x0030
+#define AR9170_LED_MODE_CONN_STATE_FORCE_OFF    0x0000
+#define AR9170_LED_MODE_CONN_STATE_FORCE_ON     0x0010
+/* Idle off / Active on */
+#define AR9170_LED_MODE_CONN_STATE_IOFF_AON     0x0020
+/* Idle on / Active off */
+#define AR9170_LED_MODE_CONN_STATE_ION_AOFF     0x0010
+
+#define AR9170_LED_MODE_MODE                    0x0040
+#define AR9170_LED_MODE_RESERVED2               0x0080
+
+#define AR9170_LED_MODE_TON_SCAN_S              8
+#define AR9170_LED_MODE_TON_SCAN                0x0f00
+
+#define AR9170_LED_MODE_TOFF_SCAN_S             12
+#define AR9170_LED_MODE_TOFF_SCAN               0xf000
+
+struct ar9170_led_mode {
+        __le16 led;
+};
+
+#endif /* __CARL9170_SHARED_EEPROM_H */
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
new file mode 100644
index 000000000000..36615462b87a
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -0,0 +1,395 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * firmware parser
+ *
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ */
+
+#include <linux/kernel.h>
+#include <linux/firmware.h>
+#include <linux/crc32.h>
+#include "carl9170.h"
+#include "fwcmd.h"
+#include "version.h"
+
+#define MAKE_STR(symbol) #symbol
+#define TO_STR(symbol) MAKE_STR(symbol)
+#define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER)
+MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT);
+
+static const u8 otus_magic[4] = { OTUS_MAGIC };
+
+static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4],
+        const unsigned int len, const u8 compatible_revision)
+{
+        const struct carl9170fw_desc_head *iter;
+
+        carl9170fw_for_each_hdr(iter, ar->fw.desc) {
+                if (carl9170fw_desc_cmp(iter, descid, len,
+                                        compatible_revision))
+                        return (void *)iter;
+        }
+
+        /* needed to find the LAST desc */
+        if (carl9170fw_desc_cmp(iter, descid, len,
+                                compatible_revision))
+                return (void *)iter;
+
+        return NULL;
+}
+
+static int carl9170_fw_verify_descs(struct ar9170 *ar,
+        const struct carl9170fw_desc_head *head, unsigned int max_len)
+{
+        const struct carl9170fw_desc_head *pos;
+        unsigned long pos_addr, end_addr;
+        unsigned int pos_length;
+
+        if (max_len < sizeof(*pos))
+                return -ENODATA;
+
+        max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len);
+
+        pos = head;
+        pos_addr = (unsigned long) pos;
+        end_addr = pos_addr + max_len;
+
+        while (pos_addr < end_addr) {
+                if (pos_addr + sizeof(*head) > end_addr)
+                        return -E2BIG;
+
+                pos_length = le16_to_cpu(pos->length);
+
+                if (pos_length < sizeof(*head))
+                        return -EBADMSG;
+
+                if (pos_length > max_len)
+                        return -EOVERFLOW;
+
+                if (pos_addr + pos_length > end_addr)
+                        return -EMSGSIZE;
+
+                if (carl9170fw_desc_cmp(pos, LAST_MAGIC,
+                                        CARL9170FW_LAST_DESC_SIZE,
+                                        CARL9170FW_LAST_DESC_CUR_VER))
+                        return 0;
+
+                pos_addr += pos_length;
+                pos = (void *)pos_addr;
+                max_len -= pos_length;
+        }
+        return -EINVAL;
+}
+
+static void carl9170_fw_info(struct ar9170 *ar)
+{
+        const struct carl9170fw_motd_desc *motd_desc;
+        unsigned int str_ver_len;
+        u32 fw_date;
+
+        dev_info(&ar->udev->dev, "driver   API: %s 2%03d-%02d-%02d [%d-%d]\n",
+                CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR,
+                CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY,
+                CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER);
+
+        motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC,
+                sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER);
+
+        if (motd_desc) {
+                str_ver_len = strnlen(motd_desc->release,
+                        CARL9170FW_MOTD_RELEASE_LEN);
+
+                fw_date = le32_to_cpu(motd_desc->fw_year_month_day);
+
+                dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n",
+                         str_ver_len, motd_desc->release,
+                         CARL9170FW_GET_YEAR(fw_date),
+                         CARL9170FW_GET_MONTH(fw_date),
+                         CARL9170FW_GET_DAY(fw_date));
+
+                strlcpy(ar->hw->wiphy->fw_version, motd_desc->release,
+                        sizeof(ar->hw->wiphy->fw_version));
+        }
+}
+
+static bool valid_dma_addr(const u32 address)
+{
+        if (address >= AR9170_SRAM_OFFSET &&
+            address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE))
+                return true;
+
+        return false;
+}
+
+static bool valid_cpu_addr(const u32 address)
+{
+        if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET &&
+            address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE)))
+                return true;
+
+        return false;
+}
+
+static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
+{
+        const struct carl9170fw_otus_desc *otus_desc;
+        const struct carl9170fw_chk_desc *chk_desc;
+        const struct carl9170fw_last_desc *last_desc;
+
+        last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC,
+                sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER);
+        if (!last_desc)
+                return -EINVAL;
+
+        otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
+                sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
+        if (!otus_desc) {
+                dev_err(&ar->udev->dev, "failed to find compatible firmware "
+                        "descriptor.\n");
+                return -ENODATA;
+        }
+
+        chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC,
+                sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER);
+
+        if (chk_desc) {
+                unsigned long fin, diff;
+                unsigned int dsc_len;
+                u32 crc32;
+
+                dsc_len = min_t(unsigned int, len,
+                        (unsigned long)chk_desc - (unsigned long)otus_desc);
+
+                fin = (unsigned long) last_desc + sizeof(*last_desc);
+                diff = fin - (unsigned long) otus_desc;
+
+                if (diff < len)
+                        len -= diff;
+
+                if (len < 256)
+                        return -EIO;
+
+                crc32 = crc32_le(~0, data, len);
+                if (cpu_to_le32(crc32) != chk_desc->fw_crc32) {
+                        dev_err(&ar->udev->dev, "fw checksum test failed.\n");
+                        return -ENOEXEC;
+                }
+
+                crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len);
+                if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) {
+                        dev_err(&ar->udev->dev, "descriptor check failed.\n");
+                        return -EINVAL;
+                }
+        } else {
+                dev_warn(&ar->udev->dev, "Unprotected firmware image.\n");
+        }
+
+#define SUPP(feat)                                              \
+        (carl9170fw_supports(otus_desc->feature_set, feat))
+
+        if (!SUPP(CARL9170FW_DUMMY_FEATURE)) {
+                dev_err(&ar->udev->dev, "invalid firmware descriptor "
+                        "format detected.\n");
+                return -EINVAL;
+        }
+
+        ar->fw.api_version = otus_desc->api_ver;
+
+        if (ar->fw.api_version < CARL9170FW_API_MIN_VER ||
+            ar->fw.api_version > CARL9170FW_API_MAX_VER) {
+                dev_err(&ar->udev->dev, "unsupported firmware api version.\n");
+                return -EINVAL;
+        }
+
+        if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) ||
+            !SUPP(CARL9170FW_HANDLE_BACK_REQ)) {
+                dev_err(&ar->udev->dev, "firmware does support "
+                        "mandatory features.\n");
+                return -ECANCELED;
+        }
+
+        if (ilog2(le32_to_cpu(otus_desc->feature_set)) >=
+                __CARL9170FW_FEATURE_NUM) {
+                dev_warn(&ar->udev->dev, "driver does not support all "
+                         "firmware features.\n");
+        }
+
+        if (!SUPP(CARL9170FW_COMMAND_CAM)) {
+                dev_info(&ar->udev->dev, "crypto offloading is disabled "
+                         "by firmware.\n");
+                ar->disable_offload = true;
+        }
+
+        if (SUPP(CARL9170FW_PSM))
+                ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS;
+
+        if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) {
+                dev_err(&ar->udev->dev, "firmware does not provide "
+                        "mandatory interfaces.\n");
+                return -EINVAL;
+        }
+
+        if (SUPP(CARL9170FW_MINIBOOT))
+                ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size);
+        else
+                ar->fw.offset = 0;
+
+        if (SUPP(CARL9170FW_USB_DOWN_STREAM)) {
+                ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream);
+                ar->fw.tx_stream = true;
+        }
+
+        if (SUPP(CARL9170FW_USB_UP_STREAM))
+                ar->fw.rx_stream = true;
+
+        ar->fw.vif_num = otus_desc->vif_num;
+        ar->fw.cmd_bufs = otus_desc->cmd_bufs;
+        ar->fw.address = le32_to_cpu(otus_desc->fw_address);
+        ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len);
+        ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe);
+        atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
+        ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len);
+
+        if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num ||
+            ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs ||
+            ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 ||
+            ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 ||
+            !valid_cpu_addr(ar->fw.address)) {
+                dev_err(&ar->udev->dev, "firmware shows obvious signs of "
+                        "malicious tampering.\n");
+                return -EINVAL;
+        }
+
+        ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr);
+        ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len);
+
+        if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >=
+            AR9170_MAC_BCN_LENGTH_MAX) {
+                ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+
+                if (SUPP(CARL9170FW_WLANTX_CAB)) {
+                        ar->hw->wiphy->interface_modes |=
+                                BIT(NL80211_IFTYPE_AP);
+                }
+        }
+
+#undef SUPPORTED
+        return 0;
+}
+
+static struct carl9170fw_desc_head *
+carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len)
+
+{
+        int scan = 0, found = 0;
+
+        if (!carl9170fw_size_check(len)) {
+                dev_err(&ar->udev->dev, "firmware size is out of bound.\n");
+                return NULL;
+        }
+
+        while (scan < len - sizeof(struct carl9170fw_desc_head)) {
+                if (fw_data[scan++] == otus_magic[found])
+                        found++;
+                else
+                        found = 0;
+
+                if (scan >= len)
+                        break;
+
+                if (found == sizeof(otus_magic))
+                        break;
+        }
+
+        if (found != sizeof(otus_magic))
+                return NULL;
+
+        return (void *)&fw_data[scan - found];
+}
+
+int carl9170_fw_fix_eeprom(struct ar9170 *ar)
+{
+        const struct carl9170fw_fix_desc *fix_desc = NULL;
+        unsigned int i, n, off;
+        u32 *data = (void *)&ar->eeprom;
+
+        fix_desc = carl9170_fw_find_desc(ar, FIX_MAGIC,
+                sizeof(*fix_desc), CARL9170FW_FIX_DESC_CUR_VER);
+
+        if (!fix_desc)
+                return 0;
+
+        n = (le16_to_cpu(fix_desc->head.length) - sizeof(*fix_desc)) /
+            sizeof(struct carl9170fw_fix_entry);
+
+        for (i = 0; i < n; i++) {
+                off = le32_to_cpu(fix_desc->data[i].address) -
+                      AR9170_EEPROM_START;
+
+                if (off >= sizeof(struct ar9170_eeprom) || (off & 3)) {
+                        dev_err(&ar->udev->dev, "Skip invalid entry %d\n", i);
+                        continue;
+                }
+
+                data[off / sizeof(*data)] &=
+                        le32_to_cpu(fix_desc->data[i].mask);
+                data[off / sizeof(*data)] |=
+                        le32_to_cpu(fix_desc->data[i].value);
+        }
+
+        return 0;
+}
+
+int carl9170_parse_firmware(struct ar9170 *ar)
+{
+        const struct carl9170fw_desc_head *fw_desc = NULL;
+        const struct firmware *fw = ar->fw.fw;
+        unsigned long header_offset = 0;
+        int err;
+
+        if (WARN_ON(!fw))
+                return -EINVAL;
+
+        fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size);
+
+        if (!fw_desc) {
+                dev_err(&ar->udev->dev, "unsupported firmware.\n");
+                return -ENODATA;
+        }
+
+        header_offset = (unsigned long)fw_desc - (unsigned long)fw->data;
+
+        err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset);
+        if (err) {
+                dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err);
+                return err;
+        }
+
+        ar->fw.desc = fw_desc;
+
+        carl9170_fw_info(ar);
+
+        err = carl9170_fw(ar, fw->data, fw->size);
+        if (err) {
+                dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n",
+                        err);
+                return err;
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
new file mode 100644
index 000000000000..d4a4e1dbef06
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -0,0 +1,268 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * Firmware command interface definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_FWCMD_H
+#define __CARL9170_SHARED_FWCMD_H
+
+#define CARL9170_MAX_CMD_LEN            64
+#define CARL9170_MAX_CMD_PAYLOAD_LEN    60
+
+#define CARL9170FW_API_MIN_VER          1
+#define CARL9170FW_API_MAX_VER          1
+
+enum carl9170_cmd_oids {
+        CARL9170_CMD_RREG               = 0x00,
+        CARL9170_CMD_WREG               = 0x01,
+        CARL9170_CMD_ECHO               = 0x02,
+        CARL9170_CMD_SWRST              = 0x03,
+        CARL9170_CMD_REBOOT             = 0x04,
+        CARL9170_CMD_BCN_CTRL           = 0x05,
+        CARL9170_CMD_READ_TSF           = 0x06,
+
+        /* CAM */
+        CARL9170_CMD_EKEY               = 0x10,
+        CARL9170_CMD_DKEY               = 0x11,
+
+        /* RF / PHY */
+        CARL9170_CMD_FREQUENCY          = 0x20,
+        CARL9170_CMD_RF_INIT            = 0x21,
+        CARL9170_CMD_SYNTH              = 0x22,
+        CARL9170_CMD_FREQ_START         = 0x23,
+        CARL9170_CMD_PSM                = 0x24,
+
+        /* Asychronous command flag */
+        CARL9170_CMD_ASYNC_FLAG         = 0x40,
+        CARL9170_CMD_WREG_ASYNC         = (CARL9170_CMD_WREG |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_REBOOT_ASYNC       = (CARL9170_CMD_REBOOT |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_BCN_CTRL_ASYNC     = (CARL9170_CMD_BCN_CTRL |
+                                           CARL9170_CMD_ASYNC_FLAG),
+        CARL9170_CMD_PSM_ASYNC          = (CARL9170_CMD_PSM |
+                                           CARL9170_CMD_ASYNC_FLAG),
+
+        /* responses and traps */
+        CARL9170_RSP_FLAG               = 0xc0,
+        CARL9170_RSP_PRETBTT            = 0xc0,
+        CARL9170_RSP_TXCOMP             = 0xc1,
+        CARL9170_RSP_BEACON_CONFIG      = 0xc2,
+        CARL9170_RSP_ATIM               = 0xc3,
+        CARL9170_RSP_WATCHDOG           = 0xc6,
+        CARL9170_RSP_TEXT               = 0xca,
+        CARL9170_RSP_HEXDUMP            = 0xcc,
+        CARL9170_RSP_RADAR              = 0xcd,
+        CARL9170_RSP_GPIO               = 0xce,
+        CARL9170_RSP_BOOT               = 0xcf,
+};
+
+struct carl9170_set_key_cmd {
+        __le16          user;
+        __le16          keyId;
+        __le16          type;
+        u8              macAddr[6];
+        u32             key[4];
+} __packed;
+#define CARL9170_SET_KEY_CMD_SIZE               28
+
+struct carl9170_disable_key_cmd {
+        __le16          user;
+        __le16          padding;
+} __packed;
+#define CARL9170_DISABLE_KEY_CMD_SIZE           4
+
+struct carl9170_u32_list {
+        u32     vals[0];
+} __packed;
+
+struct carl9170_reg_list {
+        __le32          regs[0];
+} __packed;
+
+struct carl9170_write_reg {
+        struct {
+                __le32          addr;
+                __le32          val;
+        } regs[0] __packed;
+} __packed;
+
+#define CARL9170FW_PHY_HT_ENABLE                0x4
+#define CARL9170FW_PHY_HT_DYN2040               0x8
+#define CARL9170FW_PHY_HT_EXT_CHAN_OFF          0x3
+#define CARL9170FW_PHY_HT_EXT_CHAN_OFF_S        2
+
+struct carl9170_rf_init {
+        __le32          freq;
+        u8              ht_settings;
+        u8              padding2[3];
+        __le32          delta_slope_coeff_exp;
+        __le32          delta_slope_coeff_man;
+        __le32          delta_slope_coeff_exp_shgi;
+        __le32          delta_slope_coeff_man_shgi;
+        __le32          finiteLoopCount;
+} __packed;
+#define CARL9170_RF_INIT_SIZE           28
+
+struct carl9170_rf_init_result {
+        __le32          ret;            /* AR9170_PHY_REG_AGC_CONTROL */
+} __packed;
+#define CARL9170_RF_INIT_RESULT_SIZE    4
+
+#define CARL9170_PSM_SLEEP              0x1000
+#define CARL9170_PSM_SOFTWARE           0
+#define CARL9170_PSM_WAKE               0 /* internally used. */
+#define CARL9170_PSM_COUNTER            0xfff
+#define CARL9170_PSM_COUNTER_S          0
+
+struct carl9170_psm {
+        __le32          state;
+} __packed;
+#define CARL9170_PSM_SIZE               4
+
+struct carl9170_bcn_ctrl_cmd {
+        __le32          vif_id;
+        __le32          mode;
+        __le32          bcn_addr;
+        __le32          bcn_len;
+} __packed;
+#define CARL9170_BCN_CTRL_CMD_SIZE      16
+
+#define CARL9170_BCN_CTRL_DRAIN 0
+#define CARL9170_BCN_CTRL_CAB_TRIGGER   1
+
+struct carl9170_cmd_head {
+        union {
+                struct {
+                        u8      len;
+                        u8      cmd;
+                        u8      seq;
+                        u8      ext;
+                } __packed;
+
+                u32 hdr_data;
+        } __packed;
+} __packed;
+
+struct carl9170_cmd {
+        struct carl9170_cmd_head hdr;
+        union {
+                struct carl9170_set_key_cmd     setkey;
+                struct carl9170_disable_key_cmd disablekey;
+                struct carl9170_u32_list        echo;
+                struct carl9170_reg_list        rreg;
+                struct carl9170_write_reg       wreg;
+                struct carl9170_rf_init         rf_init;
+                struct carl9170_psm             psm;
+                struct carl9170_bcn_ctrl_cmd    bcn_ctrl;
+                u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
+        } __packed;
+} __packed;
+
+#define CARL9170_TX_STATUS_QUEUE        3
+#define CARL9170_TX_STATUS_QUEUE_S      0
+#define CARL9170_TX_STATUS_RIX_S        2
+#define CARL9170_TX_STATUS_RIX          (3 << CARL9170_TX_STATUS_RIX_S)
+#define CARL9170_TX_STATUS_TRIES_S      4
+#define CARL9170_TX_STATUS_TRIES        (7 << CARL9170_TX_STATUS_TRIES_S)
+#define CARL9170_TX_STATUS_SUCCESS      0x80
+
+/*
+ * NOTE:
+ * Both structs [carl9170_tx_status and _carl9170_tx_status]
+ * need to be "bit for bit" in sync.
+ */
+struct carl9170_tx_status {
+        /*
+         * Beware of compiler bugs in all gcc pre 4.4!
+         */
+
+        u8 cookie;
+        u8 queue:2;
+        u8 rix:2;
+        u8 tries:3;
+        u8 success:1;
+} __packed;
+struct _carl9170_tx_status {
+        /*
+         * This version should be immune to all alignment bugs.
+         */
+
+        u8 cookie;
+        u8 info;
+} __packed;
+#define CARL9170_TX_STATUS_SIZE         2
+
+#define CARL9170_RSP_TX_STATUS_NUM      (CARL9170_MAX_CMD_PAYLOAD_LEN / \
+                                         sizeof(struct _carl9170_tx_status))
+
+#define CARL9170_TX_MAX_RATE_TRIES      7
+
+#define CARL9170_TX_MAX_RATES           4
+#define CARL9170_TX_MAX_RETRY_RATES     (CARL9170_TX_MAX_RATES - 1)
+#define CARL9170_ERR_MAGIC              "ERR:"
+#define CARL9170_BUG_MAGIC              "BUG:"
+
+struct carl9170_gpio {
+        __le32 gpio;
+} __packed;
+#define CARL9170_GPIO_SIZE              4
+
+struct carl9170_tsf_rsp {
+        union {
+                __le32 tsf[2];
+                __le64 tsf_64;
+        } __packed;
+} __packed;
+#define CARL9170_TSF_RSP_SIZE           8
+
+struct carl9170_rsp {
+        struct carl9170_cmd_head hdr;
+
+        union {
+                struct carl9170_rf_init_result  rf_init_res;
+                struct carl9170_u32_list        rreg_res;
+                struct carl9170_u32_list        echo;
+                struct carl9170_tx_status       tx_status[0];
+                struct _carl9170_tx_status      _tx_status[0];
+                struct carl9170_gpio            gpio;
+                struct carl9170_tsf_rsp         tsf;
+                struct carl9170_psm             psm;
+                u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
+        } __packed;
+} __packed;
+
+#endif /* __CARL9170_SHARED_FWCMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/fwdesc.h b/drivers/net/wireless/ath/carl9170/fwdesc.h
new file mode 100644
index 000000000000..7cd811708fe5
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/fwdesc.h
@@ -0,0 +1,237 @@
+/*
+ * Shared CARL9170 Header
+ *
+ * Firmware descriptor format
+ *
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ */
+
+#ifndef __CARL9170_SHARED_FWDESC_H
+#define __CARL9170_SHARED_FWDESC_H
+
+/* NOTE: Don't mess with the order of the flags! */
+enum carl9170fw_feature_list {
+        /* Always set */
+        CARL9170FW_DUMMY_FEATURE,
+
+        /*
+         * Indicates that this image has special boot block which prevents
+         * legacy drivers to drive the firmware.
+         */
+        CARL9170FW_MINIBOOT,
+
+        /* usb registers are initialized by the firmware */
+        CARL9170FW_USB_INIT_FIRMWARE,
+
+        /* command traps & notifications are send through EP2 */
+        CARL9170FW_USB_RESP_EP2,
+
+        /* usb download (app -> fw) stream */
+        CARL9170FW_USB_DOWN_STREAM,
+
+        /* usb upload (fw -> app) stream */
+        CARL9170FW_USB_UP_STREAM,
+
+        /* unusable - reserved to flag non-functional debug firmwares */
+        CARL9170FW_UNUSABLE,
+
+        /* AR9170_CMD_RF_INIT, AR9170_CMD_FREQ_START, AR9170_CMD_FREQUENCY */
+        CARL9170FW_COMMAND_PHY,
+
+        /* AR9170_CMD_EKEY, AR9170_CMD_DKEY */
+        CARL9170FW_COMMAND_CAM,
+
+        /* Firmware has a software Content After Beacon Queueing mechanism */
+        CARL9170FW_WLANTX_CAB,
+
+        /* The firmware is capable of responding to incoming BAR frames */
+        CARL9170FW_HANDLE_BACK_REQ,
+
+        /* GPIO Interrupt | CARL9170_RSP_GPIO */
+        CARL9170FW_GPIO_INTERRUPT,
+
+        /* Firmware PSM support | CARL9170_CMD_PSM */
+        CARL9170FW_PSM,
+
+        /* KEEP LAST */
+        __CARL9170FW_FEATURE_NUM
+};
+
+#define OTUS_MAGIC      "OTAR"
+#define MOTD_MAGIC      "MOTD"
+#define FIX_MAGIC       "FIX\0"
+#define DBG_MAGIC       "DBG\0"
+#define CHK_MAGIC       "CHK\0"
+#define LAST_MAGIC      "LAST"
+
+#define CARL9170FW_SET_DAY(d) (((d) - 1) % 31)
+#define CARL9170FW_SET_MONTH(m) ((((m) - 1) % 12) * 31)
+#define CARL9170FW_SET_YEAR(y) (((y) - 10) * 372)
+
+#define CARL9170FW_GET_DAY(d) (((d) % 31) + 1)
+#define CARL9170FW_GET_MONTH(m) ((((m) / 31) % 12) + 1)
+#define CARL9170FW_GET_YEAR(y) ((y) / 372 + 10)
+
+struct carl9170fw_desc_head {
+        u8      magic[4];
+        __le16 length;
+        u8 min_ver;
+        u8 cur_ver;
+} __packed;
+#define CARL9170FW_DESC_HEAD_SIZE                       \
+        (sizeof(struct carl9170fw_desc_head))
+
+#define CARL9170FW_OTUS_DESC_MIN_VER            6
+#define CARL9170FW_OTUS_DESC_CUR_VER            6
+struct carl9170fw_otus_desc {
+        struct carl9170fw_desc_head head;
+        __le32 feature_set;
+        __le32 fw_address;
+        __le32 bcn_addr;
+        __le16 bcn_len;
+        __le16 miniboot_size;
+        __le16 tx_frag_len;
+        __le16 rx_max_frame_len;
+        u8 tx_descs;
+        u8 cmd_bufs;
+        u8 api_ver;
+        u8 vif_num;
+} __packed;
+#define CARL9170FW_OTUS_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_otus_desc))
+
+#define CARL9170FW_MOTD_STRING_LEN                      24
+#define CARL9170FW_MOTD_RELEASE_LEN                     20
+#define CARL9170FW_MOTD_DESC_MIN_VER                    1
+#define CARL9170FW_MOTD_DESC_CUR_VER                    2
+struct carl9170fw_motd_desc {
+        struct carl9170fw_desc_head head;
+        __le32 fw_year_month_day;
+        char desc[CARL9170FW_MOTD_STRING_LEN];
+        char release[CARL9170FW_MOTD_RELEASE_LEN];
+} __packed;
+#define CARL9170FW_MOTD_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_motd_desc))
+
+#define CARL9170FW_FIX_DESC_MIN_VER                     1
+#define CARL9170FW_FIX_DESC_CUR_VER                     2
+struct carl9170fw_fix_entry {
+        __le32 address;
+        __le32 mask;
+        __le32 value;
+} __packed;
+
+struct carl9170fw_fix_desc {
+        struct carl9170fw_desc_head head;
+        struct carl9170fw_fix_entry data[0];
+} __packed;
+#define CARL9170FW_FIX_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_fix_desc))
+
+#define CARL9170FW_DBG_DESC_MIN_VER                     1
+#define CARL9170FW_DBG_DESC_CUR_VER                     2
+struct carl9170fw_dbg_desc {
+        struct carl9170fw_desc_head head;
+
+        __le32 bogoclock_addr;
+        __le32 counter_addr;
+        __le32 rx_total_addr;
+        __le32 rx_overrun_addr;
+
+        /* Put your debugging definitions here */
+} __packed;
+#define CARL9170FW_DBG_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_dbg_desc))
+
+#define CARL9170FW_CHK_DESC_MIN_VER                     1
+#define CARL9170FW_CHK_DESC_CUR_VER                     2
+struct carl9170fw_chk_desc {
+        struct carl9170fw_desc_head head;
+        __le32 fw_crc32;
+        __le32 hdr_crc32;
+} __packed;
+#define CARL9170FW_CHK_DESC_SIZE                        \
+        (sizeof(struct carl9170fw_chk_desc))
+
+#define CARL9170FW_LAST_DESC_MIN_VER                    1
+#define CARL9170FW_LAST_DESC_CUR_VER                    2
+struct carl9170fw_last_desc {
+        struct carl9170fw_desc_head head;
+} __packed;
+#define CARL9170FW_LAST_DESC_SIZE                       \
+        (sizeof(struct carl9170fw_fix_desc))
+
+#define CARL9170FW_DESC_MAX_LENGTH                      8192
+
+#define CARL9170FW_FILL_DESC(_magic, _length, _min_ver, _cur_ver)       \
+        .head = {                                                       \
+                .magic = _magic,                                        \
+                .length = cpu_to_le16(_length),                         \
+                .min_ver = _min_ver,                                    \
+                .cur_ver = _cur_ver,                                    \
+        }
+
+static inline void carl9170fw_fill_desc(struct carl9170fw_desc_head *head,
+                                         u8 magic[4], __le16 length,
+                                         u8 min_ver, u8 cur_ver)
+{
+        head->magic[0] = magic[0];
+        head->magic[1] = magic[1];
+        head->magic[2] = magic[2];
+        head->magic[3] = magic[3];
+
+        head->length = length;
+        head->min_ver = min_ver;
+        head->cur_ver = cur_ver;
+}
+
+#define carl9170fw_for_each_hdr(desc, fw_desc)                          \
+        for (desc = fw_desc;                                            \
+             memcmp(desc->magic, LAST_MAGIC, 4) &&                      \
+             le16_to_cpu(desc->length) >= CARL9170FW_DESC_HEAD_SIZE &&  \
+             le16_to_cpu(desc->length) < CARL9170FW_DESC_MAX_LENGTH;    \
+             desc = (void *)((unsigned long)desc + le16_to_cpu(desc->length)))
+
+#define CHECK_HDR_VERSION(head, _min_ver)                               \
+        (((head)->cur_ver < _min_ver) || ((head)->min_ver > _min_ver))  \
+
+static inline bool carl9170fw_supports(__le32 list, u8 feature)
+{
+        return le32_to_cpu(list) & BIT(feature);
+}
+
+static inline bool carl9170fw_desc_cmp(const struct carl9170fw_desc_head *head,
+                                       const u8 descid[4], u16 min_len,
+                                       u8 compatible_revision)
+{
+        if (descid[0] == head->magic[0] && descid[1] == head->magic[1] &&
+            descid[2] == head->magic[2] && descid[3] == head->magic[3] &&
+            !CHECK_HDR_VERSION(head, compatible_revision) &&
+            (le16_to_cpu(head->length) >= min_len))
+                return true;
+
+        return false;
+}
+
+#define CARL9170FW_MIN_SIZE     32
+#define CARL9170FW_MAX_SIZE     16384
+
+static inline bool carl9170fw_size_check(unsigned int len)
+{
+        return (len <= CARL9170FW_MAX_SIZE && len >= CARL9170FW_MIN_SIZE);
+}
+
+#endif /* __CARL9170_SHARED_FWDESC_H */
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
new file mode 100644
index 000000000000..b1292ac5b703
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -0,0 +1,736 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * Register map, hardware-specific definitions
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_HW_H
+#define __CARL9170_SHARED_HW_H
+
+/* High Speed UART */
+#define AR9170_UART_REG_BASE                    0x1c0000
+
+/* Definitions of interrupt registers */
+#define AR9170_UART_REG_RX_BUFFER               (AR9170_UART_REG_BASE + 0x000)
+#define AR9170_UART_REG_TX_HOLDING              (AR9170_UART_REG_BASE + 0x004)
+#define AR9170_UART_REG_FIFO_CONTROL            (AR9170_UART_REG_BASE + 0x010)
+#define         AR9170_UART_FIFO_CTRL_RESET_RX_FIFO     0x02
+#define         AR9170_UART_FIFO_CTRL_RESET_TX_FIFO     0x04
+
+#define AR9170_UART_REG_LINE_CONTROL            (AR9170_UART_REG_BASE + 0x014)
+#define AR9170_UART_REG_MODEM_CONTROL           (AR9170_UART_REG_BASE + 0x018)
+#define         AR9170_UART_MODEM_CTRL_DTR_BIT          0x01
+#define         AR9170_UART_MODEM_CTRL_RTS_BIT          0x02
+#define         AR9170_UART_MODEM_CTRL_INTERNAL_LOOP_BACK       0x10
+#define         AR9170_UART_MODEM_CTRL_AUTO_RTS         0x20
+#define         AR9170_UART_MODEM_CTRL_AUTO_CTR         0x40
+
+#define AR9170_UART_REG_LINE_STATUS             (AR9170_UART_REG_BASE + 0x01c)
+#define         AR9170_UART_LINE_STS_RX_DATA_READY      0x01
+#define         AR9170_UART_LINE_STS_RX_BUFFER_OVERRUN  0x02
+#define         AR9170_UART_LINE_STS_RX_BREAK_IND       0x10
+#define         AR9170_UART_LINE_STS_TX_FIFO_NEAR_EMPTY 0x20
+#define         AR9170_UART_LINE_STS_TRANSMITTER_EMPTY  0x40
+
+#define AR9170_UART_REG_MODEM_STATUS            (AR9170_UART_REG_BASE + 0x020)
+#define         AR9170_UART_MODEM_STS_CTS_CHANGE        0x01
+#define         AR9170_UART_MODEM_STS_DSR_CHANGE        0x02
+#define         AR9170_UART_MODEM_STS_DCD_CHANGE        0x08
+#define         AR9170_UART_MODEM_STS_CTS_COMPL         0x10
+#define         AR9170_UART_MODEM_STS_DSR_COMPL         0x20
+#define         AR9170_UART_MODEM_STS_DCD_COMPL         0x80
+
+#define AR9170_UART_REG_SCRATCH                 (AR9170_UART_REG_BASE + 0x024)
+#define AR9170_UART_REG_DIVISOR_LSB             (AR9170_UART_REG_BASE + 0x028)
+#define AR9170_UART_REG_DIVISOR_MSB             (AR9170_UART_REG_BASE + 0x02c)
+#define AR9170_UART_REG_WORD_RX_BUFFER          (AR9170_UART_REG_BASE + 0x034)
+#define AR9170_UART_REG_WORD_TX_HOLDING         (AR9170_UART_REG_BASE + 0x038)
+#define AR9170_UART_REG_FIFO_COUNT              (AR9170_UART_REG_BASE + 0x03c)
+#define AR9170_UART_REG_REMAINDER               (AR9170_UART_REG_BASE + 0x04c)
+
+/* Timer */
+#define AR9170_TIMER_REG_BASE                   0x1c1000
+
+#define AR9170_TIMER_REG_WATCH_DOG              (AR9170_TIMER_REG_BASE + 0x000)
+#define AR9170_TIMER_REG_TIMER0                 (AR9170_TIMER_REG_BASE + 0x010)
+#define AR9170_TIMER_REG_TIMER1                 (AR9170_TIMER_REG_BASE + 0x014)
+#define AR9170_TIMER_REG_TIMER2                 (AR9170_TIMER_REG_BASE + 0x018)
+#define AR9170_TIMER_REG_TIMER3                 (AR9170_TIMER_REG_BASE + 0x01c)
+#define AR9170_TIMER_REG_TIMER4                 (AR9170_TIMER_REG_BASE + 0x020)
+#define AR9170_TIMER_REG_CONTROL                (AR9170_TIMER_REG_BASE + 0x024)
+#define         AR9170_TIMER_CTRL_DISABLE_CLOCK         0x100
+
+#define AR9170_TIMER_REG_INTERRUPT              (AR9170_TIMER_REG_BASE + 0x028)
+#define         AR9170_TIMER_INT_TIMER0                 0x001
+#define         AR9170_TIMER_INT_TIMER1                 0x002
+#define         AR9170_TIMER_INT_TIMER2                 0x004
+#define         AR9170_TIMER_INT_TIMER3                 0x008
+#define         AR9170_TIMER_INT_TIMER4                 0x010
+#define         AR9170_TIMER_INT_TICK_TIMER             0x100
+
+#define AR9170_TIMER_REG_TICK_TIMER             (AR9170_TIMER_REG_BASE + 0x030)
+#define AR9170_TIMER_REG_CLOCK_LOW              (AR9170_TIMER_REG_BASE + 0x040)
+#define AR9170_TIMER_REG_CLOCK_HIGH             (AR9170_TIMER_REG_BASE + 0x044)
+
+#define AR9170_MAC_REG_BASE                     0x1c3000
+
+#define AR9170_MAC_REG_POWER_STATE_CTRL         (AR9170_MAC_REG_BASE + 0x500)
+#define         AR9170_MAC_POWER_STATE_CTRL_RESET       0x20
+
+#define AR9170_MAC_REG_MAC_POWER_STATE_CTRL     (AR9170_MAC_REG_BASE + 0x50c)
+
+#define AR9170_MAC_REG_INT_CTRL                 (AR9170_MAC_REG_BASE + 0x510)
+#define         AR9170_MAC_INT_TXC                      BIT(0)
+#define         AR9170_MAC_INT_RXC                      BIT(1)
+#define         AR9170_MAC_INT_RETRY_FAIL               BIT(2)
+#define         AR9170_MAC_INT_WAKEUP                   BIT(3)
+#define         AR9170_MAC_INT_ATIM                     BIT(4)
+#define         AR9170_MAC_INT_DTIM                     BIT(5)
+#define         AR9170_MAC_INT_CFG_BCN                  BIT(6)
+#define         AR9170_MAC_INT_ABORT                    BIT(7)
+#define         AR9170_MAC_INT_QOS                      BIT(8)
+#define         AR9170_MAC_INT_MIMO_PS                  BIT(9)
+#define         AR9170_MAC_INT_KEY_GEN                  BIT(10)
+#define         AR9170_MAC_INT_DECRY_NOUSER             BIT(11)
+#define         AR9170_MAC_INT_RADAR                    BIT(12)
+#define         AR9170_MAC_INT_QUIET_FRAME              BIT(13)
+#define         AR9170_MAC_INT_PRETBTT                  BIT(14)
+
+#define AR9170_MAC_REG_TSF_L                    (AR9170_MAC_REG_BASE + 0x514)
+#define AR9170_MAC_REG_TSF_H                    (AR9170_MAC_REG_BASE + 0x518)
+
+#define AR9170_MAC_REG_ATIM_WINDOW              (AR9170_MAC_REG_BASE + 0x51c)
+#define         AR9170_MAC_ATIM_PERIOD_S                0
+#define         AR9170_MAC_ATIM_PERIOD                  0x0000ffff
+
+#define AR9170_MAC_REG_BCN_PERIOD               (AR9170_MAC_REG_BASE + 0x520)
+#define         AR9170_MAC_BCN_PERIOD_S                 0
+#define         AR9170_MAC_BCN_PERIOD                   0x0000ffff
+#define         AR9170_MAC_BCN_DTIM_S                   16
+#define         AR9170_MAC_BCN_DTIM                     0x00ff0000
+#define         AR9170_MAC_BCN_AP_MODE                  BIT(24)
+#define         AR9170_MAC_BCN_IBSS_MODE                BIT(25)
+#define         AR9170_MAC_BCN_PWR_MGT                  BIT(26)
+#define         AR9170_MAC_BCN_STA_PS                   BIT(27)
+
+#define AR9170_MAC_REG_PRETBTT                  (AR9170_MAC_REG_BASE + 0x524)
+#define         AR9170_MAC_PRETBTT_S                    0
+#define         AR9170_MAC_PRETBTT                      0x0000ffff
+#define         AR9170_MAC_PRETBTT2_S                   16
+#define         AR9170_MAC_PRETBTT2                     0xffff0000
+
+#define AR9170_MAC_REG_MAC_ADDR_L               (AR9170_MAC_REG_BASE + 0x610)
+#define AR9170_MAC_REG_MAC_ADDR_H               (AR9170_MAC_REG_BASE + 0x614)
+#define AR9170_MAC_REG_BSSID_L                  (AR9170_MAC_REG_BASE + 0x618)
+#define AR9170_MAC_REG_BSSID_H                  (AR9170_MAC_REG_BASE + 0x61c)
+
+#define AR9170_MAC_REG_GROUP_HASH_TBL_L         (AR9170_MAC_REG_BASE + 0x624)
+#define AR9170_MAC_REG_GROUP_HASH_TBL_H         (AR9170_MAC_REG_BASE + 0x628)
+
+#define AR9170_MAC_REG_RX_TIMEOUT               (AR9170_MAC_REG_BASE + 0x62c)
+
+#define AR9170_MAC_REG_BASIC_RATE               (AR9170_MAC_REG_BASE + 0x630)
+#define AR9170_MAC_REG_MANDATORY_RATE           (AR9170_MAC_REG_BASE + 0x634)
+#define AR9170_MAC_REG_RTS_CTS_RATE             (AR9170_MAC_REG_BASE + 0x638)
+#define AR9170_MAC_REG_BACKOFF_PROTECT          (AR9170_MAC_REG_BASE + 0x63c)
+#define AR9170_MAC_REG_RX_THRESHOLD             (AR9170_MAC_REG_BASE + 0x640)
+#define AR9170_MAC_REG_AFTER_PNP                (AR9170_MAC_REG_BASE + 0x648)
+#define AR9170_MAC_REG_RX_PE_DELAY              (AR9170_MAC_REG_BASE + 0x64c)
+
+#define AR9170_MAC_REG_DYNAMIC_SIFS_ACK         (AR9170_MAC_REG_BASE + 0x658)
+#define AR9170_MAC_REG_SNIFFER                  (AR9170_MAC_REG_BASE + 0x674)
+#define         AR9170_MAC_SNIFFER_ENABLE_PROMISC       BIT(0)
+#define         AR9170_MAC_SNIFFER_DEFAULTS             0x02000000
+#define AR9170_MAC_REG_ENCRYPTION               (AR9170_MAC_REG_BASE + 0x678)
+#define         AR9170_MAC_ENCRYPTION_RX_SOFTWARE       BIT(3)
+#define         AR9170_MAC_ENCRYPTION_DEFAULTS          0x70
+
+#define AR9170_MAC_REG_MISC_680                 (AR9170_MAC_REG_BASE + 0x680)
+#define AR9170_MAC_REG_MISC_684                 (AR9170_MAC_REG_BASE + 0x684)
+#define AR9170_MAC_REG_TX_UNDERRUN              (AR9170_MAC_REG_BASE + 0x688)
+
+#define AR9170_MAC_REG_FRAMETYPE_FILTER         (AR9170_MAC_REG_BASE + 0x68c)
+#define         AR9170_MAC_FTF_ASSOC_REQ                BIT(0)
+#define         AR9170_MAC_FTF_ASSOC_RESP               BIT(1)
+#define         AR9170_MAC_FTF_REASSOC_REQ              BIT(2)
+#define         AR9170_MAC_FTF_REASSOC_RESP             BIT(3)
+#define         AR9170_MAC_FTF_PRB_REQ                  BIT(4)
+#define         AR9170_MAC_FTF_PRB_RESP                 BIT(5)
+#define         AR9170_MAC_FTF_BIT6                     BIT(6)
+#define         AR9170_MAC_FTF_BIT7                     BIT(7)
+#define         AR9170_MAC_FTF_BEACON                   BIT(8)
+#define         AR9170_MAC_FTF_ATIM                     BIT(9)
+#define         AR9170_MAC_FTF_DEASSOC                  BIT(10)
+#define         AR9170_MAC_FTF_AUTH                     BIT(11)
+#define         AR9170_MAC_FTF_DEAUTH                   BIT(12)
+#define         AR9170_MAC_FTF_BIT13                    BIT(13)
+#define         AR9170_MAC_FTF_BIT14                    BIT(14)
+#define         AR9170_MAC_FTF_BIT15                    BIT(15)
+#define         AR9170_MAC_FTF_BAR                      BIT(24)
+#define         AR9170_MAC_FTF_BA                       BIT(25)
+#define         AR9170_MAC_FTF_PSPOLL                   BIT(26)
+#define         AR9170_MAC_FTF_RTS                      BIT(27)
+#define         AR9170_MAC_FTF_CTS                      BIT(28)
+#define         AR9170_MAC_FTF_ACK                      BIT(29)
+#define         AR9170_MAC_FTF_CFE                      BIT(30)
+#define         AR9170_MAC_FTF_CFE_ACK                  BIT(31)
+#define         AR9170_MAC_FTF_DEFAULTS                 0x0500ffff
+#define         AR9170_MAC_FTF_MONITOR                  0xff00ffff
+
+#define AR9170_MAC_REG_ACK_EXTENSION            (AR9170_MAC_REG_BASE + 0x690)
+#define AR9170_MAC_REG_ACK_TPC                  (AR9170_MAC_REG_BASE + 0x694)
+#define AR9170_MAC_REG_EIFS_AND_SIFS            (AR9170_MAC_REG_BASE + 0x698)
+#define AR9170_MAC_REG_RX_TIMEOUT_COUNT         (AR9170_MAC_REG_BASE + 0x69c)
+#define AR9170_MAC_REG_RX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6a0)
+#define AR9170_MAC_REG_RX_CRC32                 (AR9170_MAC_REG_BASE + 0x6a4)
+#define AR9170_MAC_REG_RX_CRC16                 (AR9170_MAC_REG_BASE + 0x6a8)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_UNI    (AR9170_MAC_REG_BASE + 0x6ac)
+#define AR9170_MAC_REG_RX_OVERRUN               (AR9170_MAC_REG_BASE + 0x6b0)
+#define AR9170_MAC_REG_RX_ERR_DECRYPTION_MUL    (AR9170_MAC_REG_BASE + 0x6bc)
+#define AR9170_MAC_REG_TX_BLOCKACKS             (AR9170_MAC_REG_BASE + 0x6c0)
+#define AR9170_MAC_REG_NAV_COUNT                (AR9170_MAC_REG_BASE + 0x6c4)
+#define AR9170_MAC_REG_BACKOFF_STATUS           (AR9170_MAC_REG_BASE + 0x6c8)
+#define AR9170_MAC_REG_TX_RETRY                 (AR9170_MAC_REG_BASE + 0x6cc)
+
+#define AR9170_MAC_REG_TX_COMPLETE              (AR9170_MAC_REG_BASE + 0x6d4)
+
+#define AR9170_MAC_REG_CHANNEL_BUSY             (AR9170_MAC_REG_BASE + 0x6e8)
+#define AR9170_MAC_REG_EXT_BUSY                 (AR9170_MAC_REG_BASE + 0x6ec)
+
+#define AR9170_MAC_REG_SLOT_TIME                (AR9170_MAC_REG_BASE + 0x6f0)
+#define AR9170_MAC_REG_TX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6f4)
+#define AR9170_MAC_REG_ACK_FC                   (AR9170_MAC_REG_BASE + 0x6f8)
+
+#define AR9170_MAC_REG_CAM_MODE                 (AR9170_MAC_REG_BASE + 0x700)
+#define         AR9170_MAC_CAM_IBSS                     0xe0
+#define         AR9170_MAC_CAM_AP                       0xa1
+#define         AR9170_MAC_CAM_STA                      0x2
+#define         AR9170_MAC_CAM_AP_WDS                   0x3
+#define         AR9170_MAC_CAM_DEFAULTS                 (0xf << 24)
+#define         AR9170_MAC_CAM_HOST_PENDING             0x80000000
+
+#define AR9170_MAC_REG_CAM_ROLL_CALL_TBL_L      (AR9170_MAC_REG_BASE + 0x704)
+#define AR9170_MAC_REG_CAM_ROLL_CALL_TBL_H      (AR9170_MAC_REG_BASE + 0x708)
+
+#define AR9170_MAC_REG_CAM_ADDR                 (AR9170_MAC_REG_BASE + 0x70c)
+#define         AR9170_MAC_CAM_ADDR_WRITE               0x80000000
+#define AR9170_MAC_REG_CAM_DATA0                (AR9170_MAC_REG_BASE + 0x720)
+#define AR9170_MAC_REG_CAM_DATA1                (AR9170_MAC_REG_BASE + 0x724)
+#define AR9170_MAC_REG_CAM_DATA2                (AR9170_MAC_REG_BASE + 0x728)
+#define AR9170_MAC_REG_CAM_DATA3                (AR9170_MAC_REG_BASE + 0x72c)
+
+#define AR9170_MAC_REG_CAM_DBG0                 (AR9170_MAC_REG_BASE + 0x730)
+#define AR9170_MAC_REG_CAM_DBG1                 (AR9170_MAC_REG_BASE + 0x734)
+#define AR9170_MAC_REG_CAM_DBG2                 (AR9170_MAC_REG_BASE + 0x738)
+#define AR9170_MAC_REG_CAM_STATE                (AR9170_MAC_REG_BASE + 0x73c)
+#define         AR9170_MAC_CAM_STATE_READ_PENDING       0x40000000
+#define         AR9170_MAC_CAM_STATE_WRITE_PENDING      0x80000000
+
+#define AR9170_MAC_REG_CAM_TXKEY                (AR9170_MAC_REG_BASE + 0x740)
+#define AR9170_MAC_REG_CAM_RXKEY                (AR9170_MAC_REG_BASE + 0x750)
+
+#define AR9170_MAC_REG_CAM_TX_ENC_TYPE          (AR9170_MAC_REG_BASE + 0x760)
+#define AR9170_MAC_REG_CAM_RX_ENC_TYPE          (AR9170_MAC_REG_BASE + 0x770)
+#define AR9170_MAC_REG_CAM_TX_SERACH_HIT        (AR9170_MAC_REG_BASE + 0x780)
+#define AR9170_MAC_REG_CAM_RX_SERACH_HIT        (AR9170_MAC_REG_BASE + 0x790)
+
+#define AR9170_MAC_REG_AC0_CW                   (AR9170_MAC_REG_BASE + 0xb00)
+#define AR9170_MAC_REG_AC1_CW                   (AR9170_MAC_REG_BASE + 0xb04)
+#define AR9170_MAC_REG_AC2_CW                   (AR9170_MAC_REG_BASE + 0xb08)
+#define AR9170_MAC_REG_AC3_CW                   (AR9170_MAC_REG_BASE + 0xb0c)
+#define AR9170_MAC_REG_AC4_CW                   (AR9170_MAC_REG_BASE + 0xb10)
+#define AR9170_MAC_REG_AC2_AC1_AC0_AIFS         (AR9170_MAC_REG_BASE + 0xb14)
+#define AR9170_MAC_REG_AC4_AC3_AC2_AIFS         (AR9170_MAC_REG_BASE + 0xb18)
+#define AR9170_MAC_REG_TXOP_ACK_EXTENSION       (AR9170_MAC_REG_BASE + 0xb1c)
+#define AR9170_MAC_REG_TXOP_ACK_INTERVAL        (AR9170_MAC_REG_BASE + 0xb20)
+#define AR9170_MAC_REG_CONTENTION_POINT         (AR9170_MAC_REG_BASE + 0xb24)
+#define AR9170_MAC_REG_RETRY_MAX                (AR9170_MAC_REG_BASE + 0xb28)
+#define AR9170_MAC_REG_TID_CFACK_CFEND_RATE     (AR9170_MAC_REG_BASE + 0xb2c)
+#define AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND      (AR9170_MAC_REG_BASE + 0xb30)
+#define AR9170_MAC_REG_TKIP_TSC                 (AR9170_MAC_REG_BASE + 0xb34)
+#define AR9170_MAC_REG_TXOP_DURATION            (AR9170_MAC_REG_BASE + 0xb38)
+#define AR9170_MAC_REG_TX_QOS_THRESHOLD         (AR9170_MAC_REG_BASE + 0xb3c)
+#define AR9170_MAC_REG_QOS_PRIORITY_VIRTUAL_CCA (AR9170_MAC_REG_BASE + 0xb40)
+#define         AR9170_MAC_VIRTUAL_CCA_Q0               BIT(15)
+#define         AR9170_MAC_VIRTUAL_CCA_Q1               BIT(16)
+#define         AR9170_MAC_VIRTUAL_CCA_Q2               BIT(17)
+#define         AR9170_MAC_VIRTUAL_CCA_Q3               BIT(18)
+#define         AR9170_MAC_VIRTUAL_CCA_Q4               BIT(19)
+#define         AR9170_MAC_VIRTUAL_CCA_ALL              (0xf8000)
+
+#define AR9170_MAC_REG_AC1_AC0_TXOP             (AR9170_MAC_REG_BASE + 0xb44)
+#define AR9170_MAC_REG_AC3_AC2_TXOP             (AR9170_MAC_REG_BASE + 0xb48)
+
+#define AR9170_MAC_REG_AMPDU_COUNT              (AR9170_MAC_REG_BASE + 0xb88)
+#define AR9170_MAC_REG_MPDU_COUNT               (AR9170_MAC_REG_BASE + 0xb8c)
+
+#define AR9170_MAC_REG_AMPDU_FACTOR             (AR9170_MAC_REG_BASE + 0xb9c)
+#define         AR9170_MAC_AMPDU_FACTOR                 0x7f0000
+#define         AR9170_MAC_AMPDU_FACTOR_S               16
+#define AR9170_MAC_REG_AMPDU_DENSITY            (AR9170_MAC_REG_BASE + 0xba0)
+#define         AR9170_MAC_AMPDU_DENSITY                0x7
+#define         AR9170_MAC_AMPDU_DENSITY_S              0
+
+#define AR9170_MAC_REG_FCS_SELECT               (AR9170_MAC_REG_BASE + 0xbb0)
+#define         AR9170_MAC_FCS_SWFCS                    0x1
+#define         AR9170_MAC_FCS_FIFO_PROT                0x4
+
+#define AR9170_MAC_REG_RTS_CTS_TPC              (AR9170_MAC_REG_BASE + 0xbb4)
+#define AR9170_MAC_REG_CFEND_QOSNULL_TPC        (AR9170_MAC_REG_BASE + 0xbb8)
+
+#define AR9170_MAC_REG_ACK_TABLE                (AR9170_MAC_REG_BASE + 0xc00)
+#define AR9170_MAC_REG_RX_CONTROL               (AR9170_MAC_REG_BASE + 0xc40)
+#define         AR9170_MAC_RX_CTRL_DEAGG                0x1
+#define         AR9170_MAC_RX_CTRL_SHORT_FILTER         0x2
+#define         AR9170_MAC_RX_CTRL_SA_DA_SEARCH         0x20
+#define         AR9170_MAC_RX_CTRL_PASS_TO_HOST         BIT(28)
+#define         AR9170_MAC_RX_CTRL_ACK_IN_SNIFFER       BIT(30)
+
+#define AR9170_MAC_REG_RX_CONTROL_1             (AR9170_MAC_REG_BASE + 0xc44)
+
+#define AR9170_MAC_REG_AMPDU_RX_THRESH          (AR9170_MAC_REG_BASE + 0xc50)
+
+#define AR9170_MAC_REG_RX_MPDU                  (AR9170_MAC_REG_BASE + 0xca0)
+#define AR9170_MAC_REG_RX_DROPPED_MPDU          (AR9170_MAC_REG_BASE + 0xca4)
+#define AR9170_MAC_REG_RX_DEL_MPDU              (AR9170_MAC_REG_BASE + 0xca8)
+#define AR9170_MAC_REG_RX_PHY_MISC_ERROR        (AR9170_MAC_REG_BASE + 0xcac)
+#define AR9170_MAC_REG_RX_PHY_XR_ERROR          (AR9170_MAC_REG_BASE + 0xcb0)
+#define AR9170_MAC_REG_RX_PHY_OFDM_ERROR        (AR9170_MAC_REG_BASE + 0xcb4)
+#define AR9170_MAC_REG_RX_PHY_CCK_ERROR         (AR9170_MAC_REG_BASE + 0xcb8)
+#define AR9170_MAC_REG_RX_PHY_HT_ERROR          (AR9170_MAC_REG_BASE + 0xcbc)
+#define AR9170_MAC_REG_RX_PHY_TOTAL             (AR9170_MAC_REG_BASE + 0xcc0)
+
+#define AR9170_MAC_REG_DMA_TXQ_ADDR             (AR9170_MAC_REG_BASE + 0xd00)
+#define AR9170_MAC_REG_DMA_TXQ_CURR_ADDR        (AR9170_MAC_REG_BASE + 0xd04)
+#define AR9170_MAC_REG_DMA_TXQ0_ADDR            (AR9170_MAC_REG_BASE + 0xd00)
+#define AR9170_MAC_REG_DMA_TXQ0_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd04)
+#define AR9170_MAC_REG_DMA_TXQ1_ADDR            (AR9170_MAC_REG_BASE + 0xd08)
+#define AR9170_MAC_REG_DMA_TXQ1_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd0c)
+#define AR9170_MAC_REG_DMA_TXQ2_ADDR            (AR9170_MAC_REG_BASE + 0xd10)
+#define AR9170_MAC_REG_DMA_TXQ2_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd14)
+#define AR9170_MAC_REG_DMA_TXQ3_ADDR            (AR9170_MAC_REG_BASE + 0xd18)
+#define AR9170_MAC_REG_DMA_TXQ3_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd1c)
+#define AR9170_MAC_REG_DMA_TXQ4_ADDR            (AR9170_MAC_REG_BASE + 0xd20)
+#define AR9170_MAC_REG_DMA_TXQ4_CURR_ADDR       (AR9170_MAC_REG_BASE + 0xd24)
+#define AR9170_MAC_REG_DMA_RXQ_ADDR             (AR9170_MAC_REG_BASE + 0xd28)
+#define AR9170_MAC_REG_DMA_RXQ_CURR_ADDR        (AR9170_MAC_REG_BASE + 0xd2c)
+
+#define AR9170_MAC_REG_DMA_TRIGGER              (AR9170_MAC_REG_BASE + 0xd30)
+#define         AR9170_DMA_TRIGGER_TXQ0                 BIT(0)
+#define         AR9170_DMA_TRIGGER_TXQ1                 BIT(1)
+#define         AR9170_DMA_TRIGGER_TXQ2                 BIT(2)
+#define         AR9170_DMA_TRIGGER_TXQ3                 BIT(3)
+#define         AR9170_DMA_TRIGGER_TXQ4                 BIT(4)
+#define         AR9170_DMA_TRIGGER_RXQ                  BIT(8)
+
+#define AR9170_MAC_REG_DMA_WLAN_STATUS          (AR9170_MAC_REG_BASE + 0xd38)
+#define AR9170_MAC_REG_DMA_STATUS               (AR9170_MAC_REG_BASE + 0xd3c)
+
+#define AR9170_MAC_REG_TXRX_MPI                 (AR9170_MAC_REG_BASE + 0xd7c)
+#define         AR9170_MAC_TXRX_MPI_TX_MPI_MASK         0x0000000f
+#define         AR9170_MAC_TXRX_MPI_TX_TO_MASK          0x0000fff0
+#define         AR9170_MAC_TXRX_MPI_RX_MPI_MASK         0x000f0000
+#define         AR9170_MAC_TXRX_MPI_RX_TO_MASK          0xfff00000
+
+#define AR9170_MAC_REG_BCN_ADDR                 (AR9170_MAC_REG_BASE + 0xd84)
+#define AR9170_MAC_REG_BCN_LENGTH               (AR9170_MAC_REG_BASE + 0xd88)
+#define         AR9170_MAC_BCN_LENGTH_MAX               256
+
+#define AR9170_MAC_REG_BCN_STATUS               (AR9170_MAC_REG_BASE + 0xd8c)
+
+#define AR9170_MAC_REG_BCN_PLCP                 (AR9170_MAC_REG_BASE + 0xd90)
+#define AR9170_MAC_REG_BCN_CTRL                 (AR9170_MAC_REG_BASE + 0xd94)
+#define         AR9170_BCN_CTRL_READY                   0x01
+#define         AR9170_BCN_CTRL_LOCK                    0x02
+
+#define AR9170_MAC_REG_BCN_CURR_ADDR            (AR9170_MAC_REG_BASE + 0xd98)
+#define AR9170_MAC_REG_BCN_COUNT                (AR9170_MAC_REG_BASE + 0xd9c)
+
+
+#define AR9170_MAC_REG_BCN_HT1                  (AR9170_MAC_REG_BASE + 0xda0)
+#define AR9170_MAC_REG_BCN_HT2                  (AR9170_MAC_REG_BASE + 0xda4)
+
+#define AR9170_MAC_REG_DMA_TXQX_ADDR_CURR       (AR9170_MAC_REG_BASE + 0xdc0)
+
+/* Random number generator */
+#define AR9170_RAND_REG_BASE                    0x1d0000
+
+#define AR9170_RAND_REG_NUM                     (AR9170_RAND_REG_BASE + 0x000)
+#define AR9170_RAND_REG_MODE                    (AR9170_RAND_REG_BASE + 0x004)
+#define         AR9170_RAND_MODE_MANUAL                 0x000
+#define         AR9170_RAND_MODE_FREE                   0x001
+
+/* GPIO */
+#define AR9170_GPIO_REG_BASE                    0x1d0100
+#define AR9170_GPIO_REG_PORT_TYPE               (AR9170_GPIO_REG_BASE + 0x000)
+#define AR9170_GPIO_REG_PORT_DATA               (AR9170_GPIO_REG_BASE + 0x004)
+#define         AR9170_GPIO_PORT_LED_0                  1
+#define         AR9170_GPIO_PORT_LED_1                  2
+/* WPS Button GPIO for TP-Link TL-WN821N */
+#define         AR9170_GPIO_PORT_WPS_BUTTON_PRESSED     4
+
+/* Memory Controller */
+#define AR9170_MC_REG_BASE                      0x1d1000
+
+#define AR9170_MC_REG_FLASH_WAIT_STATE          (AR9170_MC_REG_BASE + 0x000)
+#define AR9170_MC_REG_SEEPROM_WP0               (AR9170_MC_REG_BASE + 0x400)
+#define AR9170_MC_REG_SEEPROM_WP1               (AR9170_MC_REG_BASE + 0x404)
+#define AR9170_MC_REG_SEEPROM_WP2               (AR9170_MC_REG_BASE + 0x408)
+
+/* Interrupt Controller */
+#define AR9170_MAX_INT_SRC                      9
+#define AR9170_INT_REG_BASE                     0x1d2000
+
+#define AR9170_INT_REG_FLAG                     (AR9170_INT_REG_BASE + 0x000)
+#define AR9170_INT_REG_FIQ_MASK                 (AR9170_INT_REG_BASE + 0x004)
+#define AR9170_INT_REG_IRQ_MASK                 (AR9170_INT_REG_BASE + 0x008)
+/* INT_REG_FLAG, INT_REG_FIQ_MASK and INT_REG_IRQ_MASK */
+#define         AR9170_INT_FLAG_WLAN                    0x001
+#define         AR9170_INT_FLAG_PTAB_BIT                0x002
+#define         AR9170_INT_FLAG_SE_BIT                  0x004
+#define         AR9170_INT_FLAG_UART_BIT                0x008
+#define         AR9170_INT_FLAG_TIMER_BIT               0x010
+#define         AR9170_INT_FLAG_EXT_BIT                 0x020
+#define         AR9170_INT_FLAG_SW_BIT                  0x040
+#define         AR9170_INT_FLAG_USB_BIT                 0x080
+#define         AR9170_INT_FLAG_ETHERNET_BIT            0x100
+
+#define AR9170_INT_REG_PRIORITY1                (AR9170_INT_REG_BASE + 0x00c)
+#define AR9170_INT_REG_PRIORITY2                (AR9170_INT_REG_BASE + 0x010)
+#define AR9170_INT_REG_PRIORITY3                (AR9170_INT_REG_BASE + 0x014)
+#define AR9170_INT_REG_EXT_INT_CONTROL          (AR9170_INT_REG_BASE + 0x018)
+#define AR9170_INT_REG_SW_INT_CONTROL           (AR9170_INT_REG_BASE + 0x01c)
+#define         AR9170_INT_SW_INT_ENABLE                0x1
+
+#define AR9170_INT_REG_FIQ_ENCODE               (AR9170_INT_REG_BASE + 0x020)
+#define AR9170_INT_INT_IRQ_ENCODE               (AR9170_INT_REG_BASE + 0x024)
+
+/* Power Management */
+#define AR9170_PWR_REG_BASE                     0x1d4000
+
+#define AR9170_PWR_REG_POWER_STATE              (AR9170_PWR_REG_BASE + 0x000)
+
+#define AR9170_PWR_REG_RESET                    (AR9170_PWR_REG_BASE + 0x004)
+#define         AR9170_PWR_RESET_COMMIT_RESET_MASK      BIT(0)
+#define         AR9170_PWR_RESET_WLAN_MASK              BIT(1)
+#define         AR9170_PWR_RESET_DMA_MASK               BIT(2)
+#define         AR9170_PWR_RESET_BRIDGE_MASK            BIT(3)
+#define         AR9170_PWR_RESET_AHB_MASK               BIT(9)
+#define         AR9170_PWR_RESET_BB_WARM_RESET          BIT(10)
+#define         AR9170_PWR_RESET_BB_COLD_RESET          BIT(11)
+#define         AR9170_PWR_RESET_ADDA_CLK_COLD_RESET    BIT(12)
+#define         AR9170_PWR_RESET_PLL                    BIT(13)
+#define         AR9170_PWR_RESET_USB_PLL                BIT(14)
+
+#define AR9170_PWR_REG_CLOCK_SEL                (AR9170_PWR_REG_BASE + 0x008)
+#define         AR9170_PWR_CLK_AHB_40MHZ                0
+#define         AR9170_PWR_CLK_AHB_20_22MHZ             1
+#define         AR9170_PWR_CLK_AHB_40_44MHZ             2
+#define         AR9170_PWR_CLK_AHB_80_88MHZ             3
+#define         AR9170_PWR_CLK_DAC_160_INV_DLY          0x70
+
+#define AR9170_PWR_REG_CHIP_REVISION            (AR9170_PWR_REG_BASE + 0x010)
+#define AR9170_PWR_REG_PLL_ADDAC                (AR9170_PWR_REG_BASE + 0x014)
+#define AR9170_PWR_REG_WATCH_DOG_MAGIC          (AR9170_PWR_REG_BASE + 0x020)
+
+/* Faraday USB Controller */
+#define AR9170_USB_REG_BASE                     0x1e1000
+
+#define AR9170_USB_REG_MAIN_CTRL                (AR9170_USB_REG_BASE + 0x000)
+#define         AR9170_USB_MAIN_CTRL_REMOTE_WAKEUP      BIT(0)
+#define         AR9170_USB_MAIN_CTRL_ENABLE_GLOBAL_INT  BIT(2)
+#define         AR9170_USB_MAIN_CTRL_HIGHSPEED          BIT(6)
+
+#define AR9170_USB_REG_DEVICE_ADDRESS           (AR9170_USB_REG_BASE + 0x001)
+#define         AR9170_USB_DEVICE_ADDRESS_CONFIGURE     BIT(7)
+
+#define AR9170_USB_REG_TEST                     (AR9170_USB_REG_BASE + 0x002)
+#define AR9170_USB_REG_PHY_TEST_SELECT          (AR9170_USB_REG_BASE + 0x008)
+#define AR9170_USB_REG_CX_CONFIG_STATUS         (AR9170_USB_REG_BASE + 0x00b)
+#define AR9170_USB_REG_EP0_DATA                 (AR9170_USB_REG_BASE + 0x00c)
+#define AR9170_USB_REG_EP0_DATA1                (AR9170_USB_REG_BASE + 0x00c)
+#define AR9170_USB_REG_EP0_DATA2                (AR9170_USB_REG_BASE + 0x00d)
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_0         (AR9170_USB_REG_BASE + 0x011)
+#define AR9170_USB_REG_INTR_MASK_BYTE_1         (AR9170_USB_REG_BASE + 0x012)
+#define AR9170_USB_REG_INTR_MASK_BYTE_2         (AR9170_USB_REG_BASE + 0x013)
+#define AR9170_USB_REG_INTR_MASK_BYTE_3         (AR9170_USB_REG_BASE + 0x014)
+#define AR9170_USB_REG_INTR_MASK_BYTE_4         (AR9170_USB_REG_BASE + 0x015)
+#define         AR9170_USB_INTR_DISABLE_OUT_INT         (BIT(7) | BIT(6))
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_5         (AR9170_USB_REG_BASE + 0x016)
+#define AR9170_USB_REG_INTR_MASK_BYTE_6         (AR9170_USB_REG_BASE + 0x017)
+#define         AR9170_USB_INTR_DISABLE_IN_INT          BIT(6)
+
+#define AR9170_USB_REG_INTR_MASK_BYTE_7         (AR9170_USB_REG_BASE + 0x018)
+
+#define AR9170_USB_REG_INTR_GROUP               (AR9170_USB_REG_BASE + 0x020)
+
+#define AR9170_USB_REG_INTR_SOURCE_0            (AR9170_USB_REG_BASE + 0x021)
+#define AR9170_USB_REG_INTR_SOURCE_1            (AR9170_USB_REG_BASE + 0x022)
+#define AR9170_USB_REG_INTR_SOURCE_2            (AR9170_USB_REG_BASE + 0x023)
+#define AR9170_USB_REG_INTR_SOURCE_3            (AR9170_USB_REG_BASE + 0x024)
+#define AR9170_USB_REG_INTR_SOURCE_4            (AR9170_USB_REG_BASE + 0x025)
+#define AR9170_USB_REG_INTR_SOURCE_5            (AR9170_USB_REG_BASE + 0x026)
+#define AR9170_USB_REG_INTR_SOURCE_6            (AR9170_USB_REG_BASE + 0x027)
+#define AR9170_USB_REG_INTR_SOURCE_7            (AR9170_USB_REG_BASE + 0x028)
+
+#define AR9170_USB_REG_EP_MAP                   (AR9170_USB_REG_BASE + 0x030)
+#define AR9170_USB_REG_EP1_MAP                  (AR9170_USB_REG_BASE + 0x030)
+#define AR9170_USB_REG_EP2_MAP                  (AR9170_USB_REG_BASE + 0x031)
+#define AR9170_USB_REG_EP3_MAP                  (AR9170_USB_REG_BASE + 0x032)
+#define AR9170_USB_REG_EP4_MAP                  (AR9170_USB_REG_BASE + 0x033)
+#define AR9170_USB_REG_EP5_MAP                  (AR9170_USB_REG_BASE + 0x034)
+#define AR9170_USB_REG_EP6_MAP                  (AR9170_USB_REG_BASE + 0x035)
+#define AR9170_USB_REG_EP7_MAP                  (AR9170_USB_REG_BASE + 0x036)
+#define AR9170_USB_REG_EP8_MAP                  (AR9170_USB_REG_BASE + 0x037)
+#define AR9170_USB_REG_EP9_MAP                  (AR9170_USB_REG_BASE + 0x038)
+#define AR9170_USB_REG_EP10_MAP                 (AR9170_USB_REG_BASE + 0x039)
+
+#define AR9170_USB_REG_EP_IN_MAX_SIZE_HIGH      (AR9170_USB_REG_BASE + 0x03f)
+#define         AR9170_USB_EP_IN_TOGGLE                 0x10
+
+#define AR9170_USB_REG_EP_IN_MAX_SIZE_LOW       (AR9170_USB_REG_BASE + 0x03e)
+
+#define AR9170_USB_REG_EP_OUT_MAX_SIZE_HIGH     (AR9170_USB_REG_BASE + 0x05f)
+#define         AR9170_USB_EP_OUT_TOGGLE                0x10
+
+#define AR9170_USB_REG_EP_OUT_MAX_SIZE_LOW      (AR9170_USB_REG_BASE + 0x05e)
+
+#define AR9170_USB_REG_EP3_BYTE_COUNT_HIGH      (AR9170_USB_REG_BASE + 0x0ae)
+#define AR9170_USB_REG_EP3_BYTE_COUNT_LOW       (AR9170_USB_REG_BASE + 0x0be)
+#define AR9170_USB_REG_EP4_BYTE_COUNT_HIGH      (AR9170_USB_REG_BASE + 0x0af)
+#define AR9170_USB_REG_EP4_BYTE_COUNT_LOW       (AR9170_USB_REG_BASE + 0x0bf)
+
+#define AR9170_USB_REG_FIFO_MAP                 (AR9170_USB_REG_BASE + 0x080)
+#define AR9170_USB_REG_FIFO0_MAP                (AR9170_USB_REG_BASE + 0x080)
+#define AR9170_USB_REG_FIFO1_MAP                (AR9170_USB_REG_BASE + 0x081)
+#define AR9170_USB_REG_FIFO2_MAP                (AR9170_USB_REG_BASE + 0x082)
+#define AR9170_USB_REG_FIFO3_MAP                (AR9170_USB_REG_BASE + 0x083)
+#define AR9170_USB_REG_FIFO4_MAP                (AR9170_USB_REG_BASE + 0x084)
+#define AR9170_USB_REG_FIFO5_MAP                (AR9170_USB_REG_BASE + 0x085)
+#define AR9170_USB_REG_FIFO6_MAP                (AR9170_USB_REG_BASE + 0x086)
+#define AR9170_USB_REG_FIFO7_MAP                (AR9170_USB_REG_BASE + 0x087)
+#define AR9170_USB_REG_FIFO8_MAP                (AR9170_USB_REG_BASE + 0x088)
+#define AR9170_USB_REG_FIFO9_MAP                (AR9170_USB_REG_BASE + 0x089)
+
+#define AR9170_USB_REG_FIFO_CONFIG              (AR9170_USB_REG_BASE + 0x090)
+#define AR9170_USB_REG_FIFO0_CONFIG             (AR9170_USB_REG_BASE + 0x090)
+#define AR9170_USB_REG_FIFO1_CONFIG             (AR9170_USB_REG_BASE + 0x091)
+#define AR9170_USB_REG_FIFO2_CONFIG             (AR9170_USB_REG_BASE + 0x092)
+#define AR9170_USB_REG_FIFO3_CONFIG             (AR9170_USB_REG_BASE + 0x093)
+#define AR9170_USB_REG_FIFO4_CONFIG             (AR9170_USB_REG_BASE + 0x094)
+#define AR9170_USB_REG_FIFO5_CONFIG             (AR9170_USB_REG_BASE + 0x095)
+#define AR9170_USB_REG_FIFO6_CONFIG             (AR9170_USB_REG_BASE + 0x096)
+#define AR9170_USB_REG_FIFO7_CONFIG             (AR9170_USB_REG_BASE + 0x097)
+#define AR9170_USB_REG_FIFO8_CONFIG             (AR9170_USB_REG_BASE + 0x098)
+#define AR9170_USB_REG_FIFO9_CONFIG             (AR9170_USB_REG_BASE + 0x099)
+
+#define AR9170_USB_REG_EP3_DATA                 (AR9170_USB_REG_BASE + 0x0f8)
+#define AR9170_USB_REG_EP4_DATA                 (AR9170_USB_REG_BASE + 0x0fc)
+
+#define AR9170_USB_REG_FIFO_SIZE                (AR9170_USB_REG_BASE + 0x100)
+#define AR9170_USB_REG_DMA_CTL                  (AR9170_USB_REG_BASE + 0x108)
+#define         AR9170_USB_DMA_CTL_ENABLE_TO_DEVICE     BIT(0)
+#define         AR9170_USB_DMA_CTL_ENABLE_FROM_DEVICE   BIT(1)
+#define         AR9170_USB_DMA_CTL_HIGH_SPEED           BIT(2)
+#define         AR9170_USB_DMA_CTL_UP_PACKET_MODE       BIT(3)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_S          4
+#define         AR9170_USB_DMA_CTL_UP_STREAM            (BIT(4) | BIT(5))
+#define         AR9170_USB_DMA_CTL_UP_STREAM_4K         (0)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_8K         BIT(4)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_16K        BIT(5)
+#define         AR9170_USB_DMA_CTL_UP_STREAM_32K        (BIT(4) | BIT(5))
+#define         AR9170_USB_DMA_CTL_DOWN_STREAM          BIT(6)
+
+#define AR9170_USB_REG_DMA_STATUS               (AR9170_USB_REG_BASE + 0x10c)
+#define         AR9170_USB_DMA_STATUS_UP_IDLE           BIT(8)
+#define         AR9170_USB_DMA_STATUS_DN_IDLE           BIT(16)
+
+#define AR9170_USB_REG_MAX_AGG_UPLOAD           (AR9170_USB_REG_BASE + 0x110)
+#define AR9170_USB_REG_UPLOAD_TIME_CTL          (AR9170_USB_REG_BASE + 0x114)
+#define AR9170_USB_REG_CBUS_CTRL                (AR9170_USB_REG_BASE + 0x1f0)
+#define         AR9170_USB_CBUS_CTRL_BUFFER_END         (BIT(1))
+
+/* PCI/USB to AHB Bridge */
+#define AR9170_PTA_REG_BASE                     0x1e2000
+
+#define AR9170_PTA_REG_CMD                      (AR9170_PTA_REG_BASE + 0x000)
+#define AR9170_PTA_REG_PARAM1                   (AR9170_PTA_REG_BASE + 0x004)
+#define AR9170_PTA_REG_PARAM2                   (AR9170_PTA_REG_BASE + 0x008)
+#define AR9170_PTA_REG_PARAM3                   (AR9170_PTA_REG_BASE + 0x00c)
+#define AR9170_PTA_REG_RSP                      (AR9170_PTA_REG_BASE + 0x010)
+#define AR9170_PTA_REG_STATUS1                  (AR9170_PTA_REG_BASE + 0x014)
+#define AR9170_PTA_REG_STATUS2                  (AR9170_PTA_REG_BASE + 0x018)
+#define AR9170_PTA_REG_STATUS3                  (AR9170_PTA_REG_BASE + 0x01c)
+#define AR9170_PTA_REG_AHB_INT_FLAG             (AR9170_PTA_REG_BASE + 0x020)
+#define AR9170_PTA_REG_AHB_INT_MASK             (AR9170_PTA_REG_BASE + 0x024)
+#define AR9170_PTA_REG_AHB_INT_ACK              (AR9170_PTA_REG_BASE + 0x028)
+#define AR9170_PTA_REG_AHB_SCRATCH1             (AR9170_PTA_REG_BASE + 0x030)
+#define AR9170_PTA_REG_AHB_SCRATCH2             (AR9170_PTA_REG_BASE + 0x034)
+#define AR9170_PTA_REG_AHB_SCRATCH3             (AR9170_PTA_REG_BASE + 0x038)
+#define AR9170_PTA_REG_AHB_SCRATCH4             (AR9170_PTA_REG_BASE + 0x03c)
+
+#define AR9170_PTA_REG_SHARE_MEM_CTRL           (AR9170_PTA_REG_BASE + 0x124)
+
+/*
+ * PCI to AHB Bridge
+ */
+
+#define AR9170_PTA_REG_INT_FLAG                 (AR9170_PTA_REG_BASE + 0x100)
+#define         AR9170_PTA_INT_FLAG_DN                  0x01
+#define         AR9170_PTA_INT_FLAG_UP                  0x02
+#define         AR9170_PTA_INT_FLAG_CMD                 0x04
+
+#define AR9170_PTA_REG_INT_MASK                 (AR9170_PTA_REG_BASE + 0x104)
+#define AR9170_PTA_REG_DN_DMA_ADDRL             (AR9170_PTA_REG_BASE + 0x108)
+#define AR9170_PTA_REG_DN_DMA_ADDRH             (AR9170_PTA_REG_BASE + 0x10c)
+#define AR9170_PTA_REG_UP_DMA_ADDRL             (AR9170_PTA_REG_BASE + 0x110)
+#define AR9170_PTA_REG_UP_DMA_ADDRH             (AR9170_PTA_REG_BASE + 0x114)
+#define AR9170_PTA_REG_DN_PEND_TIME             (AR9170_PTA_REG_BASE + 0x118)
+#define AR9170_PTA_REG_UP_PEND_TIME             (AR9170_PTA_REG_BASE + 0x11c)
+#define AR9170_PTA_REG_CONTROL                  (AR9170_PTA_REG_BASE + 0x120)
+#define         AR9170_PTA_CTRL_4_BEAT_BURST            0x00
+#define         AR9170_PTA_CTRL_8_BEAT_BURST            0x01
+#define         AR9170_PTA_CTRL_16_BEAT_BURST           0x02
+#define         AR9170_PTA_CTRL_LOOPBACK_MODE           0x10
+
+#define AR9170_PTA_REG_MEM_CTRL                 (AR9170_PTA_REG_BASE + 0x124)
+#define AR9170_PTA_REG_MEM_ADDR                 (AR9170_PTA_REG_BASE + 0x128)
+#define AR9170_PTA_REG_DN_DMA_TRIGGER           (AR9170_PTA_REG_BASE + 0x12c)
+#define AR9170_PTA_REG_UP_DMA_TRIGGER           (AR9170_PTA_REG_BASE + 0x130)
+#define AR9170_PTA_REG_DMA_STATUS               (AR9170_PTA_REG_BASE + 0x134)
+#define AR9170_PTA_REG_DN_CURR_ADDRL            (AR9170_PTA_REG_BASE + 0x138)
+#define AR9170_PTA_REG_DN_CURR_ADDRH            (AR9170_PTA_REG_BASE + 0x13c)
+#define AR9170_PTA_REG_UP_CURR_ADDRL            (AR9170_PTA_REG_BASE + 0x140)
+#define AR9170_PTA_REG_UP_CURR_ADDRH            (AR9170_PTA_REG_BASE + 0x144)
+#define AR9170_PTA_REG_DMA_MODE_CTRL            (AR9170_PTA_REG_BASE + 0x148)
+#define         AR9170_PTA_DMA_MODE_CTRL_RESET          BIT(0)
+#define         AR9170_PTA_DMA_MODE_CTRL_DISABLE_USB    BIT(1)
+
+/* Protocol Controller Module */
+#define AR9170_MAC_REG_PC_REG_BASE              (AR9170_MAC_REG_BASE + 0xe00)
+
+
+#define AR9170_NUM_LEDS                         2
+
+/* CAM */
+#define AR9170_CAM_MAX_USER                     64
+#define AR9170_CAM_MAX_KEY_LENGTH               16
+
+#define AR9170_SRAM_OFFSET              0x100000
+#define AR9170_SRAM_SIZE                0x18000
+
+#define AR9170_PRAM_OFFSET              0x200000
+#define AR9170_PRAM_SIZE                0x8000
+
+enum cpu_clock {
+        AHB_STATIC_40MHZ = 0,
+        AHB_GMODE_22MHZ = 1,
+        AHB_AMODE_20MHZ = 1,
+        AHB_GMODE_44MHZ = 2,
+        AHB_AMODE_40MHZ = 2,
+        AHB_GMODE_88MHZ = 3,
+        AHB_AMODE_80MHZ = 3
+};
+
+/* USB endpoints */
+enum ar9170_usb_ep {
+        /*
+         * Control EP is always EP 0 (USB SPEC)
+         *
+         * The weird thing is: the original firmware has a few
+         * comments that suggest that the actual EP numbers
+         * are in the 1 to 10 range?!
+         */
+        AR9170_USB_EP_CTRL              = 0,
+
+        AR9170_USB_EP_TX,
+        AR9170_USB_EP_RX,
+        AR9170_USB_EP_IRQ,
+        AR9170_USB_EP_CMD,
+        AR9170_USB_NUM_EXTRA_EP         = 4,
+
+        __AR9170_USB_NUM_EP,
+
+        __AR9170_USB_NUM_MAX_EP         = 10
+};
+
+enum ar9170_usb_fifo {
+        __AR9170_USB_NUM_MAX_FIFO       = 10
+};
+
+enum ar9170_tx_queues {
+        AR9170_TXQ0     = 0,
+        AR9170_TXQ1,
+        AR9170_TXQ2,
+        AR9170_TXQ3,
+        AR9170_TXQ_SPECIAL,
+
+        /* keep last */
+        __AR9170_NUM_TX_QUEUES = 5
+};
+
+#define AR9170_TX_STREAM_TAG            0x697e
+#define AR9170_RX_STREAM_TAG            0x4e00
+#define AR9170_RX_STREAM_MAX_SIZE       0xffff
+
+struct ar9170_stream {
+        __le16 length;
+        __le16 tag;
+
+        u8 payload[0];
+};
+
+#define AR9170_MAX_ACKTABLE_ENTRIES                     8
+#define AR9170_MAX_VIRTUAL_MAC                          7
+
+#define AR9170_USB_EP_CTRL_MAX                          64
+#define AR9170_USB_EP_TX_MAX                            512
+#define AR9170_USB_EP_RX_MAX                            512
+#define AR9170_USB_EP_IRQ_MAX                           64
+#define AR9170_USB_EP_CMD_MAX                           64
+
+/* Trigger PRETBTT interrupt 6 Kus earlier */
+#define CARL9170_PRETBTT_KUS                            6
+
+#define AR5416_MAX_RATE_POWER                           63
+
+#define SET_VAL(reg, value, newvalue)                                   \
+        (value = ((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+
+#define MOD_VAL(reg, value, newvalue)                                   \
+        (((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+#endif  /* __CARL9170_SHARED_HW_H */
diff --git a/drivers/net/wireless/ath/carl9170/led.c b/drivers/net/wireless/ath/carl9170/led.c
new file mode 100644
index 000000000000..4bb2cbd8bd9b
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/led.c
@@ -0,0 +1,190 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * LED handling
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparer <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_led_set_state(struct ar9170 *ar, const u32 led_state)
+{
+        return carl9170_write_reg(ar, AR9170_GPIO_REG_PORT_DATA, led_state);
+}
+
+int carl9170_led_init(struct ar9170 *ar)
+{
+        int err;
+
+        /* disable LEDs */
+        /* GPIO [0/1 mode: output, 2/3: input] */
+        err = carl9170_write_reg(ar, AR9170_GPIO_REG_PORT_TYPE, 3);
+        if (err)
+                goto out;
+
+        /* GPIO 0/1 value: off */
+        err = carl9170_led_set_state(ar, 0);
+
+out:
+        return err;
+}
+
+#ifdef CONFIG_CARL9170_LEDS
+static void carl9170_led_update(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170, led_work.work);
+        int i, tmp = 300, blink_delay = 1000;
+        u32 led_val = 0;
+        bool rerun = false;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        for (i = 0; i < AR9170_NUM_LEDS; i++) {
+                if (ar->leds[i].registered) {
+                        if (ar->leds[i].last_state ||
+                            ar->leds[i].toggled) {
+
+                                if (ar->leds[i].toggled)
+                                        tmp = 70 + 200 / (ar->leds[i].toggled);
+
+                                if (tmp < blink_delay)
+                                        blink_delay = tmp;
+
+                                led_val |= 1 << i;
+                                ar->leds[i].toggled = 0;
+                                rerun = true;
+                        }
+                }
+        }
+
+        carl9170_led_set_state(ar, led_val);
+        mutex_unlock(&ar->mutex);
+
+        if (!rerun)
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw,
+                                     &ar->led_work,
+                                     msecs_to_jiffies(blink_delay));
+}
+
+static void carl9170_led_set_brightness(struct led_classdev *led,
+                                        enum led_brightness brightness)
+{
+        struct carl9170_led *arl = container_of(led, struct carl9170_led, l);
+        struct ar9170 *ar = arl->ar;
+
+        if (!arl->registered)
+                return;
+
+        if (arl->last_state != !!brightness) {
+                arl->toggled++;
+                arl->last_state = !!brightness;
+        }
+
+        if (likely(IS_ACCEPTING_CMD(ar) && arl->toggled))
+                ieee80211_queue_delayed_work(ar->hw, &ar->led_work, HZ/10);
+}
+
+static int carl9170_led_register_led(struct ar9170 *ar, int i, char *name,
+                                     char *trigger)
+{
+        int err;
+
+        snprintf(ar->leds[i].name, sizeof(ar->leds[i].name),
+                 "carl9170-%s::%s", wiphy_name(ar->hw->wiphy), name);
+
+        ar->leds[i].ar = ar;
+        ar->leds[i].l.name = ar->leds[i].name;
+        ar->leds[i].l.brightness_set = carl9170_led_set_brightness;
+        ar->leds[i].l.brightness = 0;
+        ar->leds[i].l.default_trigger = trigger;
+
+        err = led_classdev_register(wiphy_dev(ar->hw->wiphy),
+                                    &ar->leds[i].l);
+        if (err) {
+                wiphy_err(ar->hw->wiphy, "failed to register %s LED (%d).\n",
+                        ar->leds[i].name, err);
+        } else {
+                ar->leds[i].registered = true;
+        }
+
+        return err;
+}
+
+void carl9170_led_unregister(struct ar9170 *ar)
+{
+        int i;
+
+        for (i = 0; i < AR9170_NUM_LEDS; i++)
+                if (ar->leds[i].registered) {
+                        led_classdev_unregister(&ar->leds[i].l);
+                        ar->leds[i].registered = false;
+                        ar->leds[i].toggled = 0;
+                }
+
+        cancel_delayed_work_sync(&ar->led_work);
+}
+
+int carl9170_led_register(struct ar9170 *ar)
+{
+        int err;
+
+        INIT_DELAYED_WORK(&ar->led_work, carl9170_led_update);
+
+        err = carl9170_led_register_led(ar, 0, "tx",
+                                        ieee80211_get_tx_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        if (ar->features & CARL9170_ONE_LED)
+                return 0;
+
+        err = carl9170_led_register_led(ar, 1, "assoc",
+                                        ieee80211_get_assoc_led_name(ar->hw));
+        if (err)
+                goto fail;
+
+        return 0;
+
+fail:
+        carl9170_led_unregister(ar);
+        return err;
+}
+
+#endif /* CONFIG_CARL9170_LEDS */
diff --git a/drivers/net/wireless/ath/carl9170/mac.c b/drivers/net/wireless/ath/carl9170/mac.c
new file mode 100644
index 000000000000..2305bc27151c
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/mac.c
@@ -0,0 +1,604 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * MAC programming
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+
+#include "carl9170.h"
+#include "cmd.h"
+
+int carl9170_set_dyn_sifs_ack(struct ar9170 *ar)
+{
+        u32 val;
+
+        if (conf_is_ht40(&ar->hw->conf))
+                val = 0x010a;
+        else {
+                if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                        val = 0x105;
+                else
+                        val = 0x104;
+        }
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_DYNAMIC_SIFS_ACK, val);
+}
+
+int carl9170_set_rts_cts_rate(struct ar9170 *ar)
+{
+        u32 rts_rate, cts_rate;
+
+        if (conf_is_ht(&ar->hw->conf)) {
+                /* 12 mbit OFDM */
+                rts_rate = 0x1da;
+                cts_rate = 0x10a;
+        } else {
+                if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                        /* 11 mbit CCK */
+                        rts_rate = 033;
+                        cts_rate = 003;
+                } else {
+                        /* 6 mbit OFDM */
+                        rts_rate = 0x1bb;
+                        cts_rate = 0x10b;
+                }
+        }
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_RTS_CTS_RATE,
+                                  rts_rate | (cts_rate) << 16);
+}
+
+int carl9170_set_slot_time(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 slottime = 20;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+        if (!vif) {
+                rcu_read_unlock();
+                return 0;
+        }
+
+        if ((ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ) ||
+            vif->bss_conf.use_short_slot)
+                slottime = 9;
+
+        rcu_read_unlock();
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
+                                  slottime << 10);
+}
+
+int carl9170_set_mac_rates(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 basic, mandatory;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (!vif) {
+                rcu_read_unlock();
+                return 0;
+        }
+
+        basic = (vif->bss_conf.basic_rates & 0xf);
+        basic |= (vif->bss_conf.basic_rates & 0xff0) << 4;
+        rcu_read_unlock();
+
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ)
+                mandatory = 0xff00; /* OFDM 6/9/12/18/24/36/48/54 */
+        else
+                mandatory = 0xff0f; /* OFDM (6/9../54) + CCK (1/2/5.5/11) */
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_BASIC_RATE, basic);
+        carl9170_regwrite(AR9170_MAC_REG_MANDATORY_RATE, mandatory);
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_set_qos(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(AR9170_MAC_REG_AC0_CW, ar->edcf[0].cw_min |
+                          (ar->edcf[0].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC1_CW, ar->edcf[1].cw_min |
+                          (ar->edcf[1].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC2_CW, ar->edcf[2].cw_min |
+                          (ar->edcf[2].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC3_CW, ar->edcf[3].cw_min |
+                          (ar->edcf[3].cw_max << 16));
+        carl9170_regwrite(AR9170_MAC_REG_AC4_CW, ar->edcf[4].cw_min |
+                          (ar->edcf[4].cw_max << 16));
+
+        carl9170_regwrite(AR9170_MAC_REG_AC2_AC1_AC0_AIFS,
+                          ((ar->edcf[0].aifs * 9 + 10)) |
+                          ((ar->edcf[1].aifs * 9 + 10) << 12) |
+                          ((ar->edcf[2].aifs * 9 + 10) << 24));
+        carl9170_regwrite(AR9170_MAC_REG_AC4_AC3_AC2_AIFS,
+                          ((ar->edcf[2].aifs * 9 + 10) >> 8) |
+                          ((ar->edcf[3].aifs * 9 + 10) << 4) |
+                          ((ar->edcf[4].aifs * 9 + 10) << 16));
+
+        carl9170_regwrite(AR9170_MAC_REG_AC1_AC0_TXOP,
+                          ar->edcf[0].txop | ar->edcf[1].txop << 16);
+        carl9170_regwrite(AR9170_MAC_REG_AC3_AC2_TXOP,
+                          ar->edcf[2].txop | ar->edcf[3].txop << 16 |
+                          ar->edcf[4].txop << 24);
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_init_mac(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        /* switch MAC to OTUS interface */
+        carl9170_regwrite(0x1c3600, 0x3);
+
+        carl9170_regwrite(AR9170_MAC_REG_ACK_EXTENSION, 0x40);
+
+        carl9170_regwrite(AR9170_MAC_REG_RETRY_MAX, 0x0);
+
+        carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
+                          AR9170_MAC_FTF_MONITOR);
+
+        /* enable MMIC */
+        carl9170_regwrite(AR9170_MAC_REG_SNIFFER,
+                        AR9170_MAC_SNIFFER_DEFAULTS);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_THRESHOLD, 0xc1f80);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_PE_DELAY, 0x70);
+        carl9170_regwrite(AR9170_MAC_REG_EIFS_AND_SIFS, 0xa144000);
+        carl9170_regwrite(AR9170_MAC_REG_SLOT_TIME, 9 << 10);
+
+        /* CF-END & CF-ACK rate => 24M OFDM */
+        carl9170_regwrite(AR9170_MAC_REG_TID_CFACK_CFEND_RATE, 0x59900000);
+
+        /* NAV protects ACK only (in TXOP) */
+        carl9170_regwrite(AR9170_MAC_REG_TXOP_DURATION, 0x201);
+
+        /* Set Beacon PHY CTRL's TPC to 0x7, TA1=1 */
+        /* OTUS set AM to 0x1 */
+        carl9170_regwrite(AR9170_MAC_REG_BCN_HT1, 0x8000170);
+
+        carl9170_regwrite(AR9170_MAC_REG_BACKOFF_PROTECT, 0x105);
+
+        /* Aggregation MAX number and timeout */
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0xa);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a00);
+
+        carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
+                          AR9170_MAC_FTF_DEFAULTS);
+
+        carl9170_regwrite(AR9170_MAC_REG_RX_CONTROL,
+                          AR9170_MAC_RX_CTRL_DEAGG |
+                          AR9170_MAC_RX_CTRL_SHORT_FILTER);
+
+        /* rate sets */
+        carl9170_regwrite(AR9170_MAC_REG_BASIC_RATE, 0x150f);
+        carl9170_regwrite(AR9170_MAC_REG_MANDATORY_RATE, 0x150f);
+        carl9170_regwrite(AR9170_MAC_REG_RTS_CTS_RATE, 0x0030033);
+
+        /* MIMO response control */
+        carl9170_regwrite(AR9170_MAC_REG_ACK_TPC, 0x4003c1e);
+
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_RX_THRESH, 0xffff);
+
+        /* set PHY register read timeout (??) */
+        carl9170_regwrite(AR9170_MAC_REG_MISC_680, 0xf00008);
+
+        /* Disable Rx TimeOut, workaround for BB. */
+        carl9170_regwrite(AR9170_MAC_REG_RX_TIMEOUT, 0x0);
+
+        /* Set WLAN DMA interrupt mode: generate int per packet */
+        carl9170_regwrite(AR9170_MAC_REG_TXRX_MPI, 0x110011);
+
+        carl9170_regwrite(AR9170_MAC_REG_FCS_SELECT,
+                        AR9170_MAC_FCS_FIFO_PROT);
+
+        /* Disables the CF_END frame, undocumented register */
+        carl9170_regwrite(AR9170_MAC_REG_TXOP_NOT_ENOUGH_IND,
+                        0x141e0f48);
+
+        /* reset group hash table */
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_L, 0xffffffff);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_H, 0xffffffff);
+
+        /* disable PRETBTT interrupt */
+        carl9170_regwrite(AR9170_MAC_REG_PRETBTT, 0x0);
+        carl9170_regwrite(AR9170_MAC_REG_BCN_PERIOD, 0x0);
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+static int carl9170_set_mac_reg(struct ar9170 *ar,
+                                const u32 reg, const u8 *mac)
+{
+        static const u8 zero[ETH_ALEN] = { 0 };
+
+        if (!mac)
+                mac = zero;
+
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(reg, get_unaligned_le32(mac));
+        carl9170_regwrite(reg + 4, get_unaligned_le16(mac + 4));
+
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_mod_virtual_mac(struct ar9170 *ar, const unsigned int id,
+                             const u8 *mac)
+{
+        if (WARN_ON(id >= ar->fw.vif_num))
+                return -EINVAL;
+
+        return carl9170_set_mac_reg(ar,
+                AR9170_MAC_REG_ACK_TABLE + (id - 1) * 8, mac);
+}
+
+int carl9170_update_multicast(struct ar9170 *ar, const u64 mc_hash)
+{
+        int err;
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_H, mc_hash >> 32);
+        carl9170_regwrite(AR9170_MAC_REG_GROUP_HASH_TBL_L, mc_hash);
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        ar->cur_mc_hash = mc_hash;
+        return 0;
+}
+
+int carl9170_set_operating_mode(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        struct ath_common *common = &ar->common;
+        u8 *mac_addr, *bssid;
+        u32 cam_mode = AR9170_MAC_CAM_DEFAULTS;
+        u32 enc_mode = AR9170_MAC_ENCRYPTION_DEFAULTS;
+        u32 rx_ctrl = AR9170_MAC_RX_CTRL_DEAGG |
+                      AR9170_MAC_RX_CTRL_SHORT_FILTER;
+        u32 sniffer = AR9170_MAC_SNIFFER_DEFAULTS;
+        int err = 0;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (vif) {
+                mac_addr = common->macaddr;
+                bssid = common->curbssid;
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_ADHOC:
+                        cam_mode |= AR9170_MAC_CAM_IBSS;
+                        break;
+                case NL80211_IFTYPE_AP:
+                        cam_mode |= AR9170_MAC_CAM_AP;
+
+                        /* iwlagn 802.11n STA Workaround */
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                case NL80211_IFTYPE_WDS:
+                        cam_mode |= AR9170_MAC_CAM_AP_WDS;
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                case NL80211_IFTYPE_STATION:
+                        cam_mode |= AR9170_MAC_CAM_STA;
+                        rx_ctrl |= AR9170_MAC_RX_CTRL_PASS_TO_HOST;
+                        break;
+                default:
+                        WARN(1, "Unsupported operation mode %x\n", vif->type);
+                        err = -EOPNOTSUPP;
+                        break;
+                }
+        } else {
+                mac_addr = NULL;
+                bssid = NULL;
+        }
+        rcu_read_unlock();
+
+        if (err)
+                return err;
+
+        if (ar->rx_software_decryption)
+                enc_mode |= AR9170_MAC_ENCRYPTION_RX_SOFTWARE;
+
+        if (ar->sniffer_enabled) {
+                rx_ctrl |= AR9170_MAC_RX_CTRL_ACK_IN_SNIFFER;
+                sniffer |= AR9170_MAC_SNIFFER_ENABLE_PROMISC;
+                enc_mode |= AR9170_MAC_ENCRYPTION_RX_SOFTWARE;
+        }
+
+        err = carl9170_set_mac_reg(ar, AR9170_MAC_REG_MAC_ADDR_L, mac_addr);
+        if (err)
+                return err;
+
+        err = carl9170_set_mac_reg(ar, AR9170_MAC_REG_BSSID_L, bssid);
+        if (err)
+                return err;
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_SNIFFER, sniffer);
+        carl9170_regwrite(AR9170_MAC_REG_CAM_MODE, cam_mode);
+        carl9170_regwrite(AR9170_MAC_REG_ENCRYPTION, enc_mode);
+        carl9170_regwrite(AR9170_MAC_REG_RX_CONTROL, rx_ctrl);
+        carl9170_regwrite_finish();
+
+        return carl9170_regwrite_result();
+}
+
+int carl9170_set_hwretry_limit(struct ar9170 *ar, const unsigned int max_retry)
+{
+        u32 tmp = min_t(u32, 0x33333, max_retry * 0x11111);
+
+        return carl9170_write_reg(ar, AR9170_MAC_REG_RETRY_MAX, tmp);
+}
+
+int carl9170_set_beacon_timers(struct ar9170 *ar)
+{
+        struct ieee80211_vif *vif;
+        u32 v = 0;
+        u32 pretbtt = 0;
+
+        rcu_read_lock();
+        vif = carl9170_get_main_vif(ar);
+
+        if (vif) {
+                struct carl9170_vif_info *mvif;
+                mvif = (void *) vif->drv_priv;
+
+                if (mvif->enable_beacon && !WARN_ON(!ar->beacon_enabled)) {
+                        ar->global_beacon_int = vif->bss_conf.beacon_int /
+                                                ar->beacon_enabled;
+
+                        SET_VAL(AR9170_MAC_BCN_DTIM, v,
+                                vif->bss_conf.dtim_period);
+
+                        switch (vif->type) {
+                        case NL80211_IFTYPE_MESH_POINT:
+                        case NL80211_IFTYPE_ADHOC:
+                                v |= AR9170_MAC_BCN_IBSS_MODE;
+                                break;
+                        case NL80211_IFTYPE_AP:
+                                v |= AR9170_MAC_BCN_AP_MODE;
+                                break;
+                        default:
+                                WARN_ON_ONCE(1);
+                                break;
+                        }
+                } else if (vif->type == NL80211_IFTYPE_STATION) {
+                        ar->global_beacon_int = vif->bss_conf.beacon_int;
+
+                        SET_VAL(AR9170_MAC_BCN_DTIM, v,
+                                ar->hw->conf.ps_dtim_period);
+
+                        v |= AR9170_MAC_BCN_STA_PS |
+                             AR9170_MAC_BCN_PWR_MGT;
+                }
+
+                if (ar->global_beacon_int) {
+                        if (ar->global_beacon_int < 15) {
+                                rcu_read_unlock();
+                                return -ERANGE;
+                        }
+
+                        ar->global_pretbtt = ar->global_beacon_int -
+                                        CARL9170_PRETBTT_KUS;
+                } else {
+                        ar->global_pretbtt = 0;
+                }
+        } else {
+                ar->global_beacon_int = 0;
+                ar->global_pretbtt = 0;
+        }
+
+        rcu_read_unlock();
+
+        SET_VAL(AR9170_MAC_BCN_PERIOD, v, ar->global_beacon_int);
+        SET_VAL(AR9170_MAC_PRETBTT, pretbtt, ar->global_pretbtt);
+        SET_VAL(AR9170_MAC_PRETBTT2, pretbtt, ar->global_pretbtt);
+
+        carl9170_regwrite_begin(ar);
+        carl9170_regwrite(AR9170_MAC_REG_PRETBTT, pretbtt);
+        carl9170_regwrite(AR9170_MAC_REG_BCN_PERIOD, v);
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
+{
+        struct sk_buff *skb;
+        struct carl9170_vif_info *cvif;
+        __le32 *data, *old = NULL;
+        u32 word, off, addr, len;
+        int i = 0, err = 0;
+
+        rcu_read_lock();
+        cvif = rcu_dereference(ar->beacon_iter);
+retry:
+        if (ar->vifs == 0 || !cvif)
+                goto out_unlock;
+
+        list_for_each_entry_continue_rcu(cvif, &ar->vif_list, list) {
+                if (cvif->active && cvif->enable_beacon)
+                        goto found;
+        }
+
+        if (!ar->beacon_enabled || i++)
+                goto out_unlock;
+
+        goto retry;
+
+found:
+        rcu_assign_pointer(ar->beacon_iter, cvif);
+
+        skb = ieee80211_beacon_get_tim(ar->hw, carl9170_get_vif(cvif),
+                NULL, NULL);
+
+        if (!skb) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
+
+        spin_lock_bh(&ar->beacon_lock);
+        data = (__le32 *)skb->data;
+        if (cvif->beacon)
+                old = (__le32 *)cvif->beacon->data;
+
+        off = cvif->id * AR9170_MAC_BCN_LENGTH_MAX;
+        addr = ar->fw.beacon_addr + off;
+        len = roundup(skb->len + FCS_LEN, 4);
+
+        if ((off + len) > ar->fw.beacon_max_len) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "beacon does not "
+                                  "fit into device memory!\n");
+                }
+
+                spin_unlock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(skb);
+                err = -EINVAL;
+                goto out_unlock;
+        }
+
+        if (len > AR9170_MAC_BCN_LENGTH_MAX) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "no support for beacons "
+                                "bigger than %d (yours:%d).\n",
+                                 AR9170_MAC_BCN_LENGTH_MAX, len);
+                }
+
+                spin_unlock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(skb);
+                err = -EMSGSIZE;
+                goto out_unlock;
+        }
+
+        carl9170_async_regwrite_begin(ar);
+
+        /* XXX: use skb->cb info */
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400);
+        } else {
+                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
+                                ((skb->len + FCS_LEN) << 16) + 0x001b);
+        }
+
+        for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
+                /*
+                 * XXX: This accesses beyond skb data for up
+                 *      to the last 3 bytes!!
+                 */
+
+                if (old && (data[i] == old[i]))
+                        continue;
+
+                word = le32_to_cpu(data[i]);
+                carl9170_async_regwrite(addr + 4 * i, word);
+        }
+        carl9170_async_regwrite_finish();
+
+        dev_kfree_skb_any(cvif->beacon);
+        cvif->beacon = NULL;
+
+        err = carl9170_async_regwrite_result();
+        if (!err)
+                cvif->beacon = skb;
+        spin_unlock_bh(&ar->beacon_lock);
+        if (err)
+                goto out_unlock;
+
+        if (submit) {
+                err = carl9170_bcn_ctrl(ar, cvif->id,
+                                        CARL9170_BCN_CTRL_CAB_TRIGGER,
+                                        addr, skb->len + FCS_LEN);
+
+                if (err)
+                        goto out_unlock;
+        }
+out_unlock:
+        rcu_read_unlock();
+        return err;
+}
+
+int carl9170_upload_key(struct ar9170 *ar, const u8 id, const u8 *mac,
+                        const u8 ktype, const u8 keyidx, const u8 *keydata,
+                        const int keylen)
+{
+        struct carl9170_set_key_cmd key = { };
+        static const u8 bcast[ETH_ALEN] = {
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+        mac = mac ? : bcast;
+
+        key.user = cpu_to_le16(id);
+        key.keyId = cpu_to_le16(keyidx);
+        key.type = cpu_to_le16(ktype);
+        memcpy(&key.macAddr, mac, ETH_ALEN);
+        if (keydata)
+                memcpy(&key.key, keydata, keylen);
+
+        return carl9170_exec_cmd(ar, CARL9170_CMD_EKEY,
+                sizeof(key), (u8 *)&key, 0, NULL);
+}
+
+int carl9170_disable_key(struct ar9170 *ar, const u8 id)
+{
+        struct carl9170_disable_key_cmd key = { };
+
+        key.user = cpu_to_le16(id);
+
+        return carl9170_exec_cmd(ar, CARL9170_CMD_DKEY,
+                sizeof(key), (u8 *)&key, 0, NULL);
+}
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
new file mode 100644
index 000000000000..43de9dfa5820
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -0,0 +1,1855 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * mac80211 interaction code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <net/mac80211.h>
+#include <net/cfg80211.h>
+#include "hw.h"
+#include "carl9170.h"
+#include "cmd.h"
+
+static int modparam_nohwcrypt;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware crypto offload.");
+
+int modparam_noht;
+module_param_named(noht, modparam_noht, int, S_IRUGO);
+MODULE_PARM_DESC(noht, "Disable MPDU aggregation.");
+
+#define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
+}
+
+struct ieee80211_rate __carl9170_ratetable[] = {
+        RATE(10, 0, 0, 0),
+        RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, 0xb, 0, 0),
+        RATE(90, 0xf, 0, 0),
+        RATE(120, 0xa, 0, 0),
+        RATE(180, 0xe, 0, 0),
+        RATE(240, 0x9, 0, 0),
+        RATE(360, 0xd, 1, 0),
+        RATE(480, 0x8, 2, 0),
+        RATE(540, 0xc, 3, 0),
+};
+#undef RATE
+
+#define carl9170_g_ratetable    (__carl9170_ratetable + 0)
+#define carl9170_g_ratetable_size       12
+#define carl9170_a_ratetable    (__carl9170_ratetable + 4)
+#define carl9170_a_ratetable_size       8
+
+/*
+ * NB: The hw_value is used as an index into the carl9170_phy_freq_params
+ *     array in phy.c so that we don't have to do frequency lookups!
+ */
+#define CHAN(_freq, _idx) {             \
+        .center_freq    = (_freq),      \
+        .hw_value       = (_idx),       \
+        .max_power      = 18, /* XXX */ \
+}
+
+static struct ieee80211_channel carl9170_2ghz_chantable[] = {
+        CHAN(2412,  0),
+        CHAN(2417,  1),
+        CHAN(2422,  2),
+        CHAN(2427,  3),
+        CHAN(2432,  4),
+        CHAN(2437,  5),
+        CHAN(2442,  6),
+        CHAN(2447,  7),
+        CHAN(2452,  8),
+        CHAN(2457,  9),
+        CHAN(2462, 10),
+        CHAN(2467, 11),
+        CHAN(2472, 12),
+        CHAN(2484, 13),
+};
+
+static struct ieee80211_channel carl9170_5ghz_chantable[] = {
+        CHAN(4920, 14),
+        CHAN(4940, 15),
+        CHAN(4960, 16),
+        CHAN(4980, 17),
+        CHAN(5040, 18),
+        CHAN(5060, 19),
+        CHAN(5080, 20),
+        CHAN(5180, 21),
+        CHAN(5200, 22),
+        CHAN(5220, 23),
+        CHAN(5240, 24),
+        CHAN(5260, 25),
+        CHAN(5280, 26),
+        CHAN(5300, 27),
+        CHAN(5320, 28),
+        CHAN(5500, 29),
+        CHAN(5520, 30),
+        CHAN(5540, 31),
+        CHAN(5560, 32),
+        CHAN(5580, 33),
+        CHAN(5600, 34),
+        CHAN(5620, 35),
+        CHAN(5640, 36),
+        CHAN(5660, 37),
+        CHAN(5680, 38),
+        CHAN(5700, 39),
+        CHAN(5745, 40),
+        CHAN(5765, 41),
+        CHAN(5785, 42),
+        CHAN(5805, 43),
+        CHAN(5825, 44),
+        CHAN(5170, 45),
+        CHAN(5190, 46),
+        CHAN(5210, 47),
+        CHAN(5230, 48),
+};
+#undef CHAN
+
+#define CARL9170_HT_CAP                                                 \
+{                                                                       \
+        .ht_supported   = true,                                         \
+        .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
+                          IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
+                          IEEE80211_HT_CAP_SGI_40 |                     \
+                          IEEE80211_HT_CAP_DSSSCCK40 |                  \
+                          IEEE80211_HT_CAP_SM_PS,                       \
+        .ampdu_factor   = IEEE80211_HT_MAX_AMPDU_64K,                   \
+        .ampdu_density  = IEEE80211_HT_MPDU_DENSITY_8,                  \
+        .mcs            = {                                             \
+                .rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },   \
+                .rx_highest = cpu_to_le16(300),                         \
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,               \
+        },                                                              \
+}
+
+static struct ieee80211_supported_band carl9170_band_2GHz = {
+        .channels       = carl9170_2ghz_chantable,
+        .n_channels     = ARRAY_SIZE(carl9170_2ghz_chantable),
+        .bitrates       = carl9170_g_ratetable,
+        .n_bitrates     = carl9170_g_ratetable_size,
+        .ht_cap         = CARL9170_HT_CAP,
+};
+
+static struct ieee80211_supported_band carl9170_band_5GHz = {
+        .channels       = carl9170_5ghz_chantable,
+        .n_channels     = ARRAY_SIZE(carl9170_5ghz_chantable),
+        .bitrates       = carl9170_a_ratetable,
+        .n_bitrates     = carl9170_a_ratetable_size,
+        .ht_cap         = CARL9170_HT_CAP,
+};
+
+static void carl9170_ampdu_gc(struct ar9170 *ar)
+{
+        struct carl9170_sta_tid *tid_info;
+        LIST_HEAD(tid_gc);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                if (tid_info->state == CARL9170_TID_STATE_SHUTDOWN) {
+                        tid_info->state = CARL9170_TID_STATE_KILLED;
+                        list_del_rcu(&tid_info->list);
+                        ar->tx_ampdu_list_len--;
+                        list_add_tail(&tid_info->tmp_list, &tid_gc);
+                }
+                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+
+        }
+        rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
+        rcu_read_unlock();
+
+        synchronize_rcu();
+
+        while (!list_empty(&tid_gc)) {
+                struct sk_buff *skb;
+                tid_info = list_first_entry(&tid_gc, struct carl9170_sta_tid,
+                                            tmp_list);
+
+                while ((skb = __skb_dequeue(&tid_info->queue)))
+                        carl9170_tx_status(ar, skb, false);
+
+                list_del_init(&tid_info->tmp_list);
+                kfree(tid_info);
+        }
+}
+
+static void carl9170_flush(struct ar9170 *ar, bool drop_queued)
+{
+        if (drop_queued) {
+                int i;
+
+                /*
+                 * We can only drop frames which have not been uploaded
+                 * to the device yet.
+                 */
+
+                for (i = 0; i < ar->hw->queues; i++) {
+                        struct sk_buff *skb;
+
+                        while ((skb = skb_dequeue(&ar->tx_pending[i])))
+                                carl9170_tx_status(ar, skb, false);
+                }
+        }
+
+        /* Wait for all other outstanding frames to timeout. */
+        if (atomic_read(&ar->tx_total_queued))
+                WARN_ON(wait_for_completion_timeout(&ar->tx_flush, HZ) == 0);
+}
+
+static void carl9170_flush_ba(struct ar9170 *ar)
+{
+        struct sk_buff_head free;
+        struct carl9170_sta_tid *tid_info;
+        struct sk_buff *skb;
+
+        __skb_queue_head_init(&free);
+
+        rcu_read_lock();
+        spin_lock_bh(&ar->tx_ampdu_list_lock);
+        list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                if (tid_info->state > CARL9170_TID_STATE_SUSPEND) {
+                        tid_info->state = CARL9170_TID_STATE_SUSPEND;
+
+                        spin_lock(&tid_info->lock);
+                        while ((skb = __skb_dequeue(&tid_info->queue)))
+                                __skb_queue_tail(&free, skb);
+                        spin_unlock(&tid_info->lock);
+                }
+        }
+        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+        rcu_read_unlock();
+
+        while ((skb = __skb_dequeue(&free)))
+                carl9170_tx_status(ar, skb, false);
+}
+
+static void carl9170_zap_queues(struct ar9170 *ar)
+{
+        struct carl9170_vif_info *cvif;
+        unsigned int i;
+
+        carl9170_ampdu_gc(ar);
+
+        carl9170_flush_ba(ar);
+        carl9170_flush(ar, true);
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                spin_lock_bh(&ar->tx_status[i].lock);
+                while (!skb_queue_empty(&ar->tx_status[i])) {
+                        struct sk_buff *skb;
+
+                        skb = skb_peek(&ar->tx_status[i]);
+                        carl9170_tx_get_skb(skb);
+                        spin_unlock_bh(&ar->tx_status[i].lock);
+                        carl9170_tx_drop(ar, skb);
+                        spin_lock_bh(&ar->tx_status[i].lock);
+                        carl9170_tx_put_skb(skb);
+                }
+                spin_unlock_bh(&ar->tx_status[i].lock);
+        }
+
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_SOFT < 1);
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD < CARL9170_NUM_TX_LIMIT_SOFT);
+        BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD >= CARL9170_BAW_BITS);
+
+        /* reinitialize queues statistics */
+        memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
+        for (i = 0; i < ar->hw->queues; i++)
+                ar->tx_stats[i].limit = CARL9170_NUM_TX_LIMIT_HARD;
+
+        for (i = 0; i < DIV_ROUND_UP(ar->fw.mem_blocks, BITS_PER_LONG); i++)
+                ar->mem_bitmap[i] = 0;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(cvif, &ar->vif_list, list) {
+                spin_lock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(cvif->beacon);
+                cvif->beacon = NULL;
+                spin_unlock_bh(&ar->beacon_lock);
+        }
+        rcu_read_unlock();
+
+        atomic_set(&ar->tx_ampdu_upload, 0);
+        atomic_set(&ar->tx_ampdu_scheduler, 0);
+        atomic_set(&ar->tx_total_pending, 0);
+        atomic_set(&ar->tx_total_queued, 0);
+        atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
+}
+
+#define CARL9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)          \
+do {                                                                    \
+        queue.aifs = ai_fs;                                             \
+        queue.cw_min = cwmin;                                           \
+        queue.cw_max = cwmax;                                           \
+        queue.txop = _txop;                                             \
+} while (0)
+
+static int carl9170_op_start(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        int err, i;
+
+        mutex_lock(&ar->mutex);
+
+        carl9170_zap_queues(ar);
+
+        /* reset QoS defaults */
+        CARL9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT */
+        CARL9170_FILL_QUEUE(ar->edcf[1], 2, 7,    15, 94); /* VIDEO */
+        CARL9170_FILL_QUEUE(ar->edcf[2], 2, 3,     7, 47); /* VOICE */
+        CARL9170_FILL_QUEUE(ar->edcf[3], 7, 15, 1023,  0); /* BACKGROUND */
+        CARL9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
+
+        ar->current_factor = ar->current_density = -1;
+        /* "The first key is unique." */
+        ar->usedkeys = 1;
+        ar->filter_state = 0;
+        ar->ps.last_action = jiffies;
+        ar->ps.last_slept = jiffies;
+        ar->erp_mode = CARL9170_ERP_AUTO;
+        ar->rx_software_decryption = false;
+        ar->disable_offload = false;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                ar->queue_stop_timeout[i] = jiffies;
+                ar->max_queue_stop_timeout[i] = 0;
+        }
+
+        atomic_set(&ar->mem_allocs, 0);
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto out;
+
+        err = carl9170_init_mac(ar);
+        if (err)
+                goto out;
+
+        err = carl9170_set_qos(ar);
+        if (err)
+                goto out;
+
+        err = carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER,
+                                 AR9170_DMA_TRIGGER_RXQ);
+        if (err)
+                goto out;
+
+        /* Clear key-cache */
+        for (i = 0; i < AR9170_CAM_MAX_USER + 4; i++) {
+                err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
+                                          0, NULL, 0);
+                if (err)
+                        goto out;
+
+                err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
+                                          1, NULL, 0);
+                if (err)
+                        goto out;
+
+                if (i < AR9170_CAM_MAX_USER) {
+                        err = carl9170_disable_key(ar, i);
+                        if (err)
+                                goto out;
+                }
+        }
+
+        carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STARTED);
+
+        ieee80211_wake_queues(ar->hw);
+        err = 0;
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static void carl9170_cancel_worker(struct ar9170 *ar)
+{
+        cancel_delayed_work_sync(&ar->tx_janitor);
+#ifdef CONFIG_CARL9170_LEDS
+        cancel_delayed_work_sync(&ar->led_work);
+#endif /* CONFIG_CARL9170_LEDS */
+        cancel_work_sync(&ar->ps_work);
+        cancel_work_sync(&ar->ampdu_work);
+}
+
+static void carl9170_op_stop(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+
+        carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
+
+        ieee80211_stop_queues(ar->hw);
+
+        mutex_lock(&ar->mutex);
+        if (IS_ACCEPTING_CMD(ar)) {
+                rcu_assign_pointer(ar->beacon_iter, NULL);
+
+                carl9170_led_set_state(ar, 0);
+
+                /* stop DMA */
+                carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER, 0);
+                carl9170_usb_stop(ar);
+        }
+
+        carl9170_zap_queues(ar);
+        mutex_unlock(&ar->mutex);
+
+        carl9170_cancel_worker(ar);
+}
+
+static void carl9170_restart_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         restart_work);
+        int err;
+
+        ar->usedkeys = 0;
+        ar->filter_state = 0;
+        carl9170_cancel_worker(ar);
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_usb_restart(ar);
+        if (net_ratelimit()) {
+                if (err) {
+                        dev_err(&ar->udev->dev, "Failed to restart device "
+                                " (%d).\n", err);
+                 } else {
+                        dev_info(&ar->udev->dev, "device restarted "
+                                 "successfully.\n");
+                }
+        }
+
+        carl9170_zap_queues(ar);
+        mutex_unlock(&ar->mutex);
+        if (!err) {
+                ar->restart_counter++;
+                atomic_set(&ar->pending_restarts, 0);
+
+                ieee80211_restart_hw(ar->hw);
+        } else {
+                /*
+                 * The reset was unsuccessful and the device seems to
+                 * be dead. But there's still one option: a low-level
+                 * usb subsystem reset...
+                 */
+
+                carl9170_usb_reset(ar);
+        }
+}
+
+void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r)
+{
+        carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
+
+        /*
+         * Sometimes, an error can trigger several different reset events.
+         * By ignoring these *surplus* reset events, the device won't be
+         * killed again, right after it has recovered.
+         */
+        if (atomic_inc_return(&ar->pending_restarts) > 1) {
+                dev_dbg(&ar->udev->dev, "ignoring restart (%d)\n", r);
+                return;
+        }
+
+        ieee80211_stop_queues(ar->hw);
+
+        dev_err(&ar->udev->dev, "restart device (%d)\n", r);
+
+        if (!WARN_ON(r == CARL9170_RR_NO_REASON) ||
+            !WARN_ON(r >= __CARL9170_RR_LAST))
+                ar->last_reason = r;
+
+        if (!ar->registered)
+                return;
+
+        if (IS_ACCEPTING_CMD(ar) && !ar->needs_full_reset)
+                ieee80211_queue_work(ar->hw, &ar->restart_work);
+        else
+                carl9170_usb_reset(ar);
+
+        /*
+         * At this point, the device instance might have vanished/disabled.
+         * So, don't put any code which access the ar9170 struct
+         * without proper protection.
+         */
+}
+
+static int carl9170_init_interface(struct ar9170 *ar,
+                                   struct ieee80211_vif *vif)
+{
+        struct ath_common *common = &ar->common;
+        int err;
+
+        if (!vif) {
+                WARN_ON_ONCE(IS_STARTED(ar));
+                return 0;
+        }
+
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
+
+        if (modparam_nohwcrypt ||
+            ((vif->type != NL80211_IFTYPE_STATION) &&
+             (vif->type != NL80211_IFTYPE_AP))) {
+                ar->rx_software_decryption = true;
+                ar->disable_offload = true;
+        }
+
+        err = carl9170_set_operating_mode(ar);
+        return err;
+}
+
+static int carl9170_op_add_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
+        struct ieee80211_vif *main_vif;
+        struct ar9170 *ar = hw->priv;
+        int vif_id = -1, err = 0;
+
+        mutex_lock(&ar->mutex);
+        rcu_read_lock();
+        if (vif_priv->active) {
+                /*
+                 * Skip the interface structure initialization,
+                 * if the vif survived the _restart call.
+                 */
+                vif_id = vif_priv->id;
+                vif_priv->enable_beacon = false;
+
+                spin_lock_bh(&ar->beacon_lock);
+                dev_kfree_skb_any(vif_priv->beacon);
+                vif_priv->beacon = NULL;
+                spin_unlock_bh(&ar->beacon_lock);
+
+                goto init;
+        }
+
+        main_vif = carl9170_get_main_vif(ar);
+
+        if (main_vif) {
+                switch (main_vif->type) {
+                case NL80211_IFTYPE_STATION:
+                        if (vif->type == NL80211_IFTYPE_STATION)
+                                break;
+
+                        err = -EBUSY;
+                        rcu_read_unlock();
+
+                        goto unlock;
+
+                case NL80211_IFTYPE_AP:
+                        if ((vif->type == NL80211_IFTYPE_STATION) ||
+                            (vif->type == NL80211_IFTYPE_WDS) ||
+                            (vif->type == NL80211_IFTYPE_AP))
+                                break;
+
+                        err = -EBUSY;
+                        rcu_read_unlock();
+                        goto unlock;
+
+                default:
+                        rcu_read_unlock();
+                        goto unlock;
+                }
+        }
+
+        vif_id = bitmap_find_free_region(&ar->vif_bitmap, ar->fw.vif_num, 0);
+
+        if (vif_id < 0) {
+                rcu_read_unlock();
+
+                err = -ENOSPC;
+                goto unlock;
+        }
+
+        BUG_ON(ar->vif_priv[vif_id].id != vif_id);
+
+        vif_priv->active = true;
+        vif_priv->id = vif_id;
+        vif_priv->enable_beacon = false;
+        ar->vifs++;
+        list_add_tail_rcu(&vif_priv->list, &ar->vif_list);
+        rcu_assign_pointer(ar->vif_priv[vif_id].vif, vif);
+
+init:
+        if (carl9170_get_main_vif(ar) == vif) {
+                rcu_assign_pointer(ar->beacon_iter, vif_priv);
+                rcu_read_unlock();
+
+                err = carl9170_init_interface(ar, vif);
+                if (err)
+                        goto unlock;
+        } else {
+                err = carl9170_mod_virtual_mac(ar, vif_id, vif->addr);
+                rcu_read_unlock();
+
+                if (err)
+                        goto unlock;
+        }
+
+unlock:
+        if (err && (vif_id != -1)) {
+                vif_priv->active = false;
+                bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
+                ar->vifs--;
+                rcu_assign_pointer(ar->vif_priv[vif_id].vif, NULL);
+                list_del_rcu(&vif_priv->list);
+                mutex_unlock(&ar->mutex);
+                synchronize_rcu();
+        } else {
+                if (ar->vifs > 1)
+                        ar->ps.off_override |= PS_OFF_VIF;
+
+                mutex_unlock(&ar->mutex);
+        }
+
+        return err;
+}
+
+static void carl9170_op_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif)
+{
+        struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
+        struct ieee80211_vif *main_vif;
+        struct ar9170 *ar = hw->priv;
+        unsigned int id;
+
+        mutex_lock(&ar->mutex);
+
+        if (WARN_ON_ONCE(!vif_priv->active))
+                goto unlock;
+
+        ar->vifs--;
+
+        rcu_read_lock();
+        main_vif = carl9170_get_main_vif(ar);
+
+        id = vif_priv->id;
+
+        vif_priv->active = false;
+        WARN_ON(vif_priv->enable_beacon);
+        vif_priv->enable_beacon = false;
+        list_del_rcu(&vif_priv->list);
+        rcu_assign_pointer(ar->vif_priv[id].vif, NULL);
+
+        if (vif == main_vif) {
+                rcu_read_unlock();
+
+                if (ar->vifs) {
+                        WARN_ON(carl9170_init_interface(ar,
+                                        carl9170_get_main_vif(ar)));
+                } else {
+                        carl9170_set_operating_mode(ar);
+                }
+        } else {
+                rcu_read_unlock();
+
+                WARN_ON(carl9170_mod_virtual_mac(ar, id, NULL));
+        }
+
+        carl9170_update_beacon(ar, false);
+        carl9170_flush_cab(ar, id);
+
+        spin_lock_bh(&ar->beacon_lock);
+        dev_kfree_skb_any(vif_priv->beacon);
+        vif_priv->beacon = NULL;
+        spin_unlock_bh(&ar->beacon_lock);
+
+        bitmap_release_region(&ar->vif_bitmap, id, 0);
+
+        carl9170_set_beacon_timers(ar);
+
+        if (ar->vifs == 1)
+                ar->ps.off_override &= ~PS_OFF_VIF;
+
+unlock:
+        mutex_unlock(&ar->mutex);
+
+        synchronize_rcu();
+}
+
+void carl9170_ps_check(struct ar9170 *ar)
+{
+        ieee80211_queue_work(ar->hw, &ar->ps_work);
+}
+
+/* caller must hold ar->mutex */
+static int carl9170_ps_update(struct ar9170 *ar)
+{
+        bool ps = false;
+        int err = 0;
+
+        if (!ar->ps.off_override)
+                ps = (ar->hw->conf.flags & IEEE80211_CONF_PS);
+
+        if (ps != ar->ps.state) {
+                err = carl9170_powersave(ar, ps);
+                if (err)
+                        return err;
+
+                if (ar->ps.state && !ps) {
+                        ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
+                                ar->ps.last_action);
+                }
+
+                if (ps)
+                        ar->ps.last_slept = jiffies;
+
+                ar->ps.last_action = jiffies;
+                ar->ps.state = ps;
+        }
+
+        return 0;
+}
+
+static void carl9170_ps_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         ps_work);
+        mutex_lock(&ar->mutex);
+        if (IS_STARTED(ar))
+                WARN_ON_ONCE(carl9170_ps_update(ar) != 0);
+        mutex_unlock(&ar->mutex);
+}
+
+
+static int carl9170_op_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0;
+
+        mutex_lock(&ar->mutex);
+        if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                err = carl9170_ps_update(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_SMPS) {
+                /* TODO */
+                err = 0;
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                /* adjust slot time for 5 GHz */
+                err = carl9170_set_slot_time(ar);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_channel(ar, hw->conf.channel,
+                        hw->conf.channel_type, CARL9170_RFI_NONE);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_dyn_sifs_ack(ar);
+                if (err)
+                        goto out;
+
+                err = carl9170_set_rts_cts_rate(ar);
+                if (err)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+}
+
+static u64 carl9170_op_prepare_multicast(struct ieee80211_hw *hw,
+                                         struct netdev_hw_addr_list *mc_list)
+{
+        struct netdev_hw_addr *ha;
+        u64 mchash;
+
+        /* always get broadcast frames */
+        mchash = 1ULL << (0xff >> 2);
+
+        netdev_hw_addr_list_for_each(ha, mc_list)
+                mchash |= 1ULL << (ha->addr[5] >> 2);
+
+        return mchash;
+}
+
+static void carl9170_op_configure_filter(struct ieee80211_hw *hw,
+                                         unsigned int changed_flags,
+                                         unsigned int *new_flags,
+                                         u64 multicast)
+{
+        struct ar9170 *ar = hw->priv;
+
+        /* mask supported flags */
+        *new_flags &= FIF_ALLMULTI | FIF_FCSFAIL | FIF_PLCPFAIL |
+                      FIF_OTHER_BSS | FIF_PROMISC_IN_BSS;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+
+        ar->filter_state = *new_flags;
+        /*
+         * We can support more by setting the sniffer bit and
+         * then checking the error flags, later.
+         */
+
+        if (changed_flags & FIF_ALLMULTI && *new_flags & FIF_ALLMULTI)
+                multicast = ~0ULL;
+
+        if (multicast != ar->cur_mc_hash)
+                WARN_ON(carl9170_update_multicast(ar, multicast));
+
+        if (changed_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS)) {
+                ar->sniffer_enabled = !!(*new_flags &
+                        (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS));
+
+                WARN_ON(carl9170_set_operating_mode(ar));
+        }
+
+        mutex_unlock(&ar->mutex);
+}
+
+
+static void carl9170_op_bss_info_changed(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         struct ieee80211_bss_conf *bss_conf,
+                                         u32 changed)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ath_common *common = &ar->common;
+        int err = 0;
+        struct carl9170_vif_info *vif_priv;
+        struct ieee80211_vif *main_vif;
+
+        mutex_lock(&ar->mutex);
+        vif_priv = (void *) vif->drv_priv;
+        main_vif = carl9170_get_main_vif(ar);
+        if (WARN_ON(!main_vif))
+                goto out;
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                struct carl9170_vif_info *iter;
+                int i = 0;
+
+                vif_priv->enable_beacon = bss_conf->enable_beacon;
+                rcu_read_lock();
+                list_for_each_entry_rcu(iter, &ar->vif_list, list) {
+                        if (iter->active && iter->enable_beacon)
+                                i++;
+
+                }
+                rcu_read_unlock();
+
+                ar->beacon_enabled = i;
+        }
+
+        if (changed & BSS_CHANGED_BEACON) {
+                err = carl9170_update_beacon(ar, false);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
+                       BSS_CHANGED_BEACON_INT)) {
+
+                if (main_vif != vif) {
+                        bss_conf->beacon_int = main_vif->bss_conf.beacon_int;
+                        bss_conf->dtim_period = main_vif->bss_conf.dtim_period;
+                }
+
+                /*
+                 * Therefore a hard limit for the broadcast traffic should
+                 * prevent false alarms.
+                 */
+                if (vif->type != NL80211_IFTYPE_STATION &&
+                    (bss_conf->beacon_int * bss_conf->dtim_period >=
+                     (CARL9170_QUEUE_STUCK_TIMEOUT / 2))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
+                err = carl9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_HT) {
+                /* TODO */
+                err = 0;
+                if (err)
+                        goto out;
+        }
+
+        if (main_vif != vif)
+                goto out;
+
+        /*
+         * The following settings can only be changed by the
+         * master interface.
+         */
+
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                err = carl9170_set_operating_mode(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                ar->common.curaid = bss_conf->aid;
+                err = carl9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                err = carl9170_set_slot_time(ar);
+                if (err)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                err = carl9170_set_mac_rates(ar);
+                if (err)
+                        goto out;
+        }
+
+out:
+        WARN_ON_ONCE(err && IS_STARTED(ar));
+        mutex_unlock(&ar->mutex);
+}
+
+static u64 carl9170_op_get_tsf(struct ieee80211_hw *hw)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_tsf_rsp tsf;
+        int err;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_READ_TSF,
+                                0, NULL, sizeof(tsf), &tsf);
+        mutex_unlock(&ar->mutex);
+        if (WARN_ON(err))
+                return 0;
+
+        return le64_to_cpu(tsf.tsf_64);
+}
+
+static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct ieee80211_key_conf *key)
+{
+        struct ar9170 *ar = hw->priv;
+        int err = 0, i;
+        u8 ktype;
+
+        if (ar->disable_offload || !vif)
+                return -EOPNOTSUPP;
+
+        /*
+         * We have to fall back to software encryption, whenever
+         * the user choose to participates in an IBSS or is connected
+         * to more than one network.
+         *
+         * This is very unfortunate, because some machines cannot handle
+         * the high througput speed in 802.11n networks.
+         */
+
+        if (!is_main_vif(ar, vif))
+                goto err_softw;
+
+        /*
+         * While the hardware supports *catch-all* key, for offloading
+         * group-key en-/de-cryption. The way of how the hardware
+         * decides which keyId maps to which key, remains a mystery...
+         */
+        if ((vif->type != NL80211_IFTYPE_STATION &&
+             vif->type != NL80211_IFTYPE_ADHOC) &&
+            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                return -EOPNOTSUPP;
+
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                ktype = AR9170_ENC_ALG_WEP64;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                ktype = AR9170_ENC_ALG_WEP128;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                ktype = AR9170_ENC_ALG_TKIP;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                ktype = AR9170_ENC_ALG_AESCCMP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        mutex_lock(&ar->mutex);
+        if (cmd == SET_KEY) {
+                if (!IS_STARTED(ar)) {
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
+                if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                        sta = NULL;
+
+                        i = 64 + key->keyidx;
+                } else {
+                        for (i = 0; i < 64; i++)
+                                if (!(ar->usedkeys & BIT(i)))
+                                        break;
+                        if (i == 64)
+                                goto err_softw;
+                }
+
+                key->hw_key_idx = i;
+
+                err = carl9170_upload_key(ar, i, sta ? sta->addr : NULL,
+                                          ktype, 0, key->key,
+                                          min_t(u8, 16, key->keylen));
+                if (err)
+                        goto out;
+
+                if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                        err = carl9170_upload_key(ar, i, sta ? sta->addr :
+                                                  NULL, ktype, 1,
+                                                  key->key + 16, 16);
+                        if (err)
+                                goto out;
+
+                        /*
+                         * hardware is not capable generating MMIC
+                         * of fragmented frames!
+                         */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                }
+
+                if (i < 64)
+                        ar->usedkeys |= BIT(i);
+
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+        } else {
+                if (!IS_STARTED(ar)) {
+                        /* The device is gone... together with the key ;-) */
+                        err = 0;
+                        goto out;
+                }
+
+                if (key->hw_key_idx < 64) {
+                        ar->usedkeys &= ~BIT(key->hw_key_idx);
+                } else {
+                        err = carl9170_upload_key(ar, key->hw_key_idx, NULL,
+                                                  AR9170_ENC_ALG_NONE, 0,
+                                                  NULL, 0);
+                        if (err)
+                                goto out;
+
+                        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                                err = carl9170_upload_key(ar, key->hw_key_idx,
+                                                          NULL,
+                                                          AR9170_ENC_ALG_NONE,
+                                                          1, NULL, 0);
+                                if (err)
+                                        goto out;
+                        }
+
+                }
+
+                err = carl9170_disable_key(ar, key->hw_key_idx);
+                if (err)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&ar->mutex);
+        return err;
+
+err_softw:
+        if (!ar->rx_software_decryption) {
+                ar->rx_software_decryption = true;
+                carl9170_set_operating_mode(ar);
+        }
+        mutex_unlock(&ar->mutex);
+        return -ENOSPC;
+}
+
+static int carl9170_op_sta_add(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta)
+{
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        unsigned int i;
+
+        if (sta->ht_cap.ht_supported) {
+                if (sta->ht_cap.ampdu_density > 6) {
+                        /*
+                         * HW does support 16us AMPDU density.
+                         * No HT-Xmit for station.
+                         */
+
+                        return 0;
+                }
+
+                for (i = 0; i < CARL9170_NUM_TID; i++)
+                        rcu_assign_pointer(sta_info->agg[i], NULL);
+
+                sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
+                sta_info->ht_sta = true;
+        }
+
+        return 0;
+}
+
+static int carl9170_op_sta_remove(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        unsigned int i;
+        bool cleanup = false;
+
+        if (sta->ht_cap.ht_supported) {
+
+                sta_info->ht_sta = false;
+
+                rcu_read_lock();
+                for (i = 0; i < CARL9170_NUM_TID; i++) {
+                        struct carl9170_sta_tid *tid_info;
+
+                        tid_info = rcu_dereference(sta_info->agg[i]);
+                        rcu_assign_pointer(sta_info->agg[i], NULL);
+
+                        if (!tid_info)
+                                continue;
+
+                        spin_lock_bh(&ar->tx_ampdu_list_lock);
+                        if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
+                                tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
+                        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                        cleanup = true;
+                }
+                rcu_read_unlock();
+
+                if (cleanup)
+                        carl9170_ampdu_gc(ar);
+        }
+
+        return 0;
+}
+
+static int carl9170_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                               const struct ieee80211_tx_queue_params *param)
+{
+        struct ar9170 *ar = hw->priv;
+        int ret;
+
+        mutex_lock(&ar->mutex);
+        if (queue < ar->hw->queues) {
+                memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param));
+                ret = carl9170_set_qos(ar);
+        } else {
+                ret = -EINVAL;
+        }
+
+        mutex_unlock(&ar->mutex);
+        return ret;
+}
+
+static void carl9170_ampdu_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         ampdu_work);
+
+        if (!IS_STARTED(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        carl9170_ampdu_gc(ar);
+        mutex_unlock(&ar->mutex);
+}
+
+static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    enum ieee80211_ampdu_mlme_action action,
+                                    struct ieee80211_sta *sta,
+                                    u16 tid, u16 *ssn)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        struct carl9170_sta_tid *tid_info;
+
+        if (modparam_noht)
+                return -EOPNOTSUPP;
+
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+                if (WARN_ON_ONCE(!sta_info->ht_sta))
+                        return -EOPNOTSUPP;
+
+                rcu_read_lock();
+                if (rcu_dereference(sta_info->agg[tid])) {
+                        rcu_read_unlock();
+                        return -EBUSY;
+                }
+
+                tid_info = kzalloc(sizeof(struct carl9170_sta_tid),
+                                   GFP_ATOMIC);
+                if (!tid_info) {
+                        rcu_read_unlock();
+                        return -ENOMEM;
+                }
+
+                tid_info->hsn = tid_info->bsn = tid_info->snx = (*ssn);
+                tid_info->state = CARL9170_TID_STATE_PROGRESS;
+                tid_info->tid = tid;
+                tid_info->max = sta_info->ampdu_max_len;
+
+                INIT_LIST_HEAD(&tid_info->list);
+                INIT_LIST_HEAD(&tid_info->tmp_list);
+                skb_queue_head_init(&tid_info->queue);
+                spin_lock_init(&tid_info->lock);
+
+                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                ar->tx_ampdu_list_len++;
+                list_add_tail_rcu(&tid_info->list, &ar->tx_ampdu_list);
+                rcu_assign_pointer(sta_info->agg[tid], tid_info);
+                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                rcu_read_unlock();
+
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+
+        case IEEE80211_AMPDU_TX_STOP:
+                rcu_read_lock();
+                tid_info = rcu_dereference(sta_info->agg[tid]);
+                if (tid_info) {
+                        spin_lock_bh(&ar->tx_ampdu_list_lock);
+                        if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
+                                tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
+                        spin_unlock_bh(&ar->tx_ampdu_list_lock);
+                }
+
+                rcu_assign_pointer(sta_info->agg[tid], NULL);
+                rcu_read_unlock();
+
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ieee80211_queue_work(ar->hw, &ar->ampdu_work);
+                break;
+
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                rcu_read_lock();
+                tid_info = rcu_dereference(sta_info->agg[tid]);
+
+                sta_info->stats[tid].clear = true;
+
+                if (tid_info) {
+                        bitmap_zero(tid_info->bitmap, CARL9170_BAW_SIZE);
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                rcu_read_unlock();
+
+                if (WARN_ON_ONCE(!tid_info))
+                        return -EFAULT;
+
+                break;
+
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                /* Handled by hardware */
+                break;
+
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
+#ifdef CONFIG_CARL9170_WPC
+static int carl9170_register_wps_button(struct ar9170 *ar)
+{
+        struct input_dev *input;
+        int err;
+
+        if (!(ar->features & CARL9170_WPS_BUTTON))
+                return 0;
+
+        input = input_allocate_device();
+        if (!input)
+                return -ENOMEM;
+
+        snprintf(ar->wps.name, sizeof(ar->wps.name), "%s WPS Button",
+                 wiphy_name(ar->hw->wiphy));
+
+        snprintf(ar->wps.phys, sizeof(ar->wps.phys),
+                 "ieee80211/%s/input0", wiphy_name(ar->hw->wiphy));
+
+        input->name = ar->wps.name;
+        input->phys = ar->wps.phys;
+        input->id.bustype = BUS_USB;
+        input->dev.parent = &ar->hw->wiphy->dev;
+
+        input_set_capability(input, EV_KEY, KEY_WPS_BUTTON);
+
+        err = input_register_device(input);
+        if (err) {
+                input_free_device(input);
+                return err;
+        }
+
+        ar->wps.pbc = input;
+        return 0;
+}
+#endif /* CONFIG_CARL9170_WPC */
+
+static int carl9170_op_get_survey(struct ieee80211_hw *hw, int idx,
+                                struct survey_info *survey)
+{
+        struct ar9170 *ar = hw->priv;
+        int err;
+
+        if (idx != 0)
+                return -ENOENT;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_get_noisefloor(ar);
+        mutex_unlock(&ar->mutex);
+        if (err)
+                return err;
+
+        survey->channel = ar->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = ar->noise[0];
+        return 0;
+}
+
+static void carl9170_op_flush(struct ieee80211_hw *hw, bool drop)
+{
+        struct ar9170 *ar = hw->priv;
+        unsigned int vid;
+
+        mutex_lock(&ar->mutex);
+        for_each_set_bit(vid, &ar->vif_bitmap, ar->fw.vif_num)
+                carl9170_flush_cab(ar, vid);
+
+        carl9170_flush(ar, drop);
+        mutex_unlock(&ar->mutex);
+}
+
+static int carl9170_op_get_stats(struct ieee80211_hw *hw,
+                                 struct ieee80211_low_level_stats *stats)
+{
+        struct ar9170 *ar = hw->priv;
+
+        memset(stats, 0, sizeof(*stats));
+        stats->dot11ACKFailureCount = ar->tx_ack_failures;
+        stats->dot11FCSErrorCount = ar->tx_fcs_errors;
+        return 0;
+}
+
+static void carl9170_op_sta_notify(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   enum sta_notify_cmd cmd,
+                                   struct ieee80211_sta *sta)
+{
+        struct ar9170 *ar = hw->priv;
+        struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
+        struct sk_buff *skb, *tmp;
+        struct sk_buff_head free;
+        int i;
+
+        switch (cmd) {
+        case STA_NOTIFY_SLEEP:
+                /*
+                 * Since the peer is no longer listening, we have to return
+                 * as many SKBs as possible back to the mac80211 stack.
+                 * It will deal with the retry procedure, once the peer
+                 * has become available again.
+                 *
+                 * NB: Ideally, the driver should return the all frames in
+                 * the correct, ascending order. However, I think that this
+                 * functionality should be implemented in the stack and not
+                 * here...
+                 */
+
+                __skb_queue_head_init(&free);
+
+                if (sta->ht_cap.ht_supported) {
+                        rcu_read_lock();
+                        for (i = 0; i < CARL9170_NUM_TID; i++) {
+                                struct carl9170_sta_tid *tid_info;
+
+                                tid_info = rcu_dereference(sta_info->agg[i]);
+
+                                if (!tid_info)
+                                        continue;
+
+                                spin_lock_bh(&ar->tx_ampdu_list_lock);
+                                if (tid_info->state >
+                                    CARL9170_TID_STATE_SUSPEND)
+                                        tid_info->state =
+                                                CARL9170_TID_STATE_SUSPEND;
+                                spin_unlock_bh(&ar->tx_ampdu_list_lock);
+
+                                spin_lock_bh(&tid_info->lock);
+                                while ((skb = __skb_dequeue(&tid_info->queue)))
+                                        __skb_queue_tail(&free, skb);
+                                spin_unlock_bh(&tid_info->lock);
+
+                                ieee80211_stop_tx_ba_session(sta,
+                                        tid_info->tid);
+                        }
+                        rcu_read_unlock();
+                }
+
+                for (i = 0; i < ar->hw->queues; i++) {
+                        spin_lock_bh(&ar->tx_pending[i].lock);
+                        skb_queue_walk_safe(&ar->tx_pending[i], skb, tmp) {
+                                struct _carl9170_tx_superframe *super;
+                                struct ieee80211_hdr *hdr;
+
+                                super = (void *) skb->data;
+                                hdr = (void *) super->frame_data;
+
+                                if (compare_ether_addr(hdr->addr1, sta->addr))
+                                        continue;
+
+                                __skb_unlink(skb, &ar->tx_pending[i]);
+                                carl9170_tx_status(ar, skb, false);
+                        }
+                        spin_unlock_bh(&ar->tx_pending[i].lock);
+                }
+
+                while ((skb = __skb_dequeue(&free)))
+                        carl9170_tx_status(ar, skb, false);
+
+                break;
+
+        case STA_NOTIFY_AWAKE:
+                if (!sta->ht_cap.ht_supported)
+                        return;
+
+                rcu_read_lock();
+                for (i = 0; i < CARL9170_NUM_TID; i++) {
+                        struct carl9170_sta_tid *tid_info;
+
+                        tid_info = rcu_dereference(sta_info->agg[i]);
+
+                        if (!tid_info)
+                                continue;
+
+                        if ((tid_info->state == CARL9170_TID_STATE_SUSPEND))
+                                tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                rcu_read_unlock();
+                break;
+        }
+}
+
+static const struct ieee80211_ops carl9170_ops = {
+        .start                  = carl9170_op_start,
+        .stop                   = carl9170_op_stop,
+        .tx                     = carl9170_op_tx,
+        .flush                  = carl9170_op_flush,
+        .add_interface          = carl9170_op_add_interface,
+        .remove_interface       = carl9170_op_remove_interface,
+        .config                 = carl9170_op_config,
+        .prepare_multicast      = carl9170_op_prepare_multicast,
+        .configure_filter       = carl9170_op_configure_filter,
+        .conf_tx                = carl9170_op_conf_tx,
+        .bss_info_changed       = carl9170_op_bss_info_changed,
+        .get_tsf                = carl9170_op_get_tsf,
+        .set_key                = carl9170_op_set_key,
+        .sta_add                = carl9170_op_sta_add,
+        .sta_remove             = carl9170_op_sta_remove,
+        .sta_notify             = carl9170_op_sta_notify,
+        .get_survey             = carl9170_op_get_survey,
+        .get_stats              = carl9170_op_get_stats,
+        .ampdu_action           = carl9170_op_ampdu_action,
+};
+
+void *carl9170_alloc(size_t priv_size)
+{
+        struct ieee80211_hw *hw;
+        struct ar9170 *ar;
+        struct sk_buff *skb;
+        int i;
+
+        /*
+         * this buffer is used for rx stream reconstruction.
+         * Under heavy load this device (or the transport layer?)
+         * tends to split the streams into separate rx descriptors.
+         */
+
+        skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
+        if (!skb)
+                goto err_nomem;
+
+        hw = ieee80211_alloc_hw(priv_size, &carl9170_ops);
+        if (!hw)
+                goto err_nomem;
+
+        ar = hw->priv;
+        ar->hw = hw;
+        ar->rx_failover = skb;
+
+        memset(&ar->rx_plcp, 0, sizeof(struct ar9170_rx_head));
+        ar->rx_has_plcp = false;
+
+        /*
+         * Here's a hidden pitfall!
+         *
+         * All 4 AC queues work perfectly well under _legacy_ operation.
+         * However as soon as aggregation is enabled, the traffic flow
+         * gets very bumpy. Therefore we have to _switch_ to a
+         * software AC with a single HW queue.
+         */
+        hw->queues = __AR9170_NUM_TXQ;
+
+        mutex_init(&ar->mutex);
+        spin_lock_init(&ar->beacon_lock);
+        spin_lock_init(&ar->cmd_lock);
+        spin_lock_init(&ar->tx_stats_lock);
+        spin_lock_init(&ar->tx_ampdu_list_lock);
+        spin_lock_init(&ar->mem_lock);
+        spin_lock_init(&ar->state_lock);
+        atomic_set(&ar->pending_restarts, 0);
+        ar->vifs = 0;
+        for (i = 0; i < ar->hw->queues; i++) {
+                skb_queue_head_init(&ar->tx_status[i]);
+                skb_queue_head_init(&ar->tx_pending[i]);
+        }
+        INIT_WORK(&ar->ps_work, carl9170_ps_work);
+        INIT_WORK(&ar->restart_work, carl9170_restart_work);
+        INIT_WORK(&ar->ampdu_work, carl9170_ampdu_work);
+        INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
+        INIT_LIST_HEAD(&ar->tx_ampdu_list);
+        rcu_assign_pointer(ar->tx_ampdu_iter,
+                           (struct carl9170_sta_tid *) &ar->tx_ampdu_list);
+
+        bitmap_zero(&ar->vif_bitmap, ar->fw.vif_num);
+        INIT_LIST_HEAD(&ar->vif_list);
+        init_completion(&ar->tx_flush);
+
+        /*
+         * Note:
+         * IBSS/ADHOC and AP mode are only enabled, if the firmware
+         * supports these modes. The code which will add the
+         * additional interface_modes is in fw.c.
+         */
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+
+        hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
+                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+                     IEEE80211_HW_SUPPORTS_PS |
+                     IEEE80211_HW_PS_NULLFUNC_STACK |
+                     IEEE80211_HW_SIGNAL_DBM;
+
+        if (!modparam_noht) {
+                /*
+                 * see the comment above, why we allow the user
+                 * to disable HT by a module parameter.
+                 */
+                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+        }
+
+        hw->extra_tx_headroom = sizeof(struct _carl9170_tx_superframe);
+        hw->sta_data_size = sizeof(struct carl9170_sta_info);
+        hw->vif_data_size = sizeof(struct carl9170_vif_info);
+
+        hw->max_rates = CARL9170_TX_MAX_RATES;
+        hw->max_rate_tries = CARL9170_TX_USER_RATE_TRIES;
+
+        for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
+                ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
+
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        return ar;
+
+err_nomem:
+        kfree_skb(skb);
+        return ERR_PTR(-ENOMEM);
+}
+
+static int carl9170_read_eeprom(struct ar9170 *ar)
+{
+#define RW      8       /* number of words to read at once */
+#define RB      (sizeof(u32) * RW)
+        u8 *eeprom = (void *)&ar->eeprom;
+        __le32 offsets[RW];
+        int i, j, err;
+
+        BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
+
+        BUILD_BUG_ON(RB > CARL9170_MAX_CMD_LEN - 4);
+#ifndef __CHECKER__
+        /* don't want to handle trailing remains */
+        BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
+#endif
+
+        for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
+                for (j = 0; j < RW; j++)
+                        offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
+                                                 RB * i + 4 * j);
+
+                err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
+                                        RB, (u8 *) &offsets,
+                                        RB, eeprom + RB * i);
+                if (err)
+                        return err;
+        }
+
+#undef RW
+#undef RB
+        return 0;
+}
+
+static int carl9170_parse_eeprom(struct ar9170 *ar)
+{
+        struct ath_regulatory *regulatory = &ar->common.regulatory;
+        unsigned int rx_streams, tx_streams, tx_params = 0;
+        int bands = 0;
+
+        if (ar->eeprom.length == cpu_to_le16(0xffff))
+                return -ENODATA;
+
+        rx_streams = hweight8(ar->eeprom.rx_mask);
+        tx_streams = hweight8(ar->eeprom.tx_mask);
+
+        if (rx_streams != tx_streams) {
+                tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
+
+                WARN_ON(!(tx_streams >= 1 && tx_streams <=
+                        IEEE80211_HT_MCS_TX_MAX_STREAMS));
+
+                tx_params = (tx_streams - 1) <<
+                            IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+
+                carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
+                carl9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
+        }
+
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &carl9170_band_2GHz;
+                bands++;
+        }
+        if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
+                ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &carl9170_band_5GHz;
+                bands++;
+        }
+
+        /*
+         * I measured this, a bandswitch takes roughly
+         * 135 ms and a frequency switch about 80.
+         *
+         * FIXME: measure these values again once EEPROM settings
+         *        are used, that will influence them!
+         */
+        if (bands == 2)
+                ar->hw->channel_change_time = 135 * 1000;
+        else
+                ar->hw->channel_change_time = 80 * 1000;
+
+        regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
+        regulatory->current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
+
+        /* second part of wiphy init */
+        SET_IEEE80211_PERM_ADDR(ar->hw, ar->eeprom.mac_address);
+
+        return bands ? 0 : -EINVAL;
+}
+
+static int carl9170_reg_notifier(struct wiphy *wiphy,
+                                 struct regulatory_request *request)
+{
+        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+        struct ar9170 *ar = hw->priv;
+
+        return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
+}
+
+int carl9170_register(struct ar9170 *ar)
+{
+        struct ath_regulatory *regulatory = &ar->common.regulatory;
+        int err = 0, i;
+
+        if (WARN_ON(ar->mem_bitmap))
+                return -EINVAL;
+
+        ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
+                                 sizeof(unsigned long), GFP_KERNEL);
+
+        if (!ar->mem_bitmap)
+                return -ENOMEM;
+
+        /* try to read EEPROM, init MAC addr */
+        err = carl9170_read_eeprom(ar);
+        if (err)
+                return err;
+
+        err = carl9170_fw_fix_eeprom(ar);
+        if (err)
+                return err;
+
+        err = carl9170_parse_eeprom(ar);
+        if (err)
+                return err;
+
+        err = ath_regd_init(regulatory, ar->hw->wiphy,
+                            carl9170_reg_notifier);
+        if (err)
+                return err;
+
+        if (modparam_noht) {
+                carl9170_band_2GHz.ht_cap.ht_supported = false;
+                carl9170_band_5GHz.ht_cap.ht_supported = false;
+        }
+
+        for (i = 0; i < ar->fw.vif_num; i++) {
+                ar->vif_priv[i].id = i;
+                ar->vif_priv[i].vif = NULL;
+        }
+
+        err = ieee80211_register_hw(ar->hw);
+        if (err)
+                return err;
+
+        /* mac80211 interface is now registered */
+        ar->registered = true;
+
+        if (!ath_is_world_regd(regulatory))
+                regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        carl9170_debugfs_register(ar);
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+        err = carl9170_led_init(ar);
+        if (err)
+                goto err_unreg;
+
+#ifdef CONFIG_CARL9170_LEDS
+        err = carl9170_led_register(ar);
+        if (err)
+                goto err_unreg;
+#endif /* CONFIG_CAR9L170_LEDS */
+
+#ifdef CONFIG_CARL9170_WPC
+        err = carl9170_register_wps_button(ar);
+        if (err)
+                goto err_unreg;
+#endif /* CONFIG_CARL9170_WPC */
+
+        dev_info(&ar->udev->dev, "Atheros AR9170 is registered as '%s'\n",
+                 wiphy_name(ar->hw->wiphy));
+
+        return 0;
+
+err_unreg:
+        carl9170_unregister(ar);
+        return err;
+}
+
+void carl9170_unregister(struct ar9170 *ar)
+{
+        if (!ar->registered)
+                return;
+
+        ar->registered = false;
+
+#ifdef CONFIG_CARL9170_LEDS
+        carl9170_led_unregister(ar);
+#endif /* CONFIG_CARL9170_LEDS */
+
+#ifdef CONFIG_CARL9170_DEBUGFS
+        carl9170_debugfs_unregister(ar);
+#endif /* CONFIG_CARL9170_DEBUGFS */
+
+#ifdef CONFIG_CARL9170_WPC
+        if (ar->wps.pbc) {
+                input_unregister_device(ar->wps.pbc);
+                ar->wps.pbc = NULL;
+        }
+#endif /* CONFIG_CARL9170_WPC */
+
+        carl9170_cancel_worker(ar);
+        cancel_work_sync(&ar->restart_work);
+
+        ieee80211_unregister_hw(ar->hw);
+}
+
+void carl9170_free(struct ar9170 *ar)
+{
+        WARN_ON(ar->registered);
+        WARN_ON(IS_INITIALIZED(ar));
+
+        kfree_skb(ar->rx_failover);
+        ar->rx_failover = NULL;
+
+        kfree(ar->mem_bitmap);
+        ar->mem_bitmap = NULL;
+
+        mutex_destroy(&ar->mutex);
+
+        ieee80211_free_hw(ar->hw);
+}
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
new file mode 100644
index 000000000000..89deca37a988
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -0,0 +1,1810 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * PHY and RF code
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/bitrev.h>
+#include "carl9170.h"
+#include "cmd.h"
+#include "phy.h"
+
+static int carl9170_init_power_cal(struct ar9170 *ar)
+{
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE_MAX, 0x7f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE1, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE2, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE3, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE4, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE5, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE6, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE7, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE8, 0x3f3f3f3f);
+        carl9170_regwrite(AR9170_PHY_REG_POWER_TX_RATE9, 0x3f3f3f3f);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+struct carl9170_phy_init {
+        u32 reg, _5ghz_20, _5ghz_40, _2ghz_40, _2ghz_20;
+};
+
+static struct carl9170_phy_init ar5416_phy_init[] = {
+        { 0x1c5800, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c5804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, },
+        { 0x1c5808, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c580c, 0xad848e19, 0xad848e19, 0xad848e19, 0xad848e19, },
+        { 0x1c5810, 0x7d14e000, 0x7d14e000, 0x7d14e000, 0x7d14e000, },
+        { 0x1c5814, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, 0x9c0a9f6b, },
+        { 0x1c5818, 0x00000090, 0x00000090, 0x00000090, 0x00000090, },
+        { 0x1c581c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, },
+        { 0x1c5824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, },
+        { 0x1c582c, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c5830, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, },
+        { 0x1c5838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c583c, 0x00200400, 0x00200400, 0x00200400, 0x00200400, },
+        { 0x1c5840, 0x206a002e, 0x206a002e, 0x206a002e, 0x206a002e, },
+        { 0x1c5844, 0x1372161e, 0x13721c1e, 0x13721c24, 0x137216a4, },
+        { 0x1c5848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, },
+        { 0x1c584c, 0x1284233c, 0x1284233c, 0x1284233c, 0x1284233c, },
+        { 0x1c5850, 0x6c48b4e4, 0x6d48b4e4, 0x6d48b0e4, 0x6c48b0e4, },
+        { 0x1c5854, 0x00000859, 0x00000859, 0x00000859, 0x00000859, },
+        { 0x1c5858, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, },
+        { 0x1c585c, 0x31395c5e, 0x3139605e, 0x3139605e, 0x31395c5e, },
+        { 0x1c5860, 0x0004dd10, 0x0004dd10, 0x0004dd20, 0x0004dd20, },
+        { 0x1c5864, 0x0001c600, 0x0001c600, 0x0001c600, 0x0001c600, },
+        { 0x1c5868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, },
+        { 0x1c586c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, },
+        { 0x1c5900, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5904, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5908, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c590c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5914, 0x000007d0, 0x000007d0, 0x00000898, 0x00000898, },
+        { 0x1c5918, 0x00000118, 0x00000230, 0x00000268, 0x00000134, },
+        { 0x1c591c, 0x10000fff, 0x10000fff, 0x10000fff, 0x10000fff, },
+        { 0x1c5920, 0x0510081c, 0x0510081c, 0x0510001c, 0x0510001c, },
+        { 0x1c5924, 0xd0058a15, 0xd0058a15, 0xd0058a15, 0xd0058a15, },
+        { 0x1c5928, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c592c, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5934, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c5938, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c593c, 0x0000007f, 0x0000007f, 0x0000007f, 0x0000007f, },
+        { 0x1c5944, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020, },
+        { 0x1c5948, 0x9280b212, 0x9280b212, 0x9280b212, 0x9280b212, },
+        { 0x1c594c, 0x00020028, 0x00020028, 0x00020028, 0x00020028, },
+        { 0x1c5954, 0x5d50e188, 0x5d50e188, 0x5d50e188, 0x5d50e188, },
+        { 0x1c5958, 0x00081fff, 0x00081fff, 0x00081fff, 0x00081fff, },
+        { 0x1c5960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c5964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, },
+        { 0x1c5970, 0x190fb515, 0x190fb515, 0x190fb515, 0x190fb515, },
+        { 0x1c5974, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5978, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c597c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5980, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5984, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5988, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c598c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5990, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5994, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5998, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c599c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59a4, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c59a8, 0x001fff00, 0x001fff00, 0x001fff00, 0x001fff00, },
+        { 0x1c59ac, 0x006f00c4, 0x006f00c4, 0x006f00c4, 0x006f00c4, },
+        { 0x1c59b0, 0x03051000, 0x03051000, 0x03051000, 0x03051000, },
+        { 0x1c59b4, 0x00000820, 0x00000820, 0x00000820, 0x00000820, },
+        { 0x1c59bc, 0x00181400, 0x00181400, 0x00181400, 0x00181400, },
+        { 0x1c59c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, },
+        { 0x1c59c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, },
+        { 0x1c59c8, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c, },
+        { 0x1c59cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, },
+        { 0x1c59d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, },
+        { 0x1c59d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59dc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59e0, 0x00000200, 0x00000200, 0x00000200, 0x00000200, },
+        { 0x1c59e4, 0x64646464, 0x64646464, 0x64646464, 0x64646464, },
+        { 0x1c59e8, 0x3c787878, 0x3c787878, 0x3c787878, 0x3c787878, },
+        { 0x1c59ec, 0x000000aa, 0x000000aa, 0x000000aa, 0x000000aa, },
+        { 0x1c59f0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c59fc, 0x00001042, 0x00001042, 0x00001042, 0x00001042, },
+        { 0x1c5a00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5a04, 0x00000040, 0x00000040, 0x00000040, 0x00000040, },
+        { 0x1c5a08, 0x00000080, 0x00000080, 0x00000080, 0x00000080, },
+        { 0x1c5a0c, 0x000001a1, 0x000001a1, 0x00000141, 0x00000141, },
+        { 0x1c5a10, 0x000001e1, 0x000001e1, 0x00000181, 0x00000181, },
+        { 0x1c5a14, 0x00000021, 0x00000021, 0x000001c1, 0x000001c1, },
+        { 0x1c5a18, 0x00000061, 0x00000061, 0x00000001, 0x00000001, },
+        { 0x1c5a1c, 0x00000168, 0x00000168, 0x00000041, 0x00000041, },
+        { 0x1c5a20, 0x000001a8, 0x000001a8, 0x000001a8, 0x000001a8, },
+        { 0x1c5a24, 0x000001e8, 0x000001e8, 0x000001e8, 0x000001e8, },
+        { 0x1c5a28, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5a2c, 0x00000068, 0x00000068, 0x00000068, 0x00000068, },
+        { 0x1c5a30, 0x00000189, 0x00000189, 0x000000a8, 0x000000a8, },
+        { 0x1c5a34, 0x000001c9, 0x000001c9, 0x00000169, 0x00000169, },
+        { 0x1c5a38, 0x00000009, 0x00000009, 0x000001a9, 0x000001a9, },
+        { 0x1c5a3c, 0x00000049, 0x00000049, 0x000001e9, 0x000001e9, },
+        { 0x1c5a40, 0x00000089, 0x00000089, 0x00000029, 0x00000029, },
+        { 0x1c5a44, 0x00000170, 0x00000170, 0x00000069, 0x00000069, },
+        { 0x1c5a48, 0x000001b0, 0x000001b0, 0x00000190, 0x00000190, },
+        { 0x1c5a4c, 0x000001f0, 0x000001f0, 0x000001d0, 0x000001d0, },
+        { 0x1c5a50, 0x00000030, 0x00000030, 0x00000010, 0x00000010, },
+        { 0x1c5a54, 0x00000070, 0x00000070, 0x00000050, 0x00000050, },
+        { 0x1c5a58, 0x00000191, 0x00000191, 0x00000090, 0x00000090, },
+        { 0x1c5a5c, 0x000001d1, 0x000001d1, 0x00000151, 0x00000151, },
+        { 0x1c5a60, 0x00000011, 0x00000011, 0x00000191, 0x00000191, },
+        { 0x1c5a64, 0x00000051, 0x00000051, 0x000001d1, 0x000001d1, },
+        { 0x1c5a68, 0x00000091, 0x00000091, 0x00000011, 0x00000011, },
+        { 0x1c5a6c, 0x000001b8, 0x000001b8, 0x00000051, 0x00000051, },
+        { 0x1c5a70, 0x000001f8, 0x000001f8, 0x00000198, 0x00000198, },
+        { 0x1c5a74, 0x00000038, 0x00000038, 0x000001d8, 0x000001d8, },
+        { 0x1c5a78, 0x00000078, 0x00000078, 0x00000018, 0x00000018, },
+        { 0x1c5a7c, 0x00000199, 0x00000199, 0x00000058, 0x00000058, },
+        { 0x1c5a80, 0x000001d9, 0x000001d9, 0x00000098, 0x00000098, },
+        { 0x1c5a84, 0x00000019, 0x00000019, 0x00000159, 0x00000159, },
+        { 0x1c5a88, 0x00000059, 0x00000059, 0x00000199, 0x00000199, },
+        { 0x1c5a8c, 0x00000099, 0x00000099, 0x000001d9, 0x000001d9, },
+        { 0x1c5a90, 0x000000d9, 0x000000d9, 0x00000019, 0x00000019, },
+        { 0x1c5a94, 0x000000f9, 0x000000f9, 0x00000059, 0x00000059, },
+        { 0x1c5a98, 0x000000f9, 0x000000f9, 0x00000099, 0x00000099, },
+        { 0x1c5a9c, 0x000000f9, 0x000000f9, 0x000000d9, 0x000000d9, },
+        { 0x1c5aa0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aa8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aac, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ab8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5abc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ac8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5acc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ad8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5adc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5ae8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5aec, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af0, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af4, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5af8, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5afc, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, },
+        { 0x1c5b00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5b04, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c5b08, 0x00000002, 0x00000002, 0x00000002, 0x00000002, },
+        { 0x1c5b0c, 0x00000003, 0x00000003, 0x00000003, 0x00000003, },
+        { 0x1c5b10, 0x00000004, 0x00000004, 0x00000004, 0x00000004, },
+        { 0x1c5b14, 0x00000005, 0x00000005, 0x00000005, 0x00000005, },
+        { 0x1c5b18, 0x00000008, 0x00000008, 0x00000008, 0x00000008, },
+        { 0x1c5b1c, 0x00000009, 0x00000009, 0x00000009, 0x00000009, },
+        { 0x1c5b20, 0x0000000a, 0x0000000a, 0x0000000a, 0x0000000a, },
+        { 0x1c5b24, 0x0000000b, 0x0000000b, 0x0000000b, 0x0000000b, },
+        { 0x1c5b28, 0x0000000c, 0x0000000c, 0x0000000c, 0x0000000c, },
+        { 0x1c5b2c, 0x0000000d, 0x0000000d, 0x0000000d, 0x0000000d, },
+        { 0x1c5b30, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5b34, 0x00000011, 0x00000011, 0x00000011, 0x00000011, },
+        { 0x1c5b38, 0x00000012, 0x00000012, 0x00000012, 0x00000012, },
+        { 0x1c5b3c, 0x00000013, 0x00000013, 0x00000013, 0x00000013, },
+        { 0x1c5b40, 0x00000014, 0x00000014, 0x00000014, 0x00000014, },
+        { 0x1c5b44, 0x00000015, 0x00000015, 0x00000015, 0x00000015, },
+        { 0x1c5b48, 0x00000018, 0x00000018, 0x00000018, 0x00000018, },
+        { 0x1c5b4c, 0x00000019, 0x00000019, 0x00000019, 0x00000019, },
+        { 0x1c5b50, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5b54, 0x0000001b, 0x0000001b, 0x0000001b, 0x0000001b, },
+        { 0x1c5b58, 0x0000001c, 0x0000001c, 0x0000001c, 0x0000001c, },
+        { 0x1c5b5c, 0x0000001d, 0x0000001d, 0x0000001d, 0x0000001d, },
+        { 0x1c5b60, 0x00000020, 0x00000020, 0x00000020, 0x00000020, },
+        { 0x1c5b64, 0x00000021, 0x00000021, 0x00000021, 0x00000021, },
+        { 0x1c5b68, 0x00000022, 0x00000022, 0x00000022, 0x00000022, },
+        { 0x1c5b6c, 0x00000023, 0x00000023, 0x00000023, 0x00000023, },
+        { 0x1c5b70, 0x00000024, 0x00000024, 0x00000024, 0x00000024, },
+        { 0x1c5b74, 0x00000025, 0x00000025, 0x00000025, 0x00000025, },
+        { 0x1c5b78, 0x00000028, 0x00000028, 0x00000028, 0x00000028, },
+        { 0x1c5b7c, 0x00000029, 0x00000029, 0x00000029, 0x00000029, },
+        { 0x1c5b80, 0x0000002a, 0x0000002a, 0x0000002a, 0x0000002a, },
+        { 0x1c5b84, 0x0000002b, 0x0000002b, 0x0000002b, 0x0000002b, },
+        { 0x1c5b88, 0x0000002c, 0x0000002c, 0x0000002c, 0x0000002c, },
+        { 0x1c5b8c, 0x0000002d, 0x0000002d, 0x0000002d, 0x0000002d, },
+        { 0x1c5b90, 0x00000030, 0x00000030, 0x00000030, 0x00000030, },
+        { 0x1c5b94, 0x00000031, 0x00000031, 0x00000031, 0x00000031, },
+        { 0x1c5b98, 0x00000032, 0x00000032, 0x00000032, 0x00000032, },
+        { 0x1c5b9c, 0x00000033, 0x00000033, 0x00000033, 0x00000033, },
+        { 0x1c5ba0, 0x00000034, 0x00000034, 0x00000034, 0x00000034, },
+        { 0x1c5ba4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5ba8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bac, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bb8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bbc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bc8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bcc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bd8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bdc, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5be8, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bec, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf0, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf4, 0x00000035, 0x00000035, 0x00000035, 0x00000035, },
+        { 0x1c5bf8, 0x00000010, 0x00000010, 0x00000010, 0x00000010, },
+        { 0x1c5bfc, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a, },
+        { 0x1c5c00, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c0c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c10, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c14, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c18, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c1c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c20, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c24, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c28, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c2c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c30, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c34, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c38, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5c3c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cf8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c5cfc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6200, 0x00000008, 0x00000008, 0x0000000e, 0x0000000e, },
+        { 0x1c6204, 0x00000440, 0x00000440, 0x00000440, 0x00000440, },
+        { 0x1c6208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, },
+        { 0x1c620c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c6210, 0x40806333, 0x40806333, 0x40806333, 0x40806333, },
+        { 0x1c6214, 0x00106c10, 0x00106c10, 0x00106c10, 0x00106c10, },
+        { 0x1c6218, 0x009c4060, 0x009c4060, 0x009c4060, 0x009c4060, },
+        { 0x1c621c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, },
+        { 0x1c6220, 0x018830c6, 0x018830c6, 0x018830c6, 0x018830c6, },
+        { 0x1c6224, 0x00000400, 0x00000400, 0x00000400, 0x00000400, },
+        { 0x1c6228, 0x000009b5, 0x000009b5, 0x000009b5, 0x000009b5, },
+        { 0x1c622c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6230, 0x00000108, 0x00000210, 0x00000210, 0x00000108, },
+        { 0x1c6234, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6238, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c623c, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, },
+        { 0x1c6240, 0x38490a20, 0x38490a20, 0x38490a20, 0x38490a20, },
+        { 0x1c6244, 0x00007bb6, 0x00007bb6, 0x00007bb6, 0x00007bb6, },
+        { 0x1c6248, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, 0x0fff3ffc, },
+        { 0x1c624c, 0x00000001, 0x00000001, 0x00000001, 0x00000001, },
+        { 0x1c6250, 0x0000a000, 0x0000a000, 0x0000a000, 0x0000a000, },
+        { 0x1c6254, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6258, 0x0cc75380, 0x0cc75380, 0x0cc75380, 0x0cc75380, },
+        { 0x1c625c, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01, },
+        { 0x1c6260, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, 0xdfa91f01, },
+        { 0x1c6264, 0x00418a11, 0x00418a11, 0x00418a11, 0x00418a11, },
+        { 0x1c6268, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c626c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c6274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, },
+        { 0x1c6278, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c627c, 0x051701ce, 0x051701ce, 0x051701ce, 0x051701ce, },
+        { 0x1c6300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, },
+        { 0x1c6304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, },
+        { 0x1c6308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, },
+        { 0x1c630c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, },
+        { 0x1c6310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, },
+        { 0x1c6314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, },
+        { 0x1c6318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, },
+        { 0x1c631c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, },
+        { 0x1c6320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, },
+        { 0x1c6324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, },
+        { 0x1c6328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, },
+        { 0x1c632c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6338, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c633c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6340, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6344, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c6348, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c634c, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6350, 0x3fffffff, 0x3fffffff, 0x3fffffff, 0x3fffffff, },
+        { 0x1c6354, 0x0003ffff, 0x0003ffff, 0x0003ffff, 0x0003ffff, },
+        { 0x1c6358, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f, },
+        { 0x1c6388, 0x08000000, 0x08000000, 0x08000000, 0x08000000, },
+        { 0x1c638c, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6390, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c6394, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c6398, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce, },
+        { 0x1c639c, 0x00000007, 0x00000007, 0x00000007, 0x00000007, },
+        { 0x1c63a0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63a8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63ac, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63b8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63bc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63cc, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d0, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d4, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f, },
+        { 0x1c63d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, },
+        { 0x1c63dc, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, },
+        { 0x1c63e0, 0x000000c0, 0x000000c0, 0x000000c0, 0x000000c0, },
+        { 0x1c6848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c6920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c6960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c720c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c726c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+        { 0x1c7848, 0x00180a65, 0x00180a65, 0x00180a68, 0x00180a68, },
+        { 0x1c7920, 0x0510001c, 0x0510001c, 0x0510001c, 0x0510001c, },
+        { 0x1c7960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, },
+        { 0x1c820c, 0x012e8160, 0x012e8160, 0x012a8160, 0x012a8160, },
+        { 0x1c826c, 0x09249126, 0x09249126, 0x09249126, 0x09249126, },
+/*      { 0x1c8864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, }, */
+        { 0x1c8864, 0x0001c600, 0x0001c600, 0x0001c600, 0x0001c600, },
+        { 0x1c895c, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, 0x004b6a8e, },
+        { 0x1c8968, 0x000003ce, 0x000003ce, 0x000003ce, 0x000003ce, },
+        { 0x1c89bc, 0x00181400, 0x00181400, 0x00181400, 0x00181400, },
+        { 0x1c9270, 0x00820820, 0x00820820, 0x00820820, 0x00820820, },
+        { 0x1c935c, 0x066c420f, 0x066c420f, 0x066c420f, 0x066c420f, },
+        { 0x1c9360, 0x0f282207, 0x0f282207, 0x0f282207, 0x0f282207, },
+        { 0x1c9364, 0x17601685, 0x17601685, 0x17601685, 0x17601685, },
+        { 0x1c9368, 0x1f801104, 0x1f801104, 0x1f801104, 0x1f801104, },
+        { 0x1c936c, 0x37a00c03, 0x37a00c03, 0x37a00c03, 0x37a00c03, },
+        { 0x1c9370, 0x3fc40883, 0x3fc40883, 0x3fc40883, 0x3fc40883, },
+        { 0x1c9374, 0x57c00803, 0x57c00803, 0x57c00803, 0x57c00803, },
+        { 0x1c9378, 0x5fd80682, 0x5fd80682, 0x5fd80682, 0x5fd80682, },
+        { 0x1c937c, 0x7fe00482, 0x7fe00482, 0x7fe00482, 0x7fe00482, },
+        { 0x1c9380, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba, },
+        { 0x1c9384, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, }
+};
+
+/*
+ * look up a certain register in ar5416_phy_init[] and return the init. value
+ * for the band and bandwidth given. Return 0 if register address not found.
+ */
+static u32 carl9170_def_val(u32 reg, bool is_2ghz, bool is_40mhz)
+{
+        unsigned int i;
+        for (i = 0; i < ARRAY_SIZE(ar5416_phy_init); i++) {
+                if (ar5416_phy_init[i].reg != reg)
+                        continue;
+
+                if (is_2ghz) {
+                        if (is_40mhz)
+                                return ar5416_phy_init[i]._2ghz_40;
+                        else
+                                return ar5416_phy_init[i]._2ghz_20;
+                } else {
+                        if (is_40mhz)
+                                return ar5416_phy_init[i]._5ghz_40;
+                        else
+                                return ar5416_phy_init[i]._5ghz_20;
+                }
+        }
+        return 0;
+}
+
+/*
+ * initialize some phy regs from eeprom values in modal_header[]
+ * acc. to band and bandwith
+ */
+static int carl9170_init_phy_from_eeprom(struct ar9170 *ar,
+                                bool is_2ghz, bool is_40mhz)
+{
+        static const u8 xpd2pd[16] = {
+                0x2, 0x2, 0x2, 0x1, 0x2, 0x2, 0x6, 0x2,
+                0x2, 0x3, 0x7, 0x2, 0xb, 0x2, 0x2, 0x2
+        };
+        /* pointer to the modal_header acc. to band */
+        struct ar9170_eeprom_modal *m = &ar->eeprom.modal_header[is_2ghz];
+        u32 val;
+
+        carl9170_regwrite_begin(ar);
+
+        /* ant common control (index 0) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_COM,
+                le32_to_cpu(m->antCtrlCommon));
+
+        /* ant control chain 0 (index 1) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_CHAIN_0,
+                le32_to_cpu(m->antCtrlChain[0]));
+
+        /* ant control chain 2 (index 2) */
+        carl9170_regwrite(AR9170_PHY_REG_SWITCH_CHAIN_2,
+                le32_to_cpu(m->antCtrlChain[1]));
+
+        /* SwSettle (index 3) */
+        if (!is_40mhz) {
+                val = carl9170_def_val(AR9170_PHY_REG_SETTLING,
+                                     is_2ghz, is_40mhz);
+                SET_VAL(AR9170_PHY_SETTLING_SWITCH, val, m->switchSettling);
+                carl9170_regwrite(AR9170_PHY_REG_SETTLING, val);
+        }
+
+        /* adcDesired, pdaDesired (index 4) */
+        val = carl9170_def_val(AR9170_PHY_REG_DESIRED_SZ, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_DESIRED_SZ_PGA, val, m->pgaDesiredSize);
+        SET_VAL(AR9170_PHY_DESIRED_SZ_ADC, val, m->adcDesiredSize);
+        carl9170_regwrite(AR9170_PHY_REG_DESIRED_SZ, val);
+
+        /* TxEndToXpaOff, TxFrameToXpaOn (index 5) */
+        val = carl9170_def_val(AR9170_PHY_REG_RF_CTL4, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF, val, m->txEndToXpaOff);
+        SET_VAL(AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF, val, m->txEndToXpaOff);
+        SET_VAL(AR9170_PHY_RF_CTL4_FRAME_XPAB_ON, val, m->txFrameToXpaOn);
+        SET_VAL(AR9170_PHY_RF_CTL4_FRAME_XPAA_ON, val, m->txFrameToXpaOn);
+        carl9170_regwrite(AR9170_PHY_REG_RF_CTL4, val);
+
+        /* TxEndToRxOn (index 6) */
+        val = carl9170_def_val(AR9170_PHY_REG_RF_CTL3, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON, val, m->txEndToRxOn);
+        carl9170_regwrite(AR9170_PHY_REG_RF_CTL3, val);
+
+        /* thresh62 (index 7) */
+        val = carl9170_def_val(0x1c8864, is_2ghz, is_40mhz);
+        val = (val & ~0x7f000) | (m->thresh62 << 12);
+        carl9170_regwrite(0x1c8864, val);
+
+        /* tx/rx attenuation chain 0 (index 8) */
+        val = carl9170_def_val(AR9170_PHY_REG_RXGAIN, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RXGAIN_TXRX_ATTEN, val, m->txRxAttenCh[0]);
+        carl9170_regwrite(AR9170_PHY_REG_RXGAIN, val);
+
+        /* tx/rx attenuation chain 2 (index 9) */
+        val = carl9170_def_val(AR9170_PHY_REG_RXGAIN_CHAIN_2,
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_RXGAIN_TXRX_ATTEN, val, m->txRxAttenCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_RXGAIN_CHAIN_2, val);
+
+        /* tx/rx margin chain 0 (index 10) */
+        val = carl9170_def_val(AR9170_PHY_REG_GAIN_2GHZ, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN, val, m->rxTxMarginCh[0]);
+        /* bsw margin chain 0 for 5GHz only */
+        if (!is_2ghz)
+                SET_VAL(AR9170_PHY_GAIN_2GHZ_BSW_MARGIN, val, m->bswMargin[0]);
+        carl9170_regwrite(AR9170_PHY_REG_GAIN_2GHZ, val);
+
+        /* tx/rx margin chain 2 (index 11) */
+        val = carl9170_def_val(AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2,
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN, val, m->rxTxMarginCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2, val);
+
+        /* iqCall, iqCallq chain 0 (index 12) */
+        val = carl9170_def_val(AR9170_PHY_REG_TIMING_CTRL4(0),
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF, val, m->iqCalICh[0]);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF, val, m->iqCalQCh[0]);
+        carl9170_regwrite(AR9170_PHY_REG_TIMING_CTRL4(0), val);
+
+        /* iqCall, iqCallq chain 2 (index 13) */
+        val = carl9170_def_val(AR9170_PHY_REG_TIMING_CTRL4(2),
+                               is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF, val, m->iqCalICh[1]);
+        SET_VAL(AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF, val, m->iqCalQCh[1]);
+        carl9170_regwrite(AR9170_PHY_REG_TIMING_CTRL4(2), val);
+
+        /* xpd gain mask (index 14) */
+        val = carl9170_def_val(AR9170_PHY_REG_TPCRG1, is_2ghz, is_40mhz);
+        SET_VAL(AR9170_PHY_TPCRG1_PD_GAIN_1, val,
+                xpd2pd[m->xpdGain & 0xf] & 3);
+        SET_VAL(AR9170_PHY_TPCRG1_PD_GAIN_2, val,
+                xpd2pd[m->xpdGain & 0xf] >> 2);
+        carl9170_regwrite(AR9170_PHY_REG_TPCRG1, val);
+
+        carl9170_regwrite(AR9170_PHY_REG_RX_CHAINMASK, ar->eeprom.rx_mask);
+        carl9170_regwrite(AR9170_PHY_REG_CAL_CHAINMASK, ar->eeprom.rx_mask);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+static int carl9170_init_phy(struct ar9170 *ar, enum ieee80211_band band)
+{
+        int i, err;
+        u32 val;
+        bool is_2ghz = band == IEEE80211_BAND_2GHZ;
+        bool is_40mhz = conf_is_ht40(&ar->hw->conf);
+
+        carl9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(ar5416_phy_init); i++) {
+                if (is_40mhz) {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_40;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_40;
+                } else {
+                        if (is_2ghz)
+                                val = ar5416_phy_init[i]._2ghz_20;
+                        else
+                                val = ar5416_phy_init[i]._5ghz_20;
+                }
+
+                carl9170_regwrite(ar5416_phy_init[i].reg, val);
+        }
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        err = carl9170_init_phy_from_eeprom(ar, is_2ghz, is_40mhz);
+        if (err)
+                return err;
+
+        err = carl9170_init_power_cal(ar);
+        if (err)
+                return err;
+
+        /* XXX: remove magic! */
+        if (is_2ghz)
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_PLL_ADDAC, 0x5163);
+        else
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_PLL_ADDAC, 0x5143);
+
+        return err;
+}
+
+struct carl9170_rf_initvals {
+        u32 reg, _5ghz, _2ghz;
+};
+
+static struct carl9170_rf_initvals carl9170_rf_initval[] = {
+        /* bank 0 */
+        { 0x1c58b0, 0x1e5795e5, 0x1e5795e5},
+        { 0x1c58e0, 0x02008020, 0x02008020},
+        /* bank 1 */
+        { 0x1c58b0, 0x02108421, 0x02108421},
+        { 0x1c58ec, 0x00000008, 0x00000008},
+        /* bank 2 */
+        { 0x1c58b0, 0x0e73ff17, 0x0e73ff17},
+        { 0x1c58e0, 0x00000420, 0x00000420},
+        /* bank 3 */
+        { 0x1c58f0, 0x01400018, 0x01c00018},
+        /* bank 4 */
+        { 0x1c58b0, 0x000001a1, 0x000001a1},
+        { 0x1c58e8, 0x00000001, 0x00000001},
+        /* bank 5 */
+        { 0x1c58b0, 0x00000013, 0x00000013},
+        { 0x1c58e4, 0x00000002, 0x00000002},
+        /* bank 6 */
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00002c00, 0x00002c00},
+        { 0x1c58b0, 0x00004800, 0x00004800},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00006000, 0x00006000},
+        { 0x1c58b0, 0x00001000, 0x00001000},
+        { 0x1c58b0, 0x00004000, 0x00004000},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00087c00, 0x00087c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00005400, 0x00005400},
+        { 0x1c58b0, 0x00000c00, 0x00000c00},
+        { 0x1c58b0, 0x00001800, 0x00001800},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00006c00, 0x00006c00},
+        { 0x1c58b0, 0x00007c00, 0x00007c00},
+        { 0x1c58b0, 0x00002c00, 0x00002c00},
+        { 0x1c58b0, 0x00003c00, 0x00003c00},
+        { 0x1c58b0, 0x00003800, 0x00003800},
+        { 0x1c58b0, 0x00001c00, 0x00001c00},
+        { 0x1c58b0, 0x00000800, 0x00000800},
+        { 0x1c58b0, 0x00000408, 0x00000408},
+        { 0x1c58b0, 0x00004c15, 0x00004c15},
+        { 0x1c58b0, 0x00004188, 0x00004188},
+        { 0x1c58b0, 0x0000201e, 0x0000201e},
+        { 0x1c58b0, 0x00010408, 0x00010408},
+        { 0x1c58b0, 0x00000801, 0x00000801},
+        { 0x1c58b0, 0x00000c08, 0x00000c08},
+        { 0x1c58b0, 0x0000181e, 0x0000181e},
+        { 0x1c58b0, 0x00001016, 0x00001016},
+        { 0x1c58b0, 0x00002800, 0x00002800},
+        { 0x1c58b0, 0x00004010, 0x00004010},
+        { 0x1c58b0, 0x0000081c, 0x0000081c},
+        { 0x1c58b0, 0x00000115, 0x00000115},
+        { 0x1c58b0, 0x00000015, 0x00000015},
+        { 0x1c58b0, 0x00000066, 0x00000066},
+        { 0x1c58b0, 0x0000001c, 0x0000001c},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000004, 0x00000004},
+        { 0x1c58b0, 0x00000015, 0x00000015},
+        { 0x1c58b0, 0x0000001f, 0x0000001f},
+        { 0x1c58e0, 0x00000000, 0x00000400},
+        /* bank 7 */
+        { 0x1c58b0, 0x000000a0, 0x000000a0},
+        { 0x1c58b0, 0x00000000, 0x00000000},
+        { 0x1c58b0, 0x00000040, 0x00000040},
+        { 0x1c58f0, 0x0000001c, 0x0000001c},
+};
+
+static int carl9170_init_rf_banks_0_7(struct ar9170 *ar, bool band5ghz)
+{
+        int err, i;
+
+        carl9170_regwrite_begin(ar);
+
+        for (i = 0; i < ARRAY_SIZE(carl9170_rf_initval); i++)
+                carl9170_regwrite(carl9170_rf_initval[i].reg,
+                                  band5ghz ? carl9170_rf_initval[i]._5ghz
+                                           : carl9170_rf_initval[i]._2ghz);
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                wiphy_err(ar->hw->wiphy, "rf init failed\n");
+
+        return err;
+}
+
+struct carl9170_phy_freq_params {
+        u8 coeff_exp;
+        u16 coeff_man;
+        u8 coeff_exp_shgi;
+        u16 coeff_man_shgi;
+};
+
+enum carl9170_bw {
+        CARL9170_BW_20,
+        CARL9170_BW_40_BELOW,
+        CARL9170_BW_40_ABOVE,
+
+        __CARL9170_NUM_BW,
+};
+
+struct carl9170_phy_freq_entry {
+        u16 freq;
+        struct carl9170_phy_freq_params params[__CARL9170_NUM_BW];
+};
+
+/* NB: must be in sync with channel tables in main! */
+static const struct carl9170_phy_freq_entry carl9170_phy_freq_params[] = {
+/*
+ *      freq,
+ *              20MHz,
+ *              40MHz (below),
+ *              40Mhz (above),
+ */
+        { 2412, {
+                { 3, 21737, 3, 19563, },
+                { 3, 21827, 3, 19644, },
+                { 3, 21647, 3, 19482, },
+        } },
+        { 2417, {
+                { 3, 21692, 3, 19523, },
+                { 3, 21782, 3, 19604, },
+                { 3, 21602, 3, 19442, },
+        } },
+        { 2422, {
+                { 3, 21647, 3, 19482, },
+                { 3, 21737, 3, 19563, },
+                { 3, 21558, 3, 19402, },
+        } },
+        { 2427, {
+                { 3, 21602, 3, 19442, },
+                { 3, 21692, 3, 19523, },
+                { 3, 21514, 3, 19362, },
+        } },
+        { 2432, {
+                { 3, 21558, 3, 19402, },
+                { 3, 21647, 3, 19482, },
+                { 3, 21470, 3, 19323, },
+        } },
+        { 2437, {
+                { 3, 21514, 3, 19362, },
+                { 3, 21602, 3, 19442, },
+                { 3, 21426, 3, 19283, },
+        } },
+        { 2442, {
+                { 3, 21470, 3, 19323, },
+                { 3, 21558, 3, 19402, },
+                { 3, 21382, 3, 19244, },
+        } },
+        { 2447, {
+                { 3, 21426, 3, 19283, },
+                { 3, 21514, 3, 19362, },
+                { 3, 21339, 3, 19205, },
+        } },
+        { 2452, {
+                { 3, 21382, 3, 19244, },
+                { 3, 21470, 3, 19323, },
+                { 3, 21295, 3, 19166, },
+        } },
+        { 2457, {
+                { 3, 21339, 3, 19205, },
+                { 3, 21426, 3, 19283, },
+                { 3, 21252, 3, 19127, },
+        } },
+        { 2462, {
+                { 3, 21295, 3, 19166, },
+                { 3, 21382, 3, 19244, },
+                { 3, 21209, 3, 19088, },
+        } },
+        { 2467, {
+                { 3, 21252, 3, 19127, },
+                { 3, 21339, 3, 19205, },
+                { 3, 21166, 3, 19050, },
+        } },
+        { 2472, {
+                { 3, 21209, 3, 19088, },
+                { 3, 21295, 3, 19166, },
+                { 3, 21124, 3, 19011, },
+        } },
+        { 2484, {
+                { 3, 21107, 3, 18996, },
+                { 3, 21192, 3, 19073, },
+                { 3, 21022, 3, 18920, },
+        } },
+        { 4920, {
+                { 4, 21313, 4, 19181, },
+                { 4, 21356, 4, 19220, },
+                { 4, 21269, 4, 19142, },
+        } },
+        { 4940, {
+                { 4, 21226, 4, 19104, },
+                { 4, 21269, 4, 19142, },
+                { 4, 21183, 4, 19065, },
+        } },
+        { 4960, {
+                { 4, 21141, 4, 19027, },
+                { 4, 21183, 4, 19065, },
+                { 4, 21098, 4, 18988, },
+        } },
+        { 4980, {
+                { 4, 21056, 4, 18950, },
+                { 4, 21098, 4, 18988, },
+                { 4, 21014, 4, 18912, },
+        } },
+        { 5040, {
+                { 4, 20805, 4, 18725, },
+                { 4, 20846, 4, 18762, },
+                { 4, 20764, 4, 18687, },
+        } },
+        { 5060, {
+                { 4, 20723, 4, 18651, },
+                { 4, 20764, 4, 18687, },
+                { 4, 20682, 4, 18614, },
+        } },
+        { 5080, {
+                { 4, 20641, 4, 18577, },
+                { 4, 20682, 4, 18614, },
+                { 4, 20601, 4, 18541, },
+        } },
+        { 5180, {
+                { 4, 20243, 4, 18219, },
+                { 4, 20282, 4, 18254, },
+                { 4, 20204, 4, 18183, },
+        } },
+        { 5200, {
+                { 4, 20165, 4, 18148, },
+                { 4, 20204, 4, 18183, },
+                { 4, 20126, 4, 18114, },
+        } },
+        { 5220, {
+                { 4, 20088, 4, 18079, },
+                { 4, 20126, 4, 18114, },
+                { 4, 20049, 4, 18044, },
+        } },
+        { 5240, {
+                { 4, 20011, 4, 18010, },
+                { 4, 20049, 4, 18044, },
+                { 4, 19973, 4, 17976, },
+        } },
+        { 5260, {
+                { 4, 19935, 4, 17941, },
+                { 4, 19973, 4, 17976, },
+                { 4, 19897, 4, 17907, },
+        } },
+        { 5280, {
+                { 4, 19859, 4, 17873, },
+                { 4, 19897, 4, 17907, },
+                { 4, 19822, 4, 17840, },
+        } },
+        { 5300, {
+                { 4, 19784, 4, 17806, },
+                { 4, 19822, 4, 17840, },
+                { 4, 19747, 4, 17772, },
+        } },
+        { 5320, {
+                { 4, 19710, 4, 17739, },
+                { 4, 19747, 4, 17772, },
+                { 4, 19673, 4, 17706, },
+        } },
+        { 5500, {
+                { 4, 19065, 4, 17159, },
+                { 4, 19100, 4, 17190, },
+                { 4, 19030, 4, 17127, },
+        } },
+        { 5520, {
+                { 4, 18996, 4, 17096, },
+                { 4, 19030, 4, 17127, },
+                { 4, 18962, 4, 17065, },
+        } },
+        { 5540, {
+                { 4, 18927, 4, 17035, },
+                { 4, 18962, 4, 17065, },
+                { 4, 18893, 4, 17004, },
+        } },
+        { 5560, {
+                { 4, 18859, 4, 16973, },
+                { 4, 18893, 4, 17004, },
+                { 4, 18825, 4, 16943, },
+        } },
+        { 5580, {
+                { 4, 18792, 4, 16913, },
+                { 4, 18825, 4, 16943, },
+                { 4, 18758, 4, 16882, },
+        } },
+        { 5600, {
+                { 4, 18725, 4, 16852, },
+                { 4, 18758, 4, 16882, },
+                { 4, 18691, 4, 16822, },
+        } },
+        { 5620, {
+                { 4, 18658, 4, 16792, },
+                { 4, 18691, 4, 16822, },
+                { 4, 18625, 4, 16762, },
+        } },
+        { 5640, {
+                { 4, 18592, 4, 16733, },
+                { 4, 18625, 4, 16762, },
+                { 4, 18559, 4, 16703, },
+        } },
+        { 5660, {
+                { 4, 18526, 4, 16673, },
+                { 4, 18559, 4, 16703, },
+                { 4, 18493, 4, 16644, },
+        } },
+        { 5680, {
+                { 4, 18461, 4, 16615, },
+                { 4, 18493, 4, 16644, },
+                { 4, 18428, 4, 16586, },
+        } },
+        { 5700, {
+                { 4, 18396, 4, 16556, },
+                { 4, 18428, 4, 16586, },
+                { 4, 18364, 4, 16527, },
+        } },
+        { 5745, {
+                { 4, 18252, 4, 16427, },
+                { 4, 18284, 4, 16455, },
+                { 4, 18220, 4, 16398, },
+        } },
+        { 5765, {
+                { 4, 18189, 5, 32740, },
+                { 4, 18220, 4, 16398, },
+                { 4, 18157, 5, 32683, },
+        } },
+        { 5785, {
+                { 4, 18126, 5, 32626, },
+                { 4, 18157, 5, 32683, },
+                { 4, 18094, 5, 32570, },
+        } },
+        { 5805, {
+                { 4, 18063, 5, 32514, },
+                { 4, 18094, 5, 32570, },
+                { 4, 18032, 5, 32458, },
+        } },
+        { 5825, {
+                { 4, 18001, 5, 32402, },
+                { 4, 18032, 5, 32458, },
+                { 4, 17970, 5, 32347, },
+        } },
+        { 5170, {
+                { 4, 20282, 4, 18254, },
+                { 4, 20321, 4, 18289, },
+                { 4, 20243, 4, 18219, },
+        } },
+        { 5190, {
+                { 4, 20204, 4, 18183, },
+                { 4, 20243, 4, 18219, },
+                { 4, 20165, 4, 18148, },
+        } },
+        { 5210, {
+                { 4, 20126, 4, 18114, },
+                { 4, 20165, 4, 18148, },
+                { 4, 20088, 4, 18079, },
+        } },
+        { 5230, {
+                { 4, 20049, 4, 18044, },
+                { 4, 20088, 4, 18079, },
+                { 4, 20011, 4, 18010, },
+        } },
+};
+
+static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
+                                      u32 freq, enum carl9170_bw bw)
+{
+        int err;
+        u32 d0, d1, td0, td1, fd0, fd1;
+        u8 chansel;
+        u8 refsel0 = 1, refsel1 = 0;
+        u8 lf_synth = 0;
+
+        switch (bw) {
+        case CARL9170_BW_40_ABOVE:
+                freq += 10;
+                break;
+        case CARL9170_BW_40_BELOW:
+                freq -= 10;
+                break;
+        case CARL9170_BW_20:
+                break;
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        if (band5ghz) {
+                if (freq % 10) {
+                        chansel = (freq - 4800) / 5;
+                } else {
+                        chansel = ((freq - 4800) / 10) * 2;
+                        refsel0 = 0;
+                        refsel1 = 1;
+                }
+                chansel = byte_rev_table[chansel];
+        } else {
+                if (freq == 2484) {
+                        chansel = 10 + (freq - 2274) / 5;
+                        lf_synth = 1;
+                } else
+                        chansel = 16 + (freq - 2272) / 5;
+                chansel *= 4;
+                chansel = byte_rev_table[chansel];
+        }
+
+        d1 =    chansel;
+        d0 =    0x21 |
+                refsel0 << 3 |
+                refsel1 << 2 |
+                lf_synth << 1;
+        td0 =   d0 & 0x1f;
+        td1 =   d1 & 0x1f;
+        fd0 =   td1 << 5 | td0;
+
+        td0 =   (d0 >> 5) & 0x7;
+        td1 =   (d1 >> 5) & 0x7;
+        fd1 =   td1 << 5 | td0;
+
+        carl9170_regwrite_begin(ar);
+
+        carl9170_regwrite(0x1c58b0, fd0);
+        carl9170_regwrite(0x1c58e8, fd1);
+
+        carl9170_regwrite_finish();
+        err = carl9170_regwrite_result();
+        if (err)
+                return err;
+
+        msleep(20);
+
+        return 0;
+}
+
+static const struct carl9170_phy_freq_params *
+carl9170_get_hw_dyn_params(struct ieee80211_channel *channel,
+                           enum carl9170_bw bw)
+{
+        unsigned int chanidx = 0;
+        u16 freq = 2412;
+
+        if (channel) {
+                chanidx = channel->hw_value;
+                freq = channel->center_freq;
+        }
+
+        BUG_ON(chanidx >= ARRAY_SIZE(carl9170_phy_freq_params));
+
+        BUILD_BUG_ON(__CARL9170_NUM_BW != 3);
+
+        WARN_ON(carl9170_phy_freq_params[chanidx].freq != freq);
+
+        return &carl9170_phy_freq_params[chanidx].params[bw];
+}
+
+static int carl9170_find_freq_idx(int nfreqs, u8 *freqs, u8 f)
+{
+        int idx = nfreqs - 2;
+
+        while (idx >= 0) {
+                if (f >= freqs[idx])
+                        return idx;
+                idx--;
+        }
+
+        return 0;
+}
+
+static s32 carl9170_interpolate_s32(s32 x, s32 x1, s32 y1, s32 x2, s32 y2)
+{
+        /* nothing to interpolate, it's horizontal */
+        if (y2 == y1)
+                return y1;
+
+        /* check if we hit one of the edges */
+        if (x == x1)
+                return y1;
+        if (x == x2)
+                return y2;
+
+        /* x1 == x2 is bad, hopefully == x */
+        if (x2 == x1)
+                return y1;
+
+        return y1 + (((y2 - y1) * (x - x1)) / (x2 - x1));
+}
+
+static u8 carl9170_interpolate_u8(u8 x, u8 x1, u8 y1, u8 x2, u8 y2)
+{
+#define SHIFT           8
+        s32 y;
+
+        y = carl9170_interpolate_s32(x << SHIFT, x1 << SHIFT,
+                y1 << SHIFT, x2 << SHIFT, y2 << SHIFT);
+
+        /*
+         * XXX: unwrap this expression
+         *      Isn't it just DIV_ROUND_UP(y, 1<<SHIFT)?
+         *      Can we rely on the compiler to optimise away the div?
+         */
+        return (y >> SHIFT) + ((y & (1<<(SHIFT-1))) >> (SHIFT - 1));
+#undef SHIFT
+}
+
+static u8 carl9170_interpolate_val(u8 x, u8 *x_array, u8 *y_array)
+{
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                if (x <= x_array[i + 1])
+                        break;
+        }
+
+        return carl9170_interpolate_u8(x, x_array[i], y_array[i],
+                x_array[i + 1], y_array[i + 1]);
+}
+
+static int carl9170_set_freq_cal_data(struct ar9170 *ar,
+        struct ieee80211_channel *channel)
+{
+        u8 *cal_freq_pier;
+        u8 vpds[2][AR5416_PD_GAIN_ICEPTS];
+        u8 pwrs[2][AR5416_PD_GAIN_ICEPTS];
+        int chain, idx, i;
+        u32 phy_data = 0;
+        u8 f, tmp;
+
+        switch (channel->band) {
+        case IEEE80211_BAND_2GHZ:
+                f = channel->center_freq - 2300;
+                cal_freq_pier = ar->eeprom.cal_freq_pier_2G;
+                i = AR5416_NUM_2G_CAL_PIERS - 1;
+                break;
+
+        case IEEE80211_BAND_5GHZ:
+                f = (channel->center_freq - 4800) / 5;
+                cal_freq_pier = ar->eeprom.cal_freq_pier_5G;
+                i = AR5416_NUM_5G_CAL_PIERS - 1;
+                break;
+
+        default:
+                return -EINVAL;
+                break;
+        }
+
+        for (; i >= 0; i--) {
+                if (cal_freq_pier[i] != 0xff)
+                        break;
+        }
+        if (i < 0)
+                return -EINVAL;
+
+        idx = carl9170_find_freq_idx(i, cal_freq_pier, f);
+
+        carl9170_regwrite_begin(ar);
+
+        for (chain = 0; chain < AR5416_MAX_CHAINS; chain++) {
+                for (i = 0; i < AR5416_PD_GAIN_ICEPTS; i++) {
+                        struct ar9170_calibration_data_per_freq *cal_pier_data;
+                        int j;
+
+                        switch (channel->band) {
+                        case IEEE80211_BAND_2GHZ:
+                                cal_pier_data = &ar->eeprom.
+                                        cal_pier_data_2G[chain][idx];
+                                break;
+
+                        case IEEE80211_BAND_5GHZ:
+                                cal_pier_data = &ar->eeprom.
+                                        cal_pier_data_5G[chain][idx];
+                                break;
+
+                        default:
+                                return -EINVAL;
+                        }
+
+                        for (j = 0; j < 2; j++) {
+                                vpds[j][i] = carl9170_interpolate_u8(f,
+                                        cal_freq_pier[idx],
+                                        cal_pier_data->vpd_pdg[j][i],
+                                        cal_freq_pier[idx + 1],
+                                        cal_pier_data[1].vpd_pdg[j][i]);
+
+                                pwrs[j][i] = carl9170_interpolate_u8(f,
+                                        cal_freq_pier[idx],
+                                        cal_pier_data->pwr_pdg[j][i],
+                                        cal_freq_pier[idx + 1],
+                                        cal_pier_data[1].pwr_pdg[j][i]) / 2;
+                        }
+                }
+
+                for (i = 0; i < 76; i++) {
+                        if (i < 25) {
+                                tmp = carl9170_interpolate_val(i, &pwrs[0][0],
+                                                               &vpds[0][0]);
+                        } else {
+                                tmp = carl9170_interpolate_val(i - 12,
+                                                               &pwrs[1][0],
+                                                               &vpds[1][0]);
+                        }
+
+                        phy_data |= tmp << ((i & 3) << 3);
+                        if ((i & 3) == 3) {
+                                carl9170_regwrite(0x1c6280 + chain * 0x1000 +
+                                                  (i & ~3), phy_data);
+                                phy_data = 0;
+                        }
+                }
+
+                for (i = 19; i < 32; i++)
+                        carl9170_regwrite(0x1c6280 + chain * 0x1000 + (i << 2),
+                                          0x0);
+        }
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+static u8 carl9170_get_max_edge_power(struct ar9170 *ar,
+        u32 freq, struct ar9170_calctl_edges edges[])
+{
+        int i;
+        u8 rc = AR5416_MAX_RATE_POWER;
+        u8 f;
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800) / 5;
+
+        for (i = 0; i < AR5416_NUM_BAND_EDGES; i++) {
+                if (edges[i].channel == 0xff)
+                        break;
+                if (f == edges[i].channel) {
+                        /* exact freq match */
+                        rc = edges[i].power_flags & ~AR9170_CALCTL_EDGE_FLAGS;
+                        break;
+                }
+                if (i > 0 && f < edges[i].channel) {
+                        if (f > edges[i - 1].channel &&
+                            edges[i - 1].power_flags &
+                            AR9170_CALCTL_EDGE_FLAGS) {
+                                /* lower channel has the inband flag set */
+                                rc = edges[i - 1].power_flags &
+                                        ~AR9170_CALCTL_EDGE_FLAGS;
+                        }
+                        break;
+                }
+        }
+
+        if (i == AR5416_NUM_BAND_EDGES) {
+                if (f > edges[i - 1].channel &&
+                    edges[i - 1].power_flags & AR9170_CALCTL_EDGE_FLAGS) {
+                        /* lower channel has the inband flag set */
+                        rc = edges[i - 1].power_flags &
+                                ~AR9170_CALCTL_EDGE_FLAGS;
+                }
+        }
+        return rc;
+}
+
+static u8 carl9170_get_heavy_clip(struct ar9170 *ar, u32 freq,
+        enum carl9170_bw bw, struct ar9170_calctl_edges edges[])
+{
+        u8 f;
+        int i;
+        u8 rc = 0;
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800) / 5;
+
+        if (bw == CARL9170_BW_40_BELOW || bw == CARL9170_BW_40_ABOVE)
+                rc |= 0xf0;
+
+        for (i = 0; i < AR5416_NUM_BAND_EDGES; i++) {
+                if (edges[i].channel == 0xff)
+                        break;
+                if (f == edges[i].channel) {
+                        if (!(edges[i].power_flags & AR9170_CALCTL_EDGE_FLAGS))
+                                rc |= 0x0f;
+                        break;
+                }
+        }
+
+        return rc;
+}
+
+/*
+ * calculate the conformance test limits and the heavy clip parameter
+ * and apply them to ar->power* (derived from otus hal/hpmain.c, line 3706)
+ */
+static void carl9170_calc_ctl(struct ar9170 *ar, u32 freq, enum carl9170_bw bw)
+{
+        u8 ctl_grp; /* CTL group */
+        u8 ctl_idx; /* CTL index */
+        int i, j;
+        struct ctl_modes {
+                u8 ctl_mode;
+                u8 max_power;
+                u8 *pwr_cal_data;
+                int pwr_cal_len;
+        } *modes;
+
+        /*
+         * order is relevant in the mode_list_*: we fall back to the
+         * lower indices if any mode is missed in the EEPROM.
+         */
+        struct ctl_modes mode_list_2ghz[] = {
+                { CTL_11B, 0, ar->power_2G_cck, 4 },
+                { CTL_11G, 0, ar->power_2G_ofdm, 4 },
+                { CTL_2GHT20, 0, ar->power_2G_ht20, 8 },
+                { CTL_2GHT40, 0, ar->power_2G_ht40, 8 },
+        };
+        struct ctl_modes mode_list_5ghz[] = {
+                { CTL_11A, 0, ar->power_5G_leg, 4 },
+                { CTL_5GHT20, 0, ar->power_5G_ht20, 8 },
+                { CTL_5GHT40, 0, ar->power_5G_ht40, 8 },
+        };
+        int nr_modes;
+
+#define EDGES(c, n) (ar->eeprom.ctl_data[c].control_edges[n])
+
+        ar->heavy_clip = 0;
+
+        /*
+         * TODO: investigate the differences between OTUS'
+         * hpreg.c::zfHpGetRegulatoryDomain() and
+         * ath/regd.c::ath_regd_get_band_ctl() -
+         * e.g. for FCC3_WORLD the OTUS procedure
+         * always returns CTL_FCC, while the one in ath/ delivers
+         * CTL_ETSI for 2GHz and CTL_FCC for 5GHz.
+         */
+        ctl_grp = ath_regd_get_band_ctl(&ar->common.regulatory,
+                                        ar->hw->conf.channel->band);
+
+        /* ctl group not found - either invalid band (NO_CTL) or ww roaming */
+        if (ctl_grp == NO_CTL || ctl_grp == SD_NO_CTL)
+                ctl_grp = CTL_FCC;
+
+        if (ctl_grp != CTL_FCC)
+                /* skip CTL and heavy clip for CTL_MKK and CTL_ETSI */
+                return;
+
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
+                modes = mode_list_2ghz;
+                nr_modes = ARRAY_SIZE(mode_list_2ghz);
+        } else {
+                modes = mode_list_5ghz;
+                nr_modes = ARRAY_SIZE(mode_list_5ghz);
+        }
+
+        for (i = 0; i < nr_modes; i++) {
+                u8 c = ctl_grp | modes[i].ctl_mode;
+                for (ctl_idx = 0; ctl_idx < AR5416_NUM_CTLS; ctl_idx++)
+                        if (c == ar->eeprom.ctl_index[ctl_idx])
+                                break;
+                if (ctl_idx < AR5416_NUM_CTLS) {
+                        int f_off = 0;
+
+                        /*
+                         * determine heavy clip parameter
+                         * from the 11G edges array
+                         */
+                        if (modes[i].ctl_mode == CTL_11G) {
+                                ar->heavy_clip =
+                                        carl9170_get_heavy_clip(ar,
+                                                freq, bw, EDGES(ctl_idx, 1));
+                        }
+
+                        /* adjust freq for 40MHz */
+                        if (modes[i].ctl_mode == CTL_2GHT40 ||
+                            modes[i].ctl_mode == CTL_5GHT40) {
+                                if (bw == CARL9170_BW_40_BELOW)
+                                        f_off = -10;
+                                else
+                                        f_off = 10;
+                        }
+
+                        modes[i].max_power =
+                                carl9170_get_max_edge_power(ar,
+                                        freq+f_off, EDGES(ctl_idx, 1));
+
+                        /*
+                         * TODO: check if the regulatory max. power is
+                         * controlled by cfg80211 for DFS.
+                         * (hpmain applies it to max_power itself for DFS freq)
+                         */
+
+                } else {
+                        /*
+                         * Workaround in otus driver, hpmain.c, line 3906:
+                         * if no data for 5GHT20 are found, take the
+                         * legacy 5G value. We extend this here to fallback
+                         * from any other HT* or 11G, too.
+                         */
+                        int k = i;
+
+                        modes[i].max_power = AR5416_MAX_RATE_POWER;
+                        while (k-- > 0) {
+                                if (modes[k].max_power !=
+                                    AR5416_MAX_RATE_POWER) {
+                                        modes[i].max_power = modes[k].max_power;
+                                        break;
+                                }
+                        }
+                }
+
+                /* apply max power to pwr_cal_data (ar->power_*) */
+                for (j = 0; j < modes[i].pwr_cal_len; j++) {
+                        modes[i].pwr_cal_data[j] = min(modes[i].pwr_cal_data[j],
+                                                       modes[i].max_power);
+                }
+        }
+
+        if (ar->heavy_clip & 0xf0) {
+                ar->power_2G_ht40[0]--;
+                ar->power_2G_ht40[1]--;
+                ar->power_2G_ht40[2]--;
+        }
+        if (ar->heavy_clip & 0xf) {
+                ar->power_2G_ht20[0]++;
+                ar->power_2G_ht20[1]++;
+                ar->power_2G_ht20[2]++;
+        }
+
+#undef EDGES
+}
+
+static int carl9170_set_power_cal(struct ar9170 *ar, u32 freq,
+                                  enum carl9170_bw bw)
+{
+        struct ar9170_calibration_target_power_legacy *ctpl;
+        struct ar9170_calibration_target_power_ht *ctph;
+        u8 *ctpres;
+        int ntargets;
+        int idx, i, n;
+        u8 ackpower, ackchains, f;
+        u8 pwr_freqs[AR5416_MAX_NUM_TGT_PWRS];
+
+        if (freq < 3000)
+                f = freq - 2300;
+        else
+                f = (freq - 4800)/5;
+
+        /*
+         * cycle through the various modes
+         *
+         * legacy modes first: 5G, 2G CCK, 2G OFDM
+         */
+        for (i = 0; i < 3; i++) {
+                switch (i) {
+                case 0: /* 5 GHz legacy */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_5G[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_leg;
+                        break;
+                case 1: /* 2.4 GHz CCK */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_cck[0];
+                        ntargets = AR5416_NUM_2G_CCK_TARGET_PWRS;
+                        ctpres = ar->power_2G_cck;
+                        break;
+                case 2: /* 2.4 GHz OFDM */
+                        ctpl = &ar->eeprom.cal_tgt_pwr_2G_ofdm[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ofdm;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctpl[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctpl[n].freq;
+                }
+                ntargets = n;
+                idx = carl9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 4; n++)
+                        ctpres[n] = carl9170_interpolate_u8(f,
+                                ctpl[idx + 0].freq, ctpl[idx + 0].power[n],
+                                ctpl[idx + 1].freq, ctpl[idx + 1].power[n]);
+        }
+
+        /* HT modes now: 5G HT20, 5G HT40, 2G CCK, 2G OFDM, 2G HT20, 2G HT40 */
+        for (i = 0; i < 4; i++) {
+                switch (i) {
+                case 0: /* 5 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht20[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht20;
+                        break;
+                case 1: /* 5 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_5G_ht40[0];
+                        ntargets = AR5416_NUM_5G_TARGET_PWRS;
+                        ctpres = ar->power_5G_ht40;
+                        break;
+                case 2: /* 2.4 GHz HT 20 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht20[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht20;
+                        break;
+                case 3: /* 2.4 GHz HT 40 */
+                        ctph = &ar->eeprom.cal_tgt_pwr_2G_ht40[0];
+                        ntargets = AR5416_NUM_2G_OFDM_TARGET_PWRS;
+                        ctpres = ar->power_2G_ht40;
+                        break;
+                default:
+                        BUG();
+                }
+
+                for (n = 0; n < ntargets; n++) {
+                        if (ctph[n].freq == 0xff)
+                                break;
+                        pwr_freqs[n] = ctph[n].freq;
+                }
+                ntargets = n;
+                idx = carl9170_find_freq_idx(ntargets, pwr_freqs, f);
+                for (n = 0; n < 8; n++)
+                        ctpres[n] = carl9170_interpolate_u8(f,
+                                ctph[idx + 0].freq, ctph[idx + 0].power[n],
+                                ctph[idx + 1].freq, ctph[idx + 1].power[n]);
+        }
+
+        /* calc. conformance test limits and apply to ar->power*[] */
+        carl9170_calc_ctl(ar, freq, bw);
+
+        /* set ACK/CTS TX power */
+        carl9170_regwrite_begin(ar);
+
+        if (ar->eeprom.tx_mask != 1)
+                ackchains = AR9170_TX_PHY_TXCHAIN_2;
+        else
+                ackchains = AR9170_TX_PHY_TXCHAIN_1;
+
+        if (freq < 3000)
+                ackpower = ar->power_2G_ofdm[0] & 0x3f;
+        else
+                ackpower = ar->power_5G_leg[0] & 0x3f;
+
+        carl9170_regwrite(AR9170_MAC_REG_ACK_TPC,
+                          0x3c1e | ackpower << 20 | ackchains << 26);
+        carl9170_regwrite(AR9170_MAC_REG_RTS_CTS_TPC,
+                          ackpower << 5 | ackchains << 11 |
+                          ackpower << 21 | ackchains << 27);
+
+        carl9170_regwrite(AR9170_MAC_REG_CFEND_QOSNULL_TPC,
+                          ackpower << 5 | ackchains << 11 |
+                          ackpower << 21 | ackchains << 27);
+
+        carl9170_regwrite_finish();
+        return carl9170_regwrite_result();
+}
+
+/* TODO: replace this with sign_extend32(noise, 8) */
+static int carl9170_calc_noise_dbm(u32 raw_noise)
+{
+        if (raw_noise & 0x100)
+                return ~0x1ff | raw_noise;
+        else
+                return raw_noise;
+}
+
+int carl9170_get_noisefloor(struct ar9170 *ar)
+{
+        static const u32 phy_regs[] = {
+                AR9170_PHY_REG_CCA, AR9170_PHY_REG_CH2_CCA,
+                AR9170_PHY_REG_EXT_CCA, AR9170_PHY_REG_CH2_EXT_CCA };
+        u32 phy_res[ARRAY_SIZE(phy_regs)];
+        int err, i;
+
+        BUILD_BUG_ON(ARRAY_SIZE(phy_regs) != ARRAY_SIZE(ar->noise));
+
+        err = carl9170_read_mreg(ar, ARRAY_SIZE(phy_regs), phy_regs, phy_res);
+        if (err)
+                return err;
+
+        for (i = 0; i < 2; i++) {
+                ar->noise[i] = carl9170_calc_noise_dbm(
+                        (phy_res[i] >> 19) & 0x1ff);
+
+                ar->noise[i + 2] = carl9170_calc_noise_dbm(
+                        (phy_res[i + 2] >> 23) & 0x1ff);
+        }
+
+        return 0;
+}
+
+static enum carl9170_bw nl80211_to_carl(enum nl80211_channel_type type)
+{
+        switch (type) {
+        case NL80211_CHAN_NO_HT:
+        case NL80211_CHAN_HT20:
+                return CARL9170_BW_20;
+        case NL80211_CHAN_HT40MINUS:
+                return CARL9170_BW_40_BELOW;
+        case NL80211_CHAN_HT40PLUS:
+                return CARL9170_BW_40_ABOVE;
+        default:
+                BUG();
+        }
+}
+
+int carl9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
+                         enum nl80211_channel_type _bw,
+                         enum carl9170_rf_init_mode rfi)
+{
+        const struct carl9170_phy_freq_params *freqpar;
+        struct carl9170_rf_init_result rf_res;
+        struct carl9170_rf_init rf;
+        u32 cmd, tmp, offs = 0, new_ht = 0;
+        int err;
+        enum carl9170_bw bw;
+        bool warm_reset;
+        struct ieee80211_channel *old_channel = NULL;
+
+        bw = nl80211_to_carl(_bw);
+
+        if (conf_is_ht(&ar->hw->conf))
+                new_ht |= CARL9170FW_PHY_HT_ENABLE;
+
+        if (conf_is_ht40(&ar->hw->conf))
+                new_ht |= CARL9170FW_PHY_HT_DYN2040;
+
+        /* may be NULL at first setup */
+        if (ar->channel) {
+                old_channel = ar->channel;
+                warm_reset = (old_channel->band != channel->band) ||
+                             (old_channel->center_freq ==
+                              channel->center_freq) ||
+                             (ar->ht_settings != new_ht);
+
+                ar->channel = NULL;
+        } else {
+                warm_reset = true;
+        }
+
+        /* HW workaround */
+        if (!ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] &&
+            channel->center_freq <= 2417)
+                warm_reset = true;
+
+        if (rfi != CARL9170_RFI_NONE || warm_reset) {
+                u32 val;
+
+                if (rfi == CARL9170_RFI_COLD)
+                        val = AR9170_PWR_RESET_BB_COLD_RESET;
+                else
+                        val = AR9170_PWR_RESET_BB_WARM_RESET;
+
+                /* warm/cold reset BB/ADDA */
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, val);
+                if (err)
+                        return err;
+
+                err = carl9170_write_reg(ar, AR9170_PWR_REG_RESET, 0x0);
+                if (err)
+                        return err;
+
+                err = carl9170_init_phy(ar, channel->band);
+                if (err)
+                        return err;
+
+                err = carl9170_init_rf_banks_0_7(ar,
+                        channel->band == IEEE80211_BAND_5GHZ);
+                if (err)
+                        return err;
+
+                cmd = CARL9170_CMD_RF_INIT;
+
+                msleep(100);
+
+                err = carl9170_echo_test(ar, 0xaabbccdd);
+                if (err)
+                        return err;
+        } else {
+                cmd = CARL9170_CMD_FREQUENCY;
+        }
+
+        err = carl9170_exec_cmd(ar, CARL9170_CMD_FREQ_START, 0, NULL, 0, NULL);
+        if (err)
+                return err;
+
+        err = carl9170_write_reg(ar, AR9170_PHY_REG_HEAVY_CLIP_ENABLE,
+                                 0x200);
+
+        err = carl9170_init_rf_bank4_pwr(ar,
+                channel->band == IEEE80211_BAND_5GHZ,
+                channel->center_freq, bw);
+        if (err)
+                return err;
+
+        tmp = AR9170_PHY_TURBO_FC_SINGLE_HT_LTF1 |
+              AR9170_PHY_TURBO_FC_HT_EN;
+
+        switch (bw) {
+        case CARL9170_BW_20:
+                break;
+        case CARL9170_BW_40_BELOW:
+                tmp |= AR9170_PHY_TURBO_FC_DYN2040_EN |
+                       AR9170_PHY_TURBO_FC_SHORT_GI_40;
+                offs = 3;
+                break;
+        case CARL9170_BW_40_ABOVE:
+                tmp |= AR9170_PHY_TURBO_FC_DYN2040_EN |
+                       AR9170_PHY_TURBO_FC_SHORT_GI_40 |
+                       AR9170_PHY_TURBO_FC_DYN2040_PRI_CH;
+                offs = 1;
+                break;
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        if (ar->eeprom.tx_mask != 1)
+                tmp |= AR9170_PHY_TURBO_FC_WALSH;
+
+        err = carl9170_write_reg(ar, AR9170_PHY_REG_TURBO, tmp);
+        if (err)
+                return err;
+
+        err = carl9170_set_freq_cal_data(ar, channel);
+        if (err)
+                return err;
+
+        err = carl9170_set_power_cal(ar, channel->center_freq, bw);
+        if (err)
+                return err;
+
+        freqpar = carl9170_get_hw_dyn_params(channel, bw);
+
+        rf.ht_settings = new_ht;
+        if (conf_is_ht40(&ar->hw->conf))
+                SET_VAL(CARL9170FW_PHY_HT_EXT_CHAN_OFF, rf.ht_settings, offs);
+
+        rf.freq = cpu_to_le32(channel->center_freq * 1000);
+        rf.delta_slope_coeff_exp = cpu_to_le32(freqpar->coeff_exp);
+        rf.delta_slope_coeff_man = cpu_to_le32(freqpar->coeff_man);
+        rf.delta_slope_coeff_exp_shgi = cpu_to_le32(freqpar->coeff_exp_shgi);
+        rf.delta_slope_coeff_man_shgi = cpu_to_le32(freqpar->coeff_man_shgi);
+
+        if (rfi != CARL9170_RFI_NONE)
+                rf.finiteLoopCount = cpu_to_le32(2000);
+        else
+                rf.finiteLoopCount = cpu_to_le32(1000);
+
+        err = carl9170_exec_cmd(ar, cmd, sizeof(rf), &rf,
+                                sizeof(rf_res), &rf_res);
+        if (err)
+                return err;
+
+        err = le32_to_cpu(rf_res.ret);
+        if (err != 0) {
+                ar->chan_fail++;
+                ar->total_chan_fail++;
+
+                wiphy_err(ar->hw->wiphy, "channel change: %d -> %d "
+                          "failed (%d).\n", old_channel ?
+                          old_channel->center_freq : -1, channel->center_freq,
+                          err);
+
+                if ((rfi == CARL9170_RFI_COLD) || (ar->chan_fail > 3)) {
+                        /*
+                         * We have tried very hard to change to _another_
+                         * channel and we've failed to do so!
+                         * Chances are that the PHY/RF is no longer
+                         * operable (due to corruptions/fatal events/bugs?)
+                         * and we need to reset at a higher level.
+                         */
+                        carl9170_restart(ar, CARL9170_RR_TOO_MANY_PHY_ERRORS);
+                        return 0;
+                }
+
+                err = carl9170_set_channel(ar, channel, _bw,
+                                           CARL9170_RFI_COLD);
+                if (err)
+                        return err;
+        } else {
+                ar->chan_fail = 0;
+        }
+
+        err = carl9170_get_noisefloor(ar);
+        if (err)
+                return err;
+
+        if (ar->heavy_clip) {
+                err = carl9170_write_reg(ar, AR9170_PHY_REG_HEAVY_CLIP_ENABLE,
+                                         0x200 | ar->heavy_clip);
+                if (err) {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "failed to set "
+                                       "heavy clip\n");
+                        }
+
+                        return err;
+                }
+        }
+
+        /* FIXME: PSM does not work in 5GHz Band */
+        if (channel->band == IEEE80211_BAND_5GHZ)
+                ar->ps.off_override |= PS_OFF_5GHZ;
+        else
+                ar->ps.off_override &= ~PS_OFF_5GHZ;
+
+        ar->channel = channel;
+        ar->ht_settings = new_ht;
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/carl9170/phy.h b/drivers/net/wireless/ath/carl9170/phy.h
new file mode 100644
index 000000000000..53c18d34ffcc
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/phy.h
@@ -0,0 +1,567 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * PHY register map
+ *
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_PHY_H
+#define __CARL9170_SHARED_PHY_H
+
+#define AR9170_PHY_REG_BASE                     (0x1bc000 + 0x9800)
+#define AR9170_PHY_REG(_n)                      (AR9170_PHY_REG_BASE + \
+                                                 ((_n) << 2))
+
+#define AR9170_PHY_REG_TEST                     (AR9170_PHY_REG_BASE + 0x0000)
+#define         AR9170_PHY_TEST_AGC_CLR                 0x10000000
+#define         AR9170_PHY_TEST_RFSILENT_BB             0x00002000
+
+#define AR9170_PHY_REG_TURBO                    (AR9170_PHY_REG_BASE + 0x0004)
+#define         AR9170_PHY_TURBO_FC_TURBO_MODE          0x00000001
+#define         AR9170_PHY_TURBO_FC_TURBO_SHORT         0x00000002
+#define         AR9170_PHY_TURBO_FC_DYN2040_EN          0x00000004
+#define         AR9170_PHY_TURBO_FC_DYN2040_PRI_ONLY    0x00000008
+#define         AR9170_PHY_TURBO_FC_DYN2040_PRI_CH      0x00000010
+/* For 25 MHz channel spacing -- not used but supported by hw */
+#define         AR9170_PHY_TURBO_FC_DYN2040_EXT_CH      0x00000020
+#define         AR9170_PHY_TURBO_FC_HT_EN               0x00000040
+#define         AR9170_PHY_TURBO_FC_SHORT_GI_40         0x00000080
+#define         AR9170_PHY_TURBO_FC_WALSH               0x00000100
+#define         AR9170_PHY_TURBO_FC_SINGLE_HT_LTF1      0x00000200
+#define         AR9170_PHY_TURBO_FC_ENABLE_DAC_FIFO     0x00000800
+
+#define AR9170_PHY_REG_TEST2                    (AR9170_PHY_REG_BASE + 0x0008)
+
+#define AR9170_PHY_REG_TIMING2                  (AR9170_PHY_REG_BASE + 0x0010)
+#define         AR9170_PHY_TIMING2_USE_FORCE            0x00001000
+#define         AR9170_PHY_TIMING2_FORCE                0x00000fff
+#define         AR9170_PHY_TIMING2_FORCE_S                       0
+
+#define AR9170_PHY_REG_TIMING3                  (AR9170_PHY_REG_BASE + 0x0014)
+#define         AR9170_PHY_TIMING3_DSC_EXP              0x0001e000
+#define         AR9170_PHY_TIMING3_DSC_EXP_S            13
+#define         AR9170_PHY_TIMING3_DSC_MAN              0xfffe0000
+#define         AR9170_PHY_TIMING3_DSC_MAN_S            17
+
+#define AR9170_PHY_REG_CHIP_ID                  (AR9170_PHY_REG_BASE + 0x0018)
+#define         AR9170_PHY_CHIP_ID_REV_0                0x80
+#define         AR9170_PHY_CHIP_ID_REV_1                0x81
+#define         AR9170_PHY_CHIP_ID_9160_REV_0           0xb0
+
+#define AR9170_PHY_REG_ACTIVE                   (AR9170_PHY_REG_BASE + 0x001c)
+#define         AR9170_PHY_ACTIVE_EN                    0x00000001
+#define         AR9170_PHY_ACTIVE_DIS                   0x00000000
+
+#define AR9170_PHY_REG_RF_CTL2                  (AR9170_PHY_REG_BASE + 0x0024)
+#define         AR9170_PHY_RF_CTL2_TX_END_DATA_START    0x000000ff
+#define         AR9170_PHY_RF_CTL2_TX_END_DATA_START_S  0
+#define         AR9170_PHY_RF_CTL2_TX_END_PA_ON         0x0000ff00
+#define         AR9170_PHY_RF_CTL2_TX_END_PA_ON_S       8
+
+#define AR9170_PHY_REG_RF_CTL3                  (AR9170_PHY_REG_BASE + 0x0028)
+#define         AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON   0x00ff0000
+#define         AR9170_PHY_RF_CTL3_TX_END_TO_A2_RX_ON_S 16
+
+#define AR9170_PHY_REG_ADC_CTL                  (AR9170_PHY_REG_BASE + 0x002c)
+#define         AR9170_PHY_ADC_CTL_OFF_INBUFGAIN        0x00000003
+#define         AR9170_PHY_ADC_CTL_OFF_INBUFGAIN_S      0
+#define         AR9170_PHY_ADC_CTL_OFF_PWDDAC           0x00002000
+#define         AR9170_PHY_ADC_CTL_OFF_PWDBANDGAP       0x00004000
+#define         AR9170_PHY_ADC_CTL_OFF_PWDADC           0x00008000
+#define         AR9170_PHY_ADC_CTL_ON_INBUFGAIN         0x00030000
+#define         AR9170_PHY_ADC_CTL_ON_INBUFGAIN_S       16
+
+#define AR9170_PHY_REG_ADC_SERIAL_CTL           (AR9170_PHY_REG_BASE + 0x0030)
+#define         AR9170_PHY_ADC_SCTL_SEL_INTERNAL_ADDAC  0x00000000
+#define         AR9170_PHY_ADC_SCTL_SEL_EXTERNAL_RADIO  0x00000001
+
+#define AR9170_PHY_REG_RF_CTL4                  (AR9170_PHY_REG_BASE + 0x0034)
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF      0xff000000
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAB_OFF_S    24
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF      0x00ff0000
+#define         AR9170_PHY_RF_CTL4_TX_END_XPAA_OFF_S    16
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAB_ON        0x0000ff00
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAB_ON_S      8
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAA_ON        0x000000ff
+#define         AR9170_PHY_RF_CTL4_FRAME_XPAA_ON_S      0
+
+#define AR9170_PHY_REG_TSTDAC_CONST             (AR9170_PHY_REG_BASE + 0x003c)
+
+#define AR9170_PHY_REG_SETTLING                 (AR9170_PHY_REG_BASE + 0x0044)
+#define         AR9170_PHY_SETTLING_SWITCH              0x00003f80
+#define         AR9170_PHY_SETTLING_SWITCH_S            7
+
+#define AR9170_PHY_REG_RXGAIN                   (AR9170_PHY_REG_BASE + 0x0048)
+#define AR9170_PHY_REG_RXGAIN_CHAIN_2           (AR9170_PHY_REG_BASE + 0x2048)
+#define         AR9170_PHY_RXGAIN_TXRX_ATTEN            0x0003f000
+#define         AR9170_PHY_RXGAIN_TXRX_ATTEN_S          12
+#define         AR9170_PHY_RXGAIN_TXRX_RF_MAX           0x007c0000
+#define         AR9170_PHY_RXGAIN_TXRX_RF_MAX_S         18
+
+#define AR9170_PHY_REG_DESIRED_SZ               (AR9170_PHY_REG_BASE + 0x0050)
+#define         AR9170_PHY_DESIRED_SZ_ADC               0x000000ff
+#define         AR9170_PHY_DESIRED_SZ_ADC_S             0
+#define         AR9170_PHY_DESIRED_SZ_PGA               0x0000ff00
+#define         AR9170_PHY_DESIRED_SZ_PGA_S             8
+#define         AR9170_PHY_DESIRED_SZ_TOT_DES           0x0ff00000
+#define         AR9170_PHY_DESIRED_SZ_TOT_DES_S         20
+
+#define AR9170_PHY_REG_FIND_SIG                 (AR9170_PHY_REG_BASE + 0x0058)
+#define         AR9170_PHY_FIND_SIG_FIRSTEP             0x0003f000
+#define         AR9170_PHY_FIND_SIG_FIRSTEP_S           12
+#define         AR9170_PHY_FIND_SIG_FIRPWR              0x03fc0000
+#define         AR9170_PHY_FIND_SIG_FIRPWR_S            18
+
+#define AR9170_PHY_REG_AGC_CTL1                 (AR9170_PHY_REG_BASE + 0x005c)
+#define         AR9170_PHY_AGC_CTL1_COARSE_LOW          0x00007f80
+#define         AR9170_PHY_AGC_CTL1_COARSE_LOW_S        7
+#define         AR9170_PHY_AGC_CTL1_COARSE_HIGH         0x003f8000
+#define         AR9170_PHY_AGC_CTL1_COARSE_HIGH_S       15
+
+#define AR9170_PHY_REG_AGC_CONTROL              (AR9170_PHY_REG_BASE + 0x0060)
+#define         AR9170_PHY_AGC_CONTROL_CAL              0x00000001
+#define         AR9170_PHY_AGC_CONTROL_NF               0x00000002
+#define         AR9170_PHY_AGC_CONTROL_ENABLE_NF        0x00008000
+#define         AR9170_PHY_AGC_CONTROL_FLTR_CAL         0x00010000
+#define         AR9170_PHY_AGC_CONTROL_NO_UPDATE_NF     0x00020000
+
+#define AR9170_PHY_REG_CCA                      (AR9170_PHY_REG_BASE + 0x0064)
+#define         AR9170_PHY_CCA_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CCA_MINCCA_PWR_S             19
+#define         AR9170_PHY_CCA_THRESH62                 0x0007f000
+#define         AR9170_PHY_CCA_THRESH62_S               12
+
+#define AR9170_PHY_REG_SFCORR                   (AR9170_PHY_REG_BASE + 0x0068)
+#define         AR9170_PHY_SFCORR_M2COUNT_THR           0x0000001f
+#define         AR9170_PHY_SFCORR_M2COUNT_THR_S         0
+#define         AR9170_PHY_SFCORR_M1_THRESH             0x00fe0000
+#define         AR9170_PHY_SFCORR_M1_THRESH_S           17
+#define         AR9170_PHY_SFCORR_M2_THRESH             0x7f000000
+#define         AR9170_PHY_SFCORR_M2_THRESH_S           24
+
+#define AR9170_PHY_REG_SFCORR_LOW               (AR9170_PHY_REG_BASE + 0x006c)
+#define         AR9170_PHY_SFCORR_LOW_USE_SELF_CORR_LOW 0x00000001
+#define         AR9170_PHY_SFCORR_LOW_M2COUNT_THR_LOW   0x00003f00
+#define         AR9170_PHY_SFCORR_LOW_M2COUNT_THR_LOW_S 8
+#define         AR9170_PHY_SFCORR_LOW_M1_THRESH_LOW     0x001fc000
+#define         AR9170_PHY_SFCORR_LOW_M1_THRESH_LOW_S   14
+#define         AR9170_PHY_SFCORR_LOW_M2_THRESH_LOW     0x0fe00000
+#define         AR9170_PHY_SFCORR_LOW_M2_THRESH_LOW_S   21
+
+#define AR9170_PHY_REG_SLEEP_CTR_CONTROL        (AR9170_PHY_REG_BASE + 0x0070)
+#define AR9170_PHY_REG_SLEEP_CTR_LIMIT          (AR9170_PHY_REG_BASE + 0x0074)
+#define AR9170_PHY_REG_SLEEP_SCAL               (AR9170_PHY_REG_BASE + 0x0078)
+
+#define AR9170_PHY_REG_PLL_CTL                  (AR9170_PHY_REG_BASE + 0x007c)
+#define         AR9170_PHY_PLL_CTL_40                   0xaa
+#define         AR9170_PHY_PLL_CTL_40_5413              0x04
+#define         AR9170_PHY_PLL_CTL_44                   0xab
+#define         AR9170_PHY_PLL_CTL_44_2133              0xeb
+#define         AR9170_PHY_PLL_CTL_40_2133              0xea
+
+#define AR9170_PHY_REG_BIN_MASK_1               (AR9170_PHY_REG_BASE + 0x0100)
+#define AR9170_PHY_REG_BIN_MASK_2               (AR9170_PHY_REG_BASE + 0x0104)
+#define AR9170_PHY_REG_BIN_MASK_3               (AR9170_PHY_REG_BASE + 0x0108)
+#define AR9170_PHY_REG_MASK_CTL                 (AR9170_PHY_REG_BASE + 0x010c)
+
+/* analogue power on time (100ns) */
+#define AR9170_PHY_REG_RX_DELAY                 (AR9170_PHY_REG_BASE + 0x0114)
+#define AR9170_PHY_REG_SEARCH_START_DELAY       (AR9170_PHY_REG_BASE + 0x0118)
+#define         AR9170_PHY_RX_DELAY_DELAY               0x00003fff
+
+#define AR9170_PHY_REG_TIMING_CTRL4(_i)         (AR9170_PHY_REG_BASE + \
+                                                (0x0120 + ((_i) << 12)))
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF         0x01f
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF_S       0
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF         0x7e0
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF_S       5
+#define         AR9170_PHY_TIMING_CTRL4_IQCORR_ENABLE           0x800
+#define         AR9170_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX     0xf000
+#define         AR9170_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX_S   12
+#define         AR9170_PHY_TIMING_CTRL4_DO_IQCAL                0x10000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI        0x80000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER      0x40000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK        0x20000000
+#define         AR9170_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK       0x10000000
+
+#define AR9170_PHY_REG_TIMING5                  (AR9170_PHY_REG_BASE + 0x0124)
+#define         AR9170_PHY_TIMING5_CYCPWR_THR1          0x000000fe
+#define         AR9170_PHY_TIMING5_CYCPWR_THR1_S        1
+
+#define AR9170_PHY_REG_POWER_TX_RATE1           (AR9170_PHY_REG_BASE + 0x0134)
+#define AR9170_PHY_REG_POWER_TX_RATE2           (AR9170_PHY_REG_BASE + 0x0138)
+#define AR9170_PHY_REG_POWER_TX_RATE_MAX        (AR9170_PHY_REG_BASE + 0x013c)
+#define         AR9170_PHY_POWER_TX_RATE_MAX_TPC_ENABLE 0x00000040
+
+#define AR9170_PHY_REG_FRAME_CTL                (AR9170_PHY_REG_BASE + 0x0144)
+#define         AR9170_PHY_FRAME_CTL_TX_CLIP            0x00000038
+#define         AR9170_PHY_FRAME_CTL_TX_CLIP_S          3
+
+#define AR9170_PHY_REG_SPUR_REG                 (AR9170_PHY_REG_BASE + 0x014c)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_CNTL      (0xff << 18)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_CNTL_S    18
+#define         AR9170_PHY_SPUR_REG_ENABLE_MASK_PPM     0x20000
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_SELECT    (0xff << 9)
+#define         AR9170_PHY_SPUR_REG_MASK_RATE_SELECT_S  9
+#define         AR9170_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI        0x100
+#define         AR9170_PHY_SPUR_REG_SPUR_RSSI_THRESH    0x7f
+#define         AR9170_PHY_SPUR_REG_SPUR_RSSI_THRESH_S  0
+
+#define AR9170_PHY_REG_RADAR_EXT                (AR9170_PHY_REG_BASE + 0x0140)
+#define         AR9170_PHY_RADAR_EXT_ENA                0x00004000
+
+#define AR9170_PHY_REG_RADAR_0                  (AR9170_PHY_REG_BASE + 0x0154)
+#define         AR9170_PHY_RADAR_0_ENA                  0x00000001
+#define         AR9170_PHY_RADAR_0_FFT_ENA              0x80000000
+/* inband pulse threshold */
+#define         AR9170_PHY_RADAR_0_INBAND               0x0000003e
+#define         AR9170_PHY_RADAR_0_INBAND_S             1
+/* pulse RSSI threshold */
+#define         AR9170_PHY_RADAR_0_PRSSI                0x00000fc0
+#define         AR9170_PHY_RADAR_0_PRSSI_S              6
+/* pulse height threshold */
+#define         AR9170_PHY_RADAR_0_HEIGHT               0x0003f000
+#define         AR9170_PHY_RADAR_0_HEIGHT_S             12
+/* radar RSSI threshold */
+#define         AR9170_PHY_RADAR_0_RRSSI                0x00fc0000
+#define         AR9170_PHY_RADAR_0_RRSSI_S              18
+/* radar firepower threshold */
+#define         AR9170_PHY_RADAR_0_FIRPWR               0x7f000000
+#define         AR9170_PHY_RADAR_0_FIRPWR_S             24
+
+#define AR9170_PHY_REG_RADAR_1                  (AR9170_PHY_REG_BASE + 0x0158)
+#define         AR9170_PHY_RADAR_1_RELPWR_ENA           0x00800000
+#define         AR9170_PHY_RADAR_1_USE_FIR128           0x00400000
+#define         AR9170_PHY_RADAR_1_RELPWR_THRESH        0x003f0000
+#define         AR9170_PHY_RADAR_1_RELPWR_THRESH_S      16
+#define         AR9170_PHY_RADAR_1_BLOCK_CHECK          0x00008000
+#define         AR9170_PHY_RADAR_1_MAX_RRSSI            0x00004000
+#define         AR9170_PHY_RADAR_1_RELSTEP_CHECK        0x00002000
+#define         AR9170_PHY_RADAR_1_RELSTEP_THRESH       0x00001f00
+#define         AR9170_PHY_RADAR_1_RELSTEP_THRESH_S     8
+#define         AR9170_PHY_RADAR_1_MAXLEN               0x000000ff
+#define         AR9170_PHY_RADAR_1_MAXLEN_S             0
+
+#define AR9170_PHY_REG_SWITCH_CHAIN_0           (AR9170_PHY_REG_BASE + 0x0160)
+#define AR9170_PHY_REG_SWITCH_CHAIN_2           (AR9170_PHY_REG_BASE + 0x2160)
+
+#define AR9170_PHY_REG_SWITCH_COM               (AR9170_PHY_REG_BASE + 0x0164)
+
+#define AR9170_PHY_REG_CCA_THRESHOLD            (AR9170_PHY_REG_BASE + 0x0168)
+
+#define AR9170_PHY_REG_SIGMA_DELTA              (AR9170_PHY_REG_BASE + 0x016c)
+#define         AR9170_PHY_SIGMA_DELTA_ADC_SEL          0x00000003
+#define         AR9170_PHY_SIGMA_DELTA_ADC_SEL_S        0
+#define         AR9170_PHY_SIGMA_DELTA_FILT2            0x000000f8
+#define         AR9170_PHY_SIGMA_DELTA_FILT2_S          3
+#define         AR9170_PHY_SIGMA_DELTA_FILT1            0x00001f00
+#define         AR9170_PHY_SIGMA_DELTA_FILT1_S          8
+#define         AR9170_PHY_SIGMA_DELTA_ADC_CLIP         0x01ffe000
+#define         AR9170_PHY_SIGMA_DELTA_ADC_CLIP_S       13
+
+#define AR9170_PHY_REG_RESTART                  (AR9170_PHY_REG_BASE + 0x0170)
+#define         AR9170_PHY_RESTART_DIV_GC               0x001c0000
+#define         AR9170_PHY_RESTART_DIV_GC_S             18
+
+#define AR9170_PHY_REG_RFBUS_REQ                (AR9170_PHY_REG_BASE + 0x017c)
+#define         AR9170_PHY_RFBUS_REQ_EN                 0x00000001
+
+#define AR9170_PHY_REG_TIMING7                  (AR9170_PHY_REG_BASE + 0x0180)
+#define AR9170_PHY_REG_TIMING8                  (AR9170_PHY_REG_BASE + 0x0184)
+#define         AR9170_PHY_TIMING8_PILOT_MASK_2         0x000fffff
+#define         AR9170_PHY_TIMING8_PILOT_MASK_2_S       0
+
+#define AR9170_PHY_REG_BIN_MASK2_1              (AR9170_PHY_REG_BASE + 0x0188)
+#define AR9170_PHY_REG_BIN_MASK2_2              (AR9170_PHY_REG_BASE + 0x018c)
+#define AR9170_PHY_REG_BIN_MASK2_3              (AR9170_PHY_REG_BASE + 0x0190)
+#define AR9170_PHY_REG_BIN_MASK2_4              (AR9170_PHY_REG_BASE + 0x0194)
+#define         AR9170_PHY_BIN_MASK2_4_MASK_4           0x00003fff
+#define         AR9170_PHY_BIN_MASK2_4_MASK_4_S         0
+
+#define AR9170_PHY_REG_TIMING9                  (AR9170_PHY_REG_BASE + 0x0198)
+#define AR9170_PHY_REG_TIMING10                 (AR9170_PHY_REG_BASE + 0x019c)
+#define         AR9170_PHY_TIMING10_PILOT_MASK_2        0x000fffff
+#define         AR9170_PHY_TIMING10_PILOT_MASK_2_S      0
+
+#define AR9170_PHY_REG_TIMING11                 (AR9170_PHY_REG_BASE + 0x01a0)
+#define         AR9170_PHY_TIMING11_SPUR_DELTA_PHASE    0x000fffff
+#define         AR9170_PHY_TIMING11_SPUR_DELTA_PHASE_S  0
+#define         AR9170_PHY_TIMING11_SPUR_FREQ_SD        0x3ff00000
+#define         AR9170_PHY_TIMING11_SPUR_FREQ_SD_S      20
+#define         AR9170_PHY_TIMING11_USE_SPUR_IN_AGC     0x40000000
+#define         AR9170_PHY_TIMING11_USE_SPUR_IN_SELFCOR 0x80000000
+
+#define AR9170_PHY_REG_RX_CHAINMASK             (AR9170_PHY_REG_BASE + 0x01a4)
+#define AR9170_PHY_REG_NEW_ADC_DC_GAIN_CORR(_i) (AR9170_PHY_REG_BASE + \
+                                                 0x01b4 + ((_i) << 12))
+#define         AR9170_PHY_NEW_ADC_GAIN_CORR_ENABLE             0x40000000
+#define         AR9170_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE        0x80000000
+
+#define AR9170_PHY_REG_MULTICHAIN_GAIN_CTL      (AR9170_PHY_REG_BASE + 0x01ac)
+#define         AR9170_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
+#define         AR9170_PHY_9285_ANT_DIV_CTL             0x01000000
+#define         AR9170_PHY_9285_ANT_DIV_CTL_S           24
+#define         AR9170_PHY_9285_ANT_DIV_ALT_LNACONF     0x06000000
+#define         AR9170_PHY_9285_ANT_DIV_ALT_LNACONF_S   25
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_LNACONF    0x18000000
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_LNACONF_S  27
+#define         AR9170_PHY_9285_ANT_DIV_ALT_GAINTB      0x20000000
+#define         AR9170_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
+#define         AR9170_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
+#define         AR9170_PHY_9285_ANT_DIV_LNA1            2
+#define         AR9170_PHY_9285_ANT_DIV_LNA2            1
+#define         AR9170_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
+#define         AR9170_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
+#define         AR9170_PHY_9285_ANT_DIV_GAINTB_0        0
+#define         AR9170_PHY_9285_ANT_DIV_GAINTB_1        1
+
+#define AR9170_PHY_REG_EXT_CCA0                 (AR9170_PHY_REG_BASE + 0x01b8)
+#define         AR9170_PHY_REG_EXT_CCA0_THRESH62        0x000000ff
+#define         AR9170_PHY_REG_EXT_CCA0_THRESH62_S      0
+
+#define AR9170_PHY_REG_EXT_CCA                  (AR9170_PHY_REG_BASE + 0x01bc)
+#define         AR9170_PHY_EXT_CCA_CYCPWR_THR1          0x0000fe00
+#define         AR9170_PHY_EXT_CCA_CYCPWR_THR1_S        9
+#define         AR9170_PHY_EXT_CCA_THRESH62             0x007f0000
+#define         AR9170_PHY_EXT_CCA_THRESH62_S           16
+#define         AR9170_PHY_EXT_MINCCA_PWR               0xff800000
+#define         AR9170_PHY_EXT_MINCCA_PWR_S             23
+
+#define AR9170_PHY_REG_SFCORR_EXT               (AR9170_PHY_REG_BASE + 0x01c0)
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH         0x0000007f
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_S       0
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH         0x00003f80
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_S       7
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_LOW     0x001fc000
+#define         AR9170_PHY_SFCORR_EXT_M1_THRESH_LOW_S   14
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_LOW     0x0fe00000
+#define         AR9170_PHY_SFCORR_EXT_M2_THRESH_LOW_S   21
+#define         AR9170_PHY_SFCORR_SPUR_SUBCHNL_SD_S     28
+
+#define AR9170_PHY_REG_HALFGI                   (AR9170_PHY_REG_BASE + 0x01d0)
+#define         AR9170_PHY_HALFGI_DSC_MAN               0x0007fff0
+#define         AR9170_PHY_HALFGI_DSC_MAN_S             4
+#define         AR9170_PHY_HALFGI_DSC_EXP               0x0000000f
+#define         AR9170_PHY_HALFGI_DSC_EXP_S             0
+
+#define AR9170_PHY_REG_CHANNEL_MASK_01_30       (AR9170_PHY_REG_BASE + 0x01d4)
+#define AR9170_PHY_REG_CHANNEL_MASK_31_60       (AR9170_PHY_REG_BASE + 0x01d8)
+
+#define AR9170_PHY_REG_CHAN_INFO_MEMORY         (AR9170_PHY_REG_BASE + 0x01dc)
+#define         AR9170_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK        0x0001
+
+#define AR9170_PHY_REG_HEAVY_CLIP_ENABLE        (AR9170_PHY_REG_BASE + 0x01e0)
+#define AR9170_PHY_REG_HEAVY_CLIP_FACTOR_RIFS   (AR9170_PHY_REG_BASE + 0x01ec)
+#define         AR9170_PHY_RIFS_INIT_DELAY              0x03ff0000
+
+#define AR9170_PHY_REG_CALMODE                  (AR9170_PHY_REG_BASE + 0x01f0)
+#define         AR9170_PHY_CALMODE_IQ                   0x00000000
+#define         AR9170_PHY_CALMODE_ADC_GAIN             0x00000001
+#define         AR9170_PHY_CALMODE_ADC_DC_PER           0x00000002
+#define         AR9170_PHY_CALMODE_ADC_DC_INIT          0x00000003
+
+#define AR9170_PHY_REG_REFCLKDLY                (AR9170_PHY_REG_BASE + 0x01f4)
+#define AR9170_PHY_REG_REFCLKPD                 (AR9170_PHY_REG_BASE + 0x01f8)
+
+
+#define AR9170_PHY_REG_CAL_MEAS_0(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0410 + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_1(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0414 \ + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_2(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x0418 + ((_i) << 12))
+#define AR9170_PHY_REG_CAL_MEAS_3(_i)           (AR9170_PHY_REG_BASE + \
+                                                 0x041c + ((_i) << 12))
+
+#define AR9170_PHY_REG_CURRENT_RSSI             (AR9170_PHY_REG_BASE + 0x041c)
+
+#define AR9170_PHY_REG_RFBUS_GRANT              (AR9170_PHY_REG_BASE + 0x0420)
+#define         AR9170_PHY_RFBUS_GRANT_EN               0x00000001
+
+#define AR9170_PHY_REG_CHAN_INFO_GAIN_DIFF      (AR9170_PHY_REG_BASE + 0x04f4)
+#define         AR9170_PHY_CHAN_INFO_GAIN_DIFF_UPPER_LIMIT      320
+
+#define AR9170_PHY_REG_CHAN_INFO_GAIN           (AR9170_PHY_REG_BASE + 0x04fc)
+
+#define AR9170_PHY_REG_MODE                     (AR9170_PHY_REG_BASE + 0x0a00)
+#define         AR9170_PHY_MODE_ASYNCFIFO               0x80
+#define         AR9170_PHY_MODE_AR2133                  0x08
+#define         AR9170_PHY_MODE_AR5111                  0x00
+#define         AR9170_PHY_MODE_AR5112                  0x08
+#define         AR9170_PHY_MODE_DYNAMIC                 0x04
+#define         AR9170_PHY_MODE_RF2GHZ                  0x02
+#define         AR9170_PHY_MODE_RF5GHZ                  0x00
+#define         AR9170_PHY_MODE_CCK                     0x01
+#define         AR9170_PHY_MODE_OFDM                    0x00
+#define         AR9170_PHY_MODE_DYN_CCK_DISABLE         0x100
+
+#define AR9170_PHY_REG_CCK_TX_CTRL              (AR9170_PHY_REG_BASE + 0x0a04)
+#define         AR9170_PHY_CCK_TX_CTRL_JAPAN                    0x00000010
+#define         AR9170_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK         0x0000000c
+#define         AR9170_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK_S       2
+
+#define AR9170_PHY_REG_CCK_DETECT               (AR9170_PHY_REG_BASE + 0x0a08)
+#define         AR9170_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003f
+#define         AR9170_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
+/* [12:6] settling time for antenna switch */
+#define         AR9170_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001fc0
+#define         AR9170_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
+#define         AR9170_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
+#define         AR9170_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV_S  13
+
+#define AR9170_PHY_REG_GAIN_2GHZ_CHAIN_2        (AR9170_PHY_REG_BASE + 0x2a0c)
+#define AR9170_PHY_REG_GAIN_2GHZ                (AR9170_PHY_REG_BASE + 0x0a0c)
+#define         AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN        0x00fc0000
+#define         AR9170_PHY_GAIN_2GHZ_RXTX_MARGIN_S      18
+#define         AR9170_PHY_GAIN_2GHZ_BSW_MARGIN         0x00003c00
+#define         AR9170_PHY_GAIN_2GHZ_BSW_MARGIN_S       10
+#define         AR9170_PHY_GAIN_2GHZ_BSW_ATTEN          0x0000001f
+#define         AR9170_PHY_GAIN_2GHZ_BSW_ATTEN_S        0
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_MARGIN     0x003e0000
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_MARGIN_S   17
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_MARGIN     0x0001f000
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_MARGIN_S   12
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_DB         0x00000fc0
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN2_DB_S       6
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_DB         0x0000003f
+#define         AR9170_PHY_GAIN_2GHZ_XATTEN1_DB_S       0
+
+#define AR9170_PHY_REG_CCK_RXCTRL4              (AR9170_PHY_REG_BASE + 0x0a1c)
+#define         AR9170_PHY_CCK_RXCTRL4_FREQ_EST_SHORT   0x01f80000
+#define         AR9170_PHY_CCK_RXCTRL4_FREQ_EST_SHORT_S 19
+
+#define AR9170_PHY_REG_DAG_CTRLCCK              (AR9170_PHY_REG_BASE + 0x0a28)
+#define         AR9170_REG_DAG_CTRLCCK_EN_RSSI_THR      0x00000200
+#define         AR9170_REG_DAG_CTRLCCK_RSSI_THR         0x0001fc00
+#define         AR9170_REG_DAG_CTRLCCK_RSSI_THR_S       10
+
+#define AR9170_PHY_REG_FORCE_CLKEN_CCK          (AR9170_PHY_REG_BASE + 0x0a2c)
+#define         AR9170_FORCE_CLKEN_CCK_MRC_MUX          0x00000040
+
+#define AR9170_PHY_REG_POWER_TX_RATE3           (AR9170_PHY_REG_BASE + 0x0a34)
+#define AR9170_PHY_REG_POWER_TX_RATE4           (AR9170_PHY_REG_BASE + 0x0a38)
+
+#define AR9170_PHY_REG_SCRM_SEQ_XR              (AR9170_PHY_REG_BASE + 0x0a3c)
+#define AR9170_PHY_REG_HEADER_DETECT_XR         (AR9170_PHY_REG_BASE + 0x0a40)
+#define AR9170_PHY_REG_CHIRP_DETECTED_XR        (AR9170_PHY_REG_BASE + 0x0a44)
+#define AR9170_PHY_REG_BLUETOOTH                (AR9170_PHY_REG_BASE + 0x0a54)
+
+#define AR9170_PHY_REG_TPCRG1                   (AR9170_PHY_REG_BASE + 0x0a58)
+#define         AR9170_PHY_TPCRG1_NUM_PD_GAIN           0x0000c000
+#define         AR9170_PHY_TPCRG1_NUM_PD_GAIN_S         14
+#define         AR9170_PHY_TPCRG1_PD_GAIN_1             0x00030000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_1_S           16
+#define         AR9170_PHY_TPCRG1_PD_GAIN_2             0x000c0000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_2_S           18
+#define         AR9170_PHY_TPCRG1_PD_GAIN_3             0x00300000
+#define         AR9170_PHY_TPCRG1_PD_GAIN_3_S           20
+#define         AR9170_PHY_TPCRG1_PD_CAL_ENABLE         0x00400000
+#define         AR9170_PHY_TPCRG1_PD_CAL_ENABLE_S       22
+
+#define AR9170_PHY_REG_TX_PWRCTRL4              (AR9170_PHY_REG_BASE + 0x0a64)
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_VALID      0x00000001
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_VALID_S    0
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_OUT        0x000001fe
+#define         AR9170_PHY_TX_PWRCTRL_PD_AVG_OUT_S      1
+
+#define AR9170_PHY_REG_ANALOG_SWAP              (AR9170_PHY_REG_BASE + 0x0a68)
+#define         AR9170_PHY_ANALOG_SWAP_AB               0x0001
+#define         AR9170_PHY_ANALOG_SWAP_ALT_CHAIN        0x00000040
+
+#define AR9170_PHY_REG_TPCRG5                   (AR9170_PHY_REG_BASE + 0x0a6c)
+#define         AR9170_PHY_TPCRG5_PD_GAIN_OVERLAP       0x0000000f
+#define         AR9170_PHY_TPCRG5_PD_GAIN_OVERLAP_S     0
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_1    0x000003f0
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_1_S  4
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_2    0x0000fc00
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_2_S  10
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_3    0x003f0000
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_3_S  16
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0fc00000
+#define         AR9170_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
+
+#define AR9170_PHY_REG_TX_PWRCTRL6_0            (AR9170_PHY_REG_BASE + 0x0a70)
+#define AR9170_PHY_REG_TX_PWRCTRL6_1            (AR9170_PHY_REG_BASE + 0x1a70)
+#define         AR9170_PHY_TX_PWRCTRL_ERR_EST_MODE      0x03000000
+#define         AR9170_PHY_TX_PWRCTRL_ERR_EST_MODE_S    24
+
+#define AR9170_PHY_REG_TX_PWRCTRL7              (AR9170_PHY_REG_BASE + 0x0a74)
+#define         AR9170_PHY_TX_PWRCTRL_INIT_TX_GAIN      0x01f80000
+#define         AR9170_PHY_TX_PWRCTRL_INIT_TX_GAIN_S    19
+
+#define AR9170_PHY_REG_TX_PWRCTRL9              (AR9170_PHY_REG_BASE + 0x0a7c)
+#define         AR9170_PHY_TX_DESIRED_SCALE_CCK         0x00007c00
+#define         AR9170_PHY_TX_DESIRED_SCALE_CCK_S       10
+#define         AR9170_PHY_TX_PWRCTRL9_RES_DC_REMOVAL   0x80000000
+#define         AR9170_PHY_TX_PWRCTRL9_RES_DC_REMOVAL_S 31
+
+#define AR9170_PHY_REG_TX_GAIN_TBL1             (AR9170_PHY_REG_BASE + 0x0b00)
+#define         AR9170_PHY_TX_GAIN                      0x0007f000
+#define         AR9170_PHY_TX_GAIN_S                    12
+
+/* Carrier leak calibration control, do it after AGC calibration */
+#define AR9170_PHY_REG_CL_CAL_CTL               (AR9170_PHY_REG_BASE + 0x0b58)
+#define         AR9170_PHY_CL_CAL_ENABLE                0x00000002
+#define         AR9170_PHY_CL_CAL_PARALLEL_CAL_ENABLE   0x00000001
+
+#define AR9170_PHY_REG_POWER_TX_RATE5           (AR9170_PHY_REG_BASE + 0x0b8c)
+#define AR9170_PHY_REG_POWER_TX_RATE6           (AR9170_PHY_REG_BASE + 0x0b90)
+
+#define AR9170_PHY_REG_CH0_TX_PWRCTRL11         (AR9170_PHY_REG_BASE + 0x0b98)
+#define AR9170_PHY_REG_CH1_TX_PWRCTRL11         (AR9170_PHY_REG_BASE + 0x1b98)
+#define         AR9170_PHY_TX_CHX_PWRCTRL_OLPC_TEMP_COMP        0x0000fc00
+#define         AR9170_PHY_TX_CHX_PWRCTRL_OLPC_TEMP_COMP_S      10
+
+#define AR9170_PHY_REG_CAL_CHAINMASK            (AR9170_PHY_REG_BASE + 0x0b9c)
+#define AR9170_PHY_REG_VIT_MASK2_M_46_61        (AR9170_PHY_REG_BASE + 0x0ba0)
+#define AR9170_PHY_REG_MASK2_M_31_45            (AR9170_PHY_REG_BASE + 0x0ba4)
+#define AR9170_PHY_REG_MASK2_M_16_30            (AR9170_PHY_REG_BASE + 0x0ba8)
+#define AR9170_PHY_REG_MASK2_M_00_15            (AR9170_PHY_REG_BASE + 0x0bac)
+#define AR9170_PHY_REG_PILOT_MASK_01_30         (AR9170_PHY_REG_BASE + 0x0bb0)
+#define AR9170_PHY_REG_PILOT_MASK_31_60         (AR9170_PHY_REG_BASE + 0x0bb4)
+#define AR9170_PHY_REG_MASK2_P_15_01            (AR9170_PHY_REG_BASE + 0x0bb8)
+#define AR9170_PHY_REG_MASK2_P_30_16            (AR9170_PHY_REG_BASE + 0x0bbc)
+#define AR9170_PHY_REG_MASK2_P_45_31            (AR9170_PHY_REG_BASE + 0x0bc0)
+#define AR9170_PHY_REG_MASK2_P_61_45            (AR9170_PHY_REG_BASE + 0x0bc4)
+#define AR9170_PHY_REG_POWER_TX_SUB             (AR9170_PHY_REG_BASE + 0x0bc8)
+#define AR9170_PHY_REG_POWER_TX_RATE7           (AR9170_PHY_REG_BASE + 0x0bcc)
+#define AR9170_PHY_REG_POWER_TX_RATE8           (AR9170_PHY_REG_BASE + 0x0bd0)
+#define AR9170_PHY_REG_POWER_TX_RATE9           (AR9170_PHY_REG_BASE + 0x0bd4)
+#define AR9170_PHY_REG_XPA_CFG                  (AR9170_PHY_REG_BASE + 0x0bd8)
+#define         AR9170_PHY_FORCE_XPA_CFG                0x000000001
+#define         AR9170_PHY_FORCE_XPA_CFG_S              0
+
+#define AR9170_PHY_REG_CH1_CCA                  (AR9170_PHY_REG_BASE + 0x1064)
+#define         AR9170_PHY_CH1_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CH1_MINCCA_PWR_S             19
+
+#define AR9170_PHY_REG_CH2_CCA                  (AR9170_PHY_REG_BASE + 0x2064)
+#define         AR9170_PHY_CH2_MINCCA_PWR               0x0ff80000
+#define         AR9170_PHY_CH2_MINCCA_PWR_S             19
+
+#define AR9170_PHY_REG_CH1_EXT_CCA              (AR9170_PHY_REG_BASE + 0x11bc)
+#define         AR9170_PHY_CH1_EXT_MINCCA_PWR           0xff800000
+#define         AR9170_PHY_CH1_EXT_MINCCA_PWR_S         23
+
+#define AR9170_PHY_REG_CH2_EXT_CCA              (AR9170_PHY_REG_BASE + 0x21bc)
+#define         AR9170_PHY_CH2_EXT_MINCCA_PWR           0xff800000
+#define         AR9170_PHY_CH2_EXT_MINCCA_PWR_S         23
+
+#define REDUCE_CHAIN_0 0x00000050
+#define REDUCE_CHAIN_1 0x00000051
+
+#endif  /* __CARL9170_SHARED_PHY_H */
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
new file mode 100644
index 000000000000..671dbc429547
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -0,0 +1,909 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * 802.11 & command trap routines
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "hw.h"
+#include "cmd.h"
+
+static void carl9170_dbg_message(struct ar9170 *ar, const char *buf, u32 len)
+{
+        bool restart = false;
+        enum carl9170_restart_reasons reason = CARL9170_RR_NO_REASON;
+
+        if (len > 3) {
+                if (memcmp(buf, CARL9170_ERR_MAGIC, 3) == 0) {
+                        ar->fw.err_counter++;
+                        if (ar->fw.err_counter > 3) {
+                                restart = true;
+                                reason = CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS;
+                        }
+                }
+
+                if (memcmp(buf, CARL9170_BUG_MAGIC, 3) == 0) {
+                        ar->fw.bug_counter++;
+                        restart = true;
+                        reason = CARL9170_RR_FATAL_FIRMWARE_ERROR;
+                }
+        }
+
+        wiphy_info(ar->hw->wiphy, "FW: %.*s\n", len, buf);
+
+        if (restart)
+                carl9170_restart(ar, reason);
+}
+
+static void carl9170_handle_ps(struct ar9170 *ar, struct carl9170_rsp *rsp)
+{
+        u32 ps;
+        bool new_ps;
+
+        ps = le32_to_cpu(rsp->psm.state);
+
+        new_ps = (ps & CARL9170_PSM_COUNTER) != CARL9170_PSM_WAKE;
+        if (ar->ps.state != new_ps) {
+                if (!new_ps) {
+                        ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
+                                ar->ps.last_action);
+                }
+
+                ar->ps.last_action = jiffies;
+
+                ar->ps.state = new_ps;
+        }
+}
+
+static int carl9170_check_sequence(struct ar9170 *ar, unsigned int seq)
+{
+        if (ar->cmd_seq < -1)
+                return 0;
+
+        /*
+         * Initialize Counter
+         */
+        if (ar->cmd_seq < 0)
+                ar->cmd_seq = seq;
+
+        /*
+         * The sequence is strictly monotonic increasing and it never skips!
+         *
+         * Therefore we can safely assume that whenever we received an
+         * unexpected sequence we have lost some valuable data.
+         */
+        if (seq != ar->cmd_seq) {
+                int count;
+
+                count = (seq - ar->cmd_seq) % ar->fw.cmd_bufs;
+
+                wiphy_err(ar->hw->wiphy, "lost %d command responses/traps! "
+                          "w:%d g:%d\n", count, ar->cmd_seq, seq);
+
+                carl9170_restart(ar, CARL9170_RR_LOST_RSP);
+                return -EIO;
+        }
+
+        ar->cmd_seq = (ar->cmd_seq + 1) % ar->fw.cmd_bufs;
+        return 0;
+}
+
+static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
+{
+        /*
+         * Some commands may have a variable response length
+         * and we cannot predict the correct length in advance.
+         * So we only check if we provided enough space for the data.
+         */
+        if (unlikely(ar->readlen != (len - 4))) {
+                dev_warn(&ar->udev->dev, "received invalid command response:"
+                         "got %d, instead of %d\n", len - 4, ar->readlen);
+                print_hex_dump_bytes("carl9170 cmd:", DUMP_PREFIX_OFFSET,
+                        ar->cmd_buf, (ar->cmd.hdr.len + 4) & 0x3f);
+                print_hex_dump_bytes("carl9170 rsp:", DUMP_PREFIX_OFFSET,
+                        buffer, len);
+                /*
+                 * Do not complete. The command times out,
+                 * and we get a stack trace from there.
+                 */
+                carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
+        }
+
+        spin_lock(&ar->cmd_lock);
+        if (ar->readbuf) {
+                if (len >= 4)
+                        memcpy(ar->readbuf, buffer + 4, len - 4);
+
+                ar->readbuf = NULL;
+        }
+        complete(&ar->cmd_wait);
+        spin_unlock(&ar->cmd_lock);
+}
+
+void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
+{
+        struct carl9170_rsp *cmd = (void *) buf;
+        struct ieee80211_vif *vif;
+
+        if (carl9170_check_sequence(ar, cmd->hdr.seq))
+                return;
+
+        if ((cmd->hdr.cmd & CARL9170_RSP_FLAG) != CARL9170_RSP_FLAG) {
+                if (!(cmd->hdr.cmd & CARL9170_CMD_ASYNC_FLAG))
+                        carl9170_cmd_callback(ar, len, buf);
+
+                return;
+        }
+
+        if (unlikely(cmd->hdr.len != (len - 4))) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "FW: received over-/under"
+                                "sized event %x (%d, but should be %d).\n",
+                               cmd->hdr.cmd, cmd->hdr.len, len - 4);
+
+                        print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE,
+                                             buf, len);
+                }
+
+                return;
+        }
+
+        /* hardware event handlers */
+        switch (cmd->hdr.cmd) {
+        case CARL9170_RSP_PRETBTT:
+                /* pre-TBTT event */
+                rcu_read_lock();
+                vif = carl9170_get_main_vif(ar);
+
+                if (!vif) {
+                        rcu_read_unlock();
+                        break;
+                }
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_STATION:
+                        carl9170_handle_ps(ar, cmd);
+                        break;
+
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_ADHOC:
+                        carl9170_update_beacon(ar, true);
+                        break;
+
+                default:
+                        break;
+                }
+                rcu_read_unlock();
+
+                break;
+
+
+        case CARL9170_RSP_TXCOMP:
+                /* TX status notification */
+                carl9170_tx_process_status(ar, cmd);
+                break;
+
+        case CARL9170_RSP_BEACON_CONFIG:
+                /*
+                 * (IBSS) beacon send notification
+                 * bytes: 04 c2 XX YY B4 B3 B2 B1
+                 *
+                 * XX always 80
+                 * YY always 00
+                 * B1-B4 "should" be the number of send out beacons.
+                 */
+                break;
+
+        case CARL9170_RSP_ATIM:
+                /* End of Atim Window */
+                break;
+
+        case CARL9170_RSP_WATCHDOG:
+                /* Watchdog Interrupt */
+                carl9170_restart(ar, CARL9170_RR_WATCHDOG);
+                break;
+
+        case CARL9170_RSP_TEXT:
+                /* firmware debug */
+                carl9170_dbg_message(ar, (char *)buf + 4, len - 4);
+                break;
+
+        case CARL9170_RSP_HEXDUMP:
+                wiphy_dbg(ar->hw->wiphy, "FW: HD %d\n", len - 4);
+                print_hex_dump_bytes("FW:", DUMP_PREFIX_NONE,
+                                     (char *)buf + 4, len - 4);
+                break;
+
+        case CARL9170_RSP_RADAR:
+                if (!net_ratelimit())
+                        break;
+
+                wiphy_info(ar->hw->wiphy, "FW: RADAR! Please report this "
+                       "incident to linux-wireless@vger.kernel.org !\n");
+                break;
+
+        case CARL9170_RSP_GPIO:
+#ifdef CONFIG_CARL9170_WPC
+                if (ar->wps.pbc) {
+                        bool state = !!(cmd->gpio.gpio & cpu_to_le32(
+                                AR9170_GPIO_PORT_WPS_BUTTON_PRESSED));
+
+                        if (state != ar->wps.pbc_state) {
+                                ar->wps.pbc_state = state;
+                                input_report_key(ar->wps.pbc, KEY_WPS_BUTTON,
+                                                 state);
+                                input_sync(ar->wps.pbc);
+                        }
+                }
+#endif /* CONFIG_CARL9170_WPC */
+                break;
+
+        case CARL9170_RSP_BOOT:
+                complete(&ar->fw_boot_wait);
+                break;
+
+        default:
+                wiphy_err(ar->hw->wiphy, "FW: received unhandled event %x\n",
+                        cmd->hdr.cmd);
+                print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
+                break;
+        }
+}
+
+static int carl9170_rx_mac_status(struct ar9170 *ar,
+        struct ar9170_rx_head *head, struct ar9170_rx_macstatus *mac,
+        struct ieee80211_rx_status *status)
+{
+        struct ieee80211_channel *chan;
+        u8 error, decrypt;
+
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
+
+        error = mac->error;
+
+        if (error & AR9170_RX_ERROR_WRONG_RA) {
+                if (!ar->sniffer_enabled)
+                        return -EINVAL;
+        }
+
+        if (error & AR9170_RX_ERROR_PLCP) {
+                if (!(ar->filter_state & FIF_PLCPFAIL))
+                        return -EINVAL;
+
+                status->flag |= RX_FLAG_FAILED_PLCP_CRC;
+        }
+
+        if (error & AR9170_RX_ERROR_FCS) {
+                ar->tx_fcs_errors++;
+
+                if (!(ar->filter_state & FIF_FCSFAIL))
+                        return -EINVAL;
+
+                status->flag |= RX_FLAG_FAILED_FCS_CRC;
+        }
+
+        decrypt = ar9170_get_decrypt_type(mac);
+        if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
+            decrypt != AR9170_ENC_ALG_NONE) {
+                if ((decrypt == AR9170_ENC_ALG_TKIP) &&
+                    (error & AR9170_RX_ERROR_MMIC))
+                        status->flag |= RX_FLAG_MMIC_ERROR;
+
+                status->flag |= RX_FLAG_DECRYPTED;
+        }
+
+        if (error & AR9170_RX_ERROR_DECRYPT && !ar->sniffer_enabled)
+                return -ENODATA;
+
+        error &= ~(AR9170_RX_ERROR_MMIC |
+                   AR9170_RX_ERROR_FCS |
+                   AR9170_RX_ERROR_WRONG_RA |
+                   AR9170_RX_ERROR_DECRYPT |
+                   AR9170_RX_ERROR_PLCP);
+
+        /* drop any other error frames */
+        if (unlikely(error)) {
+                /* TODO: update netdevice's RX dropped/errors statistics */
+
+                if (net_ratelimit())
+                        wiphy_dbg(ar->hw->wiphy, "received frame with "
+                               "suspicious error code (%#x).\n", error);
+
+                return -EINVAL;
+        }
+
+        chan = ar->channel;
+        if (chan) {
+                status->band = chan->band;
+                status->freq = chan->center_freq;
+        }
+
+        switch (mac->status & AR9170_RX_STATUS_MODULATION) {
+        case AR9170_RX_STATUS_MODULATION_CCK:
+                if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
+                        status->flag |= RX_FLAG_SHORTPRE;
+                switch (head->plcp[0]) {
+                case AR9170_RX_PHY_RATE_CCK_1M:
+                        status->rate_idx = 0;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_2M:
+                        status->rate_idx = 1;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_5M:
+                        status->rate_idx = 2;
+                        break;
+                case AR9170_RX_PHY_RATE_CCK_11M:
+                        status->rate_idx = 3;
+                        break;
+                default:
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "invalid plcp cck "
+                                       "rate (%x).\n", head->plcp[0]);
+                        }
+
+                        return -EINVAL;
+                }
+                break;
+
+        case AR9170_RX_STATUS_MODULATION_DUPOFDM:
+        case AR9170_RX_STATUS_MODULATION_OFDM:
+                switch (head->plcp[0] & 0xf) {
+                case AR9170_TXRX_PHY_RATE_OFDM_6M:
+                        status->rate_idx = 0;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_9M:
+                        status->rate_idx = 1;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_12M:
+                        status->rate_idx = 2;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_18M:
+                        status->rate_idx = 3;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_24M:
+                        status->rate_idx = 4;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_36M:
+                        status->rate_idx = 5;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_48M:
+                        status->rate_idx = 6;
+                        break;
+                case AR9170_TXRX_PHY_RATE_OFDM_54M:
+                        status->rate_idx = 7;
+                        break;
+                default:
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "invalid plcp ofdm "
+                                        "rate (%x).\n", head->plcp[0]);
+                        }
+
+                        return -EINVAL;
+                }
+                if (status->band == IEEE80211_BAND_2GHZ)
+                        status->rate_idx += 4;
+                break;
+
+        case AR9170_RX_STATUS_MODULATION_HT:
+                if (head->plcp[3] & 0x80)
+                        status->flag |= RX_FLAG_40MHZ;
+                if (head->plcp[6] & 0x80)
+                        status->flag |= RX_FLAG_SHORT_GI;
+
+                status->rate_idx = clamp(0, 75, head->plcp[3] & 0x7f);
+                status->flag |= RX_FLAG_HT;
+                break;
+
+        default:
+                BUG();
+                return -ENOSYS;
+        }
+
+        return 0;
+}
+
+static void carl9170_rx_phy_status(struct ar9170 *ar,
+        struct ar9170_rx_phystatus *phy, struct ieee80211_rx_status *status)
+{
+        int i;
+
+        BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
+
+        for (i = 0; i < 3; i++)
+                if (phy->rssi[i] != 0x80)
+                        status->antenna |= BIT(i);
+
+        /* post-process RSSI */
+        for (i = 0; i < 7; i++)
+                if (phy->rssi[i] & 0x80)
+                        phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
+
+        /* TODO: we could do something with phy_errors */
+        status->signal = ar->noise[0] + phy->rssi_combined;
+}
+
+static struct sk_buff *carl9170_rx_copy_data(u8 *buf, int len)
+{
+        struct sk_buff *skb;
+        int reserved = 0;
+        struct ieee80211_hdr *hdr = (void *) buf;
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                reserved += NET_IP_ALIGN;
+
+                if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
+                        reserved += NET_IP_ALIGN;
+        }
+
+        if (ieee80211_has_a4(hdr->frame_control))
+                reserved += NET_IP_ALIGN;
+
+        reserved = 32 + (reserved & NET_IP_ALIGN);
+
+        skb = dev_alloc_skb(len + reserved);
+        if (likely(skb)) {
+                skb_reserve(skb, reserved);
+                memcpy(skb_put(skb, len), buf, len);
+        }
+
+        return skb;
+}
+
+static u8 *carl9170_find_ie(u8 *data, unsigned int len, u8 ie)
+{
+        struct ieee80211_mgmt *mgmt = (void *)data;
+        u8 *pos, *end;
+
+        pos = (u8 *)mgmt->u.beacon.variable;
+        end = data + len;
+        while (pos < end) {
+                if (pos + 2 + pos[1] > end)
+                        return NULL;
+
+                if (pos[0] == ie)
+                        return pos;
+
+                pos += 2 + pos[1];
+        }
+        return NULL;
+}
+
+/*
+ * NOTE:
+ *
+ * The firmware is in charge of waking up the device just before
+ * the AP is expected to transmit the next beacon.
+ *
+ * This leaves the driver with the important task of deciding when
+ * to set the PHY back to bed again.
+ */
+static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
+{
+        struct ieee80211_hdr *hdr = (void *) data;
+        struct ieee80211_tim_ie *tim_ie;
+        u8 *tim;
+        u8 tim_len;
+        bool cam;
+
+        if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS)))
+                return;
+
+        /* check if this really is a beacon */
+        if (!ieee80211_is_beacon(hdr->frame_control))
+                return;
+
+        /* min. beacon length + FCS_LEN */
+        if (len <= 40 + FCS_LEN)
+                return;
+
+        /* and only beacons from the associated BSSID, please */
+        if (compare_ether_addr(hdr->addr3, ar->common.curbssid) ||
+            !ar->common.curaid)
+                return;
+
+        ar->ps.last_beacon = jiffies;
+
+        tim = carl9170_find_ie(data, len - FCS_LEN, WLAN_EID_TIM);
+        if (!tim)
+                return;
+
+        if (tim[1] < sizeof(*tim_ie))
+                return;
+
+        tim_len = tim[1];
+        tim_ie = (struct ieee80211_tim_ie *) &tim[2];
+
+        if (!WARN_ON_ONCE(!ar->hw->conf.ps_dtim_period))
+                ar->ps.dtim_counter = (tim_ie->dtim_count - 1) %
+                        ar->hw->conf.ps_dtim_period;
+
+        /* Check whenever the PHY can be turned off again. */
+
+        /* 1. What about buffered unicast traffic for our AID? */
+        cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
+
+        /* 2. Maybe the AP wants to send multicast/broadcast data? */
+        cam = !!(tim_ie->bitmap_ctrl & 0x01);
+
+        if (!cam) {
+                /* back to low-power land. */
+                ar->ps.off_override &= ~PS_OFF_BCN;
+                carl9170_ps_check(ar);
+        } else {
+                /* force CAM */
+                ar->ps.off_override |= PS_OFF_BCN;
+        }
+}
+
+/*
+ * If the frame alignment is right (or the kernel has
+ * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
+ * is only a single MPDU in the USB frame, then we could
+ * submit to mac80211 the SKB directly. However, since
+ * there may be multiple packets in one SKB in stream
+ * mode, and we need to observe the proper ordering,
+ * this is non-trivial.
+ */
+
+static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
+{
+        struct ar9170_rx_head *head;
+        struct ar9170_rx_macstatus *mac;
+        struct ar9170_rx_phystatus *phy = NULL;
+        struct ieee80211_rx_status status;
+        struct sk_buff *skb;
+        int mpdu_len;
+
+        if (!IS_STARTED(ar))
+                return;
+
+        if (unlikely(len < sizeof(*mac))) {
+                ar->rx_dropped++;
+                return;
+        }
+
+        mpdu_len = len - sizeof(*mac);
+
+        mac = (void *)(buf + mpdu_len);
+        if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
+                ar->rx_dropped++;
+                return;
+        }
+
+        switch (mac->status & AR9170_RX_STATUS_MPDU) {
+        case AR9170_RX_STATUS_MPDU_FIRST:
+                /* Aggregated MPDUs start with an PLCP header */
+                if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
+                        head = (void *) buf;
+
+                        /*
+                         * The PLCP header needs to be cached for the
+                         * following MIDDLE + LAST A-MPDU packets.
+                         *
+                         * So, if you are wondering why all frames seem
+                         * to share a common RX status information,
+                         * then you have the answer right here...
+                         */
+                        memcpy(&ar->rx_plcp, (void *) buf,
+                               sizeof(struct ar9170_rx_head));
+
+                        mpdu_len -= sizeof(struct ar9170_rx_head);
+                        buf += sizeof(struct ar9170_rx_head);
+
+                        ar->rx_has_plcp = true;
+                } else {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "plcp info "
+                                        "is clipped.\n");
+                        }
+
+                        ar->rx_dropped++;
+                        return;
+                }
+                break;
+
+        case AR9170_RX_STATUS_MPDU_LAST:
+                /*
+                 * The last frame of an A-MPDU has an extra tail
+                 * which does contain the phy status of the whole
+                 * aggregate.
+                 */
+
+                if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
+                        mpdu_len -= sizeof(struct ar9170_rx_phystatus);
+                        phy = (void *)(buf + mpdu_len);
+                } else {
+                        if (net_ratelimit()) {
+                                wiphy_err(ar->hw->wiphy, "frame tail "
+                                        "is clipped.\n");
+                        }
+
+                        ar->rx_dropped++;
+                        return;
+                }
+
+        case AR9170_RX_STATUS_MPDU_MIDDLE:
+                /*  These are just data + mac status */
+                if (unlikely(!ar->rx_has_plcp)) {
+                        if (!net_ratelimit())
+                                return;
+
+                        wiphy_err(ar->hw->wiphy, "rx stream does not start "
+                                        "with a first_mpdu frame tag.\n");
+
+                        ar->rx_dropped++;
+                        return;
+                }
+
+                head = &ar->rx_plcp;
+                break;
+
+        case AR9170_RX_STATUS_MPDU_SINGLE:
+                /* single mpdu has both: plcp (head) and phy status (tail) */
+                head = (void *) buf;
+
+                mpdu_len -= sizeof(struct ar9170_rx_head);
+                mpdu_len -= sizeof(struct ar9170_rx_phystatus);
+
+                buf += sizeof(struct ar9170_rx_head);
+                phy = (void *)(buf + mpdu_len);
+                break;
+
+        default:
+                BUG_ON(1);
+                break;
+        }
+
+        /* FC + DU + RA + FCS */
+        if (unlikely(mpdu_len < (2 + 2 + 6 + FCS_LEN))) {
+                ar->rx_dropped++;
+                return;
+        }
+
+        memset(&status, 0, sizeof(status));
+        if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status))) {
+                ar->rx_dropped++;
+                return;
+        }
+
+        if (phy)
+                carl9170_rx_phy_status(ar, phy, &status);
+
+        carl9170_ps_beacon(ar, buf, mpdu_len);
+
+        skb = carl9170_rx_copy_data(buf, mpdu_len);
+        if (likely(skb)) {
+                memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+                ieee80211_rx(ar->hw, skb);
+        } else {
+                ar->rx_dropped++;
+        }
+}
+
+static void carl9170_rx_untie_cmds(struct ar9170 *ar, const u8 *respbuf,
+                                   const unsigned int resplen)
+{
+        struct carl9170_rsp *cmd;
+        int i = 0;
+
+        while (i < resplen) {
+                cmd = (void *) &respbuf[i];
+
+                i += cmd->hdr.len + 4;
+                if (unlikely(i > resplen))
+                        break;
+
+                carl9170_handle_command_response(ar, cmd, cmd->hdr.len + 4);
+        }
+
+        if (unlikely(i != resplen)) {
+                if (!net_ratelimit())
+                        return;
+
+                wiphy_err(ar->hw->wiphy, "malformed firmware trap:\n");
+                print_hex_dump_bytes("rxcmd:", DUMP_PREFIX_OFFSET,
+                                     respbuf, resplen);
+        }
+}
+
+static void __carl9170_rx(struct ar9170 *ar, u8 *buf, unsigned int len)
+{
+        unsigned int i = 0;
+
+        /* weird thing, but this is the same in the original driver */
+        while (len > 2 && i < 12 && buf[0] == 0xff && buf[1] == 0xff) {
+                i += 2;
+                len -= 2;
+                buf += 2;
+        }
+
+        if (unlikely(len < 4))
+                return;
+
+        /* found the 6 * 0xffff marker? */
+        if (i == 12)
+                carl9170_rx_untie_cmds(ar, buf, len);
+        else
+                carl9170_handle_mpdu(ar, buf, len);
+}
+
+static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len)
+{
+        unsigned int tlen, wlen = 0, clen = 0;
+        struct ar9170_stream *rx_stream;
+        u8 *tbuf;
+
+        tbuf = buf;
+        tlen = len;
+
+        while (tlen >= 4) {
+                rx_stream = (void *) tbuf;
+                clen = le16_to_cpu(rx_stream->length);
+                wlen = ALIGN(clen, 4);
+
+                /* check if this is stream has a valid tag.*/
+                if (rx_stream->tag != cpu_to_le16(AR9170_RX_STREAM_TAG)) {
+                        /*
+                         * TODO: handle the highly unlikely event that the
+                         * corrupted stream has the TAG at the right position.
+                         */
+
+                        /* check if the frame can be repaired. */
+                        if (!ar->rx_failover_missing) {
+
+                                /* this is not "short read". */
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy,
+                                                "missing tag!\n");
+                                }
+
+                                __carl9170_rx(ar, tbuf, tlen);
+                                return;
+                        }
+
+                        if (ar->rx_failover_missing > tlen) {
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy,
+                                                "possible multi "
+                                                "stream corruption!\n");
+                                        goto err_telluser;
+                                } else {
+                                        goto err_silent;
+                                }
+                        }
+
+                        memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
+                        ar->rx_failover_missing -= tlen;
+
+                        if (ar->rx_failover_missing <= 0) {
+                                /*
+                                 * nested carl9170_rx_stream call!
+                                 *
+                                 * termination is guranteed, even when the
+                                 * combined frame also have an element with
+                                 * a bad tag.
+                                 */
+
+                                ar->rx_failover_missing = 0;
+                                carl9170_rx_stream(ar, ar->rx_failover->data,
+                                                   ar->rx_failover->len);
+
+                                skb_reset_tail_pointer(ar->rx_failover);
+                                skb_trim(ar->rx_failover, 0);
+                        }
+
+                        return;
+                }
+
+                /* check if stream is clipped */
+                if (wlen > tlen - 4) {
+                        if (ar->rx_failover_missing) {
+                                /* TODO: handle double stream corruption. */
+                                if (net_ratelimit()) {
+                                        wiphy_err(ar->hw->wiphy, "double rx "
+                                                "stream corruption!\n");
+                                        goto err_telluser;
+                                } else {
+                                        goto err_silent;
+                                }
+                        }
+
+                        /*
+                         * save incomplete data set.
+                         * the firmware will resend the missing bits when
+                         * the rx - descriptor comes round again.
+                         */
+
+                        memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
+                        ar->rx_failover_missing = clen - tlen;
+                        return;
+                }
+                __carl9170_rx(ar, rx_stream->payload, clen);
+
+                tbuf += wlen + 4;
+                tlen -= wlen + 4;
+        }
+
+        if (tlen) {
+                if (net_ratelimit()) {
+                        wiphy_err(ar->hw->wiphy, "%d bytes of unprocessed "
+                                "data left in rx stream!\n", tlen);
+                }
+
+                goto err_telluser;
+        }
+
+        return;
+
+err_telluser:
+        wiphy_err(ar->hw->wiphy, "damaged RX stream data [want:%d, "
+                "data:%d, rx:%d, pending:%d ]\n", clen, wlen, tlen,
+                ar->rx_failover_missing);
+
+        if (ar->rx_failover_missing)
+                print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
+                                     ar->rx_failover->data,
+                                     ar->rx_failover->len);
+
+        print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
+                             buf, len);
+
+        wiphy_err(ar->hw->wiphy, "please check your hardware and cables, if "
+                "you see this message frequently.\n");
+
+err_silent:
+        if (ar->rx_failover_missing) {
+                skb_reset_tail_pointer(ar->rx_failover);
+                skb_trim(ar->rx_failover, 0);
+                ar->rx_failover_missing = 0;
+        }
+}
+
+void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len)
+{
+        if (ar->fw.rx_stream)
+                carl9170_rx_stream(ar, buf, len);
+        else
+                __carl9170_rx(ar, buf, len);
+}
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
new file mode 100644
index 000000000000..e0d2374e0c77
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -0,0 +1,1373 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * 802.11 xmit & status routines
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "hw.h"
+#include "cmd.h"
+
+static inline unsigned int __carl9170_get_queue(struct ar9170 *ar,
+                                                unsigned int queue)
+{
+        if (unlikely(modparam_noht)) {
+                return queue;
+        } else {
+                /*
+                 * This is just another workaround, until
+                 * someone figures out how to get QoS and
+                 * AMPDU to play nicely together.
+                 */
+
+                return 2;               /* AC_BE */
+        }
+}
+
+static inline unsigned int carl9170_get_queue(struct ar9170 *ar,
+                                              struct sk_buff *skb)
+{
+        return __carl9170_get_queue(ar, skb_get_queue_mapping(skb));
+}
+
+static bool is_mem_full(struct ar9170 *ar)
+{
+        return (DIV_ROUND_UP(IEEE80211_MAX_FRAME_LEN, ar->fw.mem_block_size) >
+                atomic_read(&ar->mem_free_blocks));
+}
+
+static void carl9170_tx_accounting(struct ar9170 *ar, struct sk_buff *skb)
+{
+        int queue, i;
+        bool mem_full;
+
+        atomic_inc(&ar->tx_total_queued);
+
+        queue = skb_get_queue_mapping(skb);
+        spin_lock_bh(&ar->tx_stats_lock);
+
+        /*
+         * The driver has to accept the frame, regardless if the queue is
+         * full to the brim, or not. We have to do the queuing internally,
+         * since mac80211 assumes that a driver which can operate with
+         * aggregated frames does not reject frames for this reason.
+         */
+        ar->tx_stats[queue].len++;
+        ar->tx_stats[queue].count++;
+
+        mem_full = is_mem_full(ar);
+        for (i = 0; i < ar->hw->queues; i++) {
+                if (mem_full || ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
+                        ieee80211_stop_queue(ar->hw, i);
+                        ar->queue_stop_timeout[i] = jiffies;
+                }
+        }
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+}
+
+static void carl9170_tx_accounting_free(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *txinfo;
+        int queue;
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        queue = skb_get_queue_mapping(skb);
+
+        spin_lock_bh(&ar->tx_stats_lock);
+
+        ar->tx_stats[queue].len--;
+
+        if (!is_mem_full(ar)) {
+                unsigned int i;
+                for (i = 0; i < ar->hw->queues; i++) {
+                        if (ar->tx_stats[i].len >= CARL9170_NUM_TX_LIMIT_SOFT)
+                                continue;
+
+                        if (ieee80211_queue_stopped(ar->hw, i)) {
+                                unsigned long tmp;
+
+                                tmp = jiffies - ar->queue_stop_timeout[i];
+                                if (tmp > ar->max_queue_stop_timeout[i])
+                                        ar->max_queue_stop_timeout[i] = tmp;
+                        }
+
+                        ieee80211_wake_queue(ar->hw, i);
+                }
+        }
+
+        spin_unlock_bh(&ar->tx_stats_lock);
+        if (atomic_dec_and_test(&ar->tx_total_queued))
+                complete(&ar->tx_flush);
+}
+
+static int carl9170_alloc_dev_space(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        unsigned int chunks;
+        int cookie = -1;
+
+        atomic_inc(&ar->mem_allocs);
+
+        chunks = DIV_ROUND_UP(skb->len, ar->fw.mem_block_size);
+        if (unlikely(atomic_sub_return(chunks, &ar->mem_free_blocks) < 0)) {
+                atomic_add(chunks, &ar->mem_free_blocks);
+                return -ENOSPC;
+        }
+
+        spin_lock_bh(&ar->mem_lock);
+        cookie = bitmap_find_free_region(ar->mem_bitmap, ar->fw.mem_blocks, 0);
+        spin_unlock_bh(&ar->mem_lock);
+
+        if (unlikely(cookie < 0)) {
+                atomic_add(chunks, &ar->mem_free_blocks);
+                return -ENOSPC;
+        }
+
+        super = (void *) skb->data;
+
+        /*
+         * Cookie #0 serves two special purposes:
+         *  1. The firmware might use it generate BlockACK frames
+         *     in responds of an incoming BlockAckReqs.
+         *
+         *  2. Prevent double-free bugs.
+         */
+        super->s.cookie = (u8) cookie + 1;
+        return 0;
+}
+
+static void carl9170_release_dev_space(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        int cookie;
+
+        /* make a local copy of the cookie */
+        cookie = super->s.cookie;
+        /* invalidate cookie */
+        super->s.cookie = 0;
+
+        /*
+         * Do a out-of-bounds check on the cookie:
+         *
+         *  * cookie "0" is reserved and won't be assigned to any
+         *    out-going frame. Internally however, it is used to
+         *    mark no longer/un-accounted frames and serves as a
+         *    cheap way of preventing frames from being freed
+         *    twice by _accident_. NB: There is a tiny race...
+         *
+         *  * obviously, cookie number is limited by the amount
+         *    of available memory blocks, so the number can
+         *    never execeed the mem_blocks count.
+         */
+        if (unlikely(WARN_ON_ONCE(cookie == 0) ||
+            WARN_ON_ONCE(cookie > ar->fw.mem_blocks)))
+                return;
+
+        atomic_add(DIV_ROUND_UP(skb->len, ar->fw.mem_block_size),
+                   &ar->mem_free_blocks);
+
+        spin_lock_bh(&ar->mem_lock);
+        bitmap_release_region(ar->mem_bitmap, cookie - 1, 0);
+        spin_unlock_bh(&ar->mem_lock);
+}
+
+/* Called from any context */
+static void carl9170_tx_release(struct kref *ref)
+{
+        struct ar9170 *ar;
+        struct carl9170_tx_info *arinfo;
+        struct ieee80211_tx_info *txinfo;
+        struct sk_buff *skb;
+
+        arinfo = container_of(ref, struct carl9170_tx_info, ref);
+        txinfo = container_of((void *) arinfo, struct ieee80211_tx_info,
+                              rate_driver_data);
+        skb = container_of((void *) txinfo, struct sk_buff, cb);
+
+        ar = arinfo->ar;
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        BUILD_BUG_ON(
+            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+
+        memset(&txinfo->status.ampdu_ack_len, 0,
+               sizeof(struct ieee80211_tx_info) -
+               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
+
+        if (atomic_read(&ar->tx_total_queued))
+                ar->tx_schedule = true;
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU) {
+                if (!atomic_read(&ar->tx_ampdu_upload))
+                        ar->tx_ampdu_schedule = true;
+
+                if (txinfo->flags & IEEE80211_TX_STAT_AMPDU) {
+                        txinfo->status.ampdu_len = txinfo->pad[0];
+                        txinfo->status.ampdu_ack_len = txinfo->pad[1];
+                        txinfo->pad[0] = txinfo->pad[1] = 0;
+                } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
+                        /*
+                         * drop redundant tx_status reports:
+                         *
+                         * 1. ampdu_ack_len of the final tx_status does
+                         *    include the feedback of this particular frame.
+                         *
+                         * 2. tx_status_irqsafe only queues up to 128
+                         *    tx feedback reports and discards the rest.
+                         *
+                         * 3. minstrel_ht is picky, it only accepts
+                         *    reports of frames with the TX_STATUS_AMPDU flag.
+                         */
+
+                        dev_kfree_skb_any(skb);
+                        return;
+                } else {
+                        /*
+                         * Frame has failed, but we want to keep it in
+                         * case it was lost due to a power-state
+                         * transition.
+                         */
+                }
+        }
+
+        skb_pull(skb, sizeof(struct _carl9170_tx_superframe));
+        ieee80211_tx_status_irqsafe(ar->hw, skb);
+}
+
+void carl9170_tx_get_skb(struct sk_buff *skb)
+{
+        struct carl9170_tx_info *arinfo = (void *)
+                (IEEE80211_SKB_CB(skb))->rate_driver_data;
+        kref_get(&arinfo->ref);
+}
+
+int carl9170_tx_put_skb(struct sk_buff *skb)
+{
+        struct carl9170_tx_info *arinfo = (void *)
+                (IEEE80211_SKB_CB(skb))->rate_driver_data;
+
+        return kref_put(&arinfo->ref, carl9170_tx_release);
+}
+
+/* Caller must hold the tid_info->lock & rcu_read_lock */
+static void carl9170_tx_shift_bm(struct ar9170 *ar,
+        struct carl9170_sta_tid *tid_info, u16 seq)
+{
+        u16 off;
+
+        off = SEQ_DIFF(seq, tid_info->bsn);
+
+        if (WARN_ON_ONCE(off >= CARL9170_BAW_BITS))
+                return;
+
+        /*
+         * Sanity check. For each MPDU we set the bit in bitmap and
+         * clear it once we received the tx_status.
+         * But if the bit is already cleared then we've been bitten
+         * by a bug.
+         */
+        WARN_ON_ONCE(!test_and_clear_bit(off, tid_info->bitmap));
+
+        off = SEQ_DIFF(tid_info->snx, tid_info->bsn);
+        if (WARN_ON_ONCE(off >= CARL9170_BAW_BITS))
+                return;
+
+        if (!bitmap_empty(tid_info->bitmap, off))
+                off = find_first_bit(tid_info->bitmap, off);
+
+        tid_info->bsn += off;
+        tid_info->bsn &= 0x0fff;
+
+        bitmap_shift_right(tid_info->bitmap, tid_info->bitmap,
+                           off, CARL9170_BAW_BITS);
+}
+
+static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
+        struct sk_buff *skb, struct ieee80211_tx_info *txinfo)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        struct ieee80211_hdr *hdr = (void *) super->frame_data;
+        struct ieee80211_tx_info *tx_info;
+        struct carl9170_tx_info *ar_info;
+        struct carl9170_sta_info *sta_info;
+        struct ieee80211_sta *sta;
+        struct carl9170_sta_tid *tid_info;
+        struct ieee80211_vif *vif;
+        unsigned int vif_id;
+        u8 tid;
+
+        if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
+                return;
+
+        tx_info = IEEE80211_SKB_CB(skb);
+        ar_info = (void *) tx_info->rate_driver_data;
+
+        vif_id = (super->s.misc & CARL9170_TX_SUPER_MISC_VIF_ID) >>
+                 CARL9170_TX_SUPER_MISC_VIF_ID_S;
+
+        if (WARN_ON_ONCE(vif_id >= AR9170_MAX_VIRTUAL_MAC))
+                return;
+
+        rcu_read_lock();
+        vif = rcu_dereference(ar->vif_priv[vif_id].vif);
+        if (unlikely(!vif))
+                goto out_rcu;
+
+        /*
+         * Normally we should use wrappers like ieee80211_get_DA to get
+         * the correct peer ieee80211_sta.
+         *
+         * But there is a problem with indirect traffic (broadcasts, or
+         * data which is designated for other stations) in station mode.
+         * The frame will be directed to the AP for distribution and not
+         * to the actual destination.
+         */
+        sta = ieee80211_find_sta(vif, hdr->addr1);
+        if (unlikely(!sta))
+                goto out_rcu;
+
+        tid = get_tid_h(hdr);
+
+        sta_info = (void *) sta->drv_priv;
+        tid_info = rcu_dereference(sta_info->agg[tid]);
+        if (!tid_info)
+                goto out_rcu;
+
+        spin_lock_bh(&tid_info->lock);
+        if (likely(tid_info->state >= CARL9170_TID_STATE_IDLE))
+                carl9170_tx_shift_bm(ar, tid_info, get_seq_h(hdr));
+
+        if (sta_info->stats[tid].clear) {
+                sta_info->stats[tid].clear = false;
+                sta_info->stats[tid].ampdu_len = 0;
+                sta_info->stats[tid].ampdu_ack_len = 0;
+        }
+
+        sta_info->stats[tid].ampdu_len++;
+        if (txinfo->status.rates[0].count == 1)
+                sta_info->stats[tid].ampdu_ack_len++;
+
+        if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
+                txinfo->pad[0] = sta_info->stats[tid].ampdu_len;
+                txinfo->pad[1] = sta_info->stats[tid].ampdu_ack_len;
+                txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
+                sta_info->stats[tid].clear = true;
+        }
+        spin_unlock_bh(&tid_info->lock);
+
+out_rcu:
+        rcu_read_unlock();
+}
+
+void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
+                        const bool success)
+{
+        struct ieee80211_tx_info *txinfo;
+
+        carl9170_tx_accounting_free(ar, skb);
+
+        txinfo = IEEE80211_SKB_CB(skb);
+
+        if (success)
+                txinfo->flags |= IEEE80211_TX_STAT_ACK;
+        else
+                ar->tx_ack_failures++;
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU)
+                carl9170_tx_status_process_ampdu(ar, skb, txinfo);
+
+        carl9170_tx_put_skb(skb);
+}
+
+/* This function may be called form any context */
+void carl9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+
+        atomic_dec(&ar->tx_total_pending);
+
+        if (txinfo->flags & IEEE80211_TX_CTL_AMPDU)
+                atomic_dec(&ar->tx_ampdu_upload);
+
+        if (carl9170_tx_put_skb(skb))
+                tasklet_hi_schedule(&ar->usb_tasklet);
+}
+
+static struct sk_buff *carl9170_get_queued_skb(struct ar9170 *ar, u8 cookie,
+                                               struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+
+        spin_lock_bh(&queue->lock);
+        skb_queue_walk(queue, skb) {
+                struct _carl9170_tx_superframe *txc = (void *) skb->data;
+
+                if (txc->s.cookie != cookie)
+                        continue;
+
+                __skb_unlink(skb, queue);
+                spin_unlock_bh(&queue->lock);
+
+                carl9170_release_dev_space(ar, skb);
+                return skb;
+        }
+        spin_unlock_bh(&queue->lock);
+
+        return NULL;
+}
+
+static void carl9170_tx_fill_rateinfo(struct ar9170 *ar, unsigned int rix,
+        unsigned int tries, struct ieee80211_tx_info *txinfo)
+{
+        unsigned int i;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                if (txinfo->status.rates[i].idx < 0)
+                        break;
+
+                if (i == rix) {
+                        txinfo->status.rates[i].count = tries;
+                        i++;
+                        break;
+                }
+        }
+
+        for (; i < IEEE80211_TX_MAX_RATES; i++) {
+                txinfo->status.rates[i].idx = -1;
+                txinfo->status.rates[i].count = 0;
+        }
+}
+
+static void carl9170_check_queue_stop_timeout(struct ar9170 *ar)
+{
+        int i;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        bool restart = false;
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                spin_lock_bh(&ar->tx_status[i].lock);
+
+                skb = skb_peek(&ar->tx_status[i]);
+
+                if (!skb)
+                        goto next;
+
+                txinfo = IEEE80211_SKB_CB(skb);
+                arinfo = (void *) txinfo->rate_driver_data;
+
+                if (time_is_before_jiffies(arinfo->timeout +
+                    msecs_to_jiffies(CARL9170_QUEUE_STUCK_TIMEOUT)) == true)
+                        restart = true;
+
+next:
+                spin_unlock_bh(&ar->tx_status[i].lock);
+        }
+
+        if (restart) {
+                /*
+                 * At least one queue has been stuck for long enough.
+                 * Give the device a kick and hope it gets back to
+                 * work.
+                 *
+                 * possible reasons may include:
+                 *  - frames got lost/corrupted (bad connection to the device)
+                 *  - stalled rx processing/usb controller hiccups
+                 *  - firmware errors/bugs
+                 *  - every bug you can think of.
+                 *  - all bugs you can't...
+                 *  - ...
+                 */
+                carl9170_restart(ar, CARL9170_RR_STUCK_TX);
+        }
+}
+
+void carl9170_tx_janitor(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170,
+                                         tx_janitor.work);
+        if (!IS_STARTED(ar))
+                return;
+
+        ar->tx_janitor_last_run = jiffies;
+
+        carl9170_check_queue_stop_timeout(ar);
+
+        if (!atomic_read(&ar->tx_total_queued))
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw, &ar->tx_janitor,
+                msecs_to_jiffies(CARL9170_TX_TIMEOUT));
+}
+
+static void __carl9170_tx_process_status(struct ar9170 *ar,
+        const uint8_t cookie, const uint8_t info)
+{
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        unsigned int r, t, q;
+        bool success = true;
+
+        q = ar9170_qmap[info & CARL9170_TX_STATUS_QUEUE];
+
+        skb = carl9170_get_queued_skb(ar, cookie, &ar->tx_status[q]);
+        if (!skb) {
+                /*
+                 * We have lost the race to another thread.
+                 */
+
+                return ;
+        }
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        arinfo = (void *) txinfo->rate_driver_data;
+
+        if (!(info & CARL9170_TX_STATUS_SUCCESS))
+                success = false;
+
+        r = (info & CARL9170_TX_STATUS_RIX) >> CARL9170_TX_STATUS_RIX_S;
+        t = (info & CARL9170_TX_STATUS_TRIES) >> CARL9170_TX_STATUS_TRIES_S;
+
+        carl9170_tx_fill_rateinfo(ar, r, t, txinfo);
+        carl9170_tx_status(ar, skb, success);
+}
+
+void carl9170_tx_process_status(struct ar9170 *ar,
+                                const struct carl9170_rsp *cmd)
+{
+        unsigned int i;
+
+        for (i = 0;  i < cmd->hdr.ext; i++) {
+                if (WARN_ON(i > ((cmd->hdr.len / 2) + 1))) {
+                        print_hex_dump_bytes("UU:", DUMP_PREFIX_NONE,
+                                             (void *) cmd, cmd->hdr.len + 4);
+                        break;
+                }
+
+                __carl9170_tx_process_status(ar, cmd->_tx_status[i].cookie,
+                                             cmd->_tx_status[i].info);
+        }
+}
+
+static __le32 carl9170_tx_physet(struct ar9170 *ar,
+        struct ieee80211_tx_info *info, struct ieee80211_tx_rate *txrate)
+{
+        struct ieee80211_rate *rate = NULL;
+        u32 power, chains;
+        __le32 tmp;
+
+        tmp = cpu_to_le32(0);
+
+        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ <<
+                        AR9170_TX_PHY_BW_S);
+        /* this works because 40 MHz is 2 and dup is 3 */
+        if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP <<
+                        AR9170_TX_PHY_BW_S);
+
+        if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
+                tmp |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
+
+        if (txrate->flags & IEEE80211_TX_RC_MCS) {
+                u32 r = txrate->idx;
+                u8 *txpower;
+
+                /* heavy clip control */
+                tmp |= cpu_to_le32((r & 0x7) <<
+                        AR9170_TX_PHY_TX_HEAVY_CLIP_S);
+
+                if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht40;
+                        else
+                                txpower = ar->power_2G_ht40;
+                } else {
+                        if (info->band == IEEE80211_BAND_5GHZ)
+                                txpower = ar->power_5G_ht20;
+                        else
+                                txpower = ar->power_2G_ht20;
+                }
+
+                power = txpower[r & 7];
+
+                /* +1 dBm for HT40 */
+                if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        power += 2;
+
+                r <<= AR9170_TX_PHY_MCS_S;
+                BUG_ON(r & ~AR9170_TX_PHY_MCS);
+
+                tmp |= cpu_to_le32(r & AR9170_TX_PHY_MCS);
+                tmp |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
+
+                /*
+                 * green field preamble does not work.
+                 *
+                 * if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
+                 * tmp |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
+                 */
+        } else {
+                u8 *txpower;
+                u32 mod;
+                u32 phyrate;
+                u8 idx = txrate->idx;
+
+                if (info->band != IEEE80211_BAND_2GHZ) {
+                        idx += 4;
+                        txpower = ar->power_5G_leg;
+                        mod = AR9170_TX_PHY_MOD_OFDM;
+                } else {
+                        if (idx < 4) {
+                                txpower = ar->power_2G_cck;
+                                mod = AR9170_TX_PHY_MOD_CCK;
+                        } else {
+                                mod = AR9170_TX_PHY_MOD_OFDM;
+                                txpower = ar->power_2G_ofdm;
+                        }
+                }
+
+                rate = &__carl9170_ratetable[idx];
+
+                phyrate = rate->hw_value & 0xF;
+                power = txpower[(rate->hw_value & 0x30) >> 4];
+                phyrate <<= AR9170_TX_PHY_MCS_S;
+
+                tmp |= cpu_to_le32(mod);
+                tmp |= cpu_to_le32(phyrate);
+
+                /*
+                 * short preamble seems to be broken too.
+                 *
+                 * if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                 *      tmp |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
+                 */
+        }
+        power <<= AR9170_TX_PHY_TX_PWR_S;
+        power &= AR9170_TX_PHY_TX_PWR;
+        tmp |= cpu_to_le32(power);
+
+        /* set TX chains */
+        if (ar->eeprom.tx_mask == 1) {
+                chains = AR9170_TX_PHY_TXCHAIN_1;
+        } else {
+                chains = AR9170_TX_PHY_TXCHAIN_2;
+
+                /* >= 36M legacy OFDM - use only one chain */
+                if (rate && rate->bitrate >= 360 &&
+                    !(txrate->flags & IEEE80211_TX_RC_MCS))
+                        chains = AR9170_TX_PHY_TXCHAIN_1;
+        }
+        tmp |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_S);
+
+        return tmp;
+}
+
+static bool carl9170_tx_rts_check(struct ar9170 *ar,
+                                  struct ieee80211_tx_rate *rate,
+                                  bool ampdu, bool multi)
+{
+        switch (ar->erp_mode) {
+        case CARL9170_ERP_AUTO:
+                if (ampdu)
+                        break;
+
+        case CARL9170_ERP_MAC80211:
+                if (!(rate->flags & IEEE80211_TX_RC_USE_RTS_CTS))
+                        break;
+
+        case CARL9170_ERP_RTS:
+                if (likely(!multi))
+                        return true;
+
+        default:
+                break;
+        }
+
+        return false;
+}
+
+static bool carl9170_tx_cts_check(struct ar9170 *ar,
+                                  struct ieee80211_tx_rate *rate)
+{
+        switch (ar->erp_mode) {
+        case CARL9170_ERP_AUTO:
+        case CARL9170_ERP_MAC80211:
+                if (!(rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                        break;
+
+        case CARL9170_ERP_CTS:
+                return true;
+
+        default:
+                break;
+        }
+
+        return false;
+}
+
+static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        struct _carl9170_tx_superframe *txc;
+        struct carl9170_vif_info *cvif;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_tx_rate *txrate;
+        struct ieee80211_sta *sta;
+        struct carl9170_tx_info *arinfo;
+        unsigned int hw_queue;
+        int i;
+        u16 keytype = 0;
+        u16 len, icv = 0;
+        bool ampdu, no_ack;
+
+        BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
+        BUILD_BUG_ON(sizeof(struct _carl9170_tx_superdesc) !=
+                     CARL9170_TX_SUPERDESC_LEN);
+
+        BUILD_BUG_ON(sizeof(struct _ar9170_tx_hwdesc) !=
+                     AR9170_TX_HWDESC_LEN);
+
+        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES < CARL9170_TX_MAX_RATES);
+
+        hw_queue = ar9170_qmap[carl9170_get_queue(ar, skb)];
+
+        hdr = (void *)skb->data;
+        info = IEEE80211_SKB_CB(skb);
+        len = skb->len;
+
+        /*
+         * Note: If the frame was sent through a monitor interface,
+         * the ieee80211_vif pointer can be NULL.
+         */
+        if (likely(info->control.vif))
+                cvif = (void *) info->control.vif->drv_priv;
+        else
+                cvif = NULL;
+
+        sta = info->control.sta;
+
+        txc = (void *)skb_push(skb, sizeof(*txc));
+        memset(txc, 0, sizeof(*txc));
+
+        ampdu = !!(info->flags & IEEE80211_TX_CTL_AMPDU);
+        no_ack = !!(info->flags & IEEE80211_TX_CTL_NO_ACK);
+
+        if (info->control.hw_key) {
+                icv = info->control.hw_key->icv_len;
+
+                switch (info->control.hw_key->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                case WLAN_CIPHER_SUITE_TKIP:
+                        keytype = AR9170_TX_MAC_ENCR_RC4;
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        keytype = AR9170_TX_MAC_ENCR_AES;
+                        break;
+                default:
+                        WARN_ON(1);
+                        goto err_out;
+                }
+        }
+
+        BUILD_BUG_ON(AR9170_MAX_VIRTUAL_MAC >
+                ((CARL9170_TX_SUPER_MISC_VIF_ID >>
+                 CARL9170_TX_SUPER_MISC_VIF_ID_S) + 1));
+
+        txc->s.len = cpu_to_le16(len + sizeof(*txc));
+        txc->f.length = cpu_to_le16(len + icv + 4);
+        SET_VAL(CARL9170_TX_SUPER_MISC_VIF_ID, txc->s.misc,
+                cvif ? cvif->id : 0);
+
+        txc->f.mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
+                                         AR9170_TX_MAC_BACKOFF);
+
+        SET_VAL(CARL9170_TX_SUPER_MISC_QUEUE, txc->s.misc, hw_queue);
+
+        txc->f.mac_control |= cpu_to_le16(hw_queue << AR9170_TX_MAC_QOS_S);
+        txc->f.mac_control |= cpu_to_le16(keytype);
+        txc->f.phy_control = cpu_to_le32(0);
+
+        if (no_ack)
+                txc->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
+
+        if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
+                txc->s.misc |= CARL9170_TX_SUPER_MISC_CAB;
+
+        txrate = &info->control.rates[0];
+        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                txc->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
+        else if (carl9170_tx_cts_check(ar, txrate))
+                txc->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
+
+        SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[0], txrate->count);
+        txc->f.phy_control |= carl9170_tx_physet(ar, info, txrate);
+
+        if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
+                        txrate = &info->control.rates[i];
+                        if (txrate->idx >= 0)
+                                continue;
+
+                        txrate->idx = 0;
+                        txrate->count = ar->hw->max_rate_tries;
+                }
+        }
+
+        /*
+         * NOTE: For the first rate, the ERP & AMPDU flags are directly
+         * taken from mac_control. For all fallback rate, the firmware
+         * updates the mac_control flags from the rate info field.
+         */
+        for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
+                txrate = &info->control.rates[i];
+                if (txrate->idx < 0)
+                        break;
+
+                SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[i],
+                        txrate->count);
+
+                if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                        txc->s.ri[i] |= (AR9170_TX_MAC_PROT_RTS <<
+                                CARL9170_TX_SUPER_RI_ERP_PROT_S);
+                else if (carl9170_tx_cts_check(ar, txrate))
+                        txc->s.ri[i] |= (AR9170_TX_MAC_PROT_CTS <<
+                                CARL9170_TX_SUPER_RI_ERP_PROT_S);
+
+                /*
+                 * unaggregated fallback, in case aggregation
+                 * proves to be unsuccessful and unreliable.
+                 */
+                if (ampdu && i < 3)
+                        txc->s.ri[i] |= CARL9170_TX_SUPER_RI_AMPDU;
+
+                txc->s.rr[i - 1] = carl9170_tx_physet(ar, info, txrate);
+        }
+
+        if (ieee80211_is_probe_resp(hdr->frame_control))
+                txc->s.misc |= CARL9170_TX_SUPER_MISC_FILL_IN_TSF;
+
+        if (ampdu) {
+                unsigned int density, factor;
+
+                if (unlikely(!sta || !cvif))
+                        goto err_out;
+
+                density = info->control.sta->ht_cap.ampdu_density;
+                factor = info->control.sta->ht_cap.ampdu_factor;
+
+                if (density) {
+                        /*
+                         * Watch out!
+                         *
+                         * Otus uses slightly different density values than
+                         * those from the 802.11n spec.
+                         */
+
+                        density = max_t(unsigned int, density + 1, 7u);
+                }
+
+                factor = min_t(unsigned int, 1u, factor);
+
+                SET_VAL(CARL9170_TX_SUPER_AMPDU_DENSITY,
+                        txc->s.ampdu_settings, density);
+
+                SET_VAL(CARL9170_TX_SUPER_AMPDU_FACTOR,
+                        txc->s.ampdu_settings, factor);
+
+                if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS) {
+                        txc->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+                } else {
+                        /*
+                         * Not sure if it's even possible to aggregate
+                         * non-ht rates with this HW.
+                         */
+                        WARN_ON_ONCE(1);
+                }
+        }
+
+        arinfo = (void *)info->rate_driver_data;
+        arinfo->timeout = jiffies;
+        arinfo->ar = ar;
+        kref_init(&arinfo->ref);
+        return 0;
+
+err_out:
+        skb_pull(skb, sizeof(*txc));
+        return -EINVAL;
+}
+
+static void carl9170_set_immba(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+
+        super = (void *) skb->data;
+        super->f.mac_control |= cpu_to_le16(AR9170_TX_MAC_IMM_BA);
+}
+
+static void carl9170_set_ampdu_params(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+        int tmp;
+
+        super = (void *) skb->data;
+
+        tmp = (super->s.ampdu_settings & CARL9170_TX_SUPER_AMPDU_DENSITY) <<
+                CARL9170_TX_SUPER_AMPDU_DENSITY_S;
+
+        /*
+         * If you haven't noticed carl9170_tx_prepare has already filled
+         * in all ampdu spacing & factor parameters.
+         * Now it's the time to check whenever the settings have to be
+         * updated by the firmware, or if everything is still the same.
+         *
+         * There's no sane way to handle different density values with
+         * this hardware, so we may as well just do the compare in the
+         * driver.
+         */
+
+        if (tmp != ar->current_density) {
+                ar->current_density = tmp;
+                super->s.ampdu_settings |=
+                        CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY;
+        }
+
+        tmp = (super->s.ampdu_settings & CARL9170_TX_SUPER_AMPDU_FACTOR) <<
+                CARL9170_TX_SUPER_AMPDU_FACTOR_S;
+
+        if (tmp != ar->current_factor) {
+                ar->current_factor = tmp;
+                super->s.ampdu_settings |=
+                        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR;
+        }
+}
+
+static bool carl9170_tx_rate_check(struct ar9170 *ar, struct sk_buff *_dest,
+                                   struct sk_buff *_src)
+{
+        struct _carl9170_tx_superframe *dest, *src;
+
+        dest = (void *) _dest->data;
+        src = (void *) _src->data;
+
+        /*
+         * The mac80211 rate control algorithm expects that all MPDUs in
+         * an AMPDU share the same tx vectors.
+         * This is not really obvious right now, because the hardware
+         * does the AMPDU setup according to its own rulebook.
+         * Our nicely assembled, strictly monotonic increasing mpdu
+         * chains will be broken up, mashed back together...
+         */
+
+        return (dest->f.phy_control == src->f.phy_control);
+}
+
+static void carl9170_tx_ampdu(struct ar9170 *ar)
+{
+        struct sk_buff_head agg;
+        struct carl9170_sta_tid *tid_info;
+        struct sk_buff *skb, *first;
+        unsigned int i = 0, done_ampdus = 0;
+        u16 seq, queue, tmpssn;
+
+        atomic_inc(&ar->tx_ampdu_scheduler);
+        ar->tx_ampdu_schedule = false;
+
+        if (atomic_read(&ar->tx_ampdu_upload))
+                return;
+
+        if (!ar->tx_ampdu_list_len)
+                return;
+
+        __skb_queue_head_init(&agg);
+
+        rcu_read_lock();
+        tid_info = rcu_dereference(ar->tx_ampdu_iter);
+        if (WARN_ON_ONCE(!tid_info)) {
+                rcu_read_unlock();
+                return;
+        }
+
+retry:
+        list_for_each_entry_continue_rcu(tid_info, &ar->tx_ampdu_list, list) {
+                i++;
+
+                if (tid_info->state < CARL9170_TID_STATE_PROGRESS)
+                        continue;
+
+                queue = TID_TO_WME_AC(tid_info->tid);
+
+                spin_lock_bh(&tid_info->lock);
+                if (tid_info->state != CARL9170_TID_STATE_XMIT) {
+                        first = skb_peek(&tid_info->queue);
+                        if (first) {
+                                struct ieee80211_tx_info *txinfo;
+                                struct carl9170_tx_info *arinfo;
+
+                                txinfo = IEEE80211_SKB_CB(first);
+                                arinfo = (void *) txinfo->rate_driver_data;
+
+                                if (time_is_after_jiffies(arinfo->timeout +
+                                    msecs_to_jiffies(CARL9170_QUEUE_TIMEOUT))
+                                    == true)
+                                        goto processed;
+
+                                /*
+                                 * We've been waiting for the frame which
+                                 * matches "snx" (start sequence of the
+                                 * next aggregate) for some time now.
+                                 *
+                                 * But it never arrived. Therefore
+                                 * jump to the next available frame
+                                 * and kick-start the transmission.
+                                 *
+                                 * Note: This might induce odd latency
+                                 * spikes because the receiver will be
+                                 * waiting for the lost frame too.
+                                 */
+                                ar->tx_ampdu_timeout++;
+
+                                tid_info->snx = carl9170_get_seq(first);
+                                tid_info->state = CARL9170_TID_STATE_XMIT;
+                        } else {
+                                goto processed;
+                        }
+                }
+
+                tid_info->counter++;
+                first = skb_peek(&tid_info->queue);
+                tmpssn = carl9170_get_seq(first);
+                seq = tid_info->snx;
+
+                if (unlikely(tmpssn != seq)) {
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+
+                        goto processed;
+                }
+
+                while ((skb = skb_peek(&tid_info->queue))) {
+                        /* strict 0, 1, ..., n - 1, n frame sequence order */
+                        if (unlikely(carl9170_get_seq(skb) != seq))
+                                break;
+
+                        /* don't upload more than AMPDU FACTOR allows. */
+                        if (unlikely(SEQ_DIFF(tid_info->snx, tid_info->bsn) >=
+                            (tid_info->max - 1)))
+                                break;
+
+                        if (!carl9170_tx_rate_check(ar, skb, first))
+                                break;
+
+                        atomic_inc(&ar->tx_ampdu_upload);
+                        tid_info->snx = seq = SEQ_NEXT(seq);
+                        __skb_unlink(skb, &tid_info->queue);
+
+                        __skb_queue_tail(&agg, skb);
+
+                        if (skb_queue_len(&agg) >= CARL9170_NUM_TX_AGG_MAX)
+                                break;
+                }
+
+                if (skb_queue_empty(&tid_info->queue) ||
+                    carl9170_get_seq(skb_peek(&tid_info->queue)) !=
+                    tid_info->snx) {
+                        /*
+                         * stop TID, if A-MPDU frames are still missing,
+                         * or whenever the queue is empty.
+                         */
+
+                        tid_info->state = CARL9170_TID_STATE_IDLE;
+                }
+                done_ampdus++;
+
+processed:
+                spin_unlock_bh(&tid_info->lock);
+
+                if (skb_queue_empty(&agg))
+                        continue;
+
+                /* apply ampdu spacing & factor settings */
+                carl9170_set_ampdu_params(ar, skb_peek(&agg));
+
+                /* set aggregation push bit */
+                carl9170_set_immba(ar, skb_peek_tail(&agg));
+
+                spin_lock_bh(&ar->tx_pending[queue].lock);
+                skb_queue_splice_tail_init(&agg, &ar->tx_pending[queue]);
+                spin_unlock_bh(&ar->tx_pending[queue].lock);
+                ar->tx_schedule = true;
+        }
+        if ((done_ampdus++ == 0) && (i++ == 0))
+                goto retry;
+
+        rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
+        rcu_read_unlock();
+}
+
+static struct sk_buff *carl9170_tx_pick_skb(struct ar9170 *ar,
+                                            struct sk_buff_head *queue)
+{
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
+        struct carl9170_tx_info *arinfo;
+
+        BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
+
+        spin_lock_bh(&queue->lock);
+        skb = skb_peek(queue);
+        if (unlikely(!skb))
+                goto err_unlock;
+
+        if (carl9170_alloc_dev_space(ar, skb))
+                goto err_unlock;
+
+        __skb_unlink(skb, queue);
+        spin_unlock_bh(&queue->lock);
+
+        info = IEEE80211_SKB_CB(skb);
+        arinfo = (void *) info->rate_driver_data;
+
+        arinfo->timeout = jiffies;
+
+        /*
+         * increase ref count to "2".
+         * Ref counting is the easiest way to solve the race between
+         * the the urb's completion routine: carl9170_tx_callback and
+         * wlan tx status functions: carl9170_tx_status/janitor.
+         */
+        carl9170_tx_get_skb(skb);
+
+        return skb;
+
+err_unlock:
+        spin_unlock_bh(&queue->lock);
+        return NULL;
+}
+
+void carl9170_tx_drop(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super;
+        uint8_t q = 0;
+
+        ar->tx_dropped++;
+
+        super = (void *)skb->data;
+        SET_VAL(CARL9170_TX_SUPER_MISC_QUEUE, q,
+                ar9170_qmap[carl9170_get_queue(ar, skb)]);
+        __carl9170_tx_process_status(ar, super->s.cookie, q);
+}
+
+static void carl9170_tx(struct ar9170 *ar)
+{
+        struct sk_buff *skb;
+        unsigned int i, q;
+        bool schedule_garbagecollector = false;
+
+        ar->tx_schedule = false;
+
+        if (unlikely(!IS_STARTED(ar)))
+                return;
+
+        carl9170_usb_handle_tx_err(ar);
+
+        for (i = 0; i < ar->hw->queues; i++) {
+                while (!skb_queue_empty(&ar->tx_pending[i])) {
+                        skb = carl9170_tx_pick_skb(ar, &ar->tx_pending[i]);
+                        if (unlikely(!skb))
+                                break;
+
+                        atomic_inc(&ar->tx_total_pending);
+
+                        q = __carl9170_get_queue(ar, i);
+                        /*
+                         * NB: tx_status[i] vs. tx_status[q],
+                         * TODO: Move into pick_skb or alloc_dev_space.
+                         */
+                        skb_queue_tail(&ar->tx_status[q], skb);
+
+                        carl9170_usb_tx(ar, skb);
+                        schedule_garbagecollector = true;
+                }
+        }
+
+        if (!schedule_garbagecollector)
+                return;
+
+        ieee80211_queue_delayed_work(ar->hw, &ar->tx_janitor,
+                msecs_to_jiffies(CARL9170_TX_TIMEOUT));
+}
+
+static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
+        struct ieee80211_sta *sta, struct sk_buff *skb)
+{
+        struct carl9170_sta_info *sta_info;
+        struct carl9170_sta_tid *agg;
+        struct sk_buff *iter;
+        unsigned int max;
+        u16 tid, seq, qseq, off;
+        bool run = false;
+
+        tid = carl9170_get_tid(skb);
+        seq = carl9170_get_seq(skb);
+        sta_info = (void *) sta->drv_priv;
+
+        rcu_read_lock();
+        agg = rcu_dereference(sta_info->agg[tid]);
+        max = sta_info->ampdu_max_len;
+
+        if (!agg)
+                goto err_unlock_rcu;
+
+        spin_lock_bh(&agg->lock);
+        if (unlikely(agg->state < CARL9170_TID_STATE_IDLE))
+                goto err_unlock;
+
+        /* check if sequence is within the BA window */
+        if (unlikely(!BAW_WITHIN(agg->bsn, CARL9170_BAW_BITS, seq)))
+                goto err_unlock;
+
+        if (WARN_ON_ONCE(!BAW_WITHIN(agg->snx, CARL9170_BAW_BITS, seq)))
+                goto err_unlock;
+
+        off = SEQ_DIFF(seq, agg->bsn);
+        if (WARN_ON_ONCE(test_and_set_bit(off, agg->bitmap)))
+                goto err_unlock;
+
+        if (likely(BAW_WITHIN(agg->hsn, CARL9170_BAW_BITS, seq))) {
+                __skb_queue_tail(&agg->queue, skb);
+                agg->hsn = seq;
+                goto queued;
+        }
+
+        skb_queue_reverse_walk(&agg->queue, iter) {
+                qseq = carl9170_get_seq(iter);
+
+                if (BAW_WITHIN(qseq, CARL9170_BAW_BITS, seq)) {
+                        __skb_queue_after(&agg->queue, iter, skb);
+                        goto queued;
+                }
+        }
+
+        __skb_queue_head(&agg->queue, skb);
+queued:
+
+        if (unlikely(agg->state != CARL9170_TID_STATE_XMIT)) {
+                if (agg->snx == carl9170_get_seq(skb_peek(&agg->queue))) {
+                        agg->state = CARL9170_TID_STATE_XMIT;
+                        run = true;
+                }
+        }
+
+        spin_unlock_bh(&agg->lock);
+        rcu_read_unlock();
+
+        return run;
+
+err_unlock:
+        spin_unlock_bh(&agg->lock);
+
+err_unlock_rcu:
+        rcu_read_unlock();
+        carl9170_tx_status(ar, skb, false);
+        ar->tx_dropped++;
+        return false;
+}
+
+int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ar9170 *ar = hw->priv;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_sta *sta;
+        bool run;
+
+        if (unlikely(!IS_STARTED(ar)))
+                goto err_free;
+
+        info = IEEE80211_SKB_CB(skb);
+        sta = info->control.sta;
+
+        if (unlikely(carl9170_tx_prepare(ar, skb)))
+                goto err_free;
+
+        carl9170_tx_accounting(ar, skb);
+        /*
+         * from now on, one has to use carl9170_tx_status to free
+         * all ressouces which are associated with the frame.
+         */
+
+        if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if (WARN_ON_ONCE(!sta))
+                        goto err_free;
+
+                run = carl9170_tx_ampdu_queue(ar, sta, skb);
+                if (run)
+                        carl9170_tx_ampdu(ar);
+
+        } else {
+                unsigned int queue = skb_get_queue_mapping(skb);
+
+                skb_queue_tail(&ar->tx_pending[queue], skb);
+        }
+
+        carl9170_tx(ar);
+        return NETDEV_TX_OK;
+
+err_free:
+        ar->tx_dropped++;
+        dev_kfree_skb_any(skb);
+        return NETDEV_TX_OK;
+}
+
+void carl9170_tx_scheduler(struct ar9170 *ar)
+{
+
+        if (ar->tx_ampdu_schedule)
+                carl9170_tx_ampdu(ar);
+
+        if (ar->tx_schedule)
+                carl9170_tx(ar);
+}
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
new file mode 100644
index 000000000000..eb789a9e4f15
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -0,0 +1,1138 @@
+/*
+ * Atheros CARL9170 driver
+ *
+ * USB - frontend
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/usb.h>
+#include <linux/firmware.h>
+#include <linux/etherdevice.h>
+#include <linux/device.h>
+#include <net/mac80211.h>
+#include "carl9170.h"
+#include "cmd.h"
+#include "hw.h"
+#include "fwcmd.h"
+
+MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
+MODULE_AUTHOR("Christian Lamparter <chunkeey@googlemail.com>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
+MODULE_FIRMWARE(CARL9170FW_NAME);
+MODULE_ALIAS("ar9170usb");
+MODULE_ALIAS("arusb_lnx");
+
+/*
+ * Note:
+ *
+ * Always update our wiki's device list (located at:
+ * http://wireless.kernel.org/en/users/Drivers/ar9170/devices ),
+ * whenever you add a new device.
+ */
+static struct usb_device_id carl9170_usb_ids[] = {
+        /* Atheros 9170 */
+        { USB_DEVICE(0x0cf3, 0x9170) },
+        /* Atheros TG121N */
+        { USB_DEVICE(0x0cf3, 0x1001) },
+        /* TP-Link TL-WN821N v2 */
+        { USB_DEVICE(0x0cf3, 0x1002), .driver_info = CARL9170_WPS_BUTTON |
+                 CARL9170_ONE_LED },
+        /* 3Com Dual Band 802.11n USB Adapter */
+        { USB_DEVICE(0x0cf3, 0x1010) },
+        /* H3C Dual Band 802.11n USB Adapter */
+        { USB_DEVICE(0x0cf3, 0x1011) },
+        /* Cace Airpcap NX */
+        { USB_DEVICE(0xcace, 0x0300) },
+        /* D-Link DWA 160 A1 */
+        { USB_DEVICE(0x07d1, 0x3c10) },
+        /* D-Link DWA 160 A2 */
+        { USB_DEVICE(0x07d1, 0x3a09) },
+        /* Netgear WNA1000 */
+        { USB_DEVICE(0x0846, 0x9040) },
+        /* Netgear WNDA3100 */
+        { USB_DEVICE(0x0846, 0x9010) },
+        /* Netgear WN111 v2 */
+        { USB_DEVICE(0x0846, 0x9001), .driver_info = CARL9170_ONE_LED },
+        /* Zydas ZD1221 */
+        { USB_DEVICE(0x0ace, 0x1221) },
+        /* Proxim ORiNOCO 802.11n USB */
+        { USB_DEVICE(0x1435, 0x0804) },
+        /* WNC Generic 11n USB Dongle */
+        { USB_DEVICE(0x1435, 0x0326) },
+        /* ZyXEL NWD271N */
+        { USB_DEVICE(0x0586, 0x3417) },
+        /* Z-Com UB81 BG */
+        { USB_DEVICE(0x0cde, 0x0023) },
+        /* Z-Com UB82 ABG */
+        { USB_DEVICE(0x0cde, 0x0026) },
+        /* Sphairon Homelink 1202 */
+        { USB_DEVICE(0x0cde, 0x0027) },
+        /* Arcadyan WN7512 */
+        { USB_DEVICE(0x083a, 0xf522) },
+        /* Planex GWUS300 */
+        { USB_DEVICE(0x2019, 0x5304) },
+        /* IO-Data WNGDNUS2 */
+        { USB_DEVICE(0x04bb, 0x093f) },
+        /* NEC WL300NU-G */
+        { USB_DEVICE(0x0409, 0x0249) },
+        /* AVM FRITZ!WLAN USB Stick N */
+        { USB_DEVICE(0x057c, 0x8401) },
+        /* AVM FRITZ!WLAN USB Stick N 2.4 */
+        { USB_DEVICE(0x057c, 0x8402) },
+        /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
+        { USB_DEVICE(0x1668, 0x1200) },
+
+        /* terminate */
+        {}
+};
+MODULE_DEVICE_TABLE(usb, carl9170_usb_ids);
+
+static void carl9170_usb_submit_data_urb(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int err;
+
+        if (atomic_inc_return(&ar->tx_anch_urbs) > AR9170_NUM_TX_URBS)
+                goto err_acc;
+
+        urb = usb_get_from_anchor(&ar->tx_wait);
+        if (!urb)
+                goto err_acc;
+
+        usb_anchor_urb(urb, &ar->tx_anch);
+
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (unlikely(err)) {
+                if (net_ratelimit()) {
+                        dev_err(&ar->udev->dev, "tx submit failed (%d)\n",
+                                urb->status);
+                }
+
+                usb_unanchor_urb(urb);
+                usb_anchor_urb(urb, &ar->tx_err);
+        }
+
+        usb_free_urb(urb);
+
+        if (likely(err == 0))
+                return;
+
+err_acc:
+        atomic_dec(&ar->tx_anch_urbs);
+}
+
+static void carl9170_usb_tx_data_complete(struct urb *urb)
+{
+        struct ar9170 *ar = (struct ar9170 *)
+              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+
+        if (WARN_ON_ONCE(!ar)) {
+                dev_kfree_skb_irq(urb->context);
+                return;
+        }
+
+        atomic_dec(&ar->tx_anch_urbs);
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                carl9170_tx_callback(ar, (void *)urb->context);
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                /*
+                 * Defer the frame clean-up to the tasklet worker.
+                 * This is necessary, because carl9170_tx_drop
+                 * does not work in an irqsave context.
+                 */
+                usb_anchor_urb(urb, &ar->tx_err);
+                return;
+
+        /* a random transmission error has occurred? */
+        default:
+                if (net_ratelimit()) {
+                        dev_err(&ar->udev->dev, "tx failed (%d)\n",
+                                urb->status);
+                }
+
+                usb_anchor_urb(urb, &ar->tx_err);
+                break;
+        }
+
+        if (likely(IS_STARTED(ar)))
+                carl9170_usb_submit_data_urb(ar);
+}
+
+static int carl9170_usb_submit_cmd_urb(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int err;
+
+        if (atomic_inc_return(&ar->tx_cmd_urbs) != 1) {
+                atomic_dec(&ar->tx_cmd_urbs);
+                return 0;
+        }
+
+        urb = usb_get_from_anchor(&ar->tx_cmd);
+        if (!urb) {
+                atomic_dec(&ar->tx_cmd_urbs);
+                return 0;
+        }
+
+        usb_anchor_urb(urb, &ar->tx_anch);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (unlikely(err)) {
+                usb_unanchor_urb(urb);
+                atomic_dec(&ar->tx_cmd_urbs);
+        }
+        usb_free_urb(urb);
+
+        return err;
+}
+
+static void carl9170_usb_cmd_complete(struct urb *urb)
+{
+        struct ar9170 *ar = urb->context;
+        int err = 0;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        atomic_dec(&ar->tx_cmd_urbs);
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+
+        default:
+                err = urb->status;
+                break;
+        }
+
+        if (!IS_INITIALIZED(ar))
+                return;
+
+        if (err)
+                dev_err(&ar->udev->dev, "submit cmd cb failed (%d).\n", err);
+
+        err = carl9170_usb_submit_cmd_urb(ar);
+        if (err)
+                dev_err(&ar->udev->dev, "submit cmd failed (%d).\n", err);
+}
+
+static void carl9170_usb_rx_irq_complete(struct urb *urb)
+{
+        struct ar9170 *ar = urb->context;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        switch (urb->status) {
+        /* everything is fine */
+        case 0:
+                break;
+
+        /* disconnect */
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+
+        default:
+                goto resubmit;
+        }
+
+        carl9170_handle_command_response(ar, urb->transfer_buffer,
+                                         urb->actual_length);
+
+resubmit:
+        usb_anchor_urb(urb, &ar->rx_anch);
+        if (unlikely(usb_submit_urb(urb, GFP_ATOMIC)))
+                usb_unanchor_urb(urb);
+}
+
+static int carl9170_usb_submit_rx_urb(struct ar9170 *ar, gfp_t gfp)
+{
+        struct urb *urb;
+        int err = 0, runs = 0;
+
+        while ((atomic_read(&ar->rx_anch_urbs) < AR9170_NUM_RX_URBS) &&
+                (runs++ < AR9170_NUM_RX_URBS)) {
+                err = -ENOSPC;
+                urb = usb_get_from_anchor(&ar->rx_pool);
+                if (urb) {
+                        usb_anchor_urb(urb, &ar->rx_anch);
+                        err = usb_submit_urb(urb, gfp);
+                        if (unlikely(err)) {
+                                usb_unanchor_urb(urb);
+                                usb_anchor_urb(urb, &ar->rx_pool);
+                        } else {
+                                atomic_dec(&ar->rx_pool_urbs);
+                                atomic_inc(&ar->rx_anch_urbs);
+                        }
+                        usb_free_urb(urb);
+                }
+        }
+
+        return err;
+}
+
+static void carl9170_usb_rx_work(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int i;
+
+        for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
+                urb = usb_get_from_anchor(&ar->rx_work);
+                if (!urb)
+                        break;
+
+                atomic_dec(&ar->rx_work_urbs);
+                if (IS_INITIALIZED(ar)) {
+                        carl9170_rx(ar, urb->transfer_buffer,
+                                    urb->actual_length);
+                }
+
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+
+                usb_free_urb(urb);
+
+                carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
+        }
+}
+
+void carl9170_usb_handle_tx_err(struct ar9170 *ar)
+{
+        struct urb *urb;
+
+        while ((urb = usb_get_from_anchor(&ar->tx_err))) {
+                struct sk_buff *skb = (void *)urb->context;
+
+                carl9170_tx_drop(ar, skb);
+                carl9170_tx_callback(ar, skb);
+                usb_free_urb(urb);
+        }
+}
+
+static void carl9170_usb_tasklet(unsigned long data)
+{
+        struct ar9170 *ar = (struct ar9170 *) data;
+
+        if (!IS_INITIALIZED(ar))
+                return;
+
+        carl9170_usb_rx_work(ar);
+
+        /*
+         * Strictly speaking: The tx scheduler is not part of the USB system.
+         * But the rx worker returns frames back to the mac80211-stack and
+         * this is the _perfect_ place to generate the next transmissions.
+         */
+        if (IS_STARTED(ar))
+                carl9170_tx_scheduler(ar);
+}
+
+static void carl9170_usb_rx_complete(struct urb *urb)
+{
+        struct ar9170 *ar = (struct ar9170 *)urb->context;
+        int err;
+
+        if (WARN_ON_ONCE(!ar))
+                return;
+
+        atomic_dec(&ar->rx_anch_urbs);
+
+        switch (urb->status) {
+        case 0:
+                /* rx path */
+                usb_anchor_urb(urb, &ar->rx_work);
+                atomic_inc(&ar->rx_work_urbs);
+                break;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                /* handle disconnect events*/
+                return;
+
+        default:
+                /* handle all other errors */
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+                break;
+        }
+
+        err = carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
+        if (unlikely(err)) {
+                /*
+                 * usb_submit_rx_urb reported a problem.
+                 * In case this is due to a rx buffer shortage,
+                 * elevate the tasklet worker priority to
+                 * the highest available level.
+                 */
+                tasklet_hi_schedule(&ar->usb_tasklet);
+
+                if (atomic_read(&ar->rx_anch_urbs) == 0) {
+                        /*
+                         * The system is too slow to cope with
+                         * the enormous workload. We have simply
+                         * run out of active rx urbs and this
+                         * unfortunatly leads to an unpredictable
+                         * device.
+                         */
+
+                        carl9170_restart(ar, CARL9170_RR_SLOW_SYSTEM);
+                }
+        } else {
+                /*
+                 * Using anything less than _high_ priority absolutely
+                 * kills the rx performance my UP-System...
+                 */
+                tasklet_hi_schedule(&ar->usb_tasklet);
+        }
+}
+
+static struct urb *carl9170_usb_alloc_rx_urb(struct ar9170 *ar, gfp_t gfp)
+{
+        struct urb *urb;
+        void *buf;
+
+        buf = kmalloc(ar->fw.rx_size, gfp);
+        if (!buf)
+                return NULL;
+
+        urb = usb_alloc_urb(0, gfp);
+        if (!urb) {
+                kfree(buf);
+                return NULL;
+        }
+
+        usb_fill_bulk_urb(urb, ar->udev, usb_rcvbulkpipe(ar->udev,
+                          AR9170_USB_EP_RX), buf, ar->fw.rx_size,
+                          carl9170_usb_rx_complete, ar);
+
+        urb->transfer_flags |= URB_FREE_BUFFER;
+
+        return urb;
+}
+
+static int carl9170_usb_send_rx_irq_urb(struct ar9170 *ar)
+{
+        struct urb *urb = NULL;
+        void *ibuf;
+        int err = -ENOMEM;
+
+        urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!urb)
+                goto out;
+
+        ibuf = kmalloc(AR9170_USB_EP_CTRL_MAX, GFP_KERNEL);
+        if (!ibuf)
+                goto out;
+
+        usb_fill_int_urb(urb, ar->udev, usb_rcvintpipe(ar->udev,
+                         AR9170_USB_EP_IRQ), ibuf, AR9170_USB_EP_CTRL_MAX,
+                         carl9170_usb_rx_irq_complete, ar, 1);
+
+        urb->transfer_flags |= URB_FREE_BUFFER;
+
+        usb_anchor_urb(urb, &ar->rx_anch);
+        err = usb_submit_urb(urb, GFP_KERNEL);
+        if (err)
+                usb_unanchor_urb(urb);
+
+out:
+        usb_free_urb(urb);
+        return err;
+}
+
+static int carl9170_usb_init_rx_bulk_urbs(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int i, err = -EINVAL;
+
+        /*
+         * The driver actively maintains a second shadow
+         * pool for inactive, but fully-prepared rx urbs.
+         *
+         * The pool should help the driver to master huge
+         * workload spikes without running the risk of
+         * undersupplying the hardware or wasting time by
+         * processing rx data (streams) inside the urb
+         * completion (hardirq context).
+         */
+        for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
+                urb = carl9170_usb_alloc_rx_urb(ar, GFP_KERNEL);
+                if (!urb) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
+
+                usb_anchor_urb(urb, &ar->rx_pool);
+                atomic_inc(&ar->rx_pool_urbs);
+                usb_free_urb(urb);
+        }
+
+        err = carl9170_usb_submit_rx_urb(ar, GFP_KERNEL);
+        if (err)
+                goto err_out;
+
+        /* the device now waiting for the firmware. */
+        carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
+        return 0;
+
+err_out:
+
+        usb_scuttle_anchored_urbs(&ar->rx_pool);
+        usb_scuttle_anchored_urbs(&ar->rx_work);
+        usb_kill_anchored_urbs(&ar->rx_anch);
+        return err;
+}
+
+static int carl9170_usb_flush(struct ar9170 *ar)
+{
+        struct urb *urb;
+        int ret, err = 0;
+
+        while ((urb = usb_get_from_anchor(&ar->tx_wait))) {
+                struct sk_buff *skb = (void *)urb->context;
+                carl9170_tx_drop(ar, skb);
+                carl9170_tx_callback(ar, skb);
+                usb_free_urb(urb);
+        }
+
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, HZ);
+        if (ret == 0)
+                err = -ETIMEDOUT;
+
+        /* lets wait a while until the tx - queues are dried out */
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, HZ);
+        if (ret == 0)
+                err = -ETIMEDOUT;
+
+        usb_kill_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+
+        return err;
+}
+
+static void carl9170_usb_cancel_urbs(struct ar9170 *ar)
+{
+        int err;
+
+        carl9170_set_state(ar, CARL9170_UNKNOWN_STATE);
+
+        err = carl9170_usb_flush(ar);
+        if (err)
+                dev_err(&ar->udev->dev, "stuck tx urbs!\n");
+
+        usb_poison_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+        usb_poison_anchored_urbs(&ar->rx_anch);
+
+        tasklet_kill(&ar->usb_tasklet);
+
+        usb_scuttle_anchored_urbs(&ar->rx_work);
+        usb_scuttle_anchored_urbs(&ar->rx_pool);
+        usb_scuttle_anchored_urbs(&ar->tx_cmd);
+}
+
+int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
+                        const bool free_buf)
+{
+        struct urb *urb;
+
+        if (!IS_INITIALIZED(ar))
+                return -EPERM;
+
+        if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4))
+                return -EINVAL;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                return -ENOMEM;
+
+        usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
+                AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
+                carl9170_usb_cmd_complete, ar, 1);
+
+        urb->transfer_flags |= URB_ZERO_PACKET;
+
+        if (free_buf)
+                urb->transfer_flags |= URB_FREE_BUFFER;
+
+        usb_anchor_urb(urb, &ar->tx_cmd);
+        usb_free_urb(urb);
+
+        return carl9170_usb_submit_cmd_urb(ar);
+}
+
+int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd,
+        unsigned int plen, void *payload, unsigned int outlen, void *out)
+{
+        int err = -ENOMEM;
+
+        if (!IS_ACCEPTING_CMD(ar))
+                return -EIO;
+
+        if (!(cmd & CARL9170_CMD_ASYNC_FLAG))
+                might_sleep();
+
+        ar->cmd.hdr.len = plen;
+        ar->cmd.hdr.cmd = cmd;
+        /* writing multiple regs fills this buffer already */
+        if (plen && payload != (u8 *)(ar->cmd.data))
+                memcpy(ar->cmd.data, payload, plen);
+
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readbuf = (u8 *)out;
+        ar->readlen = outlen;
+        spin_unlock_bh(&ar->cmd_lock);
+
+        err = __carl9170_exec_cmd(ar, &ar->cmd, false);
+
+        if (!(cmd & CARL9170_CMD_ASYNC_FLAG)) {
+                err = wait_for_completion_timeout(&ar->cmd_wait, HZ);
+                if (err == 0) {
+                        err = -ETIMEDOUT;
+                        goto err_unbuf;
+                }
+
+                if (ar->readlen != outlen) {
+                        err = -EMSGSIZE;
+                        goto err_unbuf;
+                }
+        }
+
+        return 0;
+
+err_unbuf:
+        /* Maybe the device was removed in the moment we were waiting? */
+        if (IS_STARTED(ar)) {
+                dev_err(&ar->udev->dev, "no command feedback "
+                        "received (%d).\n", err);
+
+                /* provide some maybe useful debug information */
+                print_hex_dump_bytes("carl9170 cmd: ", DUMP_PREFIX_NONE,
+                                     &ar->cmd, plen + 4);
+
+                carl9170_restart(ar, CARL9170_RR_COMMAND_TIMEOUT);
+        }
+
+        /* invalidate to avoid completing the next command prematurely */
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readbuf = NULL;
+        ar->readlen = 0;
+        spin_unlock_bh(&ar->cmd_lock);
+
+        return err;
+}
+
+void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct urb *urb;
+        struct ar9170_stream *tx_stream;
+        void *data;
+        unsigned int len;
+
+        if (!IS_STARTED(ar))
+                goto err_drop;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto err_drop;
+
+        if (ar->fw.tx_stream) {
+                tx_stream = (void *) (skb->data - sizeof(*tx_stream));
+
+                len = skb->len + sizeof(*tx_stream);
+                tx_stream->length = cpu_to_le16(len);
+                tx_stream->tag = cpu_to_le16(AR9170_TX_STREAM_TAG);
+                data = tx_stream;
+        } else {
+                data = skb->data;
+                len = skb->len;
+        }
+
+        usb_fill_bulk_urb(urb, ar->udev, usb_sndbulkpipe(ar->udev,
+                AR9170_USB_EP_TX), data, len,
+                carl9170_usb_tx_data_complete, skb);
+
+        urb->transfer_flags |= URB_ZERO_PACKET;
+
+        usb_anchor_urb(urb, &ar->tx_wait);
+
+        usb_free_urb(urb);
+
+        carl9170_usb_submit_data_urb(ar);
+        return;
+
+err_drop:
+        carl9170_tx_drop(ar, skb);
+        carl9170_tx_callback(ar, skb);
+}
+
+static void carl9170_release_firmware(struct ar9170 *ar)
+{
+        if (ar->fw.fw) {
+                release_firmware(ar->fw.fw);
+                memset(&ar->fw, 0, sizeof(ar->fw));
+        }
+}
+
+void carl9170_usb_stop(struct ar9170 *ar)
+{
+        int ret;
+
+        carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STOPPED);
+
+        ret = carl9170_usb_flush(ar);
+        if (ret)
+                dev_err(&ar->udev->dev, "kill pending tx urbs.\n");
+
+        usb_poison_anchored_urbs(&ar->tx_anch);
+        carl9170_usb_handle_tx_err(ar);
+
+        /* kill any pending command */
+        spin_lock_bh(&ar->cmd_lock);
+        ar->readlen = 0;
+        spin_unlock_bh(&ar->cmd_lock);
+        complete_all(&ar->cmd_wait);
+
+        /* This is required to prevent an early completion on _start */
+        INIT_COMPLETION(ar->cmd_wait);
+
+        /*
+         * Note:
+         * So far we freed all tx urbs, but we won't dare to touch any rx urbs.
+         * Else we would end up with a unresponsive device...
+         */
+}
+
+int carl9170_usb_open(struct ar9170 *ar)
+{
+        usb_unpoison_anchored_urbs(&ar->tx_anch);
+
+        carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
+        return 0;
+}
+
+static int carl9170_usb_load_firmware(struct ar9170 *ar)
+{
+        const u8 *data;
+        u8 *buf;
+        unsigned int transfer;
+        size_t len;
+        u32 addr;
+        int err = 0;
+
+        buf = kmalloc(4096, GFP_KERNEL);
+        if (!buf) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        data = ar->fw.fw->data;
+        len = ar->fw.fw->size;
+        addr = ar->fw.address;
+
+        /* this removes the miniboot image */
+        data += ar->fw.offset;
+        len -= ar->fw.offset;
+
+        while (len) {
+                transfer = min_t(unsigned int, len, 4096u);
+                memcpy(buf, data, transfer);
+
+                err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
+                                      0x30 /* FW DL */, 0x40 | USB_DIR_OUT,
+                                      addr >> 8, 0, buf, transfer, 100);
+
+                if (err < 0) {
+                        kfree(buf);
+                        goto err_out;
+                }
+
+                len -= transfer;
+                data += transfer;
+                addr += transfer;
+        }
+        kfree(buf);
+
+        err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
+                              0x31 /* FW DL COMPLETE */,
+                              0x40 | USB_DIR_OUT, 0, 0, NULL, 0, 200);
+
+        if (wait_for_completion_timeout(&ar->fw_boot_wait, HZ) == 0) {
+                err = -ETIMEDOUT;
+                goto err_out;
+        }
+
+        err = carl9170_echo_test(ar, 0x4a110123);
+        if (err)
+                goto err_out;
+
+        /* firmware restarts cmd counter */
+        ar->cmd_seq = -1;
+
+        return 0;
+
+err_out:
+        dev_err(&ar->udev->dev, "firmware upload failed (%d).\n", err);
+        return err;
+}
+
+int carl9170_usb_restart(struct ar9170 *ar)
+{
+        int err = 0;
+
+        if (ar->intf->condition != USB_INTERFACE_BOUND)
+                return 0;
+
+        /* Disable command response sequence counter. */
+        ar->cmd_seq = -2;
+
+        err = carl9170_reboot(ar);
+
+        carl9170_usb_stop(ar);
+
+        if (err)
+                goto err_out;
+
+        tasklet_schedule(&ar->usb_tasklet);
+
+        /* The reboot procedure can take quite a while to complete. */
+        msleep(1100);
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_out;
+
+        err = carl9170_usb_load_firmware(ar);
+        if (err)
+                goto err_out;
+
+        return 0;
+
+err_out:
+        carl9170_usb_cancel_urbs(ar);
+        return err;
+}
+
+void carl9170_usb_reset(struct ar9170 *ar)
+{
+        /*
+         * This is the last resort to get the device going again
+         * without any *user replugging action*.
+         *
+         * But there is a catch: usb_reset really is like a physical
+         * *reconnect*. The mac80211 state will be lost in the process.
+         * Therefore a userspace application, which is monitoring
+         * the link must step in.
+         */
+        carl9170_usb_cancel_urbs(ar);
+
+        carl9170_usb_stop(ar);
+
+        usb_queue_reset_device(ar->intf);
+}
+
+static int carl9170_usb_init_device(struct ar9170 *ar)
+{
+        int err;
+
+        err = carl9170_usb_send_rx_irq_urb(ar);
+        if (err)
+                goto err_out;
+
+        err = carl9170_usb_init_rx_bulk_urbs(ar);
+        if (err)
+                goto err_unrx;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_usb_load_firmware(ar);
+        mutex_unlock(&ar->mutex);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+err_out:
+        return err;
+}
+
+static void carl9170_usb_firmware_failed(struct ar9170 *ar)
+{
+        struct device *parent = ar->udev->dev.parent;
+        struct usb_device *udev;
+
+        /*
+         * Store a copy of the usb_device pointer locally.
+         * This is because device_release_driver initiates
+         * carl9170_usb_disconnect, which in turn frees our
+         * driver context (ar).
+         */
+        udev = ar->udev;
+
+        complete(&ar->fw_load_wait);
+
+        /* unbind anything failed */
+        if (parent)
+                device_lock(parent);
+
+        device_release_driver(&udev->dev);
+        if (parent)
+                device_unlock(parent);
+
+        usb_put_dev(udev);
+}
+
+static void carl9170_usb_firmware_finish(struct ar9170 *ar)
+{
+        int err;
+
+        err = carl9170_parse_firmware(ar);
+        if (err)
+                goto err_freefw;
+
+        err = carl9170_usb_init_device(ar);
+        if (err)
+                goto err_freefw;
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_unrx;
+
+        err = carl9170_register(ar);
+
+        carl9170_usb_stop(ar);
+        if (err)
+                goto err_unrx;
+
+        complete(&ar->fw_load_wait);
+        usb_put_dev(ar->udev);
+        return;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+err_freefw:
+        carl9170_release_firmware(ar);
+        carl9170_usb_firmware_failed(ar);
+}
+
+static void carl9170_usb_firmware_step2(const struct firmware *fw,
+                                        void *context)
+{
+        struct ar9170 *ar = context;
+
+        if (fw) {
+                ar->fw.fw = fw;
+                carl9170_usb_firmware_finish(ar);
+                return;
+        }
+
+        dev_err(&ar->udev->dev, "firmware not found.\n");
+        carl9170_usb_firmware_failed(ar);
+}
+
+static int carl9170_usb_probe(struct usb_interface *intf,
+                              const struct usb_device_id *id)
+{
+        struct ar9170 *ar;
+        struct usb_device *udev;
+        int err;
+
+        err = usb_reset_device(interface_to_usbdev(intf));
+        if (err)
+                return err;
+
+        ar = carl9170_alloc(sizeof(*ar));
+        if (IS_ERR(ar))
+                return PTR_ERR(ar);
+
+        udev = interface_to_usbdev(intf);
+        usb_get_dev(udev);
+        ar->udev = udev;
+        ar->intf = intf;
+        ar->features = id->driver_info;
+
+        usb_set_intfdata(intf, ar);
+        SET_IEEE80211_DEV(ar->hw, &intf->dev);
+
+        init_usb_anchor(&ar->rx_anch);
+        init_usb_anchor(&ar->rx_pool);
+        init_usb_anchor(&ar->rx_work);
+        init_usb_anchor(&ar->tx_wait);
+        init_usb_anchor(&ar->tx_anch);
+        init_usb_anchor(&ar->tx_cmd);
+        init_usb_anchor(&ar->tx_err);
+        init_completion(&ar->cmd_wait);
+        init_completion(&ar->fw_boot_wait);
+        init_completion(&ar->fw_load_wait);
+        tasklet_init(&ar->usb_tasklet, carl9170_usb_tasklet,
+                     (unsigned long)ar);
+
+        atomic_set(&ar->tx_cmd_urbs, 0);
+        atomic_set(&ar->tx_anch_urbs, 0);
+        atomic_set(&ar->rx_work_urbs, 0);
+        atomic_set(&ar->rx_anch_urbs, 0);
+        atomic_set(&ar->rx_pool_urbs, 0);
+        ar->cmd_seq = -2;
+
+        usb_get_dev(ar->udev);
+
+        carl9170_set_state(ar, CARL9170_STOPPED);
+
+        return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
+                &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
+}
+
+static void carl9170_usb_disconnect(struct usb_interface *intf)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+        struct usb_device *udev;
+
+        if (WARN_ON(!ar))
+                return;
+
+        udev = ar->udev;
+        wait_for_completion(&ar->fw_load_wait);
+
+        if (IS_INITIALIZED(ar)) {
+                carl9170_reboot(ar);
+                carl9170_usb_stop(ar);
+        }
+
+        carl9170_usb_cancel_urbs(ar);
+        carl9170_unregister(ar);
+
+        usb_set_intfdata(intf, NULL);
+
+        carl9170_release_firmware(ar);
+        carl9170_free(ar);
+        usb_put_dev(udev);
+}
+
+#ifdef CONFIG_PM
+static int carl9170_usb_suspend(struct usb_interface *intf,
+                                pm_message_t message)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+
+        if (!ar)
+                return -ENODEV;
+
+        carl9170_usb_cancel_urbs(ar);
+
+        /*
+         * firmware automatically reboots for usb suspend.
+         */
+
+        return 0;
+}
+
+static int carl9170_usb_resume(struct usb_interface *intf)
+{
+        struct ar9170 *ar = usb_get_intfdata(intf);
+        int err;
+
+        if (!ar)
+                return -ENODEV;
+
+        usb_unpoison_anchored_urbs(&ar->rx_anch);
+
+        err = carl9170_usb_init_device(ar);
+        if (err)
+                goto err_unrx;
+
+        err = carl9170_usb_open(ar);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        carl9170_usb_cancel_urbs(ar);
+
+        return err;
+}
+#endif /* CONFIG_PM */
+
+static struct usb_driver carl9170_driver = {
+        .name = KBUILD_MODNAME,
+        .probe = carl9170_usb_probe,
+        .disconnect = carl9170_usb_disconnect,
+        .id_table = carl9170_usb_ids,
+        .soft_unbind = 1,
+#ifdef CONFIG_PM
+        .suspend = carl9170_usb_suspend,
+        .resume = carl9170_usb_resume,
+#endif /* CONFIG_PM */
+};
+
+static int __init carl9170_usb_init(void)
+{
+        return usb_register(&carl9170_driver);
+}
+
+static void __exit carl9170_usb_exit(void)
+{
+        usb_deregister(&carl9170_driver);
+}
+
+module_init(carl9170_usb_init);
+module_exit(carl9170_usb_exit);
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
new file mode 100644
index 000000000000..0e917f80eab4
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -0,0 +1,7 @@
+#ifndef __CARL9170_SHARED_VERSION_H
+#define __CARL9170_SHARED_VERSION_H
+#define CARL9170FW_VERSION_YEAR 10
+#define CARL9170FW_VERSION_MONTH 8
+#define CARL9170FW_VERSION_DAY 30
+#define CARL9170FW_VERSION_GIT "1.8.8.1"
+#endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/ath/carl9170/wlan.h b/drivers/net/wireless/ath/carl9170/wlan.h
new file mode 100644
index 000000000000..48ead2268f50
--- /dev/null
+++ b/drivers/net/wireless/ath/carl9170/wlan.h
@@ -0,0 +1,412 @@
+/*
+ * Shared Atheros AR9170 Header
+ *
+ * RX/TX meta descriptor format
+ *
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, see
+ * http://www.gnu.org/licenses/.
+ *
+ * This file incorporates work covered by the following copyright and
+ * permission notice:
+ *    Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ *    Permission to use, copy, modify, and/or distribute this software for any
+ *    purpose with or without fee is hereby granted, provided that the above
+ *    copyright notice and this permission notice appear in all copies.
+ *
+ *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __CARL9170_SHARED_WLAN_H
+#define __CARL9170_SHARED_WLAN_H
+
+#include "fwcmd.h"
+
+#define AR9170_RX_PHY_RATE_CCK_1M               0x0a
+#define AR9170_RX_PHY_RATE_CCK_2M               0x14
+#define AR9170_RX_PHY_RATE_CCK_5M               0x37
+#define AR9170_RX_PHY_RATE_CCK_11M              0x6e
+
+#define AR9170_ENC_ALG_NONE                     0x0
+#define AR9170_ENC_ALG_WEP64                    0x1
+#define AR9170_ENC_ALG_TKIP                     0x2
+#define AR9170_ENC_ALG_AESCCMP                  0x4
+#define AR9170_ENC_ALG_WEP128                   0x5
+#define AR9170_ENC_ALG_WEP256                   0x6
+#define AR9170_ENC_ALG_CENC                     0x7
+
+#define AR9170_RX_ENC_SOFTWARE                  0x8
+
+#define AR9170_RX_STATUS_MODULATION             0x03
+#define AR9170_RX_STATUS_MODULATION_S           0
+#define AR9170_RX_STATUS_MODULATION_CCK         0x00
+#define AR9170_RX_STATUS_MODULATION_OFDM        0x01
+#define AR9170_RX_STATUS_MODULATION_HT          0x02
+#define AR9170_RX_STATUS_MODULATION_DUPOFDM     0x03
+
+/* depends on modulation */
+#define AR9170_RX_STATUS_SHORT_PREAMBLE         0x08
+#define AR9170_RX_STATUS_GREENFIELD             0x08
+
+#define AR9170_RX_STATUS_MPDU                   0x30
+#define AR9170_RX_STATUS_MPDU_S                 4
+#define AR9170_RX_STATUS_MPDU_SINGLE            0x00
+#define AR9170_RX_STATUS_MPDU_FIRST             0x20
+#define AR9170_RX_STATUS_MPDU_MIDDLE            0x30
+#define AR9170_RX_STATUS_MPDU_LAST              0x10
+
+#define AR9170_RX_ERROR_RXTO                    0x01
+#define AR9170_RX_ERROR_OVERRUN                 0x02
+#define AR9170_RX_ERROR_DECRYPT                 0x04
+#define AR9170_RX_ERROR_FCS                     0x08
+#define AR9170_RX_ERROR_WRONG_RA                0x10
+#define AR9170_RX_ERROR_PLCP                    0x20
+#define AR9170_RX_ERROR_MMIC                    0x40
+#define AR9170_RX_ERROR_FATAL                   0x80
+
+/* these are either-or */
+#define AR9170_TX_MAC_PROT_RTS                  0x0001
+#define AR9170_TX_MAC_PROT_CTS                  0x0002
+#define AR9170_TX_MAC_PROT                      0x0003
+
+#define AR9170_TX_MAC_NO_ACK                    0x0004
+/* if unset, MAC will only do SIFS space before frame */
+#define AR9170_TX_MAC_BACKOFF                   0x0008
+#define AR9170_TX_MAC_BURST                     0x0010
+#define AR9170_TX_MAC_AGGR                      0x0020
+
+/* encryption is a two-bit field */
+#define AR9170_TX_MAC_ENCR_NONE                 0x0000
+#define AR9170_TX_MAC_ENCR_RC4                  0x0040
+#define AR9170_TX_MAC_ENCR_CENC                 0x0080
+#define AR9170_TX_MAC_ENCR_AES                  0x00c0
+
+#define AR9170_TX_MAC_MMIC                      0x0100
+#define AR9170_TX_MAC_HW_DURATION               0x0200
+#define AR9170_TX_MAC_QOS_S                     10
+#define AR9170_TX_MAC_QOS                       0x0c00
+#define AR9170_TX_MAC_DISABLE_TXOP              0x1000
+#define AR9170_TX_MAC_TXOP_RIFS                 0x2000
+#define AR9170_TX_MAC_IMM_BA                    0x4000
+
+/* either-or */
+#define AR9170_TX_PHY_MOD_CCK                   0x00000000
+#define AR9170_TX_PHY_MOD_OFDM                  0x00000001
+#define AR9170_TX_PHY_MOD_HT                    0x00000002
+
+/* depends on modulation */
+#define AR9170_TX_PHY_SHORT_PREAMBLE            0x00000004
+#define AR9170_TX_PHY_GREENFIELD                0x00000004
+
+#define AR9170_TX_PHY_BW_S                      3
+#define AR9170_TX_PHY_BW                        (3 << AR9170_TX_PHY_BW_SHIFT)
+#define AR9170_TX_PHY_BW_20MHZ                  0
+#define AR9170_TX_PHY_BW_40MHZ                  2
+#define AR9170_TX_PHY_BW_40MHZ_DUP              3
+
+#define AR9170_TX_PHY_TX_HEAVY_CLIP_S           6
+#define AR9170_TX_PHY_TX_HEAVY_CLIP             (7 << \
+                                                 AR9170_TX_PHY_TX_HEAVY_CLIP_S)
+
+#define AR9170_TX_PHY_TX_PWR_S                  9
+#define AR9170_TX_PHY_TX_PWR                    (0x3f << \
+                                                 AR9170_TX_PHY_TX_PWR_S)
+
+#define AR9170_TX_PHY_TXCHAIN_S                 15
+#define AR9170_TX_PHY_TXCHAIN                   (7 << \
+                                                 AR9170_TX_PHY_TXCHAIN_S)
+#define AR9170_TX_PHY_TXCHAIN_1                 1
+/* use for cck, ofdm 6/9/12/18/24 and HT if capable */
+#define AR9170_TX_PHY_TXCHAIN_2                 5
+
+#define AR9170_TX_PHY_MCS_S                     18
+#define AR9170_TX_PHY_MCS                       (0x7f << \
+                                                 AR9170_TX_PHY_MCS_S)
+
+#define AR9170_TX_PHY_RATE_CCK_1M               0x0
+#define AR9170_TX_PHY_RATE_CCK_2M               0x1
+#define AR9170_TX_PHY_RATE_CCK_5M               0x2
+#define AR9170_TX_PHY_RATE_CCK_11M              0x3
+
+/* same as AR9170_RX_PHY_RATE */
+#define AR9170_TXRX_PHY_RATE_OFDM_6M            0xb
+#define AR9170_TXRX_PHY_RATE_OFDM_9M            0xf
+#define AR9170_TXRX_PHY_RATE_OFDM_12M           0xa
+#define AR9170_TXRX_PHY_RATE_OFDM_18M           0xe
+#define AR9170_TXRX_PHY_RATE_OFDM_24M           0x9
+#define AR9170_TXRX_PHY_RATE_OFDM_36M           0xd
+#define AR9170_TXRX_PHY_RATE_OFDM_48M           0x8
+#define AR9170_TXRX_PHY_RATE_OFDM_54M           0xc
+
+#define AR9170_TXRX_PHY_RATE_HT_MCS0            0x0
+#define AR9170_TXRX_PHY_RATE_HT_MCS1            0x1
+#define AR9170_TXRX_PHY_RATE_HT_MCS2            0x2
+#define AR9170_TXRX_PHY_RATE_HT_MCS3            0x3
+#define AR9170_TXRX_PHY_RATE_HT_MCS4            0x4
+#define AR9170_TXRX_PHY_RATE_HT_MCS5            0x5
+#define AR9170_TXRX_PHY_RATE_HT_MCS6            0x6
+#define AR9170_TXRX_PHY_RATE_HT_MCS7            0x7
+#define AR9170_TXRX_PHY_RATE_HT_MCS8            0x8
+#define AR9170_TXRX_PHY_RATE_HT_MCS9            0x9
+#define AR9170_TXRX_PHY_RATE_HT_MCS10           0xa
+#define AR9170_TXRX_PHY_RATE_HT_MCS11           0xb
+#define AR9170_TXRX_PHY_RATE_HT_MCS12           0xc
+#define AR9170_TXRX_PHY_RATE_HT_MCS13           0xd
+#define AR9170_TXRX_PHY_RATE_HT_MCS14           0xe
+#define AR9170_TXRX_PHY_RATE_HT_MCS15           0xf
+
+#define AR9170_TX_PHY_SHORT_GI                  0x80000000
+
+#ifdef __CARL9170FW__
+struct ar9170_tx_hw_mac_control {
+        union {
+                struct {
+                        /*
+                         * Beware of compiler bugs in all gcc pre 4.4!
+                         */
+
+                        u8 erp_prot:2;
+                        u8 no_ack:1;
+                        u8 backoff:1;
+                        u8 burst:1;
+                        u8 ampdu:1;
+
+                        u8 enc_mode:2;
+
+                        u8 hw_mmic:1;
+                        u8 hw_duration:1;
+
+                        u8 qos_queue:2;
+
+                        u8 disable_txop:1;
+                        u8 txop_rifs:1;
+
+                        u8 ba_end:1;
+                        u8 probe:1;
+                } __packed;
+
+                __le16 set;
+        } __packed;
+} __packed;
+
+struct ar9170_tx_hw_phy_control {
+        union {
+                struct {
+                        /*
+                         * Beware of compiler bugs in all gcc pre 4.4!
+                         */
+
+                        u8 modulation:2;
+                        u8 preamble:1;
+                        u8 bandwidth:2;
+                        u8:1;
+                        u8 heavy_clip:3;
+                        u8 tx_power:6;
+                        u8 chains:3;
+                        u8 mcs:7;
+                        u8:6;
+                        u8 short_gi:1;
+                } __packed;
+
+                __le32 set;
+        } __packed;
+} __packed;
+
+struct ar9170_tx_rate_info {
+        u8 tries:3;
+        u8 erp_prot:2;
+        u8 ampdu:1;
+        u8 free:2; /* free for use (e.g.:RIFS/TXOP/AMPDU) */
+} __packed;
+
+struct carl9170_tx_superdesc {
+        __le16 len;
+        u8 rix;
+        u8 cnt;
+        u8 cookie;
+        u8 ampdu_density:3;
+        u8 ampdu_factor:2;
+        u8 ampdu_commit_density:1;
+        u8 ampdu_commit_factor:1;
+        u8 ampdu_unused_bit:1;
+        u8 queue:2;
+        u8 reserved:1;
+        u8 vif_id:3;
+        u8 fill_in_tsf:1;
+        u8 cab:1;
+        u8 padding2;
+        struct ar9170_tx_rate_info ri[CARL9170_TX_MAX_RATES];
+        struct ar9170_tx_hw_phy_control rr[CARL9170_TX_MAX_RETRY_RATES];
+} __packed;
+
+struct ar9170_tx_hwdesc {
+        __le16 length;
+        struct ar9170_tx_hw_mac_control mac;
+        struct ar9170_tx_hw_phy_control phy;
+} __packed;
+
+struct ar9170_tx_frame {
+        struct ar9170_tx_hwdesc hdr;
+
+        union {
+                struct ieee80211_hdr i3e;
+                u8 payload[0];
+        } data;
+} __packed;
+
+struct carl9170_tx_superframe {
+        struct carl9170_tx_superdesc s;
+        struct ar9170_tx_frame f;
+} __packed;
+
+#endif /* __CARL9170FW__ */
+
+struct _ar9170_tx_hwdesc {
+        __le16 length;
+        __le16 mac_control;
+        __le32 phy_control;
+} __packed;
+
+#define CARL9170_TX_SUPER_AMPDU_DENSITY_S               0
+#define CARL9170_TX_SUPER_AMPDU_DENSITY                 0x7
+#define CARL9170_TX_SUPER_AMPDU_FACTOR                  0x18
+#define CARL9170_TX_SUPER_AMPDU_FACTOR_S                3
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY          0x20
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_DENSITY_S        5
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR           0x40
+#define CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR_S         6
+
+#define CARL9170_TX_SUPER_MISC_QUEUE                    0x3
+#define CARL9170_TX_SUPER_MISC_QUEUE_S                  0
+#define CARL9170_TX_SUPER_MISC_VIF_ID                   0x38
+#define CARL9170_TX_SUPER_MISC_VIF_ID_S                 3
+#define CARL9170_TX_SUPER_MISC_FILL_IN_TSF              0x40
+#define CARL9170_TX_SUPER_MISC_CAB                      0x80
+
+#define CARL9170_TX_SUPER_RI_TRIES                      0x7
+#define CARL9170_TX_SUPER_RI_TRIES_S                    0
+#define CARL9170_TX_SUPER_RI_ERP_PROT                   0x18
+#define CARL9170_TX_SUPER_RI_ERP_PROT_S                 3
+#define CARL9170_TX_SUPER_RI_AMPDU                      0x20
+#define CARL9170_TX_SUPER_RI_AMPDU_S                    5
+
+struct _carl9170_tx_superdesc {
+        __le16 len;
+        u8 rix;
+        u8 cnt;
+        u8 cookie;
+        u8 ampdu_settings;
+        u8 misc;
+        u8 padding;
+        u8 ri[CARL9170_TX_MAX_RATES];
+        __le32 rr[CARL9170_TX_MAX_RETRY_RATES];
+} __packed;
+
+struct _carl9170_tx_superframe {
+        struct _carl9170_tx_superdesc s;
+        struct _ar9170_tx_hwdesc f;
+        u8 frame_data[0];
+} __packed;
+
+#define CARL9170_TX_SUPERDESC_LEN               24
+#define AR9170_TX_HWDESC_LEN                    8
+#define AR9170_TX_SUPERFRAME_LEN                (CARL9170_TX_HWDESC_LEN + \
+                                                 AR9170_TX_SUPERDESC_LEN)
+
+struct ar9170_rx_head {
+        u8 plcp[12];
+} __packed;
+
+struct ar9170_rx_phystatus {
+        union {
+                struct {
+                        u8 rssi_ant0, rssi_ant1, rssi_ant2,
+                                rssi_ant0x, rssi_ant1x, rssi_ant2x,
+                                rssi_combined;
+                } __packed;
+                u8 rssi[7];
+        } __packed;
+
+        u8 evm_stream0[6], evm_stream1[6];
+        u8 phy_err;
+} __packed;
+
+struct ar9170_rx_macstatus {
+        u8 SAidx, DAidx;
+        u8 error;
+        u8 status;
+} __packed;
+
+struct ar9170_rx_frame_single {
+        struct ar9170_rx_head phy_head;
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_phystatus phy_tail;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_head {
+        struct ar9170_rx_head phy_head;
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_middle {
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame_tail {
+        struct ieee80211_hdr i3e;
+        struct ar9170_rx_phystatus phy_tail;
+        struct ar9170_rx_macstatus macstatus;
+} __packed;
+
+struct ar9170_rx_frame {
+        union {
+                struct ar9170_rx_frame_single single;
+                struct ar9170_rx_frame_head head;
+                struct ar9170_rx_frame_middle middle;
+                struct ar9170_rx_frame_tail tail;
+        } __packed;
+} __packed;
+
+static inline u8 ar9170_get_decrypt_type(struct ar9170_rx_macstatus *t)
+{
+        return (t->SAidx & 0xc0) >> 4 |
+               (t->DAidx & 0xc0) >> 6;
+}
+
+enum ar9170_txq {
+        AR9170_TXQ_BE,
+
+        AR9170_TXQ_VI,
+        AR9170_TXQ_VO,
+        AR9170_TXQ_BK,
+
+        __AR9170_NUM_TXQ,
+};
+
+static const u8 ar9170_qmap[__AR9170_NUM_TXQ] = { 2, 1, 0, 3 };
+
+#define AR9170_TXQ_DEPTH                        32
+
+#endif /* __CARL9170_SHARED_WLAN_H */
diff --git a/drivers/net/wireless/ath/debug.h b/drivers/net/wireless/ath/debug.h
index 873bf526e11f..fd3a020682dc 100644
--- a/drivers/net/wireless/ath/debug.h
+++ b/drivers/net/wireless/ath/debug.h
@@ -36,6 +36,7 @@
  * @ATH_DBG_PS: power save processing
  * @ATH_DBG_HWTIMER: hardware timer handling
  * @ATH_DBG_BTCOEX: bluetooth coexistance
+ * @ATH_DBG_BSTUCK: stuck beacons
  * @ATH_DBG_ANY: enable all debugging
  *
  * The debug level is used to control the amount and type of debugging output
@@ -60,6 +61,7 @@ enum ATH_DEBUG {
         ATH_DBG_HWTIMER         = 0x00001000,
         ATH_DBG_BTCOEX          = 0x00002000,
         ATH_DBG_WMI             = 0x00004000,
+        ATH_DBG_BSTUCK          = 0x00008000,
         ATH_DBG_ANY             = 0xffffffff
 };
 
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
new file mode 100644
index 000000000000..bd21a4d82085
--- /dev/null
+++ b/drivers/net/wireless/ath/key.c
@@ -0,0 +1,568 @@
+/*
+ * Copyright (c) 2009 Atheros Communications Inc.
+ * Copyright (c) 2010 Bruno Randolf <br1@einfach.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+#include <net/mac80211.h>
+
+#include "ath.h"
+#include "reg.h"
+#include "debug.h"
+
+#define REG_READ                        (common->ops->read)
+#define REG_WRITE(_ah, _reg, _val)      (common->ops->write)(_ah, _val, _reg)
+
+#define IEEE80211_WEP_NKID      4       /* number of key ids */
+
+/************************/
+/* Key Cache Management */
+/************************/
+
+bool ath_hw_keyreset(struct ath_common *common, u16 entry)
+{
+        u32 keyType;
+        void *ah = common->ah;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
+                return false;
+        }
+
+        keyType = REG_READ(ah, AR_KEYTABLE_TYPE(entry));
+
+        REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), AR_KEYTABLE_TYPE_CLR);
+        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), 0);
+        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), 0);
+
+        if (keyType == AR_KEYTABLE_TYPE_TKIP) {
+                u16 micentry = entry + 64;
+
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
+
+        }
+
+        return true;
+}
+EXPORT_SYMBOL(ath_hw_keyreset);
+
+bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac)
+{
+        u32 macHi, macLo;
+        u32 unicast_flag = AR_KEYTABLE_VALID;
+        void *ah = common->ah;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keychache entry %u out of range\n", entry);
+                return false;
+        }
+
+        if (mac != NULL) {
+                /*
+                 * AR_KEYTABLE_VALID indicates that the address is a unicast
+                 * address, which must match the transmitter address for
+                 * decrypting frames.
+                 * Not setting this bit allows the hardware to use the key
+                 * for multicast frame decryption.
+                 */
+                if (mac[0] & 0x01)
+                        unicast_flag = 0;
+
+                macHi = (mac[5] << 8) | mac[4];
+                macLo = (mac[3] << 24) |
+                        (mac[2] << 16) |
+                        (mac[1] << 8) |
+                        mac[0];
+                macLo >>= 1;
+                macLo |= (macHi & 1) << 31;
+                macHi >>= 1;
+        } else {
+                macLo = macHi = 0;
+        }
+        REG_WRITE(ah, AR_KEYTABLE_MAC0(entry), macLo);
+        REG_WRITE(ah, AR_KEYTABLE_MAC1(entry), macHi | unicast_flag);
+
+        return true;
+}
+
+bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
+                                 const struct ath_keyval *k,
+                                 const u8 *mac)
+{
+        void *ah = common->ah;
+        u32 key0, key1, key2, key3, key4;
+        u32 keyType;
+
+        if (entry >= common->keymax) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "keycache entry %u out of range\n", entry);
+                return false;
+        }
+
+        switch (k->kv_type) {
+        case ATH_CIPHER_AES_OCB:
+                keyType = AR_KEYTABLE_TYPE_AES;
+                break;
+        case ATH_CIPHER_AES_CCM:
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_CIPHER_AESCCM)) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "AES-CCM not supported by this mac rev\n");
+                        return false;
+                }
+                keyType = AR_KEYTABLE_TYPE_CCM;
+                break;
+        case ATH_CIPHER_TKIP:
+                keyType = AR_KEYTABLE_TYPE_TKIP;
+                if (entry + 64 >= common->keymax) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "entry %u inappropriate for TKIP\n", entry);
+                        return false;
+                }
+                break;
+        case ATH_CIPHER_WEP:
+                if (k->kv_len < WLAN_KEY_LEN_WEP40) {
+                        ath_print(common, ATH_DBG_ANY,
+                                  "WEP key length %u too small\n", k->kv_len);
+                        return false;
+                }
+                if (k->kv_len <= WLAN_KEY_LEN_WEP40)
+                        keyType = AR_KEYTABLE_TYPE_40;
+                else if (k->kv_len <= WLAN_KEY_LEN_WEP104)
+                        keyType = AR_KEYTABLE_TYPE_104;
+                else
+                        keyType = AR_KEYTABLE_TYPE_128;
+                break;
+        case ATH_CIPHER_CLR:
+                keyType = AR_KEYTABLE_TYPE_CLR;
+                break;
+        default:
+                ath_print(common, ATH_DBG_FATAL,
+                          "cipher %u not supported\n", k->kv_type);
+                return false;
+        }
+
+        key0 = get_unaligned_le32(k->kv_val + 0);
+        key1 = get_unaligned_le16(k->kv_val + 4);
+        key2 = get_unaligned_le32(k->kv_val + 6);
+        key3 = get_unaligned_le16(k->kv_val + 10);
+        key4 = get_unaligned_le32(k->kv_val + 12);
+        if (k->kv_len <= WLAN_KEY_LEN_WEP104)
+                key4 &= 0xff;
+
+        /*
+         * Note: Key cache registers access special memory area that requires
+         * two 32-bit writes to actually update the values in the internal
+         * memory. Consequently, the exact order and pairs used here must be
+         * maintained.
+         */
+
+        if (keyType == AR_KEYTABLE_TYPE_TKIP) {
+                u16 micentry = entry + 64;
+
+                /*
+                 * Write inverted key[47:0] first to avoid Michael MIC errors
+                 * on frames that could be sent or received at the same time.
+                 * The correct key will be written in the end once everything
+                 * else is ready.
+                 */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), ~key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), ~key1);
+
+                /* Write key[95:48] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
+
+                /* Write key[127:96] and key type */
+                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
+                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
+
+                /* Write MAC address for the entry */
+                (void) ath_hw_keysetmac(common, entry, mac);
+
+                if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) {
+                        /*
+                         * TKIP uses two key cache entries:
+                         * Michael MIC TX/RX keys in the same key cache entry
+                         * (idx = main index + 64):
+                         * key0 [31:0] = RX key [31:0]
+                         * key1 [15:0] = TX key [31:16]
+                         * key1 [31:16] = reserved
+                         * key2 [31:0] = RX key [63:32]
+                         * key3 [15:0] = TX key [15:0]
+                         * key3 [31:16] = reserved
+                         * key4 [31:0] = TX key [63:32]
+                         */
+                        u32 mic0, mic1, mic2, mic3, mic4;
+
+                        mic0 = get_unaligned_le32(k->kv_mic + 0);
+                        mic2 = get_unaligned_le32(k->kv_mic + 4);
+                        mic1 = get_unaligned_le16(k->kv_txmic + 2) & 0xffff;
+                        mic3 = get_unaligned_le16(k->kv_txmic + 0) & 0xffff;
+                        mic4 = get_unaligned_le32(k->kv_txmic + 4);
+
+                        /* Write RX[31:0] and TX[31:16] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), mic1);
+
+                        /* Write RX[63:32] and TX[15:0] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), mic3);
+
+                        /* Write TX[63:32] and keyType(reserved) */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), mic4);
+                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
+                                  AR_KEYTABLE_TYPE_CLR);
+
+                } else {
+                        /*
+                         * TKIP uses four key cache entries (two for group
+                         * keys):
+                         * Michael MIC TX/RX keys are in different key cache
+                         * entries (idx = main index + 64 for TX and
+                         * main index + 32 + 96 for RX):
+                         * key0 [31:0] = TX/RX MIC key [31:0]
+                         * key1 [31:0] = reserved
+                         * key2 [31:0] = TX/RX MIC key [63:32]
+                         * key3 [31:0] = reserved
+                         * key4 [31:0] = reserved
+                         *
+                         * Upper layer code will call this function separately
+                         * for TX and RX keys when these registers offsets are
+                         * used.
+                         */
+                        u32 mic0, mic2;
+
+                        mic0 = get_unaligned_le32(k->kv_mic + 0);
+                        mic2 = get_unaligned_le32(k->kv_mic + 4);
+
+                        /* Write MIC key[31:0] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY0(micentry), mic0);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+
+                        /* Write MIC key[63:32] */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), mic2);
+                        REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
+
+                        /* Write TX[63:32] and keyType(reserved) */
+                        REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
+                        REG_WRITE(ah, AR_KEYTABLE_TYPE(micentry),
+                                  AR_KEYTABLE_TYPE_CLR);
+                }
+
+                /* MAC address registers are reserved for the MIC entry */
+                REG_WRITE(ah, AR_KEYTABLE_MAC0(micentry), 0);
+                REG_WRITE(ah, AR_KEYTABLE_MAC1(micentry), 0);
+
+                /*
+                 * Write the correct (un-inverted) key[47:0] last to enable
+                 * TKIP now that all other registers are set with correct
+                 * values.
+                 */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
+        } else {
+                /* Write key[47:0] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY0(entry), key0);
+                REG_WRITE(ah, AR_KEYTABLE_KEY1(entry), key1);
+
+                /* Write key[95:48] */
+                REG_WRITE(ah, AR_KEYTABLE_KEY2(entry), key2);
+                REG_WRITE(ah, AR_KEYTABLE_KEY3(entry), key3);
+
+                /* Write key[127:96] and key type */
+                REG_WRITE(ah, AR_KEYTABLE_KEY4(entry), key4);
+                REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
+
+                /* Write MAC address for the entry */
+                (void) ath_hw_keysetmac(common, entry, mac);
+        }
+
+        return true;
+}
+
+static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
+                           struct ath_keyval *hk, const u8 *addr,
+                           bool authenticator)
+{
+        const u8 *key_rxmic;
+        const u8 *key_txmic;
+
+        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
+        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
+
+        if (addr == NULL) {
+                /*
+                 * Group key installation - only two key cache entries are used
+                 * regardless of splitmic capability since group key is only
+                 * used either for TX or RX.
+                 */
+                if (authenticator) {
+                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
+                } else {
+                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
+                }
+                return ath_hw_set_keycache_entry(common, keyix, hk, addr);
+        }
+        if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) {
+                /* TX and RX keys share the same key cache entry. */
+                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
+                return ath_hw_set_keycache_entry(common, keyix, hk, addr);
+        }
+
+        /* Separate key cache entries for TX and RX */
+
+        /* TX key goes at first index, RX key at +32. */
+        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+        if (!ath_hw_set_keycache_entry(common, keyix, hk, NULL)) {
+                /* TX MIC entry failed. No need to proceed further */
+                ath_print(common, ATH_DBG_FATAL,
+                          "Setting TX MIC Key Failed\n");
+                return 0;
+        }
+
+        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+        /* XXX delete tx key on failure? */
+        return ath_hw_set_keycache_entry(common, keyix + 32, hk, addr);
+}
+
+static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
+{
+        int i;
+
+        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                if (test_bit(i, common->keymap) ||
+                    test_bit(i + 64, common->keymap))
+                        continue; /* At least one part of TKIP key allocated */
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED) &&
+                    (test_bit(i + 32, common->keymap) ||
+                     test_bit(i + 64 + 32, common->keymap)))
+                        continue; /* At least one part of TKIP key allocated */
+
+                /* Found a free slot for a TKIP key */
+                return i;
+        }
+        return -1;
+}
+
+static int ath_reserve_key_cache_slot(struct ath_common *common,
+                                      u32 cipher)
+{
+        int i;
+
+        if (cipher == WLAN_CIPHER_SUITE_TKIP)
+                return ath_reserve_key_cache_slot_tkip(common);
+
+        /* First, try to find slots that would not be available for TKIP. */
+        if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            (test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i;
+                        if (!test_bit(i + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 32;
+                        if (!test_bit(i + 64, common->keymap) &&
+                            (test_bit(i , common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 64;
+                        if (!test_bit(i + 64 + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap)))
+                                return i + 64 + 32;
+                }
+        } else {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            test_bit(i + 64, common->keymap))
+                                return i;
+                        if (test_bit(i, common->keymap) &&
+                            !test_bit(i + 64, common->keymap))
+                                return i + 64;
+                }
+        }
+
+        /* No partially used TKIP slots, pick any available slot */
+        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
+                /* Do not allow slots that could be needed for TKIP group keys
+                 * to be used. This limitation could be removed if we know that
+                 * TKIP will not be used. */
+                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
+                        continue;
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
+                                continue;
+                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
+                                continue;
+                }
+
+                if (!test_bit(i, common->keymap))
+                        return i; /* Found a free slot for a key */
+        }
+
+        /* No free slot found */
+        return -1;
+}
+
+/*
+ * Configure encryption in the HW.
+ */
+int ath_key_config(struct ath_common *common,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key)
+{
+        struct ath_keyval hk;
+        const u8 *mac = NULL;
+        u8 gmac[ETH_ALEN];
+        int ret = 0;
+        int idx;
+
+        memset(&hk, 0, sizeof(hk));
+
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                hk.kv_type = ATH_CIPHER_WEP;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                hk.kv_type = ATH_CIPHER_TKIP;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                hk.kv_type = ATH_CIPHER_AES_CCM;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        hk.kv_len = key->keylen;
+        memcpy(hk.kv_val, key->key, key->keylen);
+
+        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                switch (vif->type) {
+                case NL80211_IFTYPE_AP:
+                        memcpy(gmac, vif->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->cipher);
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (!sta) {
+                                idx = key->keyidx;
+                                break;
+                        }
+                        memcpy(gmac, sta->addr, ETH_ALEN);
+                        gmac[0] |= 0x01;
+                        mac = gmac;
+                        idx = ath_reserve_key_cache_slot(common, key->cipher);
+                        break;
+                default:
+                        idx = key->keyidx;
+                        break;
+                }
+        } else if (key->keyidx) {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                if (vif->type != NL80211_IFTYPE_AP) {
+                        /* Only keyidx 0 should be used with unicast key, but
+                         * allow this for client mode for now. */
+                        idx = key->keyidx;
+                } else
+                        return -EIO;
+        } else {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                idx = ath_reserve_key_cache_slot(common, key->cipher);
+        }
+
+        if (idx < 0)
+                return -ENOSPC; /* no free key cache entries */
+
+        if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
+                                      vif->type == NL80211_IFTYPE_AP);
+        else
+                ret = ath_hw_set_keycache_entry(common, idx, &hk, mac);
+
+        if (!ret)
+                return -EIO;
+
+        set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                set_bit(idx + 64, common->keymap);
+                set_bit(idx, common->tkip_keymap);
+                set_bit(idx + 64, common->tkip_keymap);
+                if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                        set_bit(idx + 32, common->keymap);
+                        set_bit(idx + 64 + 32, common->keymap);
+                        set_bit(idx + 32, common->tkip_keymap);
+                        set_bit(idx + 64 + 32, common->tkip_keymap);
+                }
+        }
+
+        return idx;
+}
+EXPORT_SYMBOL(ath_key_config);
+
+/*
+ * Delete Key.
+ */
+void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
+{
+        ath_hw_keyreset(common, key->hw_key_idx);
+        if (key->hw_key_idx < IEEE80211_WEP_NKID)
+                return;
+
+        clear_bit(key->hw_key_idx, common->keymap);
+        if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
+                return;
+
+        clear_bit(key->hw_key_idx + 64, common->keymap);
+
+        clear_bit(key->hw_key_idx, common->tkip_keymap);
+        clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
+
+        if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+                ath_hw_keyreset(common, key->hw_key_idx + 32);
+                clear_bit(key->hw_key_idx + 32, common->keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+
+                clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
+        }
+}
+EXPORT_SYMBOL(ath_key_delete);
diff --git a/drivers/net/wireless/ath/reg.h b/drivers/net/wireless/ath/reg.h
index dfe1fbec24f5..e798ef476581 100644
--- a/drivers/net/wireless/ath/reg.h
+++ b/drivers/net/wireless/ath/reg.h
@@ -24,4 +24,27 @@
 #define AR_BSSMSKL              0x80e0
 #define AR_BSSMSKU              0x80e4
 
+#define AR_KEYTABLE_0           0x8800
+#define AR_KEYTABLE(_n)         (AR_KEYTABLE_0 + ((_n)*32))
+#define AR_KEY_CACHE_SIZE       128
+#define AR_RSVD_KEYTABLE_ENTRIES 4
+#define AR_KEY_TYPE             0x00000007
+#define AR_KEYTABLE_TYPE_40     0x00000000
+#define AR_KEYTABLE_TYPE_104    0x00000001
+#define AR_KEYTABLE_TYPE_128    0x00000003
+#define AR_KEYTABLE_TYPE_TKIP   0x00000004
+#define AR_KEYTABLE_TYPE_AES    0x00000005
+#define AR_KEYTABLE_TYPE_CCM    0x00000006
+#define AR_KEYTABLE_TYPE_CLR    0x00000007
+#define AR_KEYTABLE_ANT         0x00000008
+#define AR_KEYTABLE_VALID       0x00008000
+#define AR_KEYTABLE_KEY0(_n)    (AR_KEYTABLE(_n) + 0)
+#define AR_KEYTABLE_KEY1(_n)    (AR_KEYTABLE(_n) + 4)
+#define AR_KEYTABLE_KEY2(_n)    (AR_KEYTABLE(_n) + 8)
+#define AR_KEYTABLE_KEY3(_n)    (AR_KEYTABLE(_n) + 12)
+#define AR_KEYTABLE_KEY4(_n)    (AR_KEYTABLE(_n) + 16)
+#define AR_KEYTABLE_TYPE(_n)    (AR_KEYTABLE(_n) + 20)
+#define AR_KEYTABLE_MAC0(_n)    (AR_KEYTABLE(_n) + 24)
+#define AR_KEYTABLE_MAC1(_n)    (AR_KEYTABLE(_n) + 28)
+
 #endif /* ATH_REGISTERS_H */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 20631ae2ddd7..a1186525c70d 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2280,6 +2280,7 @@ out:
 
 static int b43_upload_microcode(struct b43_wldev *dev)
 {
+        struct wiphy *wiphy = dev->wl->hw->wiphy;
         const size_t hdr_len = sizeof(struct b43_fw_header);
         const __be32 *data;
         unsigned int i, len;
@@ -2405,6 +2406,10 @@ static int b43_upload_microcode(struct b43_wldev *dev)
                 }
         }
 
+        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
+                        dev->fw.rev, dev->fw.patch);
+        wiphy->hw_version = dev->dev->id.coreid;
+
         if (b43_is_old_txhdr_format(dev)) {
                 /* We're over the deadline, but we keep support for old fw
                  * until it turns out to be in major conflict with something new. */
@@ -3754,17 +3759,17 @@ static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         }
 
         err = -EINVAL;
-        switch (key->alg) {
-        case ALG_WEP:
-                if (key->keylen == WLAN_KEY_LEN_WEP40)
-                        algorithm = B43_SEC_ALGO_WEP40;
-                else
-                        algorithm = B43_SEC_ALGO_WEP104;
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                algorithm = B43_SEC_ALGO_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                algorithm = B43_SEC_ALGO_WEP104;
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 algorithm = B43_SEC_ALGO_TKIP;
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 algorithm = B43_SEC_ALGO_AES;
                 break;
         default:
@@ -4250,6 +4255,10 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
                 return;
+
+        /* Unregister HW RNG driver */
+        b43_rng_exit(dev->wl);
+
         b43_set_status(dev, B43_STAT_UNINIT);
 
         /* Stop the microcode PSM. */
@@ -4379,6 +4388,9 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
+        /* Register HW RNG driver */
+        b43_rng_init(dev->wl);
+
 out:
         return err;
 
@@ -4984,7 +4996,6 @@ static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
                 if (err)
                         goto err_one_core_detach;
                 b43_leds_register(wl->current_dev);
-                b43_rng_init(wl);
         }
 
       out:
@@ -5020,7 +5031,6 @@ static void b43_remove(struct ssb_device *dev)
         b43_one_core_detach(dev);
 
         if (list_empty(&wl->devlist)) {
-                b43_rng_exit(wl);
                 b43_leds_unregister(wl);
                 /* Last core on the chip unregistered.
                  * We can destroy common struct b43_wl.
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 5a725703770c..2466c0a52e5d 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -893,7 +893,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/WorkaroundsGainCtrl */
-static void b43_nphy_gain_crtl_workarounds(struct b43_wldev *dev)
+static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
 {
         struct b43_phy_n *nphy = dev->phy.n;
         u8 i, j;
@@ -1094,11 +1094,12 @@ static void b43_nphy_workarounds(struct b43_wldev *dev)
                 b43_nphy_set_rf_sequence(dev, 0, events1, delays1, 7);
                 b43_nphy_set_rf_sequence(dev, 1, events2, delays2, 7);
 
-                b43_nphy_gain_crtl_workarounds(dev);
+                b43_nphy_gain_ctrl_workarounds(dev);
 
                 if (dev->phy.rev < 2) {
                         if (b43_phy_read(dev, B43_NPHY_RXCTL) & 0x2)
-                                ; /*TODO: b43_mhf(dev, 2, 0x0010, 0x0010, 3);*/
+                                b43_hf_write(dev, b43_hf_read(dev) |
+                                                B43_HF_MLADVW);
                 } else if (dev->phy.rev == 2) {
                         b43_phy_write(dev, B43_NPHY_CRSCHECK2, 0);
                         b43_phy_write(dev, B43_NPHY_CRSCHECK3, 0);
@@ -1182,7 +1183,7 @@ static u16 b43_nphy_gen_load_samples(struct b43_wldev *dev, u32 freq, u16 max,
                 len = bw << 1;
         }
 
-        samples = kzalloc(len * sizeof(struct b43_c32), GFP_KERNEL);
+        samples = kcalloc(len, sizeof(struct b43_c32), GFP_KERNEL);
         if (!samples) {
                 b43err(dev->wl, "allocation for samples generation failed\n");
                 return 0;
@@ -3073,6 +3074,57 @@ static int b43_nphy_cal_rx_iq(struct b43_wldev *dev,
                 return b43_nphy_rev2_cal_rx_iq(dev, target, type, debug);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
+static void b43_nphy_mac_phy_clock_set(struct b43_wldev *dev, bool on)
+{
+        u32 tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
+        if (on)
+                tmslow |= SSB_TMSLOW_PHYCLK;
+        else
+                tmslow &= ~SSB_TMSLOW_PHYCLK;
+        ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RxCoreSetState */
+static void b43_nphy_set_rx_core_state(struct b43_wldev *dev, u8 mask)
+{
+        struct b43_phy *phy = &dev->phy;
+        struct b43_phy_n *nphy = phy->n;
+        u16 buf[16];
+
+        nphy->phyrxchain = mask;
+
+        if (0 /* FIXME clk */)
+                return;
+
+        b43_mac_suspend(dev);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, true);
+
+        b43_phy_maskset(dev, B43_NPHY_RFSEQCA, ~B43_NPHY_RFSEQCA_RXEN,
+                        (mask & 0x3) << B43_NPHY_RFSEQCA_RXEN_SHIFT);
+
+        if ((mask & 0x3) != 0x3) {
+                b43_phy_write(dev, B43_NPHY_HPANT_SWTHRES, 1);
+                if (dev->phy.rev >= 3) {
+                        /* TODO */
+                }
+        } else {
+                b43_phy_write(dev, B43_NPHY_HPANT_SWTHRES, 0x1E);
+                if (dev->phy.rev >= 3) {
+                        /* TODO */
+                }
+        }
+
+        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, false);
+
+        b43_mac_enable(dev);
+}
+
 /*
  * Init N-PHY
  * http://bcm-v4.sipsolutions.net/802.11/PHY/Init/N
@@ -3173,7 +3225,7 @@ int b43_phy_initn(struct b43_wldev *dev)
         b43_phy_write(dev, B43_NPHY_BBCFG, tmp & ~B43_NPHY_BBCFG_RSTCCA);
         b43_nphy_bmac_clock_fgc(dev, 0);
 
-        /* TODO N PHY MAC PHY Clock Set with argument 1 */
+        b43_nphy_mac_phy_clock_set(dev, true);
 
         b43_nphy_pa_override(dev, false);
         b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
@@ -3199,7 +3251,7 @@ int b43_phy_initn(struct b43_wldev *dev)
         }
 
         if (nphy->phyrxchain != 3)
-                ;/* TODO N PHY RX Core Set State with phyrxchain as argument */
+                b43_nphy_set_rx_core_state(dev, nphy->phyrxchain);
         if (nphy->mphase_cal_phase_id > 0)
                 ;/* TODO PHY Periodic Calibration Multi-Phase Restart */
 
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 1713f5f7a58b..67f18ecdb3bf 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -1623,6 +1623,7 @@ error:
 
 static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
 {
+        struct wiphy *wiphy = dev->wl->hw->wiphy;
         const size_t hdr_len = sizeof(struct b43legacy_fw_header);
         const __be32 *data;
         unsigned int i;
@@ -1732,6 +1733,10 @@ static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
         dev->fw.rev = fwrev;
         dev->fw.patch = fwpatch;
 
+        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
+                        dev->fw.rev, dev->fw.patch);
+        wiphy->hw_version = dev->dev->id.coreid;
+
         return 0;
 
 error:
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index a85e43a8d758..6038633ef361 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1696,7 +1696,7 @@ static int prism2_request_scan(struct net_device *dev)
                 hostap_set_word(dev, HFA384X_RID_CNFROAMINGMODE,
                                 HFA384X_ROAMING_FIRMWARE);
 
-        return 0;
+        return ret;
 }
 
 #else /* !PRISM2_NO_STATION_MODES */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 996e9d7d7586..61915f371416 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1921,9 +1921,9 @@ static int ipw2100_net_init(struct net_device *dev)
 
                 bg_band->band = IEEE80211_BAND_2GHZ;
                 bg_band->n_channels = geo->bg_channels;
-                bg_band->channels =
-                        kzalloc(geo->bg_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                bg_band->channels = kcalloc(geo->bg_channels,
+                                            sizeof(struct ieee80211_channel),
+                                            GFP_KERNEL);
                 if (!bg_band->channels) {
                         ipw2100_down(priv);
                         return -ENOMEM;
@@ -3056,9 +3056,9 @@ static void ipw2100_tx_send_commands(struct ipw2100_priv *priv)
 
                 packet = list_entry(element, struct ipw2100_tx_packet, list);
 
-                IPW_DEBUG_TX("using TBD at virt=%p, phys=%p\n",
+                IPW_DEBUG_TX("using TBD at virt=%p, phys=%04X\n",
                              &txq->drv[txq->next],
-                             (void *)(txq->nic + txq->next *
+                             (u32) (txq->nic + txq->next *
                                       sizeof(struct ipw2100_bd)));
 
                 packet->index = txq->next;
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index cb2552a6777c..0f2508384c75 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11467,9 +11467,9 @@ static int ipw_net_init(struct net_device *dev)
 
                 bg_band->band = IEEE80211_BAND_2GHZ;
                 bg_band->n_channels = geo->bg_channels;
-                bg_band->channels =
-                        kzalloc(geo->bg_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                bg_band->channels = kcalloc(geo->bg_channels,
+                                            sizeof(struct ieee80211_channel),
+                                            GFP_KERNEL);
                 /* translate geo->bg to bg_band.channels */
                 for (i = 0; i < geo->bg_channels; i++) {
                         bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
@@ -11502,9 +11502,9 @@ static int ipw_net_init(struct net_device *dev)
 
                 a_band->band = IEEE80211_BAND_5GHZ;
                 a_band->n_channels = geo->a_channels;
-                a_band->channels =
-                        kzalloc(geo->a_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
+                a_band->channels = kcalloc(geo->a_channels,
+                                           sizeof(struct ieee80211_channel),
+                                           GFP_KERNEL);
                 /* translate geo->bg to a_band.channels */
                 for (i = 0; i < geo->a_channels; i++) {
                         a_band->channels[i].band = IEEE80211_BAND_2GHZ;
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index a51e4da1bdfc..b82364258dc5 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -3,6 +3,9 @@ config IWLWIFI
         depends on PCI && MAC80211
         select FW_LOADER
 
+menu "Debugging Options"
+        depends on IWLWIFI
+
 config IWLWIFI_DEBUG
         bool "Enable full debugging output in iwlagn and iwl3945 drivers"
         depends on IWLWIFI
@@ -36,6 +39,12 @@ config IWLWIFI_DEBUGFS
           is a low-impact option that allows getting insight into the
           driver's state at runtime.
 
+config IWLWIFI_DEBUG_EXPERIMENTAL_UCODE
+        bool "Experimental uCode support"
+        depends on IWLWIFI && IWLWIFI_DEBUG
+        ---help---
+          Enable use of experimental ucode for testing and debugging.
+
 config IWLWIFI_DEVICE_TRACING
         bool "iwlwifi device access tracing"
         depends on IWLWIFI
@@ -53,6 +62,7 @@ config IWLWIFI_DEVICE_TRACING
 
           If unsure, say Y so we can help you better when problems
           occur.
+endmenu
 
 config IWLAGN
         tristate "Intel Wireless WiFi Next Gen AGN (iwlagn)"
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 728bb858ba97..493163925a45 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_IWLAGN)	+= iwlagn.o
 iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
 iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
 iwlagn-objs             += iwl-agn-lib.o iwl-agn-rx.o iwl-agn-calib.o
+iwlagn-objs             += iwl-agn-tt.o
 iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 0b779a41a142..56ef4ed0db47 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -130,7 +130,7 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWLAGN_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWLAGN_BROADCAST_ID;
 
         priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
@@ -217,18 +217,24 @@ static struct iwl_lib_ops iwl1000_lib = {
                 .set_ct_kill = iwl1000_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_station = iwl_update_bcast_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
         .txfifo_flush = iwlagn_txfifo_flush,
         .dev_txfifo_flush = iwlagn_dev_txfifo_flush,
+        .tt_ops = {
+                .lower_power_detection = iwl_tt_is_low_power_state,
+                .tt_power_mode = iwl_tt_current_power_mode,
+                .ct_kill_check = iwl_check_for_ct_kill,
+        }
 };
 
 static const struct iwl_ops iwl1000_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 7c731a793632..65b5834da28c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -62,7 +62,7 @@
  *****************************************************************************/
 /*
  * Please use this file (iwl-3945-hw.h) only for hardware-related definitions.
- * Please use iwl-3945-commands.h for uCode API definitions.
+ * Please use iwl-commands.h for uCode API definitions.
  * Please use iwl-3945.h for driver implementation definitions.
  */
 
@@ -226,6 +226,7 @@ struct iwl3945_eeprom {
 
 /* 4 DATA + 1 CMD. There are 2 HCCA queues that are not used. */
 #define IWL39_NUM_QUEUES        5
+#define IWL39_CMD_QUEUE_NUM     4
 
 #define IWL_DEFAULT_TX_RETRY  15
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 8e84a08ff951..d707f5bb1a8b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -343,7 +343,7 @@ void iwl3945_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 s
         int i;
 
         IWL_DEBUG_INFO(priv, "enter\n");
-        if (sta_id == priv->hw_params.bcast_sta_id)
+        if (sta_id == priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id)
                 goto out;
 
         psta = (struct iwl3945_sta_priv *) sta->drv_priv;
@@ -932,7 +932,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta(priv->vif,
+        sta = ieee80211_find_sta(priv->contexts[IWL_RXON_CTX_BSS].vif,
                                  priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
                 IWL_DEBUG_RATE(priv, "Unable to find station to initialize rate scaling.\n");
@@ -949,7 +949,8 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
         switch (priv->band) {
         case IEEE80211_BAND_2GHZ:
                 /* TODO: this always does G, not a regression */
-                if (priv->active_rxon.flags & RXON_FLG_TGG_PROTECT_MSK) {
+                if (priv->contexts[IWL_RXON_CTX_BSS].active.flags &
+                                                RXON_FLG_TGG_PROTECT_MSK) {
                         rs_sta->tgg = 1;
                         rs_sta->expected_tpt = iwl3945_expected_tpt_g_prot;
                 } else
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 8ccfcd08218d..5d09686c3389 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -245,7 +245,7 @@ int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate)
                 break;
         case IEEE80211_BAND_2GHZ:
                 if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
-                    iwl_is_associated(priv)) {
+                    iwl_is_associated(priv, IWL_RXON_CTX_BSS)) {
                         if (rate == IWL_RATE_11M_INDEX)
                                 next_rate = IWL_RATE_5M_INDEX;
                 }
@@ -273,7 +273,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
         struct iwl_queue *q = &txq->q;
         struct iwl_tx_info *tx_info;
 
-        BUG_ON(txq_id == IWL_CMD_QUEUE_NUM);
+        BUG_ON(txq_id == IWL39_CMD_QUEUE_NUM);
 
         for (index = iwl_queue_inc_wrap(index, q->n_bd); q->read_ptr != index;
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
@@ -285,7 +285,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
         }
 
         if (iwl_queue_space(q) > q->low_mark && (txq_id >= 0) &&
-                        (txq_id != IWL_CMD_QUEUE_NUM) &&
+                        (txq_id != IWL39_CMD_QUEUE_NUM) &&
                         priv->mac80211_registered)
                 iwl_wake_queue(priv, txq_id);
 }
@@ -760,7 +760,7 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                 data_retry_limit = IWL_DEFAULT_TX_RETRY;
         tx_cmd->data_retry_limit = data_retry_limit;
 
-        if (tx_id >= IWL_CMD_QUEUE_NUM)
+        if (tx_id >= IWL39_CMD_QUEUE_NUM)
                 rts_retry_limit = 3;
         else
                 rts_retry_limit = 7;
@@ -909,7 +909,7 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
 
         /* Tx queue(s) */
         for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
+                slots_num = (txq_id == IWL39_CMD_QUEUE_NUM) ?
                                 TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
                 rc = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
                                        txq_id);
@@ -1072,7 +1072,7 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
         if (priv->txq)
                 for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
                      txq_id++)
-                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                        if (txq_id == IWL39_CMD_QUEUE_NUM)
                                 iwl_cmd_queue_free(priv);
                         else
                                 iwl_tx_queue_free(priv, txq_id);
@@ -1439,17 +1439,18 @@ static int iwl3945_send_tx_power(struct iwl_priv *priv)
         int rate_idx, i;
         const struct iwl_channel_info *ch_info = NULL;
         struct iwl3945_txpowertable_cmd txpower = {
-                .channel = priv->active_rxon.channel,
+                .channel = priv->contexts[IWL_RXON_CTX_BSS].active.channel,
         };
+        u16 chan;
+
+        chan = le16_to_cpu(priv->contexts[IWL_RXON_CTX_BSS].active.channel);
 
         txpower.band = (priv->band == IEEE80211_BAND_5GHZ) ? 0 : 1;
-        ch_info = iwl_get_channel_info(priv,
-                                       priv->band,
-                                       le16_to_cpu(priv->active_rxon.channel));
+        ch_info = iwl_get_channel_info(priv, priv->band, chan);
         if (!ch_info) {
                 IWL_ERR(priv,
                         "Failed to get channel info for channel %d [%d]\n",
-                        le16_to_cpu(priv->active_rxon.channel), priv->band);
+                        chan, priv->band);
                 return -EINVAL;
         }
 
@@ -1710,7 +1711,8 @@ int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power)
         return 0;
 }
 
-static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
+static int iwl3945_send_rxon_assoc(struct iwl_priv *priv,
+                                   struct iwl_rxon_context *ctx)
 {
         int rc = 0;
         struct iwl_rx_packet *pkt;
@@ -1721,8 +1723,8 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
                 .flags = CMD_WANT_SKB,
                 .data = &rxon_assoc,
         };
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+        const struct iwl_rxon_cmd *rxon1 = &ctx->staging;
+        const struct iwl_rxon_cmd *rxon2 = &ctx->active;
 
         if ((rxon1->flags == rxon2->flags) &&
             (rxon1->filter_flags == rxon2->filter_flags) &&
@@ -1732,10 +1734,10 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
                 return 0;
         }
 
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.flags = ctx->staging.flags;
+        rxon_assoc.filter_flags = ctx->staging.filter_flags;
+        rxon_assoc.ofdm_basic_rates = ctx->staging.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = ctx->staging.cck_basic_rates;
         rxon_assoc.reserved = 0;
 
         rc = iwl_send_cmd_sync(priv, &cmd);
@@ -1761,14 +1763,14 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
  * function correctly transitions out of the RXON_ASSOC_MSK state if
  * a HW tune is required based on the RXON structure changes.
  */
-static int iwl3945_commit_rxon(struct iwl_priv *priv)
+static int iwl3945_commit_rxon(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx)
 {
         /* cast away the const for active_rxon in this function */
-        struct iwl3945_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
-        struct iwl3945_rxon_cmd *staging_rxon = (void *)&priv->staging_rxon;
+        struct iwl3945_rxon_cmd *active_rxon = (void *)&ctx->active;
+        struct iwl3945_rxon_cmd *staging_rxon = (void *)&ctx->staging;
         int rc = 0;
-        bool new_assoc =
-                !!(priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK);
+        bool new_assoc = !!(staging_rxon->filter_flags & RXON_FILTER_ASSOC_MSK);
 
         if (!iwl_is_alive(priv))
                 return -1;
@@ -1781,7 +1783,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
             ~(RXON_FLG_DIS_DIV_MSK | RXON_FLG_ANT_SEL_MSK);
         staging_rxon->flags |= iwl3945_get_antenna_flags(priv);
 
-        rc = iwl_check_rxon_cmd(priv);
+        rc = iwl_check_rxon_cmd(priv, ctx);
         if (rc) {
                 IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
                 return -EINVAL;
@@ -1790,8 +1792,9 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         /* If we don't need to send a full RXON, we can use
          * iwl3945_rxon_assoc_cmd which is used to reconfigure filter
          * and other flags for the current radio configuration. */
-        if (!iwl_full_rxon_required(priv)) {
-                rc = iwl_send_rxon_assoc(priv);
+        if (!iwl_full_rxon_required(priv, &priv->contexts[IWL_RXON_CTX_BSS])) {
+                rc = iwl_send_rxon_assoc(priv,
+                                         &priv->contexts[IWL_RXON_CTX_BSS]);
                 if (rc) {
                         IWL_ERR(priv, "Error setting RXON_ASSOC "
                                   "configuration (%d).\n", rc);
@@ -1807,7 +1810,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
          * an RXON_ASSOC and the new config wants the associated mask enabled,
          * we must clear the associated from the active configuration
          * before we apply the new config */
-        if (iwl_is_associated(priv) && new_assoc) {
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS) && new_assoc) {
                 IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
 
@@ -1819,7 +1822,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                 active_rxon->reserved5 = 0;
                 rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
                                       sizeof(struct iwl3945_rxon_cmd),
-                                      &priv->active_rxon);
+                                      &priv->contexts[IWL_RXON_CTX_BSS].active);
 
                 /* If the mask clearing failed then we set
                  * active_rxon back to what it was previously */
@@ -1829,8 +1832,9 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                                   "configuration (%d).\n", rc);
                         return rc;
                 }
-                iwl_clear_ucode_stations(priv);
-                iwl_restore_stations(priv);
+                iwl_clear_ucode_stations(priv,
+                                         &priv->contexts[IWL_RXON_CTX_BSS]);
+                iwl_restore_stations(priv, &priv->contexts[IWL_RXON_CTX_BSS]);
         }
 
         IWL_DEBUG_INFO(priv, "Sending RXON\n"
@@ -1848,7 +1852,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         staging_rxon->reserved4 = 0;
         staging_rxon->reserved5 = 0;
 
-        iwl_set_rxon_hwcrypto(priv, !iwl3945_mod_params.sw_crypto);
+        iwl_set_rxon_hwcrypto(priv, ctx, !iwl3945_mod_params.sw_crypto);
 
         /* Apply the new configuration */
         rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
@@ -1862,8 +1866,9 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
 
         if (!new_assoc) {
-                iwl_clear_ucode_stations(priv);
-                iwl_restore_stations(priv);
+                iwl_clear_ucode_stations(priv,
+                                         &priv->contexts[IWL_RXON_CTX_BSS]);
+                iwl_restore_stations(priv, &priv->contexts[IWL_RXON_CTX_BSS]);
         }
 
         /* If we issue a new RXON command which required a tune then we must
@@ -2302,8 +2307,10 @@ static int iwl3945_manage_ibss_station(struct iwl_priv *priv,
         int ret;
 
         if (add) {
-                ret = iwl_add_bssid_station(priv, vif->bss_conf.bssid, false,
-                                            &vif_priv->ibss_bssid_sta_id);
+                ret = iwl_add_bssid_station(
+                                priv, &priv->contexts[IWL_RXON_CTX_BSS],
+                                vif->bss_conf.bssid, false,
+                                &vif_priv->ibss_bssid_sta_id);
                 if (ret)
                         return ret;
 
@@ -2366,7 +2373,7 @@ int iwl3945_init_hw_rate_table(struct iwl_priv *priv)
                  * 1M CCK rates */
 
                 if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
-                    iwl_is_associated(priv)) {
+                    iwl_is_associated(priv, IWL_RXON_CTX_BSS)) {
 
                         index = IWL_FIRST_CCK_RATE;
                         for (i = IWL_RATE_6M_INDEX_TABLE;
@@ -2421,7 +2428,9 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
         priv->hw_params.max_stations = IWL3945_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWL3945_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWL3945_BROADCAST_ID;
+
+        priv->sta_key_max_num = STA_KEY_MAX_NUM;
 
         priv->hw_params.rx_wrt_ptr_reg = FH39_RSCSR_CHNL0_WPTR;
         priv->hw_params.max_beacon_itrvl = IWL39_MAX_UCODE_BEACON_INTERVAL;
@@ -2439,7 +2448,8 @@ unsigned int iwl3945_hw_get_beacon_cmd(struct iwl_priv *priv,
         tx_beacon_cmd = (struct iwl3945_tx_beacon_cmd *)&frame->u;
         memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
 
-        tx_beacon_cmd->tx.sta_id = priv->hw_params.bcast_sta_id;
+        tx_beacon_cmd->tx.sta_id =
+                priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id;
         tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 
         frame_size = iwl3945_fill_beacon_frame(priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index bb2aeebf3652..98509c5e708d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -295,7 +295,7 @@ extern const struct iwl_channel_info *iwl3945_get_channel_info(
 extern int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate);
 
 /* scanning */
-void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
 
 /* Requires full declaration of iwl_priv before including */
 #include "iwl-io.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index d92b72909233..943a9c7bfa7f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -347,7 +347,7 @@ static void iwl4965_chain_noise_reset(struct iwl_priv *priv)
         struct iwl_chain_noise_data *data = &(priv->chain_noise_data);
 
         if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
-             iwl_is_associated(priv)) {
+            iwl_is_any_associated(priv)) {
                 struct iwl_calib_diff_gain_cmd cmd;
 
                 /* clear data for chain noise calibration algorithm */
@@ -576,7 +576,7 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
         /* Activate all Tx DMA/FIFO channels */
         priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 6));
 
-        iwl4965_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+        iwl4965_set_wr_ptrs(priv, IWL_DEFAULT_CMD_QUEUE_NUM, 0);
 
         /* make sure all queue are not stopped */
         memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
@@ -587,6 +587,7 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
         priv->txq_ctx_active_msk = 0;
         /* Map each Tx/cmd queue to its corresponding fifo */
         BUILD_BUG_ON(ARRAY_SIZE(default_queue_to_tx_fifo) != 7);
+
         for (i = 0; i < ARRAY_SIZE(default_queue_to_tx_fifo); i++) {
                 int ac = default_queue_to_tx_fifo[i];
 
@@ -656,7 +657,7 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
                         sizeof(struct iwl4965_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL4965_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWL4965_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWL4965_BROADCAST_ID;
         priv->hw_params.max_data_size = IWL49_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWL49_RTC_INST_SIZE;
         priv->hw_params.max_bsm_size = BSM_SRAM_SIZE;
@@ -1374,6 +1375,7 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
         u8 band = 0;
         bool is_ht40 = false;
         u8 ctrl_chan_high = 0;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 /* If this gets hit a lot, switch it to a BUG() and catch
@@ -1385,17 +1387,16 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
 
         band = priv->band == IEEE80211_BAND_2GHZ;
 
-        is_ht40 =  is_ht40_channel(priv->active_rxon.flags);
+        is_ht40 = is_ht40_channel(ctx->active.flags);
 
-        if (is_ht40 &&
-            (priv->active_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
+        if (is_ht40 && (ctx->active.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
                 ctrl_chan_high = 1;
 
         cmd.band = band;
-        cmd.channel = priv->active_rxon.channel;
+        cmd.channel = ctx->active.channel;
 
         ret = iwl4965_fill_txpower_tbl(priv, band,
-                                le16_to_cpu(priv->active_rxon.channel),
+                                le16_to_cpu(ctx->active.channel),
                                 is_ht40, ctrl_chan_high, &cmd.tx_power);
         if (ret)
                 goto out;
@@ -1406,12 +1407,13 @@ out:
         return ret;
 }
 
-static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
+static int iwl4965_send_rxon_assoc(struct iwl_priv *priv,
+                                   struct iwl_rxon_context *ctx)
 {
         int ret = 0;
         struct iwl4965_rxon_assoc_cmd rxon_assoc;
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+        const struct iwl_rxon_cmd *rxon1 = &ctx->staging;
+        const struct iwl_rxon_cmd *rxon2 = &ctx->active;
 
         if ((rxon1->flags == rxon2->flags) &&
             (rxon1->filter_flags == rxon2->filter_flags) &&
@@ -1426,16 +1428,16 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
                 return 0;
         }
 
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.flags = ctx->staging.flags;
+        rxon_assoc.filter_flags = ctx->staging.filter_flags;
+        rxon_assoc.ofdm_basic_rates = ctx->staging.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = ctx->staging.cck_basic_rates;
         rxon_assoc.reserved = 0;
         rxon_assoc.ofdm_ht_single_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
+            ctx->staging.ofdm_ht_single_stream_basic_rates;
         rxon_assoc.ofdm_ht_dual_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
-        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
+            ctx->staging.ofdm_ht_dual_stream_basic_rates;
+        rxon_assoc.rx_chain_select_flags = ctx->staging.rx_chain;
 
         ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
                                      sizeof(rxon_assoc), &rxon_assoc, NULL);
@@ -1448,6 +1450,7 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
 static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
                                      struct ieee80211_channel_switch *ch_switch)
 {
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         int rc;
         u8 band = 0;
         bool is_ht40 = false;
@@ -1458,22 +1461,22 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
         u16 ch;
         u32 tsf_low;
         u8 switch_count;
-        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
-        struct ieee80211_vif *vif = priv->vif;
+        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+        struct ieee80211_vif *vif = ctx->vif;
         band = priv->band == IEEE80211_BAND_2GHZ;
 
-        is_ht40 = is_ht40_channel(priv->staging_rxon.flags);
+        is_ht40 = is_ht40_channel(ctx->staging.flags);
 
         if (is_ht40 &&
-            (priv->staging_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
+            (ctx->staging.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
                 ctrl_chan_high = 1;
 
         cmd.band = band;
         cmd.expect_beacon = 0;
-        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        ch = ch_switch->channel->hw_value;
         cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = priv->staging_rxon.flags;
-        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
+        cmd.rxon_flags = ctx->staging.flags;
+        cmd.rxon_filter_flags = ctx->staging.filter_flags;
         switch_count = ch_switch->count;
         tsf_low = ch_switch->timestamp & 0x0ffffffff;
         /*
@@ -1508,7 +1511,7 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, ch);
+                        ctx->active.channel, ch);
                 return -EFAULT;
         }
 
@@ -2007,7 +2010,7 @@ static u8 iwl_find_station(struct iwl_priv *priv, const u8 *addr)
                 start = IWL_STA_ID;
 
         if (is_broadcast_ether_addr(addr))
-                return priv->hw_params.bcast_sta_id;
+                return priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         for (i = start; i < priv->hw_params.max_stations; i++)
@@ -2280,12 +2283,13 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .set_ct_kill = iwl4965_set_ct_threshold,
         },
         .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_station = iwl_update_bcast_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 146e6431ae95..3975e45e7500 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -62,7 +62,7 @@
  *****************************************************************************/
 /*
  * Please use this file (iwl-5000-hw.h) only for hardware-related definitions.
- * Use iwl-5000-commands.h for uCode API definitions.
+ * Use iwl-commands.h for uCode API definitions.
  */
 
 #ifndef __iwl_5000_hw_h__
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 48bdcd8d2e94..21b4b23368e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -180,7 +180,7 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWLAGN_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWLAGN_BROADCAST_ID;
 
         priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
@@ -227,7 +227,7 @@ static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWLAGN_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWLAGN_BROADCAST_ID;
 
         priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
@@ -275,14 +275,19 @@ static void iwl5150_temperature(struct iwl_priv *priv)
 static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
                                      struct ieee80211_channel_switch *ch_switch)
 {
+        /*
+         * MULTI-FIXME
+         * See iwl_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl5000_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
         u32 switch_time_in_usec, ucode_switch_time;
         u16 ch;
         u32 tsf_low;
         u8 switch_count;
-        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
-        struct ieee80211_vif *vif = priv->vif;
+        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+        struct ieee80211_vif *vif = ctx->vif;
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = sizeof(cmd),
@@ -291,12 +296,12 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
         };
 
         cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        ch = ch_switch->channel->hw_value;
         IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
-                priv->active_rxon.channel, ch);
+                      ctx->active.channel, ch);
         cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = priv->staging_rxon.flags;
-        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
+        cmd.rxon_flags = ctx->staging.flags;
+        cmd.rxon_filter_flags = ctx->staging.filter_flags;
         switch_count = ch_switch->count;
         tsf_low = ch_switch->timestamp & 0x0ffffffff;
         /*
@@ -331,7 +336,7 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, ch);
+                        ctx->active.channel, ch);
                 return -EFAULT;
         }
         priv->switch_rxon.channel = cmd.channel;
@@ -393,18 +398,24 @@ static struct iwl_lib_ops iwl5000_lib = {
                 .set_ct_kill = iwl5000_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_station = iwl_update_bcast_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
         .txfifo_flush = iwlagn_txfifo_flush,
         .dev_txfifo_flush = iwlagn_dev_txfifo_flush,
+        .tt_ops = {
+                .lower_power_detection = iwl_tt_is_low_power_state,
+                .tt_power_mode = iwl_tt_current_power_mode,
+                .ct_kill_check = iwl_check_for_ct_kill,
+        }
 };
 
 static struct iwl_lib_ops iwl5150_lib = {
@@ -459,17 +470,24 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .set_ct_kill = iwl5150_set_ct_threshold,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_station = iwl_update_bcast_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
+                .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
         .txfifo_flush = iwlagn_txfifo_flush,
         .dev_txfifo_flush = iwlagn_dev_txfifo_flush,
+        .tt_ops = {
+                .lower_power_detection = iwl_tt_is_low_power_state,
+                .tt_power_mode = iwl_tt_current_power_mode,
+                .ct_kill_check = iwl_check_for_ct_kill,
+        }
 };
 
 static const struct iwl_ops iwl5000_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
index ddba39999997..47891e16a758 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
@@ -62,7 +62,7 @@
  *****************************************************************************/
 /*
  * Please use this file (iwl-6000-hw.h) only for hardware-related definitions.
- * Use iwl-5000-commands.h for uCode API definitions.
+ * Use iwl-commands.h for uCode API definitions.
  */
 
 #ifndef __iwl_6000_hw_h__
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index cee06b968de8..9f43f2770c96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -52,7 +52,7 @@
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 4
-#define IWL6000G2_UCODE_API_MAX 4
+#define IWL6000G2_UCODE_API_MAX 5
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
@@ -161,7 +161,7 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
                         sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWLAGN_STATION_COUNT;
-        priv->hw_params.bcast_sta_id = IWLAGN_BROADCAST_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id = IWLAGN_BROADCAST_ID;
 
         priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
@@ -198,14 +198,19 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
                                      struct ieee80211_channel_switch *ch_switch)
 {
+        /*
+         * MULTI-FIXME
+         * See iwl_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl6000_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
         u32 switch_time_in_usec, ucode_switch_time;
         u16 ch;
         u32 tsf_low;
         u8 switch_count;
-        u16 beacon_interval = le16_to_cpu(priv->rxon_timing.beacon_interval);
-        struct ieee80211_vif *vif = priv->vif;
+        u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+        struct ieee80211_vif *vif = ctx->vif;
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = sizeof(cmd),
@@ -214,12 +219,12 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         };
 
         cmd.band = priv->band == IEEE80211_BAND_2GHZ;
-        ch = ieee80211_frequency_to_channel(ch_switch->channel->center_freq);
+        ch = ch_switch->channel->hw_value;
         IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
-                      priv->active_rxon.channel, ch);
+                      ctx->active.channel, ch);
         cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = priv->staging_rxon.flags;
-        cmd.rxon_filter_flags = priv->staging_rxon.filter_flags;
+        cmd.rxon_flags = ctx->staging.flags;
+        cmd.rxon_filter_flags = ctx->staging.filter_flags;
         switch_count = ch_switch->count;
         tsf_low = ch_switch->timestamp & 0x0ffffffff;
         /*
@@ -254,7 +259,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
                 cmd.expect_beacon = is_channel_radar(ch_info);
         else {
                 IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        priv->active_rxon.channel, ch);
+                        ctx->active.channel, ch);
                 return -EFAULT;
         }
         priv->switch_rxon.channel = cmd.channel;
@@ -318,18 +323,100 @@ static struct iwl_lib_ops iwl6000_lib = {
                 .set_calib_version = iwl6000_set_calib_version,
          },
         .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_station = iwl_update_bcast_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
                 .general_stats_read = iwl_ucode_general_stats_read,
                 .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
         },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
         .txfifo_flush = iwlagn_txfifo_flush,
         .dev_txfifo_flush = iwlagn_dev_txfifo_flush,
+        .tt_ops = {
+                .lower_power_detection = iwl_tt_is_low_power_state,
+                .tt_power_mode = iwl_tt_current_power_mode,
+                .ct_kill_check = iwl_check_for_ct_kill,
+        }
+};
+
+static struct iwl_lib_ops iwl6000g2b_lib = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
+        .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
+        .txq_free_tfd = iwl_hw_txq_free_tfd,
+        .txq_init = iwl_hw_tx_queue_init,
+        .rx_handler_setup = iwlagn_bt_rx_handler_setup,
+        .setup_deferred_work = iwlagn_bt_setup_deferred_work,
+        .cancel_deferred_work = iwlagn_bt_cancel_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
+        .dump_nic_event_log = iwl_dump_nic_event_log,
+        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
+        .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .apm_ops = {
+                .init = iwl_apm_init,
+                .stop = iwl_apm_stop,
+                .config = iwl6000_nic_config,
+                .set_pwr_src = iwl_set_pwr_src,
+        },
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
+                },
+                .verify_signature  = iwlcore_eeprom_verify_signature,
+                .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
+                .release_semaphore = iwlcore_eeprom_release_semaphore,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
+                .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
+        },
+        .post_associate = iwl_post_associate,
+        .isr = iwl_isr_ict,
+        .config_ap = iwl_config_ap,
+        .temp_ops = {
+                .temperature = iwlagn_temperature,
+                .set_ct_kill = iwl6000_set_ct_threshold,
+                .set_calib_version = iwl6000_set_calib_version,
+         },
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+                .bt_stats_read = iwl_ucode_bt_stats_read,
+                .reply_tx_error = iwl_reply_tx_error_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
+        .txfifo_flush = iwlagn_txfifo_flush,
+        .dev_txfifo_flush = iwlagn_dev_txfifo_flush,
+        .tt_ops = {
+                .lower_power_detection = iwl_tt_is_low_power_state,
+                .tt_power_mode = iwl_tt_current_power_mode,
+                .ct_kill_check = iwl_check_for_ct_kill,
+        }
 };
 
 static const struct iwl_ops iwl6000_ops = {
@@ -339,21 +426,9 @@ static const struct iwl_ops iwl6000_ops = {
         .led = &iwlagn_led_ops,
 };
 
-static void do_not_send_bt_config(struct iwl_priv *priv)
-{
-}
-
-static struct iwl_hcmd_ops iwl6000g2b_hcmd = {
-        .rxon_assoc = iwlagn_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
-        .set_tx_ant = iwlagn_send_tx_ant_config,
-        .send_bt_config = do_not_send_bt_config,
-};
-
 static const struct iwl_ops iwl6000g2b_ops = {
-        .lib = &iwl6000_lib,
-        .hcmd = &iwl6000g2b_hcmd,
+        .lib = &iwl6000g2b_lib,
+        .hcmd = &iwlagn_bt_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
@@ -494,7 +569,7 @@ struct iwl_cfg iwl6000g2b_2agn_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -502,6 +577,11 @@ struct iwl_cfg iwl6000g2b_2agn_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2abg_cfg = {
@@ -530,7 +610,7 @@ struct iwl_cfg iwl6000g2b_2abg_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -538,6 +618,11 @@ struct iwl_cfg iwl6000g2b_2abg_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2bgn_cfg = {
@@ -568,7 +653,7 @@ struct iwl_cfg iwl6000g2b_2bgn_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -576,6 +661,11 @@ struct iwl_cfg iwl6000g2b_2bgn_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_2bg_cfg = {
@@ -604,7 +694,7 @@ struct iwl_cfg iwl6000g2b_2bg_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -612,6 +702,11 @@ struct iwl_cfg iwl6000g2b_2bg_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_bgn_cfg = {
@@ -642,7 +737,7 @@ struct iwl_cfg iwl6000g2b_bgn_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -650,6 +745,11 @@ struct iwl_cfg iwl6000g2b_bgn_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 struct iwl_cfg iwl6000g2b_bg_cfg = {
@@ -678,7 +778,7 @@ struct iwl_cfg iwl6000g2b_bg_cfg = {
         .supports_idle = true,
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE,
         .chain_noise_scale = 1000,
         .monitor_recover_period = IWL_LONG_MONITORING_PERIOD,
         .max_event_log_size = 512,
@@ -686,6 +786,11 @@ struct iwl_cfg iwl6000g2b_bg_cfg = {
         .chain_noise_calib_by_driver = true,
         .need_dc_calib = true,
         .bt_statistics = true,
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
+        .advanced_bt_coexist = true,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index c4c5691032a6..84ad62958535 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -625,7 +625,7 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv, void *resp)
 
         data = &(priv->sensitivity_data);
 
-        if (!iwl_is_associated(priv)) {
+        if (!iwl_is_any_associated(priv)) {
                 IWL_DEBUG_CALIB(priv, "<< - not associated\n");
                 return;
         }
@@ -763,6 +763,12 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
         unsigned long flags;
         struct statistics_rx_non_phy *rx_info;
         u8 first_chain;
+        /*
+         * MULTI-FIXME:
+         * When we support multiple interfaces on different channels,
+         * this must be modified/fixed.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         if (priv->disable_chain_noise_cal)
                 return;
@@ -793,8 +799,8 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
                 return;
         }
 
-        rxon_band24 = !!(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK);
-        rxon_chnum = le16_to_cpu(priv->staging_rxon.channel);
+        rxon_band24 = !!(ctx->staging.flags & RXON_FLG_BAND_24G_MSK);
+        rxon_chnum = le16_to_cpu(ctx->staging.channel);
         if (priv->cfg->bt_statistics) {
                 stat_band24 = !!(((struct iwl_bt_notif_statistics *)
                                  stat_resp)->flag &
@@ -914,7 +920,11 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
          * To be safe, simply mask out any chains that we know
          * are not on the device.
          */
-        active_chains &= priv->hw_params.valid_rx_ant;
+        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+                /* operated as 1x1 in full concurrency mode */
+                active_chains &= first_antenna(priv->hw_params.valid_rx_ant);
+        } else
+                active_chains &= priv->hw_params.valid_rx_ant;
 
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
index d706b8afbe5a..5391b4627397 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -25,9 +25,15 @@
 *  Intel Linux Wireless <ilw@linux.intel.com>
 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 *****************************************************************************/
-
+#include "iwl-agn.h"
 #include "iwl-agn-debugfs.h"
 
+static const char *fmt_value = "  %-30s %10u\n";
+static const char *fmt_hex   = "  %-30s       0x%02X\n";
+static const char *fmt_table = "  %-30s %10u  %10u  %10u  %10u\n";
+static const char *fmt_header =
+        "%-32s    current  cumulative       delta         max\n";
+
 static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
 {
         int p = 0;
@@ -121,436 +127,380 @@ ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - OFDM:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         fmt_header, "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "ina_cnt:",
+                         le32_to_cpu(ofdm->ina_cnt),
                          accum_ofdm->ina_cnt,
                          delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_cnt:",
+                         fmt_table, "fina_cnt:",
                          le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
                          delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
                          delta_ofdm->plcp_err, max_ofdm->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
                          delta_ofdm->crc32_err, max_ofdm->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(ofdm->overrun_err),
                          accum_ofdm->overrun_err, delta_ofdm->overrun_err,
                          max_ofdm->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(ofdm->early_overrun_err),
                          accum_ofdm->early_overrun_err,
                          delta_ofdm->early_overrun_err,
                          max_ofdm->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         fmt_table, "crc32_good:",
+                         le32_to_cpu(ofdm->crc32_good),
                          accum_ofdm->crc32_good, delta_ofdm->crc32_good,
                          max_ofdm->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         fmt_table, "false_alarm_cnt:",
                          le32_to_cpu(ofdm->false_alarm_cnt),
                          accum_ofdm->false_alarm_cnt,
                          delta_ofdm->false_alarm_cnt,
                          max_ofdm->false_alarm_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_sync_err_cnt:",
+                         fmt_table, "fina_sync_err_cnt:",
                          le32_to_cpu(ofdm->fina_sync_err_cnt),
                          accum_ofdm->fina_sync_err_cnt,
                          delta_ofdm->fina_sync_err_cnt,
                          max_ofdm->fina_sync_err_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sfd_timeout:",
+                         fmt_table, "sfd_timeout:",
                          le32_to_cpu(ofdm->sfd_timeout),
                          accum_ofdm->sfd_timeout, delta_ofdm->sfd_timeout,
                          max_ofdm->sfd_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         fmt_table, "fina_timeout:",
                          le32_to_cpu(ofdm->fina_timeout),
                          accum_ofdm->fina_timeout, delta_ofdm->fina_timeout,
                          max_ofdm->fina_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unresponded_rts:",
+                         fmt_table, "unresponded_rts:",
                          le32_to_cpu(ofdm->unresponded_rts),
                          accum_ofdm->unresponded_rts,
                          delta_ofdm->unresponded_rts,
                          max_ofdm->unresponded_rts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rxe_frame_lmt_ovrun:",
+                         fmt_table, "rxe_frame_lmt_ovrun:",
                          le32_to_cpu(ofdm->rxe_frame_limit_overrun),
                          accum_ofdm->rxe_frame_limit_overrun,
                          delta_ofdm->rxe_frame_limit_overrun,
                          max_ofdm->rxe_frame_limit_overrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         fmt_table, "sent_ack_cnt:",
                          le32_to_cpu(ofdm->sent_ack_cnt),
                          accum_ofdm->sent_ack_cnt, delta_ofdm->sent_ack_cnt,
                          max_ofdm->sent_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         fmt_table, "sent_cts_cnt:",
                          le32_to_cpu(ofdm->sent_cts_cnt),
                          accum_ofdm->sent_cts_cnt, delta_ofdm->sent_cts_cnt,
                          max_ofdm->sent_cts_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sent_ba_rsp_cnt:",
+                         fmt_table, "sent_ba_rsp_cnt:",
                          le32_to_cpu(ofdm->sent_ba_rsp_cnt),
                          accum_ofdm->sent_ba_rsp_cnt,
                          delta_ofdm->sent_ba_rsp_cnt,
                          max_ofdm->sent_ba_rsp_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         fmt_table, "dsp_self_kill:",
                          le32_to_cpu(ofdm->dsp_self_kill),
                          accum_ofdm->dsp_self_kill,
                          delta_ofdm->dsp_self_kill,
                          max_ofdm->dsp_self_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(ofdm->mh_format_err),
                          accum_ofdm->mh_format_err,
                          delta_ofdm->mh_format_err,
                          max_ofdm->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "re_acq_main_rssi_sum:",
+                         fmt_table, "re_acq_main_rssi_sum:",
                          le32_to_cpu(ofdm->re_acq_main_rssi_sum),
                          accum_ofdm->re_acq_main_rssi_sum,
                          delta_ofdm->re_acq_main_rssi_sum,
                          max_ofdm->re_acq_main_rssi_sum);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - CCK:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_cnt:",
+                         fmt_header, "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "ina_cnt:",
                          le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
                          delta_cck->ina_cnt, max_cck->ina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_cnt:",
+                         fmt_table, "fina_cnt:",
                          le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
                          delta_cck->fina_cnt, max_cck->fina_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
                          delta_cck->plcp_err, max_cck->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
                          delta_cck->crc32_err, max_cck->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(cck->overrun_err),
                          accum_cck->overrun_err, delta_cck->overrun_err,
                          max_cck->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(cck->early_overrun_err),
                          accum_cck->early_overrun_err,
                          delta_cck->early_overrun_err,
                          max_cck->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:",
+                         fmt_table, "crc32_good:",
                          le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
                          delta_cck->crc32_good, max_cck->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "false_alarm_cnt:",
+                         fmt_table, "false_alarm_cnt:",
                          le32_to_cpu(cck->false_alarm_cnt),
                          accum_cck->false_alarm_cnt,
                          delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "fina_sync_err_cnt:",
+                         fmt_table, "fina_sync_err_cnt:",
                          le32_to_cpu(cck->fina_sync_err_cnt),
                          accum_cck->fina_sync_err_cnt,
                          delta_cck->fina_sync_err_cnt,
                          max_cck->fina_sync_err_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sfd_timeout:",
+                         fmt_table, "sfd_timeout:",
                          le32_to_cpu(cck->sfd_timeout),
                          accum_cck->sfd_timeout, delta_cck->sfd_timeout,
                          max_cck->sfd_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         fmt_table, "fina_timeout:",
                          le32_to_cpu(cck->fina_timeout),
                          accum_cck->fina_timeout, delta_cck->fina_timeout,
                          max_cck->fina_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unresponded_rts:",
+                         fmt_table, "unresponded_rts:",
                          le32_to_cpu(cck->unresponded_rts),
                          accum_cck->unresponded_rts, delta_cck->unresponded_rts,
                          max_cck->unresponded_rts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rxe_frame_lmt_ovrun:",
+                         fmt_table, "rxe_frame_lmt_ovrun:",
                          le32_to_cpu(cck->rxe_frame_limit_overrun),
                          accum_cck->rxe_frame_limit_overrun,
                          delta_cck->rxe_frame_limit_overrun,
                          max_cck->rxe_frame_limit_overrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         fmt_table, "sent_ack_cnt:",
                          le32_to_cpu(cck->sent_ack_cnt),
                          accum_cck->sent_ack_cnt, delta_cck->sent_ack_cnt,
                          max_cck->sent_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         fmt_table, "sent_cts_cnt:",
                          le32_to_cpu(cck->sent_cts_cnt),
                          accum_cck->sent_cts_cnt, delta_cck->sent_cts_cnt,
                          max_cck->sent_cts_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ba_rsp_cnt:",
+                         fmt_table, "sent_ba_rsp_cnt:",
                          le32_to_cpu(cck->sent_ba_rsp_cnt),
                          accum_cck->sent_ba_rsp_cnt,
                          delta_cck->sent_ba_rsp_cnt,
                          max_cck->sent_ba_rsp_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         fmt_table, "dsp_self_kill:",
                          le32_to_cpu(cck->dsp_self_kill),
                          accum_cck->dsp_self_kill, delta_cck->dsp_self_kill,
                          max_cck->dsp_self_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(cck->mh_format_err),
                          accum_cck->mh_format_err, delta_cck->mh_format_err,
                          max_cck->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "re_acq_main_rssi_sum:",
+                         fmt_table, "re_acq_main_rssi_sum:",
                          le32_to_cpu(cck->re_acq_main_rssi_sum),
                          accum_cck->re_acq_main_rssi_sum,
                          delta_cck->re_acq_main_rssi_sum,
                          max_cck->re_acq_main_rssi_sum);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - GENERAL:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_cts:",
+                         fmt_header, "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "bogus_cts:",
                          le32_to_cpu(general->bogus_cts),
                          accum_general->bogus_cts, delta_general->bogus_cts,
                          max_general->bogus_cts);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_ack:",
+                         fmt_table, "bogus_ack:",
                          le32_to_cpu(general->bogus_ack),
                          accum_general->bogus_ack, delta_general->bogus_ack,
                          max_general->bogus_ack);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "non_bssid_frames:",
+                         fmt_table, "non_bssid_frames:",
                          le32_to_cpu(general->non_bssid_frames),
                          accum_general->non_bssid_frames,
                          delta_general->non_bssid_frames,
                          max_general->non_bssid_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "filtered_frames:",
+                         fmt_table, "filtered_frames:",
                          le32_to_cpu(general->filtered_frames),
                          accum_general->filtered_frames,
                          delta_general->filtered_frames,
                          max_general->filtered_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "non_channel_beacons:",
+                         fmt_table, "non_channel_beacons:",
                          le32_to_cpu(general->non_channel_beacons),
                          accum_general->non_channel_beacons,
                          delta_general->non_channel_beacons,
                          max_general->non_channel_beacons);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "channel_beacons:",
+                         fmt_table, "channel_beacons:",
                          le32_to_cpu(general->channel_beacons),
                          accum_general->channel_beacons,
                          delta_general->channel_beacons,
                          max_general->channel_beacons);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "num_missed_bcon:",
+                         fmt_table, "num_missed_bcon:",
                          le32_to_cpu(general->num_missed_bcon),
                          accum_general->num_missed_bcon,
                          delta_general->num_missed_bcon,
                          max_general->num_missed_bcon);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "adc_rx_saturation_time:",
+                         fmt_table, "adc_rx_saturation_time:",
                          le32_to_cpu(general->adc_rx_saturation_time),
                          accum_general->adc_rx_saturation_time,
                          delta_general->adc_rx_saturation_time,
                          max_general->adc_rx_saturation_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ina_detect_search_tm:",
+                         fmt_table, "ina_detect_search_tm:",
                          le32_to_cpu(general->ina_detection_search_time),
                          accum_general->ina_detection_search_time,
                          delta_general->ina_detection_search_time,
                          max_general->ina_detection_search_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_a:",
+                         fmt_table, "beacon_silence_rssi_a:",
                          le32_to_cpu(general->beacon_silence_rssi_a),
                          accum_general->beacon_silence_rssi_a,
                          delta_general->beacon_silence_rssi_a,
                          max_general->beacon_silence_rssi_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_b:",
+                         fmt_table, "beacon_silence_rssi_b:",
                          le32_to_cpu(general->beacon_silence_rssi_b),
                          accum_general->beacon_silence_rssi_b,
                          delta_general->beacon_silence_rssi_b,
                          max_general->beacon_silence_rssi_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_silence_rssi_c:",
+                         fmt_table, "beacon_silence_rssi_c:",
                          le32_to_cpu(general->beacon_silence_rssi_c),
                          accum_general->beacon_silence_rssi_c,
                          delta_general->beacon_silence_rssi_c,
                          max_general->beacon_silence_rssi_c);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "interference_data_flag:",
+                         fmt_table, "interference_data_flag:",
                          le32_to_cpu(general->interference_data_flag),
                          accum_general->interference_data_flag,
                          delta_general->interference_data_flag,
                          max_general->interference_data_flag);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "channel_load:",
+                         fmt_table, "channel_load:",
                          le32_to_cpu(general->channel_load),
                          accum_general->channel_load,
                          delta_general->channel_load,
                          max_general->channel_load);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "dsp_false_alarms:",
+                         fmt_table, "dsp_false_alarms:",
                          le32_to_cpu(general->dsp_false_alarms),
                          accum_general->dsp_false_alarms,
                          delta_general->dsp_false_alarms,
                          max_general->dsp_false_alarms);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_a:",
+                         fmt_table, "beacon_rssi_a:",
                          le32_to_cpu(general->beacon_rssi_a),
                          accum_general->beacon_rssi_a,
                          delta_general->beacon_rssi_a,
                          max_general->beacon_rssi_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_b:",
+                         fmt_table, "beacon_rssi_b:",
                          le32_to_cpu(general->beacon_rssi_b),
                          accum_general->beacon_rssi_b,
                          delta_general->beacon_rssi_b,
                          max_general->beacon_rssi_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_rssi_c:",
+                         fmt_table, "beacon_rssi_c:",
                          le32_to_cpu(general->beacon_rssi_c),
                          accum_general->beacon_rssi_c,
                          delta_general->beacon_rssi_c,
                          max_general->beacon_rssi_c);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_a:",
+                         fmt_table, "beacon_energy_a:",
                          le32_to_cpu(general->beacon_energy_a),
                          accum_general->beacon_energy_a,
                          delta_general->beacon_energy_a,
                          max_general->beacon_energy_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_b:",
+                         fmt_table, "beacon_energy_b:",
                          le32_to_cpu(general->beacon_energy_b),
                          accum_general->beacon_energy_b,
                          delta_general->beacon_energy_b,
                          max_general->beacon_energy_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "beacon_energy_c:",
+                         fmt_table, "beacon_energy_c:",
                          le32_to_cpu(general->beacon_energy_c),
                          accum_general->beacon_energy_c,
                          delta_general->beacon_energy_c,
                          max_general->beacon_energy_c);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Rx - OFDM_HT:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "plcp_err:",
+                         fmt_header, "Statistics_Rx - OFDM_HT:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "plcp_err:",
                          le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
                          delta_ht->plcp_err, max_ht->plcp_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "overrun_err:",
+                         fmt_table, "overrun_err:",
                          le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
                          delta_ht->overrun_err, max_ht->overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "early_overrun_err:",
+                         fmt_table, "early_overrun_err:",
                          le32_to_cpu(ht->early_overrun_err),
                          accum_ht->early_overrun_err,
                          delta_ht->early_overrun_err,
                          max_ht->early_overrun_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_good:",
+                         fmt_table, "crc32_good:",
                          le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
                          delta_ht->crc32_good, max_ht->crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "crc32_err:",
+                         fmt_table, "crc32_err:",
                          le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
                          delta_ht->crc32_err, max_ht->crc32_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "mh_format_err:",
+                         fmt_table, "mh_format_err:",
                          le32_to_cpu(ht->mh_format_err),
                          accum_ht->mh_format_err,
                          delta_ht->mh_format_err, max_ht->mh_format_err);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_crc32_good:",
+                         fmt_table, "agg_crc32_good:",
                          le32_to_cpu(ht->agg_crc32_good),
                          accum_ht->agg_crc32_good,
                          delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_mpdu_cnt:",
+                         fmt_table, "agg_mpdu_cnt:",
                          le32_to_cpu(ht->agg_mpdu_cnt),
                          accum_ht->agg_mpdu_cnt,
                          delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg_cnt:",
+                         fmt_table, "agg_cnt:",
                          le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
                          delta_ht->agg_cnt, max_ht->agg_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "unsupport_mcs:",
+                         fmt_table, "unsupport_mcs:",
                          le32_to_cpu(ht->unsupport_mcs),
                          accum_ht->unsupport_mcs,
                          delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
@@ -597,166 +547,141 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos,  "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_Tx:");
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "preamble:",
+                         fmt_header, "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "preamble:",
                          le32_to_cpu(tx->preamble_cnt),
                          accum_tx->preamble_cnt,
                          delta_tx->preamble_cnt, max_tx->preamble_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rx_detected_cnt:",
+                         fmt_table, "rx_detected_cnt:",
                          le32_to_cpu(tx->rx_detected_cnt),
                          accum_tx->rx_detected_cnt,
                          delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "bt_prio_defer_cnt:",
+                         fmt_table, "bt_prio_defer_cnt:",
                          le32_to_cpu(tx->bt_prio_defer_cnt),
                          accum_tx->bt_prio_defer_cnt,
                          delta_tx->bt_prio_defer_cnt,
                          max_tx->bt_prio_defer_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "bt_prio_kill_cnt:",
+                         fmt_table, "bt_prio_kill_cnt:",
                          le32_to_cpu(tx->bt_prio_kill_cnt),
                          accum_tx->bt_prio_kill_cnt,
                          delta_tx->bt_prio_kill_cnt,
                          max_tx->bt_prio_kill_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "few_bytes_cnt:",
+                         fmt_table, "few_bytes_cnt:",
                          le32_to_cpu(tx->few_bytes_cnt),
                          accum_tx->few_bytes_cnt,
                          delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "cts_timeout:",
+                         fmt_table, "cts_timeout:",
                          le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
                          delta_tx->cts_timeout, max_tx->cts_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ack_timeout:",
+                         fmt_table, "ack_timeout:",
                          le32_to_cpu(tx->ack_timeout),
                          accum_tx->ack_timeout,
                          delta_tx->ack_timeout, max_tx->ack_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "expected_ack_cnt:",
+                         fmt_table, "expected_ack_cnt:",
                          le32_to_cpu(tx->expected_ack_cnt),
                          accum_tx->expected_ack_cnt,
                          delta_tx->expected_ack_cnt,
                          max_tx->expected_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "actual_ack_cnt:",
+                         fmt_table, "actual_ack_cnt:",
                          le32_to_cpu(tx->actual_ack_cnt),
                          accum_tx->actual_ack_cnt,
                          delta_tx->actual_ack_cnt,
                          max_tx->actual_ack_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "dump_msdu_cnt:",
+                         fmt_table, "dump_msdu_cnt:",
                          le32_to_cpu(tx->dump_msdu_cnt),
                          accum_tx->dump_msdu_cnt,
                          delta_tx->dump_msdu_cnt,
                          max_tx->dump_msdu_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "abort_nxt_frame_mismatch:",
+                         fmt_table, "abort_nxt_frame_mismatch:",
                          le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
                          accum_tx->burst_abort_next_frame_mismatch_cnt,
                          delta_tx->burst_abort_next_frame_mismatch_cnt,
                          max_tx->burst_abort_next_frame_mismatch_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "abort_missing_nxt_frame:",
+                         fmt_table, "abort_missing_nxt_frame:",
                          le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
                          accum_tx->burst_abort_missing_next_frame_cnt,
                          delta_tx->burst_abort_missing_next_frame_cnt,
                          max_tx->burst_abort_missing_next_frame_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "cts_timeout_collision:",
+                         fmt_table, "cts_timeout_collision:",
                          le32_to_cpu(tx->cts_timeout_collision),
                          accum_tx->cts_timeout_collision,
                          delta_tx->cts_timeout_collision,
                          max_tx->cts_timeout_collision);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "ack_ba_timeout_collision:",
+                         fmt_table, "ack_ba_timeout_collision:",
                          le32_to_cpu(tx->ack_or_ba_timeout_collision),
                          accum_tx->ack_or_ba_timeout_collision,
                          delta_tx->ack_or_ba_timeout_collision,
                          max_tx->ack_or_ba_timeout_collision);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg ba_timeout:",
+                         fmt_table, "agg ba_timeout:",
                          le32_to_cpu(tx->agg.ba_timeout),
                          accum_tx->agg.ba_timeout,
                          delta_tx->agg.ba_timeout,
                          max_tx->agg.ba_timeout);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg ba_resched_frames:",
+                         fmt_table, "agg ba_resched_frames:",
                          le32_to_cpu(tx->agg.ba_reschedule_frames),
                          accum_tx->agg.ba_reschedule_frames,
                          delta_tx->agg.ba_reschedule_frames,
                          max_tx->agg.ba_reschedule_frames);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_agg_frame:",
+                         fmt_table, "agg scd_query_agg_frame:",
                          le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
                          accum_tx->agg.scd_query_agg_frame_cnt,
                          delta_tx->agg.scd_query_agg_frame_cnt,
                          max_tx->agg.scd_query_agg_frame_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_no_agg:",
+                         fmt_table, "agg scd_query_no_agg:",
                          le32_to_cpu(tx->agg.scd_query_no_agg),
                          accum_tx->agg.scd_query_no_agg,
                          delta_tx->agg.scd_query_no_agg,
                          max_tx->agg.scd_query_no_agg);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_agg:",
+                         fmt_table, "agg scd_query_agg:",
                          le32_to_cpu(tx->agg.scd_query_agg),
                          accum_tx->agg.scd_query_agg,
                          delta_tx->agg.scd_query_agg,
                          max_tx->agg.scd_query_agg);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg scd_query_mismatch:",
+                         fmt_table, "agg scd_query_mismatch:",
                          le32_to_cpu(tx->agg.scd_query_mismatch),
                          accum_tx->agg.scd_query_mismatch,
                          delta_tx->agg.scd_query_mismatch,
                          max_tx->agg.scd_query_mismatch);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg frame_not_ready:",
+                         fmt_table, "agg frame_not_ready:",
                          le32_to_cpu(tx->agg.frame_not_ready),
                          accum_tx->agg.frame_not_ready,
                          delta_tx->agg.frame_not_ready,
                          max_tx->agg.frame_not_ready);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg underrun:",
+                         fmt_table, "agg underrun:",
                          le32_to_cpu(tx->agg.underrun),
                          accum_tx->agg.underrun,
                          delta_tx->agg.underrun, max_tx->agg.underrun);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg bt_prio_kill:",
+                         fmt_table, "agg bt_prio_kill:",
                          le32_to_cpu(tx->agg.bt_prio_kill),
                          accum_tx->agg.bt_prio_kill,
                          delta_tx->agg.bt_prio_kill,
                          max_tx->agg.bt_prio_kill);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "agg rx_ba_rsp_cnt:",
+                         fmt_table, "agg rx_ba_rsp_cnt:",
                          le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
                          accum_tx->agg.rx_ba_rsp_cnt,
                          delta_tx->agg.rx_ba_rsp_cnt,
@@ -767,15 +692,15 @@ ssize_t iwl_ucode_tx_stats_read(struct file *file,
                         "tx power: (1/2 dB step)\n");
                 if ((priv->cfg->valid_tx_ant & ANT_A) && tx->tx_power.ant_a)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna A: 0x%X\n",
+                                        fmt_hex, "antenna A:",
                                         tx->tx_power.ant_a);
                 if ((priv->cfg->valid_tx_ant & ANT_B) && tx->tx_power.ant_b)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna B: 0x%X\n",
+                                        fmt_hex, "antenna B:",
                                         tx->tx_power.ant_b);
                 if ((priv->cfg->valid_tx_ant & ANT_C) && tx->tx_power.ant_c)
                         pos += scnprintf(buf + pos, bufsz - pos,
-                                        "\tantenna C: 0x%X\n",
+                                        fmt_hex, "antenna C:",
                                         tx->tx_power.ant_c);
         }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
@@ -838,84 +763,72 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
         }
 
         pos += iwl_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
-                         "acumulative       delta         max\n",
-                         "Statistics_General:");
-        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
-                         "temperature:",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_header, "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_value, "temperature:",
                          le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
-                         "temperature_m:",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_value, "temperature_m:",
                          le32_to_cpu(general->temperature_m));
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "burst_check:",
+                         fmt_value, "ttl_timestamp:",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         fmt_table, "burst_check:",
                          le32_to_cpu(dbg->burst_check),
                          accum_dbg->burst_check,
                          delta_dbg->burst_check, max_dbg->burst_check);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "burst_count:",
+                         fmt_table, "burst_count:",
                          le32_to_cpu(dbg->burst_count),
                          accum_dbg->burst_count,
                          delta_dbg->burst_count, max_dbg->burst_count);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "wait_for_silence_timeout_count:",
+                         fmt_table, "wait_for_silence_timeout_count:",
                          le32_to_cpu(dbg->wait_for_silence_timeout_cnt),
                          accum_dbg->wait_for_silence_timeout_cnt,
                          delta_dbg->wait_for_silence_timeout_cnt,
                          max_dbg->wait_for_silence_timeout_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "sleep_time:",
+                         fmt_table, "sleep_time:",
                          le32_to_cpu(general->sleep_time),
                          accum_general->sleep_time,
                          delta_general->sleep_time, max_general->sleep_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "slots_out:",
+                         fmt_table, "slots_out:",
                          le32_to_cpu(general->slots_out),
                          accum_general->slots_out,
                          delta_general->slots_out, max_general->slots_out);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "slots_idle:",
+                         fmt_table, "slots_idle:",
                          le32_to_cpu(general->slots_idle),
                          accum_general->slots_idle,
                          delta_general->slots_idle, max_general->slots_idle);
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
-                         le32_to_cpu(general->ttl_timestamp));
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "tx_on_a:",
+                         fmt_table, "tx_on_a:",
                          le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
                          delta_div->tx_on_a, max_div->tx_on_a);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "tx_on_b:",
+                         fmt_table, "tx_on_b:",
                          le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
                          delta_div->tx_on_b, max_div->tx_on_b);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "exec_time:",
+                         fmt_table, "exec_time:",
                          le32_to_cpu(div->exec_time), accum_div->exec_time,
                          delta_div->exec_time, max_div->exec_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "probe_time:",
+                         fmt_table, "probe_time:",
                          le32_to_cpu(div->probe_time), accum_div->probe_time,
                          delta_div->probe_time, max_div->probe_time);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "rx_enable_counter:",
+                         fmt_table, "rx_enable_counter:",
                          le32_to_cpu(general->rx_enable_counter),
                          accum_general->rx_enable_counter,
                          delta_general->rx_enable_counter,
                          max_general->rx_enable_counter);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "  %-30s %10u  %10u  %10u  %10u\n",
-                         "num_of_sos_states:",
+                         fmt_table, "num_of_sos_states:",
                          le32_to_cpu(general->num_of_sos_states),
                          accum_general->num_of_sos_states,
                          delta_general->num_of_sos_states,
@@ -1011,3 +924,147 @@ ssize_t iwl_ucode_bt_stats_read(struct file *file,
         kfree(buf);
         return ret;
 }
+
+ssize_t iwl_reply_tx_error_read(struct file *file,
+                                char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct reply_tx_error_statistics) * 24) +
+                (sizeof(struct reply_agg_tx_error_statistics) * 24) + 200;
+        ssize_t ret;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_TX_Error:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_DELAY),
+                         priv->_agn.reply_tx_stats.pp_delay);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_FEW_BYTES),
+                         priv->_agn.reply_tx_stats.pp_few_bytes);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_BT_PRIO),
+                         priv->_agn.reply_tx_stats.pp_bt_prio);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_QUIET_PERIOD),
+                         priv->_agn.reply_tx_stats.pp_quiet_period);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_POSTPONE_CALC_TTAK),
+                         priv->_agn.reply_tx_stats.pp_calc_ttak);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY),
+                         priv->_agn.reply_tx_stats.int_crossed_retry);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_SHORT_LIMIT),
+                         priv->_agn.reply_tx_stats.short_limit);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_LONG_LIMIT),
+                         priv->_agn.reply_tx_stats.long_limit);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FIFO_UNDERRUN),
+                         priv->_agn.reply_tx_stats.fifo_underrun);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_DRAIN_FLOW),
+                         priv->_agn.reply_tx_stats.drain_flow);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_RFKILL_FLUSH),
+                         priv->_agn.reply_tx_stats.rfkill_flush);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_LIFE_EXPIRE),
+                         priv->_agn.reply_tx_stats.life_expire);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_DEST_PS),
+                         priv->_agn.reply_tx_stats.dest_ps);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_HOST_ABORTED),
+                         priv->_agn.reply_tx_stats.host_abort);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_BT_RETRY),
+                         priv->_agn.reply_tx_stats.pp_delay);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_STA_INVALID),
+                         priv->_agn.reply_tx_stats.sta_invalid);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FRAG_DROPPED),
+                         priv->_agn.reply_tx_stats.frag_drop);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_TID_DISABLE),
+                         priv->_agn.reply_tx_stats.tid_disable);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_FIFO_FLUSHED),
+                         priv->_agn.reply_tx_stats.fifo_flush);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_INSUFFICIENT_CF_POLL),
+                         priv->_agn.reply_tx_stats.insuff_cf_poll);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_tx_fail_reason(TX_STATUS_FAIL_PASSIVE_NO_RX),
+                         priv->_agn.reply_tx_stats.fail_hw_drop);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_tx_fail_reason(
+                                TX_STATUS_FAIL_NO_BEACON_ON_RADAR),
+                         priv->_agn.reply_tx_stats.sta_color_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos, "UNKNOWN:\t\t\t%u\n",
+                         priv->_agn.reply_tx_stats.unknown);
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "\nStatistics_Agg_TX_Error:\n");
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_UNDERRUN_MSK),
+                         priv->_agn.reply_agg_tx_stats.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_BT_PRIO_MSK),
+                         priv->_agn.reply_agg_tx_stats.bt_prio);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_FEW_BYTES_MSK),
+                         priv->_agn.reply_agg_tx_stats.few_bytes);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_ABORT_MSK),
+                         priv->_agn.reply_agg_tx_stats.abort);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_TTL_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_ttl);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_try);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_LAST_SENT_BT_KILL_MSK),
+                         priv->_agn.reply_agg_tx_stats.last_sent_bt_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_SCD_QUERY_MSK),
+                         priv->_agn.reply_agg_tx_stats.scd_query);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(
+                                AGG_TX_STATE_TEST_BAD_CRC32_MSK),
+                         priv->_agn.reply_agg_tx_stats.bad_crc32);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_RESPONSE_MSK),
+                         priv->_agn.reply_agg_tx_stats.response);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_DUMP_TX_MSK),
+                         priv->_agn.reply_agg_tx_stats.dump_tx);
+        pos += scnprintf(buf + pos, bufsz - pos, "%s:\t\t\t%u\n",
+                         iwl_get_agg_tx_fail_reason(AGG_TX_STATE_DELAY_TX_MSK),
+                         priv->_agn.reply_agg_tx_stats.delay_tx);
+        pos += scnprintf(buf + pos, bufsz - pos, "UNKNOWN:\t\t\t%u\n",
+                         priv->_agn.reply_agg_tx_stats.unknown);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
index bbdce5913ac7..f2573b5486cd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
@@ -39,6 +39,8 @@ ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
                                      size_t count, loff_t *ppos);
 ssize_t iwl_ucode_bt_stats_read(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos);
+ssize_t iwl_reply_tx_error_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
 #else
 static ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
@@ -60,4 +62,9 @@ static ssize_t iwl_ucode_bt_stats_read(struct file *file, char __user *user_buf,
 {
         return 0;
 }
+static ssize_t iwl_reply_tx_error_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 75b901b3eb1e..d86902b83630 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -37,12 +37,13 @@
 #include "iwl-io.h"
 #include "iwl-agn.h"
 
-int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
+int iwlagn_send_rxon_assoc(struct iwl_priv *priv,
+                           struct iwl_rxon_context *ctx)
 {
         int ret = 0;
         struct iwl5000_rxon_assoc_cmd rxon_assoc;
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+        const struct iwl_rxon_cmd *rxon1 = &ctx->staging;
+        const struct iwl_rxon_cmd *rxon2 = &ctx->active;
 
         if ((rxon1->flags == rxon2->flags) &&
             (rxon1->filter_flags == rxon2->filter_flags) &&
@@ -60,23 +61,23 @@ int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
                 return 0;
         }
 
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.flags = ctx->staging.flags;
+        rxon_assoc.filter_flags = ctx->staging.filter_flags;
+        rxon_assoc.ofdm_basic_rates = ctx->staging.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = ctx->staging.cck_basic_rates;
         rxon_assoc.reserved1 = 0;
         rxon_assoc.reserved2 = 0;
         rxon_assoc.reserved3 = 0;
         rxon_assoc.ofdm_ht_single_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
+            ctx->staging.ofdm_ht_single_stream_basic_rates;
         rxon_assoc.ofdm_ht_dual_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
-        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
+            ctx->staging.ofdm_ht_dual_stream_basic_rates;
+        rxon_assoc.rx_chain_select_flags = ctx->staging.rx_chain;
         rxon_assoc.ofdm_ht_triple_stream_basic_rates =
-                 priv->staging_rxon.ofdm_ht_triple_stream_basic_rates;
-        rxon_assoc.acquisition_data = priv->staging_rxon.acquisition_data;
+                 ctx->staging.ofdm_ht_triple_stream_basic_rates;
+        rxon_assoc.acquisition_data = ctx->staging.acquisition_data;
 
-        ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
+        ret = iwl_send_cmd_pdu_async(priv, ctx->rxon_assoc_cmd,
                                      sizeof(rxon_assoc), &rxon_assoc, NULL);
         if (ret)
                 return ret;
@@ -184,7 +185,7 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
         int ret;
 
         if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
-             iwl_is_associated(priv)) {
+            iwl_is_any_associated(priv)) {
                 struct iwl_calib_chain_noise_reset_cmd cmd;
 
                 /* clear data for chain noise calibration algorithm */
@@ -235,13 +236,13 @@ static int iwlagn_calc_rssi(struct iwl_priv *priv,
         /* data from PHY/DSP regarding signal strength, etc.,
          *   contents are always there, not configurable by host
          */
-        struct iwl5000_non_cfg_phy *ncphy =
-                (struct iwl5000_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
+        struct iwlagn_non_cfg_phy *ncphy =
+                (struct iwlagn_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
         u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
         u8 agc;
 
-        val  = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_AGC_IDX]);
-        agc = (val & IWL50_OFDM_AGC_MSK) >> IWL50_OFDM_AGC_BIT_POS;
+        val  = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_AGC_IDX]);
+        agc = (val & IWLAGN_OFDM_AGC_MSK) >> IWLAGN_OFDM_AGC_BIT_POS;
 
         /* Find max rssi among 3 possible receivers.
          * These values are measured by the digital signal processor (DSP).
@@ -249,11 +250,14 @@ static int iwlagn_calc_rssi(struct iwl_priv *priv,
          *   if the radio's automatic gain control (AGC) is working right.
          * AGC value (see below) will provide the "interesting" info.
          */
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_AB_IDX]);
-        rssi_a = (val & IWL50_OFDM_RSSI_A_MSK) >> IWL50_OFDM_RSSI_A_BIT_POS;
-        rssi_b = (val & IWL50_OFDM_RSSI_B_MSK) >> IWL50_OFDM_RSSI_B_BIT_POS;
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_C_IDX]);
-        rssi_c = (val & IWL50_OFDM_RSSI_C_MSK) >> IWL50_OFDM_RSSI_C_BIT_POS;
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_RSSI_AB_IDX]);
+        rssi_a = (val & IWLAGN_OFDM_RSSI_INBAND_A_BITMSK) >>
+                IWLAGN_OFDM_RSSI_A_BIT_POS;
+        rssi_b = (val & IWLAGN_OFDM_RSSI_INBAND_B_BITMSK) >>
+                IWLAGN_OFDM_RSSI_B_BIT_POS;
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_RSSI_C_IDX]);
+        rssi_c = (val & IWLAGN_OFDM_RSSI_INBAND_C_BITMSK) >>
+                IWLAGN_OFDM_RSSI_C_BIT_POS;
 
         max_rssi = max_t(u32, rssi_a, rssi_b);
         max_rssi = max_t(u32, max_rssi, rssi_c);
@@ -266,12 +270,109 @@ static int iwlagn_calc_rssi(struct iwl_priv *priv,
         return max_rssi - agc - IWLAGN_RSSI_OFFSET;
 }
 
+static int iwlagn_set_pan_params(struct iwl_priv *priv)
+{
+        struct iwl_wipan_params_cmd cmd;
+        struct iwl_rxon_context *ctx_bss, *ctx_pan;
+        int slot0 = 300, slot1 = 0;
+        int ret;
+
+        if (priv->valid_contexts == BIT(IWL_RXON_CTX_BSS))
+                return 0;
+
+        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
+
+        lockdep_assert_held(&priv->mutex);
+
+        ctx_bss = &priv->contexts[IWL_RXON_CTX_BSS];
+        ctx_pan = &priv->contexts[IWL_RXON_CTX_PAN];
+
+        /*
+         * If the PAN context is inactive, then we don't need
+         * to update the PAN parameters, the last thing we'll
+         * have done before it goes inactive is making the PAN
+         * parameters be WLAN-only.
+         */
+        if (!ctx_pan->is_active)
+                return 0;
+
+        memset(&cmd, 0, sizeof(cmd));
+
+        /* only 2 slots are currently allowed */
+        cmd.num_slots = 2;
+
+        cmd.slots[0].type = 0; /* BSS */
+        cmd.slots[1].type = 1; /* PAN */
+
+        if (ctx_bss->vif && ctx_pan->vif) {
+                int bcnint = ctx_pan->vif->bss_conf.beacon_int;
+
+                /* should be set, but seems unused?? */
+                cmd.flags |= cpu_to_le16(IWL_WIPAN_PARAMS_FLG_SLOTTED_MODE);
+
+                if (ctx_pan->vif->type == NL80211_IFTYPE_AP &&
+                    bcnint &&
+                    bcnint != ctx_bss->vif->bss_conf.beacon_int) {
+                        IWL_ERR(priv,
+                                "beacon intervals don't match (%d, %d)\n",
+                                ctx_bss->vif->bss_conf.beacon_int,
+                                ctx_pan->vif->bss_conf.beacon_int);
+                } else
+                        bcnint = max_t(int, bcnint,
+                                       ctx_bss->vif->bss_conf.beacon_int);
+                if (!bcnint)
+                        bcnint = DEFAULT_BEACON_INTERVAL;
+                slot0 = bcnint / 2;
+                slot1 = bcnint - slot0;
+
+                if (test_bit(STATUS_SCAN_HW, &priv->status) ||
+                    (!ctx_bss->vif->bss_conf.idle &&
+                     !ctx_bss->vif->bss_conf.assoc)) {
+                        slot0 = bcnint * 3 - 20;
+                        slot1 = 20;
+                } else if (!ctx_pan->vif->bss_conf.idle &&
+                           !ctx_pan->vif->bss_conf.assoc) {
+                        slot1 = bcnint * 3 - 20;
+                        slot0 = 20;
+                }
+        } else if (ctx_pan->vif) {
+                slot0 = 0;
+                slot1 = max_t(int, 1, ctx_pan->vif->bss_conf.dtim_period) *
+                                        ctx_pan->vif->bss_conf.beacon_int;
+                slot1 = max_t(int, DEFAULT_BEACON_INTERVAL, slot1);
+
+                if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                        slot0 = slot1 * 3 - 20;
+                        slot1 = 20;
+                }
+        }
+
+        cmd.slots[0].width = cpu_to_le16(slot0);
+        cmd.slots[1].width = cpu_to_le16(slot1);
+
+        ret = iwl_send_cmd_pdu(priv, REPLY_WIPAN_PARAMS, sizeof(cmd), &cmd);
+        if (ret)
+                IWL_ERR(priv, "Error setting PAN parameters (%d)\n", ret);
+
+        return ret;
+}
+
 struct iwl_hcmd_ops iwlagn_hcmd = {
         .rxon_assoc = iwlagn_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
         .set_rxon_chain = iwl_set_rxon_chain,
         .set_tx_ant = iwlagn_send_tx_ant_config,
         .send_bt_config = iwl_send_bt_config,
+        .set_pan_params = iwlagn_set_pan_params,
+};
+
+struct iwl_hcmd_ops iwlagn_bt_hcmd = {
+        .rxon_assoc = iwlagn_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
+        .set_tx_ant = iwlagn_send_tx_ant_config,
+        .send_bt_config = iwlagn_send_advance_bt_config,
+        .set_pan_params = iwlagn_set_pan_params,
 };
 
 struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 9dd9e64c2b0b..299fd9d59604 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -46,6 +46,181 @@ static inline u32 iwlagn_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
                             tx_resp->frame_count) & MAX_SN;
 }
 
+static void iwlagn_count_tx_err_status(struct iwl_priv *priv, u16 status)
+{
+        status &= TX_STATUS_MSK;
+
+        switch (status) {
+        case TX_STATUS_POSTPONE_DELAY:
+                priv->_agn.reply_tx_stats.pp_delay++;
+                break;
+        case TX_STATUS_POSTPONE_FEW_BYTES:
+                priv->_agn.reply_tx_stats.pp_few_bytes++;
+                break;
+        case TX_STATUS_POSTPONE_BT_PRIO:
+                priv->_agn.reply_tx_stats.pp_bt_prio++;
+                break;
+        case TX_STATUS_POSTPONE_QUIET_PERIOD:
+                priv->_agn.reply_tx_stats.pp_quiet_period++;
+                break;
+        case TX_STATUS_POSTPONE_CALC_TTAK:
+                priv->_agn.reply_tx_stats.pp_calc_ttak++;
+                break;
+        case TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY:
+                priv->_agn.reply_tx_stats.int_crossed_retry++;
+                break;
+        case TX_STATUS_FAIL_SHORT_LIMIT:
+                priv->_agn.reply_tx_stats.short_limit++;
+                break;
+        case TX_STATUS_FAIL_LONG_LIMIT:
+                priv->_agn.reply_tx_stats.long_limit++;
+                break;
+        case TX_STATUS_FAIL_FIFO_UNDERRUN:
+                priv->_agn.reply_tx_stats.fifo_underrun++;
+                break;
+        case TX_STATUS_FAIL_DRAIN_FLOW:
+                priv->_agn.reply_tx_stats.drain_flow++;
+                break;
+        case TX_STATUS_FAIL_RFKILL_FLUSH:
+                priv->_agn.reply_tx_stats.rfkill_flush++;
+                break;
+        case TX_STATUS_FAIL_LIFE_EXPIRE:
+                priv->_agn.reply_tx_stats.life_expire++;
+                break;
+        case TX_STATUS_FAIL_DEST_PS:
+                priv->_agn.reply_tx_stats.dest_ps++;
+                break;
+        case TX_STATUS_FAIL_HOST_ABORTED:
+                priv->_agn.reply_tx_stats.host_abort++;
+                break;
+        case TX_STATUS_FAIL_BT_RETRY:
+                priv->_agn.reply_tx_stats.bt_retry++;
+                break;
+        case TX_STATUS_FAIL_STA_INVALID:
+                priv->_agn.reply_tx_stats.sta_invalid++;
+                break;
+        case TX_STATUS_FAIL_FRAG_DROPPED:
+                priv->_agn.reply_tx_stats.frag_drop++;
+                break;
+        case TX_STATUS_FAIL_TID_DISABLE:
+                priv->_agn.reply_tx_stats.tid_disable++;
+                break;
+        case TX_STATUS_FAIL_FIFO_FLUSHED:
+                priv->_agn.reply_tx_stats.fifo_flush++;
+                break;
+        case TX_STATUS_FAIL_INSUFFICIENT_CF_POLL:
+                priv->_agn.reply_tx_stats.insuff_cf_poll++;
+                break;
+        case TX_STATUS_FAIL_PASSIVE_NO_RX:
+                priv->_agn.reply_tx_stats.fail_hw_drop++;
+                break;
+        case TX_STATUS_FAIL_NO_BEACON_ON_RADAR:
+                priv->_agn.reply_tx_stats.sta_color_mismatch++;
+                break;
+        default:
+                priv->_agn.reply_tx_stats.unknown++;
+                break;
+        }
+}
+
+static void iwlagn_count_agg_tx_err_status(struct iwl_priv *priv, u16 status)
+{
+        status &= AGG_TX_STATUS_MSK;
+
+        switch (status) {
+        case AGG_TX_STATE_UNDERRUN_MSK:
+                priv->_agn.reply_agg_tx_stats.underrun++;
+                break;
+        case AGG_TX_STATE_BT_PRIO_MSK:
+                priv->_agn.reply_agg_tx_stats.bt_prio++;
+                break;
+        case AGG_TX_STATE_FEW_BYTES_MSK:
+                priv->_agn.reply_agg_tx_stats.few_bytes++;
+                break;
+        case AGG_TX_STATE_ABORT_MSK:
+                priv->_agn.reply_agg_tx_stats.abort++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_TTL_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_ttl++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_try++;
+                break;
+        case AGG_TX_STATE_LAST_SENT_BT_KILL_MSK:
+                priv->_agn.reply_agg_tx_stats.last_sent_bt_kill++;
+                break;
+        case AGG_TX_STATE_SCD_QUERY_MSK:
+                priv->_agn.reply_agg_tx_stats.scd_query++;
+                break;
+        case AGG_TX_STATE_TEST_BAD_CRC32_MSK:
+                priv->_agn.reply_agg_tx_stats.bad_crc32++;
+                break;
+        case AGG_TX_STATE_RESPONSE_MSK:
+                priv->_agn.reply_agg_tx_stats.response++;
+                break;
+        case AGG_TX_STATE_DUMP_TX_MSK:
+                priv->_agn.reply_agg_tx_stats.dump_tx++;
+                break;
+        case AGG_TX_STATE_DELAY_TX_MSK:
+                priv->_agn.reply_agg_tx_stats.delay_tx++;
+                break;
+        default:
+                priv->_agn.reply_agg_tx_stats.unknown++;
+                break;
+        }
+}
+
+static void iwlagn_set_tx_status(struct iwl_priv *priv,
+                                 struct ieee80211_tx_info *info,
+                                 struct iwl5000_tx_resp *tx_resp,
+                                 int txq_id, bool is_agg)
+{
+        u16  status = le16_to_cpu(tx_resp->status.status);
+
+        info->status.rates[0].count = tx_resp->failure_frame + 1;
+        if (is_agg)
+                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+        info->flags |= iwl_tx_status_to_mac80211(status);
+        iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
+                                    info);
+        if (!iwl_is_tx_success(status))
+                iwlagn_count_tx_err_status(priv, status);
+
+        IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
+                           "0x%x retries %d\n",
+                           txq_id,
+                           iwl_get_tx_fail_reason(status), status,
+                           le32_to_cpu(tx_resp->rate_n_flags),
+                           tx_resp->failure_frame);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+#define AGG_TX_STATE_FAIL(x) case AGG_TX_STATE_ ## x: return #x
+
+const char *iwl_get_agg_tx_fail_reason(u16 status)
+{
+        status &= AGG_TX_STATUS_MSK;
+        switch (status) {
+        case AGG_TX_STATE_TRANSMITTED:
+                return "SUCCESS";
+                AGG_TX_STATE_FAIL(UNDERRUN_MSK);
+                AGG_TX_STATE_FAIL(BT_PRIO_MSK);
+                AGG_TX_STATE_FAIL(FEW_BYTES_MSK);
+                AGG_TX_STATE_FAIL(ABORT_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_TTL_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_TRY_CNT_MSK);
+                AGG_TX_STATE_FAIL(LAST_SENT_BT_KILL_MSK);
+                AGG_TX_STATE_FAIL(SCD_QUERY_MSK);
+                AGG_TX_STATE_FAIL(TEST_BAD_CRC32_MSK);
+                AGG_TX_STATE_FAIL(RESPONSE_MSK);
+                AGG_TX_STATE_FAIL(DUMP_TX_MSK);
+                AGG_TX_STATE_FAIL(DELAY_TX_MSK);
+        }
+
+        return "UNKNOWN";
+}
+#endif /* CONFIG_IWLWIFI_DEBUG */
+
 static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                                       struct iwl_ht_agg *agg,
                                       struct iwl5000_tx_resp *tx_resp,
@@ -53,9 +228,7 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
 {
         u16 status;
         struct agg_tx_status *frame_status = &tx_resp->status;
-        struct ieee80211_tx_info *info = NULL;
         struct ieee80211_hdr *hdr = NULL;
-        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
         int i, sh, idx;
         u16 seq;
 
@@ -64,31 +237,20 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
 
         agg->frame_count = tx_resp->frame_count;
         agg->start_idx = start_idx;
-        agg->rate_n_flags = rate_n_flags;
+        agg->rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
         agg->bitmap = 0;
 
         /* # frames attempted by Tx command */
         if (agg->frame_count == 1) {
                 /* Only one frame was attempted; no block-ack will arrive */
-                status = le16_to_cpu(frame_status[0].status);
                 idx = start_idx;
 
-                /* FIXME: code repetition */
                 IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
                                    agg->frame_count, agg->start_idx, idx);
-
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb);
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
-
-                /* FIXME: code repetition end */
-
-                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
-                                    status & 0xff, tx_resp->failure_frame);
-                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
-
+                iwlagn_set_tx_status(priv,
+                                     IEEE80211_SKB_CB(
+                                        priv->txq[txq_id].txb[idx].skb),
+                                     tx_resp, txq_id, true);
                 agg->wait_for_ba = 0;
         } else {
                 /* Two or more frames were attempted; expect block-ack */
@@ -109,12 +271,20 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                         idx = SEQ_TO_INDEX(seq);
                         txq_id = SEQ_TO_QUEUE(seq);
 
+                        if (status & AGG_TX_STATUS_MSK)
+                                iwlagn_count_agg_tx_err_status(priv, status);
+
                         if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
                                       AGG_TX_STATE_ABORT_MSK))
                                 continue;
 
                         IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
                                            agg->frame_count, txq_id, idx);
+                        IWL_DEBUG_TX_REPLY(priv, "status %s (0x%08x), "
+                                           "try-count (0x%08x)\n",
+                                           iwl_get_agg_tx_fail_reason(status),
+                                           status & AGG_TX_STATUS_MSK,
+                                           status & AGG_TX_TRY_MSK);
 
                         hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
                         if (!hdr) {
@@ -247,7 +417,14 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                 struct iwl_ht_agg *agg;
 
                 agg = &priv->stations[sta_id].tid[tid].agg;
-
+                /*
+                 * If the BT kill count is non-zero, we'll get this
+                 * notification again.
+                 */
+                if (tx_resp->bt_kill_count && tx_resp->frame_count == 1 &&
+                    priv->cfg->advanced_bt_coexist) {
+                        IWL_WARN(priv, "receive reply tx with bt_kill\n");
+                }
                 iwlagn_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
 
                 /* check if BAR is needed */
@@ -274,20 +451,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                 }
         } else {
                 BUG_ON(txq_id != txq->swq_id);
-
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwlagn_hwrate_to_tx_control(priv,
-                                        le32_to_cpu(tx_resp->rate_n_flags),
-                                        info);
-
-                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
-                                   "0x%x retries %d\n",
-                                   txq_id,
-                                   iwl_get_tx_fail_reason(status), status,
-                                   le32_to_cpu(tx_resp->rate_n_flags),
-                                   tx_resp->failure_frame);
-
+                iwlagn_set_tx_status(priv, info, tx_resp, txq_id, false);
                 freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                 iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
@@ -1098,7 +1262,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                 if (chan->band != band)
                         continue;
 
-                channel = ieee80211_frequency_to_channel(chan->center_freq);
+                channel = chan->hw_value;
                 scan_ch->channel = cpu_to_le16(channel);
 
                 ch_info = iwl_get_channel_info(priv, band, channel);
@@ -1147,7 +1311,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
         return added;
 }
 
-void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
@@ -1155,7 +1319,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 .flags = CMD_SIZE_HUGE,
         };
         struct iwl_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         u32 rate_flags = 0;
         u16 cmd_len;
         u16 rx_chain = 0;
@@ -1167,48 +1331,12 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         int  chan_mod;
         u8 active_chains;
         u8 scan_tx_antennas = priv->hw_params.valid_tx_ant;
+        int ret;
 
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
-                               "Ignoring second request.\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
+        lockdep_assert_held(&priv->mutex);
 
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
-                goto done;
-        }
+        if (vif)
+                ctx = iwl_rxon_ctx_from_vif(vif);
 
         if (!priv->scan_cmd) {
                 priv->scan_cmd = kmalloc(sizeof(struct iwl_scan_cmd) +
@@ -1216,7 +1344,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 if (!priv->scan_cmd) {
                         IWL_DEBUG_SCAN(priv,
                                        "fail to allocate memory for scan\n");
-                        goto done;
+                        return -ENOMEM;
                 }
         }
         scan = priv->scan_cmd;
@@ -1225,7 +1353,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_any_associated(priv)) {
                 u16 interval = 0;
                 u32 extra;
                 u32 suspend_time = 100;
@@ -1276,13 +1404,15 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
 
         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
-        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
+        scan->tx_cmd.sta_id = ctx->bcast_sta_id;
         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 
         switch (priv->scan_band) {
         case IEEE80211_BAND_2GHZ:
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
-                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
+                chan_mod = le32_to_cpu(
+                        priv->contexts[IWL_RXON_CTX_BSS].active.flags &
+                                                RXON_FLG_CHANNEL_MODE_MSK)
                                        >> RXON_FLG_CHANNEL_MODE_POS;
                 if (chan_mod == CHANNEL_MODE_PURE_40) {
                         rate = IWL_RATE_6M_PLCP;
@@ -1290,6 +1420,12 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
+                /*
+                 * Internal scans are passive, so we can indiscriminately set
+                 * the BT ignore flag on 2.4 GHz since it applies to TX only.
+                 */
+                if (priv->cfg->advanced_bt_coexist)
+                        scan->tx_cmd.tx_flags |= TX_CMD_FLG_IGNORE_BT;
                 scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
                 break;
         case IEEE80211_BAND_5GHZ:
@@ -1315,8 +1451,8 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                                                 IWL_GOOD_CRC_TH_NEVER;
                 break;
         default:
-                IWL_WARN(priv, "Invalid scan band count\n");
-                goto done;
+                IWL_WARN(priv, "Invalid scan band\n");
+                return -EIO;
         }
 
         band = priv->scan_band;
@@ -1327,6 +1463,12 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         if (priv->cfg->scan_tx_antennas[band])
                 scan_tx_antennas = priv->cfg->scan_tx_antennas[band];
 
+        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+                /* operated as 1x1 in full concurrency mode */
+                scan_tx_antennas =
+                        first_antenna(priv->cfg->scan_tx_antennas[band]);
+        }
+
         priv->scan_tx_ant[band] = iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band],
                                                     scan_tx_antennas);
         rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
@@ -1345,6 +1487,11 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 rx_ant = first_antenna(active_chains);
         }
+        if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+                /* operated as 1x1 in full concurrency mode */
+                rx_ant = first_antenna(rx_ant);
+        }
+
         /* MIMO is not used here, but value is required */
         rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
@@ -1385,7 +1532,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         }
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
+                return -EIO;
         }
 
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
@@ -1393,25 +1540,21 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         cmd.data = scan;
         scan->len = cpu_to_le16(cmd.len);
 
+        if (priv->cfg->ops->hcmd->set_pan_params) {
+                ret = priv->cfg->ops->hcmd->set_pan_params(priv);
+                if (ret)
+                        return ret;
+        }
+
         set_bit(STATUS_SCAN_HW, &priv->status);
-        if (iwl_send_cmd_sync(priv, &cmd))
-                goto done;
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret) {
+                clear_bit(STATUS_SCAN_HW, &priv->status);
+                if (priv->cfg->ops->hcmd->set_pan_params)
+                        priv->cfg->ops->hcmd->set_pan_params(priv);
+        }
 
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
-
-        return;
-
- done:
-        /* Cannot perform scan. Make sure we clear scanning
-        * bits from status so next scan request can be performed.
-        * If we don't clear scanning status bit here all next scan
-        * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        return ret;
 }
 
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
@@ -1420,7 +1563,8 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
 
         if (add)
-                return iwl_add_bssid_station(priv, vif->bss_conf.bssid, true,
+                return iwl_add_bssid_station(priv, vif_priv->ctx,
+                                             vif->bss_conf.bssid, true,
                                              &vif_priv->ibss_bssid_sta_id);
         return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
                                   vif->bss_conf.bssid);
@@ -1453,7 +1597,7 @@ int iwlagn_wait_tx_queue_empty(struct iwl_priv *priv)
 
         /* waiting for all the tx frames complete might take a while */
         for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
-                if (cnt == IWL_CMD_QUEUE_NUM)
+                if (cnt == priv->cmd_queue)
                         continue;
                 txq = &priv->txq[cnt];
                 q = &txq->q;
@@ -1518,3 +1662,379 @@ done:
         ieee80211_wake_queues(priv->hw);
         mutex_unlock(&priv->mutex);
 }
+
+/*
+ * BT coex
+ */
+/*
+ * Macros to access the lookup table.
+ *
+ * The lookup table has 7 inputs: bt3_prio, bt3_txrx, bt_rf_act, wifi_req,
+* wifi_prio, wifi_txrx and wifi_sh_ant_req.
+ *
+ * It has three outputs: WLAN_ACTIVE, WLAN_KILL and ANT_SWITCH
+ *
+ * The format is that "registers" 8 through 11 contain the WLAN_ACTIVE bits
+ * one after another in 32-bit registers, and "registers" 0 through 7 contain
+ * the WLAN_KILL and ANT_SWITCH bits interleaved (in that order).
+ *
+ * These macros encode that format.
+ */
+#define LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, wifi_req, wifi_prio, \
+                  wifi_txrx, wifi_sh_ant_req) \
+        (bt3_prio | (bt3_txrx << 1) | (bt_rf_act << 2) | (wifi_req << 3) | \
+        (wifi_prio << 4) | (wifi_txrx << 5) | (wifi_sh_ant_req << 6))
+
+#define LUT_PTA_WLAN_ACTIVE_OP(lut, op, val) \
+        lut[8 + ((val) >> 5)] op (cpu_to_le32(BIT((val) & 0x1f)))
+#define LUT_TEST_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                                 wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        (!!(LUT_PTA_WLAN_ACTIVE_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, \
+                                   bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
+                                   wifi_sh_ant_req))))
+#define LUT_SET_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                                wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        LUT_PTA_WLAN_ACTIVE_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, \
+                               bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
+                               wifi_sh_ant_req))
+#define LUT_CLEAR_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, \
+                                  wifi_req, wifi_prio, wifi_txrx, \
+                                  wifi_sh_ant_req) \
+        LUT_PTA_WLAN_ACTIVE_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, \
+                               bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
+                               wifi_sh_ant_req))
+
+#define LUT_WLAN_KILL_OP(lut, op, val) \
+        lut[(val) >> 4] op (cpu_to_le32(BIT(((val) << 1) & 0x1e)))
+#define LUT_TEST_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                           wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        (!!(LUT_WLAN_KILL_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                             wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))))
+#define LUT_SET_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                          wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        LUT_WLAN_KILL_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                         wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
+#define LUT_CLEAR_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                            wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        LUT_WLAN_KILL_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                         wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
+
+#define LUT_ANT_SWITCH_OP(lut, op, val) \
+        lut[(val) >> 4] op (cpu_to_le32(BIT((((val) << 1) & 0x1e) + 1)))
+#define LUT_TEST_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                            wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        (!!(LUT_ANT_SWITCH_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                              wifi_req, wifi_prio, wifi_txrx, \
+                              wifi_sh_ant_req))))
+#define LUT_SET_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                           wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        LUT_ANT_SWITCH_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                          wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
+#define LUT_CLEAR_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
+                             wifi_prio, wifi_txrx, wifi_sh_ant_req) \
+        LUT_ANT_SWITCH_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
+                          wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
+
+static const __le32 iwlagn_def_3w_lookup[12] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaeaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xcc00ff28),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xcc00aaaa),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xc0004000),
+        cpu_to_le32(0x00004000),
+        cpu_to_le32(0xf0005000),
+        cpu_to_le32(0xf0004000),
+};
+
+static const __le32 iwlagn_concurrent_lookup[12] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+};
+
+void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
+{
+        struct iwlagn_bt_cmd bt_cmd = {
+                .max_kill = IWLAGN_BT_MAX_KILL_DEFAULT,
+                .bt3_timer_t7_value = IWLAGN_BT3_T7_DEFAULT,
+                .bt3_prio_sample_time = IWLAGN_BT3_PRIO_SAMPLE_DEFAULT,
+                .bt3_timer_t2_value = IWLAGN_BT3_T2_DEFAULT,
+        };
+
+        BUILD_BUG_ON(sizeof(iwlagn_def_3w_lookup) !=
+                        sizeof(bt_cmd.bt3_lookup_table));
+
+        bt_cmd.prio_boost = priv->cfg->bt_prio_boost;
+        bt_cmd.kill_ack_mask = priv->kill_ack_mask;
+        bt_cmd.kill_cts_mask = priv->kill_cts_mask;
+        bt_cmd.valid = priv->bt_valid;
+        bt_cmd.tx_prio_boost = 0;
+        bt_cmd.rx_prio_boost = 0;
+
+        /*
+         * Configure BT coex mode to "no coexistence" when the
+         * user disabled BT coexistence, we have no interface
+         * (might be in monitor mode), or the interface is in
+         * IBSS mode (no proper uCode support for coex then).
+         */
+        if (!bt_coex_active || priv->iw_mode == NL80211_IFTYPE_ADHOC) {
+                bt_cmd.flags = 0;
+        } else {
+                bt_cmd.flags = IWLAGN_BT_FLAG_COEX_MODE_3W <<
+                                        IWLAGN_BT_FLAG_COEX_MODE_SHIFT;
+                if (priv->bt_ch_announce)
+                        bt_cmd.flags |= IWLAGN_BT_FLAG_CHANNEL_INHIBITION;
+                IWL_DEBUG_INFO(priv, "BT coex flag: 0X%x\n", bt_cmd.flags);
+        }
+        if (priv->bt_full_concurrent)
+                memcpy(bt_cmd.bt3_lookup_table, iwlagn_concurrent_lookup,
+                        sizeof(iwlagn_concurrent_lookup));
+        else
+                memcpy(bt_cmd.bt3_lookup_table, iwlagn_def_3w_lookup,
+                        sizeof(iwlagn_def_3w_lookup));
+
+        IWL_DEBUG_INFO(priv, "BT coex %s in %s mode\n",
+                       bt_cmd.flags ? "active" : "disabled",
+                       priv->bt_full_concurrent ?
+                       "full concurrency" : "3-wire");
+
+        if (iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG, sizeof(bt_cmd), &bt_cmd))
+                IWL_ERR(priv, "failed to send BT Coex Config\n");
+
+        /*
+         * When we are doing a restart, need to also reconfigure BT
+         * SCO to the device. If not doing a restart, bt_sco_active
+         * will always be false, so there's no need to have an extra
+         * variable to check for it.
+         */
+        if (priv->bt_sco_active) {
+                struct iwlagn_bt_sco_cmd sco_cmd = { .flags = 0 };
+
+                if (priv->bt_sco_active)
+                        sco_cmd.flags |= IWLAGN_BT_SCO_ACTIVE;
+                if (iwl_send_cmd_pdu(priv, REPLY_BT_COEX_SCO,
+                                     sizeof(sco_cmd), &sco_cmd))
+                        IWL_ERR(priv, "failed to send BT SCO command\n");
+        }
+}
+
+static void iwlagn_bt_traffic_change_work(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, bt_traffic_change_work);
+        struct iwl_rxon_context *ctx;
+        int smps_request = -1;
+
+        IWL_DEBUG_INFO(priv, "BT traffic load changes: %d\n",
+                       priv->bt_traffic_load);
+
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                smps_request = IEEE80211_SMPS_AUTOMATIC;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                smps_request = IEEE80211_SMPS_DYNAMIC;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                smps_request = IEEE80211_SMPS_STATIC;
+                break;
+        default:
+                IWL_ERR(priv, "Invalid BT traffic load: %d\n",
+                        priv->bt_traffic_load);
+                break;
+        }
+
+        mutex_lock(&priv->mutex);
+
+        if (priv->cfg->ops->lib->update_chain_flags)
+                priv->cfg->ops->lib->update_chain_flags(priv);
+
+        if (smps_request != -1) {
+                for_each_context(priv, ctx) {
+                        if (ctx->vif && ctx->vif->type == NL80211_IFTYPE_STATION)
+                                ieee80211_request_smps(ctx->vif, smps_request);
+                }
+        }
+
+        mutex_unlock(&priv->mutex);
+}
+
+static void iwlagn_print_uartmsg(struct iwl_priv *priv,
+                                struct iwl_bt_uart_msg *uart_msg)
+{
+        IWL_DEBUG_NOTIF(priv, "Message Type = 0x%X, SSN = 0x%X, "
+                        "Update Req = 0x%X",
+                (BT_UART_MSG_FRAME1MSGTYPE_MSK & uart_msg->frame1) >>
+                        BT_UART_MSG_FRAME1MSGTYPE_POS,
+                (BT_UART_MSG_FRAME1SSN_MSK & uart_msg->frame1) >>
+                        BT_UART_MSG_FRAME1SSN_POS,
+                (BT_UART_MSG_FRAME1UPDATEREQ_MSK & uart_msg->frame1) >>
+                        BT_UART_MSG_FRAME1UPDATEREQ_POS);
+
+        IWL_DEBUG_NOTIF(priv, "Open connections = 0x%X, Traffic load = 0x%X, "
+                        "Chl_SeqN = 0x%X, In band = 0x%X",
+                (BT_UART_MSG_FRAME2OPENCONNECTIONS_MSK & uart_msg->frame2) >>
+                        BT_UART_MSG_FRAME2OPENCONNECTIONS_POS,
+                (BT_UART_MSG_FRAME2TRAFFICLOAD_MSK & uart_msg->frame2) >>
+                        BT_UART_MSG_FRAME2TRAFFICLOAD_POS,
+                (BT_UART_MSG_FRAME2CHLSEQN_MSK & uart_msg->frame2) >>
+                        BT_UART_MSG_FRAME2CHLSEQN_POS,
+                (BT_UART_MSG_FRAME2INBAND_MSK & uart_msg->frame2) >>
+                        BT_UART_MSG_FRAME2INBAND_POS);
+
+        IWL_DEBUG_NOTIF(priv, "SCO/eSCO = 0x%X, Sniff = 0x%X, A2DP = 0x%X, "
+                        "ACL = 0x%X, Master = 0x%X, OBEX = 0x%X",
+                (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3SCOESCO_POS,
+                (BT_UART_MSG_FRAME3SNIFF_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3SNIFF_POS,
+                (BT_UART_MSG_FRAME3A2DP_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3A2DP_POS,
+                (BT_UART_MSG_FRAME3ACL_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3ACL_POS,
+                (BT_UART_MSG_FRAME3MASTER_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3MASTER_POS,
+                (BT_UART_MSG_FRAME3OBEX_MSK & uart_msg->frame3) >>
+                        BT_UART_MSG_FRAME3OBEX_POS);
+
+        IWL_DEBUG_NOTIF(priv, "Idle duration = 0x%X",
+                (BT_UART_MSG_FRAME4IDLEDURATION_MSK & uart_msg->frame4) >>
+                        BT_UART_MSG_FRAME4IDLEDURATION_POS);
+
+        IWL_DEBUG_NOTIF(priv, "Tx Activity = 0x%X, Rx Activity = 0x%X, "
+                        "eSCO Retransmissions = 0x%X",
+                (BT_UART_MSG_FRAME5TXACTIVITY_MSK & uart_msg->frame5) >>
+                        BT_UART_MSG_FRAME5TXACTIVITY_POS,
+                (BT_UART_MSG_FRAME5RXACTIVITY_MSK & uart_msg->frame5) >>
+                        BT_UART_MSG_FRAME5RXACTIVITY_POS,
+                (BT_UART_MSG_FRAME5ESCORETRANSMIT_MSK & uart_msg->frame5) >>
+                        BT_UART_MSG_FRAME5ESCORETRANSMIT_POS);
+
+        IWL_DEBUG_NOTIF(priv, "Sniff Interval = 0x%X, Discoverable = 0x%X",
+                (BT_UART_MSG_FRAME6SNIFFINTERVAL_MSK & uart_msg->frame6) >>
+                        BT_UART_MSG_FRAME6SNIFFINTERVAL_POS,
+                (BT_UART_MSG_FRAME6DISCOVERABLE_MSK & uart_msg->frame6) >>
+                        BT_UART_MSG_FRAME6DISCOVERABLE_POS);
+
+        IWL_DEBUG_NOTIF(priv, "Sniff Activity = 0x%X, Inquiry/Page SR Mode = "
+                        "0x%X, Connectable = 0x%X",
+                (BT_UART_MSG_FRAME7SNIFFACTIVITY_MSK & uart_msg->frame7) >>
+                        BT_UART_MSG_FRAME7SNIFFACTIVITY_POS,
+                (BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_MSK & uart_msg->frame7) >>
+                        BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_POS,
+                (BT_UART_MSG_FRAME7CONNECTABLE_MSK & uart_msg->frame7) >>
+                        BT_UART_MSG_FRAME7CONNECTABLE_POS);
+}
+
+static void iwlagn_set_kill_ack_msk(struct iwl_priv *priv,
+                                     struct iwl_bt_uart_msg *uart_msg)
+{
+        u8 kill_ack_msk;
+        __le32 bt_kill_ack_msg[2] = {
+                        cpu_to_le32(0xFFFFFFF), cpu_to_le32(0xFFFFFC00) };
+
+        kill_ack_msk = (((BT_UART_MSG_FRAME3A2DP_MSK |
+                        BT_UART_MSG_FRAME3SNIFF_MSK |
+                        BT_UART_MSG_FRAME3SCOESCO_MSK) &
+                        uart_msg->frame3) == 0) ? 1 : 0;
+        if (priv->kill_ack_mask != bt_kill_ack_msg[kill_ack_msk]) {
+                priv->bt_valid |= IWLAGN_BT_VALID_KILL_ACK_MASK;
+                priv->kill_ack_mask = bt_kill_ack_msg[kill_ack_msk];
+                /* schedule to send runtime bt_config */
+                queue_work(priv->workqueue, &priv->bt_runtime_config);
+        }
+
+}
+
+void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
+                                             struct iwl_rx_mem_buffer *rxb)
+{
+        unsigned long flags;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_bt_coex_profile_notif *coex = &pkt->u.bt_coex_profile_notif;
+        struct iwlagn_bt_sco_cmd sco_cmd = { .flags = 0 };
+        struct iwl_bt_uart_msg *uart_msg = &coex->last_bt_uart_msg;
+        u8 last_traffic_load;
+
+        IWL_DEBUG_NOTIF(priv, "BT Coex notification:\n");
+        IWL_DEBUG_NOTIF(priv, "    status: %d\n", coex->bt_status);
+        IWL_DEBUG_NOTIF(priv, "    traffic load: %d\n", coex->bt_traffic_load);
+        IWL_DEBUG_NOTIF(priv, "    CI compliance: %d\n",
+                        coex->bt_ci_compliance);
+        iwlagn_print_uartmsg(priv, uart_msg);
+
+        last_traffic_load = priv->notif_bt_traffic_load;
+        priv->notif_bt_traffic_load = coex->bt_traffic_load;
+        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
+                if (priv->bt_status != coex->bt_status ||
+                    last_traffic_load != coex->bt_traffic_load) {
+                        if (coex->bt_status) {
+                                /* BT on */
+                                if (!priv->bt_ch_announce)
+                                        priv->bt_traffic_load =
+                                                IWL_BT_COEX_TRAFFIC_LOAD_HIGH;
+                                else
+                                        priv->bt_traffic_load =
+                                                coex->bt_traffic_load;
+                        } else {
+                                /* BT off */
+                                priv->bt_traffic_load =
+                                        IWL_BT_COEX_TRAFFIC_LOAD_NONE;
+                        }
+                        priv->bt_status = coex->bt_status;
+                        queue_work(priv->workqueue,
+                                   &priv->bt_traffic_change_work);
+                }
+                if (priv->bt_sco_active !=
+                    (uart_msg->frame3 & BT_UART_MSG_FRAME3SCOESCO_MSK)) {
+                        priv->bt_sco_active = uart_msg->frame3 &
+                                BT_UART_MSG_FRAME3SCOESCO_MSK;
+                        if (priv->bt_sco_active)
+                                sco_cmd.flags |= IWLAGN_BT_SCO_ACTIVE;
+                        iwl_send_cmd_pdu_async(priv, REPLY_BT_COEX_SCO,
+                                       sizeof(sco_cmd), &sco_cmd, NULL);
+                }
+        }
+
+        iwlagn_set_kill_ack_msk(priv, uart_msg);
+
+        /* FIXME: based on notification, adjust the prio_boost */
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->bt_ci_compliance = coex->bt_ci_compliance;
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+void iwlagn_bt_rx_handler_setup(struct iwl_priv *priv)
+{
+        iwlagn_rx_handler_setup(priv);
+        priv->rx_handlers[REPLY_BT_COEX_PROFILE_NOTIF] =
+                iwlagn_bt_coex_profile_notif;
+}
+
+void iwlagn_bt_setup_deferred_work(struct iwl_priv *priv)
+{
+        iwlagn_setup_deferred_work(priv);
+
+        INIT_WORK(&priv->bt_traffic_change_work,
+                  iwlagn_bt_traffic_change_work);
+}
+
+void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv)
+{
+        cancel_work_sync(&priv->bt_traffic_change_work);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 23e5c42e7d7e..57629fba3a7d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -82,6 +82,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
                                    struct iwl_lq_sta *lq_sta);
 static void rs_fill_link_cmd(struct iwl_priv *priv,
                              struct iwl_lq_sta *lq_sta, u32 rate_n_flags);
+static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search);
 
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -300,7 +301,19 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                                       struct ieee80211_sta *sta)
 {
         int ret = -EAGAIN;
-        u32 load = rs_tl_get_load(lq_data, tid);
+        u32 load;
+
+        /*
+         * Don't create TX aggregation sessions when in high
+         * BT traffic, as they would just be disrupted by BT.
+         */
+        if (priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH) {
+                IWL_ERR(priv, "BT traffic (%d), no aggregation allowed\n",
+                        priv->bt_traffic_load);
+                return ret;
+        }
+
+        load = rs_tl_get_load(lq_data, tid);
 
         if (load > IWL_AGG_LOAD_THRESHOLD) {
                 IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
@@ -502,6 +515,7 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
         u8 num_of_ant = get_num_of_ant_from_rate(rate_n_flags);
         u8 mcs;
 
+        memset(tbl, 0, sizeof(struct iwl_scale_tbl_info));
         *rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
 
         if (*rate_idx  == IWL_RATE_INVALID) {
@@ -588,11 +602,13 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
  * Green-field mode is valid if the station supports it and
  * there are no non-GF stations present in the BSS.
  */
-static inline u8 rs_use_green(struct ieee80211_sta *sta,
-                              struct iwl_ht_config *ht_conf)
+static bool rs_use_green(struct ieee80211_sta *sta)
 {
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
+
         return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
-                !(ht_conf->non_GF_STA_present);
+                !(ctx->ht.non_gf_sta_present);
 }
 
 /**
@@ -744,6 +760,32 @@ static bool table_type_matches(struct iwl_scale_tbl_info *a,
                 (a->is_SGI == b->is_SGI);
 }
 
+static void rs_bt_update_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                            struct iwl_lq_sta *lq_sta)
+{
+        struct iwl_scale_tbl_info *tbl;
+        bool full_concurrent;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        if (priv->bt_ci_compliance && priv->bt_ant_couple_ok)
+                full_concurrent = true;
+        else
+                full_concurrent = false;
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        if (priv->bt_full_concurrent != full_concurrent) {
+                priv->bt_full_concurrent = full_concurrent;
+
+                /* Update uCode's rate table. */
+                tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+                rs_fill_link_cmd(priv, lq_sta, tbl->current_rate);
+                iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_ASYNC, false);
+
+                queue_work(priv->workqueue, &priv->bt_full_concurrency);
+        }
+}
+
 /*
  * mac80211 sends us Tx status
  */
@@ -763,6 +805,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         u32 tx_rate;
         struct iwl_scale_tbl_info tbl_type;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
@@ -829,7 +873,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 lq_sta->missed_rate_counter++;
                 if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
+                        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_ASYNC, false);
                 }
                 /* Regardless, ignore this status info for outdated rate */
                 return;
@@ -848,7 +892,20 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 other_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
         } else {
                 IWL_DEBUG_RATE(priv, "Neither active nor search matches tx rate\n");
-                return;
+                tmp_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+                IWL_DEBUG_RATE(priv, "active- lq:%x, ant:%x, SGI:%d\n",
+                        tmp_tbl->lq_type, tmp_tbl->ant_type, tmp_tbl->is_SGI);
+                tmp_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
+                IWL_DEBUG_RATE(priv, "search- lq:%x, ant:%x, SGI:%d\n",
+                        tmp_tbl->lq_type, tmp_tbl->ant_type, tmp_tbl->is_SGI);
+                IWL_DEBUG_RATE(priv, "actual- lq:%x, ant:%x, SGI:%d\n",
+                        tbl_type.lq_type, tbl_type.ant_type, tbl_type.is_SGI);
+                /*
+                 * no matching table found, let's by-pass the data collection
+                 * and continue to perform rate scale to find the rate table
+                 */
+                rs_stay_in_table(lq_sta, true);
+                goto done;
         }
 
         /*
@@ -909,10 +966,14 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         }
         /* The last TX rate is cached in lq_sta; it's set in if/else above */
         lq_sta->last_rate_n_flags = tx_rate;
-
+done:
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
                 rs_rate_scale_perform(priv, skb, sta, lq_sta);
+
+        /* Is there a need to switch between full concurrency and 3-wire? */
+        if (priv->bt_ant_couple_ok)
+                rs_bt_update_lq(priv, ctx, lq_sta);
 }
 
 /*
@@ -1106,6 +1167,8 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         u16 rate_mask;
         s32 rate;
         s8 is_green = lq_sta->is_green;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
@@ -1126,7 +1189,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1160,6 +1223,8 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         u16 rate_mask;
         s32 rate;
         s8 is_green = lq_sta->is_green;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
@@ -1180,7 +1245,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1215,6 +1280,8 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         u16 rate_mask;
         u8 is_green = lq_sta->is_green;
         s32 rate;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
@@ -1227,7 +1294,7 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1265,18 +1332,52 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         struct iwl_rate_scale_data *window = &(tbl->win[index]);
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action = tbl->action;
+        u8 start_action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret = 0;
         u8 update_search_tbl_counter = 0;
 
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+                if (tbl->action == IWL_LEGACY_SWITCH_ANTENNA2)
+                        tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+                if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2 &&
+                    tbl->action != IWL_LEGACY_SWITCH_SISO)
+                        tbl->action = IWL_LEGACY_SWITCH_SISO;
+                break;
+        default:
+                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                break;
+        }
+
         if (!iwl_ht_enabled(priv))
                 /* stay in Legacy */
                 tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
         else if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE &&
                    tbl->action > IWL_LEGACY_SWITCH_SISO)
                 tbl->action = IWL_LEGACY_SWITCH_SISO;
+
+        /* configure as 1x1 if bt full concurrency */
+        if (priv->bt_full_concurrent) {
+                if (!iwl_ht_enabled(priv))
+                        tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
+                else if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
+                        tbl->action = IWL_LEGACY_SWITCH_SISO;
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+        }
+
+        start_action = tbl->action;
         for (; ;) {
                 lq_sta->action_counter++;
                 switch (tbl->action) {
@@ -1291,7 +1392,10 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                                 break;
 
                         /* Don't change antenna if success has been great */
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
+                        if (window->success_ratio >= IWL_RS_GOOD_RATIO &&
+                            !priv->bt_full_concurrent &&
+                            priv->bt_traffic_load ==
+                                        IWL_BT_COEX_TRAFFIC_LOAD_NONE)
                                 break;
 
                         /* Set up search table to try other antenna */
@@ -1403,31 +1507,64 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action = tbl->action;
+        u8 start_action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
 
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+                if (tbl->action == IWL_SISO_SWITCH_ANTENNA2)
+                        tbl->action = IWL_SISO_SWITCH_ANTENNA1;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+                if (tbl->action != IWL_SISO_SWITCH_ANTENNA1)
+                        tbl->action = IWL_SISO_SWITCH_ANTENNA1;
+                break;
+        default:
+                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                break;
+        }
+
         if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE &&
             tbl->action > IWL_SISO_SWITCH_ANTENNA2) {
                 /* stay in SISO */
                 tbl->action = IWL_SISO_SWITCH_ANTENNA1;
         }
+
+        /* configure as 1x1 if bt full concurrency */
+        if (priv->bt_full_concurrent) {
+                valid_tx_ant = first_antenna(priv->hw_params.valid_tx_ant);
+                if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
+                        tbl->action = IWL_SISO_SWITCH_ANTENNA1;
+        }
+
+        start_action = tbl->action;
         for (;;) {
                 lq_sta->action_counter++;
                 switch (tbl->action) {
                 case IWL_SISO_SWITCH_ANTENNA1:
                 case IWL_SISO_SWITCH_ANTENNA2:
                         IWL_DEBUG_RATE(priv, "LQ: SISO toggle Antenna\n");
-
                         if ((tbl->action == IWL_SISO_SWITCH_ANTENNA1 &&
-                                                        tx_chains_num <= 1) ||
+                                                tx_chains_num <= 1) ||
                             (tbl->action == IWL_SISO_SWITCH_ANTENNA2 &&
-                                                        tx_chains_num <= 2))
+                                                tx_chains_num <= 2))
                                 break;
 
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
+                        if (window->success_ratio >= IWL_RS_GOOD_RATIO &&
+                            !priv->bt_full_concurrent &&
+                            priv->bt_traffic_load ==
+                                        IWL_BT_COEX_TRAFFIC_LOAD_NONE)
                                 break;
 
                         memcpy(search_tbl, tbl, sz);
@@ -1541,18 +1678,47 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action = tbl->action;
+        u8 start_action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
 
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                if (tbl->action != IWL_MIMO2_SWITCH_SISO_A)
+                        tbl->action = IWL_MIMO2_SWITCH_SISO_A;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B ||
+                    tbl->action == IWL_MIMO2_SWITCH_SISO_C)
+                        tbl->action = IWL_MIMO2_SWITCH_SISO_A;
+                break;
+        default:
+                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                break;
+        }
+
         if ((iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE) &&
             (tbl->action < IWL_MIMO2_SWITCH_SISO_A ||
              tbl->action > IWL_MIMO2_SWITCH_SISO_C)) {
                 /* switch in SISO */
                 tbl->action = IWL_MIMO2_SWITCH_SISO_A;
         }
+
+        /* configure as 1x1 if bt full concurrency */
+        if (priv->bt_full_concurrent &&
+            (tbl->action < IWL_MIMO2_SWITCH_SISO_A ||
+             tbl->action > IWL_MIMO2_SWITCH_SISO_C))
+                tbl->action = IWL_MIMO2_SWITCH_SISO_A;
+
+        start_action = tbl->action;
         for (;;) {
                 lq_sta->action_counter++;
                 switch (tbl->action) {
@@ -1682,18 +1848,47 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action = tbl->action;
+        u8 start_action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret;
         u8 update_search_tbl_counter = 0;
 
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                if (tbl->action != IWL_MIMO3_SWITCH_SISO_A)
+                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                if (tbl->action == IWL_MIMO3_SWITCH_SISO_B ||
+                    tbl->action == IWL_MIMO3_SWITCH_SISO_C)
+                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
+                break;
+        default:
+                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                break;
+        }
+
         if ((iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE) &&
             (tbl->action < IWL_MIMO3_SWITCH_SISO_A ||
              tbl->action > IWL_MIMO3_SWITCH_SISO_C)) {
                 /* switch in SISO */
                 tbl->action = IWL_MIMO3_SWITCH_SISO_A;
         }
+
+        /* configure as 1x1 if bt full concurrency */
+        if (priv->bt_full_concurrent &&
+            (tbl->action < IWL_MIMO3_SWITCH_SISO_A ||
+             tbl->action > IWL_MIMO3_SWITCH_SISO_C))
+                tbl->action = IWL_MIMO3_SWITCH_SISO_A;
+
+        start_action = tbl->action;
         for (;;) {
                 lq_sta->action_counter++;
                 switch (tbl->action) {
@@ -1820,7 +2015,7 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
  * 2) # times calling this function
  * 3) elapsed time in this mode (not used, for now)
  */
-static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
+static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
 {
         struct iwl_scale_tbl_info *tbl;
         int i;
@@ -1851,7 +2046,8 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
                  * allow a new search.  Also (below) reset all bitmaps and
                  * stats in active history.
                  */
-                if ((lq_sta->total_failed > lq_sta->max_failure_limit) ||
+                if (force_search ||
+                    (lq_sta->total_failed > lq_sta->max_failure_limit) ||
                     (lq_sta->total_success > lq_sta->max_success_limit) ||
                     ((!lq_sta->search_better_tbl) && (lq_sta->flush_timer)
                      && (flush_interval_passed))) {
@@ -1900,6 +2096,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
  * return rate_n_flags as used in the table
  */
 static u32 rs_update_rate_tbl(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx,
                                 struct iwl_lq_sta *lq_sta,
                                 struct iwl_scale_tbl_info *tbl,
                                 int index, u8 is_green)
@@ -1909,7 +2106,7 @@ static u32 rs_update_rate_tbl(struct iwl_priv *priv,
         /* Update uCode's rate table. */
         rate = rate_n_flags_from_tbl(priv, tbl, index, is_green);
         rs_fill_link_cmd(priv, lq_sta, rate);
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
+        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_ASYNC, false);
 
         return rate;
 }
@@ -1948,6 +2145,8 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         s32 sr;
         u8 tid = MAX_TID_COUNT;
         struct iwl_tid_data *tid_data;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         IWL_DEBUG_RATE(priv, "rate scale calculate new rate for skb\n");
 
@@ -1986,7 +2185,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         if (is_legacy(tbl->lq_type))
                 lq_sta->is_green = 0;
         else
-                lq_sta->is_green = rs_use_green(sta, &priv->current_ht_config);
+                lq_sta->is_green = rs_use_green(sta);
         is_green = lq_sta->is_green;
 
         /* current tx rate */
@@ -2025,7 +2224,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
                         tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
                         /* get "active" rate info */
                         index = iwl_hwrate_to_plcp_idx(tbl->current_rate);
-                        rate = rs_update_rate_tbl(priv, lq_sta,
+                        rate = rs_update_rate_tbl(priv, ctx, lq_sta,
                                                   tbl, index, is_green);
                 }
                 return;
@@ -2067,7 +2266,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 
                 /* Should we stay with this modulation mode,
                  * or search for a new one? */
-                rs_stay_in_table(lq_sta);
+                rs_stay_in_table(lq_sta, false);
 
                 goto out;
         }
@@ -2215,6 +2414,28 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         if (iwl_tx_ant_restriction(priv) != IWL_ANT_OK_MULTI &&
                 (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type)))
                 scale_action = -1;
+
+        if ((priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
+             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+                if (lq_sta->last_bt_traffic > priv->bt_traffic_load) {
+                        /*
+                         * don't set scale_action, don't want to scale up if
+                         * the rate scale doesn't otherwise think that is a
+                         * good idea.
+                         */
+                } else if (lq_sta->last_bt_traffic <= priv->bt_traffic_load) {
+                        scale_action = -1;
+                }
+        }
+        lq_sta->last_bt_traffic = priv->bt_traffic_load;
+
+        if ((priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
+             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+                /* search for a new modulation */
+                rs_stay_in_table(lq_sta, true);
+                goto lq_update;
+        }
+
         switch (scale_action) {
         case -1:
                 /* Decrease starting rate, update uCode's rate table */
@@ -2245,13 +2466,13 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 lq_update:
         /* Replace uCode's rate table for the destination station. */
         if (update_lq)
-                rate = rs_update_rate_tbl(priv, lq_sta,
+                rate = rs_update_rate_tbl(priv, ctx, lq_sta,
                                           tbl, index, is_green);
 
         if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_MULTI) {
                 /* Should we stay with this modulation mode,
                  * or search for a new one? */
-                rs_stay_in_table(lq_sta);
+          rs_stay_in_table(lq_sta, false);
         }
         /*
          * Search for new modulation mode if we're:
@@ -2287,7 +2508,7 @@ lq_update:
                         IWL_DEBUG_RATE(priv, "Switch current  mcs: %X index: %d\n",
                                      tbl->current_rate, index);
                         rs_fill_link_cmd(priv, lq_sta, tbl->current_rate);
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
+                        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_ASYNC, false);
                 } else
                         done_search = 1;
         }
@@ -2357,12 +2578,17 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         int rate_idx;
         int i;
         u32 rate;
-        u8 use_green = rs_use_green(sta, &priv->current_ht_config);
+        u8 use_green = rs_use_green(sta);
         u8 active_tbl = 0;
         u8 valid_tx_ant;
+        struct iwl_station_priv *sta_priv;
+        struct iwl_rxon_context *ctx;
 
         if (!sta || !lq_sta)
-                goto out;
+                return;
+
+        sta_priv = (void *)sta->drv_priv;
+        ctx = sta_priv->common.ctx;
 
         i = lq_sta->last_txrate_idx;
 
@@ -2394,9 +2620,7 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_link_cmd(NULL, lq_sta, rate);
         priv->stations[lq_sta->lq.sta_id].lq = &lq_sta->lq;
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_SYNC, true);
- out:
-        return;
+        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_SYNC, true);
 }
 
 static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
@@ -2524,7 +2748,7 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
         lq_sta->is_dup = 0;
         lq_sta->max_rate_idx = -1;
         lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
-        lq_sta->is_green = rs_use_green(sta, &priv->current_ht_config);
+        lq_sta->is_green = rs_use_green(sta);
         lq_sta->active_legacy_rate = priv->active_rate & ~(0x1000);
         lq_sta->band = priv->band;
         /*
@@ -2594,10 +2818,15 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
         rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
 
         /* Interpret new_rate (rate_n_flags) */
-        memset(&tbl_type, 0, sizeof(tbl_type));
         rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
                                   &tbl_type, &rate_idx);
 
+        if (priv && priv->bt_full_concurrent) {
+                /* 1x1 only */
+                tbl_type.ant_type =
+                        first_antenna(priv->hw_params.valid_tx_ant);
+        }
+
         /* How many times should we repeat the initial rate? */
         if (is_legacy(tbl_type.lq_type)) {
                 ant_toggle_cnt = 1;
@@ -2622,9 +2851,12 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
 
         index++;
         repeat_rate--;
-
-        if (priv)
-                valid_tx_ant = priv->hw_params.valid_tx_ant;
+        if (priv) {
+                if (priv->bt_full_concurrent)
+                        valid_tx_ant = ANT_A;
+                else
+                        valid_tx_ant = priv->hw_params.valid_tx_ant;
+        }
 
         /* Fill rest of rate table */
         while (index < LINK_QUAL_MAX_RETRY_NUM) {
@@ -2639,7 +2871,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                                          rs_toggle_antenna(valid_tx_ant,
                                                         &new_rate, &tbl_type))
                                         ant_toggle_cnt = 1;
-}
+                        }
 
                         /* Override next rate if needed for debug purposes */
                         rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
@@ -2654,6 +2886,12 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, &tbl_type,
                                                 &rate_idx);
 
+                if (priv && priv->bt_full_concurrent) {
+                        /* 1x1 only */
+                        tbl_type.ant_type =
+                                first_antenna(priv->hw_params.valid_tx_ant);
+                }
+
                 /* Indicate to uCode which entries might be MIMO.
                  * If initial rate was MIMO, this will finally end up
                  * as (IWL_HT_NUMBER_TRY * 2), after 2nd pass, otherwise 0. */
@@ -2694,8 +2932,18 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
 
         lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
         lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+
         lq_cmd->agg_params.agg_time_limit =
                 cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+        /*
+         * overwrite if needed, pass aggregation time limit
+         * to uCode in uSec
+         */
+        if (priv && priv->cfg->agg_time_limit &&
+            priv->cfg->agg_time_limit >= LINK_QUAL_AGG_TIME_LIMIT_MIN &&
+            priv->cfg->agg_time_limit <= LINK_QUAL_AGG_TIME_LIMIT_MAX)
+                lq_cmd->agg_params.agg_time_limit =
+                        cpu_to_le16(priv->cfg->agg_time_limit);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
@@ -2760,6 +3008,9 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
         char buf[64];
         int buf_size;
         u32 parsed_rate;
+        struct iwl_station_priv *sta_priv =
+                container_of(lq_sta, struct iwl_station_priv, lq_sta);
+        struct iwl_rxon_context *ctx = sta_priv->common.ctx;
 
         priv = lq_sta->drv;
         memset(buf, 0, sizeof(buf));
@@ -2782,7 +3033,8 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
 
         if (lq_sta->dbg_fixed_rate) {
                 rs_fill_link_cmd(NULL, lq_sta, lq_sta->dbg_fixed_rate);
-                iwl_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC, false);
+                iwl_send_lq_cmd(lq_sta->drv, ctx, &lq_sta->lq, CMD_ASYNC,
+                                false);
         }
 
         return count;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index 8292f6d48ec6..357cdb26f16d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -432,6 +432,8 @@ struct iwl_lq_sta {
         u32 last_rate_n_flags;
         /* packets destined for this STA are aggregated */
         u8 is_agg;
+        /* BT traffic this sta was last updated in */
+        u8 last_bt_traffic;
 };
 
 static inline u8 num_of_ant(u8 mask)
@@ -451,15 +453,6 @@ static inline u8 first_antenna(u8 mask)
 }
 
 
-static inline u8 iwl_get_prev_ieee_rate(u8 rate_index)
-{
-        u8 rate = iwl_rates[rate_index].prev_ieee;
-
-        if (rate == IWL_RATE_INVALID)
-                rate = rate_index;
-        return rate;
-}
-
 static inline u8 iwl3945_get_prev_ieee_rate(u8 rate_index)
 {
         u8 rate = iwl3945_rates[rate_index].prev_ieee;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tt.c b/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
new file mode 100644
index 000000000000..07b2c6cadf51
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
@@ -0,0 +1,704 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
+ *
+ * Portions of this file are derived from the ipw3945 project, as well
+ * as portions of the ieee80211 subsystem header files.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+
+#include <net/mac80211.h>
+
+#include "iwl-eeprom.h"
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-commands.h"
+#include "iwl-debug.h"
+#include "iwl-agn-tt.h"
+
+/* default Thermal Throttling transaction table
+ * Current state   |         Throttling Down               |  Throttling Up
+ *=============================================================================
+ *                 Condition Nxt State  Condition Nxt State Condition Nxt State
+ *-----------------------------------------------------------------------------
+ *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
+ *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
+ *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
+ *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
+ *=============================================================================
+ */
+static const struct iwl_tt_trans tt_range_0[IWL_TI_STATE_MAX - 1] = {
+        {IWL_TI_0, IWL_ABSOLUTE_ZERO, 104},
+        {IWL_TI_1, 105, CT_KILL_THRESHOLD - 1},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
+};
+static const struct iwl_tt_trans tt_range_1[IWL_TI_STATE_MAX - 1] = {
+        {IWL_TI_0, IWL_ABSOLUTE_ZERO, 95},
+        {IWL_TI_2, 110, CT_KILL_THRESHOLD - 1},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
+};
+static const struct iwl_tt_trans tt_range_2[IWL_TI_STATE_MAX - 1] = {
+        {IWL_TI_1, IWL_ABSOLUTE_ZERO, 100},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX},
+        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
+};
+static const struct iwl_tt_trans tt_range_3[IWL_TI_STATE_MAX - 1] = {
+        {IWL_TI_0, IWL_ABSOLUTE_ZERO, CT_KILL_EXIT_THRESHOLD},
+        {IWL_TI_CT_KILL, CT_KILL_EXIT_THRESHOLD + 1, IWL_ABSOLUTE_MAX},
+        {IWL_TI_CT_KILL, CT_KILL_EXIT_THRESHOLD + 1, IWL_ABSOLUTE_MAX}
+};
+
+/* Advance Thermal Throttling default restriction table */
+static const struct iwl_tt_restriction restriction_range[IWL_TI_STATE_MAX] = {
+        {IWL_ANT_OK_MULTI, IWL_ANT_OK_MULTI, true },
+        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_MULTI, true },
+        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_SINGLE, false },
+        {IWL_ANT_OK_NONE, IWL_ANT_OK_NONE, false }
+};
+
+bool iwl_tt_is_low_power_state(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        if (tt->state >= IWL_TI_1)
+                return true;
+        return false;
+}
+
+u8 iwl_tt_current_power_mode(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        return tt->tt_power_mode;
+}
+
+bool iwl_ht_enabled(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        struct iwl_tt_restriction *restriction;
+
+        if (!priv->thermal_throttle.advanced_tt)
+                return true;
+        restriction = tt->restriction + tt->state;
+        return restriction->is_ht;
+}
+
+static bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
+{
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
+        bool within_margin = false;
+
+        if (priv->cfg->temperature_kelvin)
+                temp = KELVIN_TO_CELSIUS(priv->temperature);
+
+        if (!priv->thermal_throttle.advanced_tt)
+                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
+                                CT_KILL_THRESHOLD_LEGACY) ? true : false;
+        else
+                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
+                                CT_KILL_THRESHOLD) ? true : false;
+        return within_margin;
+}
+
+bool iwl_check_for_ct_kill(struct iwl_priv *priv)
+{
+        bool is_ct_kill = false;
+
+        if (iwl_within_ct_kill_margin(priv)) {
+                iwl_tt_enter_ct_kill(priv);
+                is_ct_kill = true;
+        }
+        return is_ct_kill;
+}
+
+enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        struct iwl_tt_restriction *restriction;
+
+        if (!priv->thermal_throttle.advanced_tt)
+                return IWL_ANT_OK_MULTI;
+        restriction = tt->restriction + tt->state;
+        return restriction->tx_stream;
+}
+
+enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        struct iwl_tt_restriction *restriction;
+
+        if (!priv->thermal_throttle.advanced_tt)
+                return IWL_ANT_OK_MULTI;
+        restriction = tt->restriction + tt->state;
+        return restriction->rx_stream;
+}
+
+#define CT_KILL_EXIT_DURATION (5)       /* 5 seconds duration */
+#define CT_KILL_WAITING_DURATION (300)  /* 300ms duration */
+
+/*
+ * toggle the bit to wake up uCode and check the temperature
+ * if the temperature is below CT, uCode will stay awake and send card
+ * state notification with CT_KILL bit clear to inform Thermal Throttling
+ * Management to change state. Otherwise, uCode will go back to sleep
+ * without doing anything, driver should continue the 5 seconds timer
+ * to wake up uCode for temperature check until temperature drop below CT
+ */
+static void iwl_tt_check_exit_ct_kill(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        unsigned long flags;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (tt->state == IWL_TI_CT_KILL) {
+                if (priv->thermal_throttle.ct_kill_toggle) {
+                        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
+                                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
+                        priv->thermal_throttle.ct_kill_toggle = false;
+                } else {
+                        iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
+                                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
+                        priv->thermal_throttle.ct_kill_toggle = true;
+                }
+                iwl_read32(priv, CSR_UCODE_DRV_GP1);
+                spin_lock_irqsave(&priv->reg_lock, flags);
+                if (!iwl_grab_nic_access(priv))
+                        iwl_release_nic_access(priv);
+                spin_unlock_irqrestore(&priv->reg_lock, flags);
+
+                /* Reschedule the ct_kill timer to occur in
+                 * CT_KILL_EXIT_DURATION seconds to ensure we get a
+                 * thermal update */
+                IWL_DEBUG_POWER(priv, "schedule ct_kill exit timer\n");
+                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm,
+                          jiffies + CT_KILL_EXIT_DURATION * HZ);
+        }
+}
+
+static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
+                           bool stop)
+{
+        if (stop) {
+                IWL_DEBUG_POWER(priv, "Stop all queues\n");
+                if (priv->mac80211_registered)
+                        ieee80211_stop_queues(priv->hw);
+                IWL_DEBUG_POWER(priv,
+                                "Schedule 5 seconds CT_KILL Timer\n");
+                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm,
+                          jiffies + CT_KILL_EXIT_DURATION * HZ);
+        } else {
+                IWL_DEBUG_POWER(priv, "Wake all queues\n");
+                if (priv->mac80211_registered)
+                        ieee80211_wake_queues(priv->hw);
+        }
+}
+
+static void iwl_tt_ready_for_ct_kill(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* temperature timer expired, ready to go into CT_KILL state */
+        if (tt->state != IWL_TI_CT_KILL) {
+                IWL_DEBUG_POWER(priv, "entering CT_KILL state when "
+                                "temperature timer expired\n");
+                tt->state = IWL_TI_CT_KILL;
+                set_bit(STATUS_CT_KILL, &priv->status);
+                iwl_perform_ct_kill_task(priv, true);
+        }
+}
+
+static void iwl_prepare_ct_kill_task(struct iwl_priv *priv)
+{
+        IWL_DEBUG_POWER(priv, "Prepare to enter IWL_TI_CT_KILL\n");
+        /* make request to retrieve statistics information */
+        iwl_send_statistics_request(priv, CMD_SYNC, false);
+        /* Reschedule the ct_kill wait timer */
+        mod_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
+                 jiffies + msecs_to_jiffies(CT_KILL_WAITING_DURATION));
+}
+
+#define IWL_MINIMAL_POWER_THRESHOLD             (CT_KILL_THRESHOLD_LEGACY)
+#define IWL_REDUCED_PERFORMANCE_THRESHOLD_2     (100)
+#define IWL_REDUCED_PERFORMANCE_THRESHOLD_1     (90)
+
+/*
+ * Legacy thermal throttling
+ * 1) Avoid NIC destruction due to high temperatures
+ *      Chip will identify dangerously high temperatures that can
+ *      harm the device and will power down
+ * 2) Avoid the NIC power down due to high temperature
+ *      Throttle early enough to lower the power consumption before
+ *      drastic steps are needed
+ */
+static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        enum iwl_tt_state old_state;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if ((tt->tt_previous_temp) &&
+            (temp > tt->tt_previous_temp) &&
+            ((temp - tt->tt_previous_temp) >
+            IWL_TT_INCREASE_MARGIN)) {
+                IWL_DEBUG_POWER(priv,
+                        "Temperature increase %d degree Celsius\n",
+                        (temp - tt->tt_previous_temp));
+        }
+#endif
+        old_state = tt->state;
+        /* in Celsius */
+        if (temp >= IWL_MINIMAL_POWER_THRESHOLD)
+                tt->state = IWL_TI_CT_KILL;
+        else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_2)
+                tt->state = IWL_TI_2;
+        else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_1)
+                tt->state = IWL_TI_1;
+        else
+                tt->state = IWL_TI_0;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        tt->tt_previous_temp = temp;
+#endif
+        /* stop ct_kill_waiting_tm timer */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
+        if (tt->state != old_state) {
+                switch (tt->state) {
+                case IWL_TI_0:
+                        /*
+                         * When the system is ready to go back to IWL_TI_0
+                         * we only have to call iwl_power_update_mode() to
+                         * do so.
+                         */
+                        break;
+                case IWL_TI_1:
+                        tt->tt_power_mode = IWL_POWER_INDEX_3;
+                        break;
+                case IWL_TI_2:
+                        tt->tt_power_mode = IWL_POWER_INDEX_4;
+                        break;
+                default:
+                        tt->tt_power_mode = IWL_POWER_INDEX_5;
+                        break;
+                }
+                mutex_lock(&priv->mutex);
+                if (old_state == IWL_TI_CT_KILL)
+                        clear_bit(STATUS_CT_KILL, &priv->status);
+                if (tt->state != IWL_TI_CT_KILL &&
+                    iwl_power_update_mode(priv, true)) {
+                        /* TT state not updated
+                         * try again during next temperature read
+                         */
+                        if (old_state == IWL_TI_CT_KILL)
+                                set_bit(STATUS_CT_KILL, &priv->status);
+                        tt->state = old_state;
+                        IWL_ERR(priv, "Cannot update power mode, "
+                                        "TT state not updated\n");
+                } else {
+                        if (tt->state == IWL_TI_CT_KILL) {
+                                if (force) {
+                                        set_bit(STATUS_CT_KILL, &priv->status);
+                                        iwl_perform_ct_kill_task(priv, true);
+                                } else {
+                                        iwl_prepare_ct_kill_task(priv);
+                                        tt->state = old_state;
+                                }
+                        } else if (old_state == IWL_TI_CT_KILL &&
+                                 tt->state != IWL_TI_CT_KILL)
+                                iwl_perform_ct_kill_task(priv, false);
+                        IWL_DEBUG_POWER(priv, "Temperature state changed %u\n",
+                                        tt->state);
+                        IWL_DEBUG_POWER(priv, "Power Index change to %u\n",
+                                        tt->tt_power_mode);
+                }
+                mutex_unlock(&priv->mutex);
+        }
+}
+
+/*
+ * Advance thermal throttling
+ * 1) Avoid NIC destruction due to high temperatures
+ *      Chip will identify dangerously high temperatures that can
+ *      harm the device and will power down
+ * 2) Avoid the NIC power down due to high temperature
+ *      Throttle early enough to lower the power consumption before
+ *      drastic steps are needed
+ *      Actions include relaxing the power down sleep thresholds and
+ *      decreasing the number of TX streams
+ * 3) Avoid throughput performance impact as much as possible
+ *
+ *=============================================================================
+ *                 Condition Nxt State  Condition Nxt State Condition Nxt State
+ *-----------------------------------------------------------------------------
+ *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
+ *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
+ *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
+ *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
+ *=============================================================================
+ */
+static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        int i;
+        bool changed = false;
+        enum iwl_tt_state old_state;
+        struct iwl_tt_trans *transaction;
+
+        old_state = tt->state;
+        for (i = 0; i < IWL_TI_STATE_MAX - 1; i++) {
+                /* based on the current TT state,
+                 * find the curresponding transaction table
+                 * each table has (IWL_TI_STATE_MAX - 1) entries
+                 * tt->transaction + ((old_state * (IWL_TI_STATE_MAX - 1))
+                 * will advance to the correct table.
+                 * then based on the current temperature
+                 * find the next state need to transaction to
+                 * go through all the possible (IWL_TI_STATE_MAX - 1) entries
+                 * in the current table to see if transaction is needed
+                 */
+                transaction = tt->transaction +
+                        ((old_state * (IWL_TI_STATE_MAX - 1)) + i);
+                if (temp >= transaction->tt_low &&
+                    temp <= transaction->tt_high) {
+#ifdef CONFIG_IWLWIFI_DEBUG
+                        if ((tt->tt_previous_temp) &&
+                            (temp > tt->tt_previous_temp) &&
+                            ((temp - tt->tt_previous_temp) >
+                            IWL_TT_INCREASE_MARGIN)) {
+                                IWL_DEBUG_POWER(priv,
+                                        "Temperature increase %d "
+                                        "degree Celsius\n",
+                                        (temp - tt->tt_previous_temp));
+                        }
+                        tt->tt_previous_temp = temp;
+#endif
+                        if (old_state !=
+                            transaction->next_state) {
+                                changed = true;
+                                tt->state =
+                                        transaction->next_state;
+                        }
+                        break;
+                }
+        }
+        /* stop ct_kill_waiting_tm timer */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
+        if (changed) {
+                if (tt->state >= IWL_TI_1) {
+                        /* force PI = IWL_POWER_INDEX_5 in the case of TI > 0 */
+                        tt->tt_power_mode = IWL_POWER_INDEX_5;
+
+                        if (!iwl_ht_enabled(priv)) {
+                                struct iwl_rxon_context *ctx;
+
+                                for_each_context(priv, ctx) {
+                                        struct iwl_rxon_cmd *rxon;
+
+                                        rxon = &ctx->staging;
+
+                                        /* disable HT */
+                                        rxon->flags &= ~(
+                                                RXON_FLG_CHANNEL_MODE_MSK |
+                                                RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
+                                                RXON_FLG_HT40_PROT_MSK |
+                                                RXON_FLG_HT_PROT_MSK);
+                                }
+                        } else {
+                                /* check HT capability and set
+                                 * according to the system HT capability
+                                 * in case get disabled before */
+                                iwl_set_rxon_ht(priv, &priv->current_ht_config);
+                        }
+
+                } else {
+                        /*
+                         * restore system power setting -- it will be
+                         * recalculated automatically.
+                         */
+
+                        /* check HT capability and set
+                         * according to the system HT capability
+                         * in case get disabled before */
+                        iwl_set_rxon_ht(priv, &priv->current_ht_config);
+                }
+                mutex_lock(&priv->mutex);
+                if (old_state == IWL_TI_CT_KILL)
+                        clear_bit(STATUS_CT_KILL, &priv->status);
+                if (tt->state != IWL_TI_CT_KILL &&
+                    iwl_power_update_mode(priv, true)) {
+                        /* TT state not updated
+                         * try again during next temperature read
+                         */
+                        IWL_ERR(priv, "Cannot update power mode, "
+                                        "TT state not updated\n");
+                        if (old_state == IWL_TI_CT_KILL)
+                                set_bit(STATUS_CT_KILL, &priv->status);
+                        tt->state = old_state;
+                } else {
+                        IWL_DEBUG_POWER(priv,
+                                        "Thermal Throttling to new state: %u\n",
+                                        tt->state);
+                        if (old_state != IWL_TI_CT_KILL &&
+                            tt->state == IWL_TI_CT_KILL) {
+                                if (force) {
+                                        IWL_DEBUG_POWER(priv,
+                                                "Enter IWL_TI_CT_KILL\n");
+                                        set_bit(STATUS_CT_KILL, &priv->status);
+                                        iwl_perform_ct_kill_task(priv, true);
+                                } else {
+                                        iwl_prepare_ct_kill_task(priv);
+                                        tt->state = old_state;
+                                }
+                        } else if (old_state == IWL_TI_CT_KILL &&
+                                  tt->state != IWL_TI_CT_KILL) {
+                                IWL_DEBUG_POWER(priv, "Exit IWL_TI_CT_KILL\n");
+                                iwl_perform_ct_kill_task(priv, false);
+                        }
+                }
+                mutex_unlock(&priv->mutex);
+        }
+}
+
+/* Card State Notification indicated reach critical temperature
+ * if PSP not enable, no Thermal Throttling function will be performed
+ * just set the GP1 bit to acknowledge the event
+ * otherwise, go into IWL_TI_CT_KILL state
+ * since Card State Notification will not provide any temperature reading
+ * for Legacy mode
+ * so just pass the CT_KILL temperature to iwl_legacy_tt_handler()
+ * for advance mode
+ * pass CT_KILL_THRESHOLD+1 to make sure move into IWL_TI_CT_KILL state
+ */
+static void iwl_bg_ct_enter(struct work_struct *work)
+{
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_enter);
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (!iwl_is_ready(priv))
+                return;
+
+        if (tt->state != IWL_TI_CT_KILL) {
+                IWL_ERR(priv, "Device reached critical temperature "
+                              "- ucode going to sleep!\n");
+                if (!priv->thermal_throttle.advanced_tt)
+                        iwl_legacy_tt_handler(priv,
+                                              IWL_MINIMAL_POWER_THRESHOLD,
+                                              true);
+                else
+                        iwl_advance_tt_handler(priv,
+                                               CT_KILL_THRESHOLD + 1, true);
+        }
+}
+
+/* Card State Notification indicated out of critical temperature
+ * since Card State Notification will not provide any temperature reading
+ * so pass the IWL_REDUCED_PERFORMANCE_THRESHOLD_2 temperature
+ * to iwl_legacy_tt_handler() to get out of IWL_CT_KILL state
+ */
+static void iwl_bg_ct_exit(struct work_struct *work)
+{
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_exit);
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (!iwl_is_ready(priv))
+                return;
+
+        /* stop ct_kill_exit_tm timer */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
+
+        if (tt->state == IWL_TI_CT_KILL) {
+                IWL_ERR(priv,
+                        "Device temperature below critical"
+                        "- ucode awake!\n");
+                /*
+                 * exit from CT_KILL state
+                 * reset the current temperature reading
+                 */
+                priv->temperature = 0;
+                if (!priv->thermal_throttle.advanced_tt)
+                        iwl_legacy_tt_handler(priv,
+                                      IWL_REDUCED_PERFORMANCE_THRESHOLD_2,
+                                      true);
+                else
+                        iwl_advance_tt_handler(priv, CT_KILL_EXIT_THRESHOLD,
+                                               true);
+        }
+}
+
+void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing critical temperature enter.\n");
+        queue_work(priv->workqueue, &priv->ct_enter);
+}
+EXPORT_SYMBOL(iwl_tt_enter_ct_kill);
+
+void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing critical temperature exit.\n");
+        queue_work(priv->workqueue, &priv->ct_exit);
+}
+EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
+
+static void iwl_bg_tt_work(struct work_struct *work)
+{
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, tt_work);
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (priv->cfg->temperature_kelvin)
+                temp = KELVIN_TO_CELSIUS(priv->temperature);
+
+        if (!priv->thermal_throttle.advanced_tt)
+                iwl_legacy_tt_handler(priv, temp, false);
+        else
+                iwl_advance_tt_handler(priv, temp, false);
+}
+
+void iwl_tt_handler(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing thermal throttling work.\n");
+        queue_work(priv->workqueue, &priv->tt_work);
+}
+EXPORT_SYMBOL(iwl_tt_handler);
+
+/* Thermal throttling initialization
+ * For advance thermal throttling:
+ *     Initialize Thermal Index and temperature threshold table
+ *     Initialize thermal throttling restriction table
+ */
+void iwl_tt_initialize(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        int size = sizeof(struct iwl_tt_trans) * (IWL_TI_STATE_MAX - 1);
+        struct iwl_tt_trans *transaction;
+
+        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling\n");
+
+        memset(tt, 0, sizeof(struct iwl_tt_mgmt));
+
+        tt->state = IWL_TI_0;
+        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
+        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
+        priv->thermal_throttle.ct_kill_exit_tm.function =
+                iwl_tt_check_exit_ct_kill;
+        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
+        priv->thermal_throttle.ct_kill_waiting_tm.data =
+                (unsigned long)priv;
+        priv->thermal_throttle.ct_kill_waiting_tm.function =
+                iwl_tt_ready_for_ct_kill;
+        /* setup deferred ct kill work */
+        INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
+        INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
+        INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
+
+        if (priv->cfg->adv_thermal_throttle) {
+                IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
+                tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
+                                         IWL_TI_STATE_MAX, GFP_KERNEL);
+                tt->transaction = kzalloc(sizeof(struct iwl_tt_trans) *
+                        IWL_TI_STATE_MAX * (IWL_TI_STATE_MAX - 1),
+                        GFP_KERNEL);
+                if (!tt->restriction || !tt->transaction) {
+                        IWL_ERR(priv, "Fallback to Legacy Throttling\n");
+                        priv->thermal_throttle.advanced_tt = false;
+                        kfree(tt->restriction);
+                        tt->restriction = NULL;
+                        kfree(tt->transaction);
+                        tt->transaction = NULL;
+                } else {
+                        transaction = tt->transaction +
+                                (IWL_TI_0 * (IWL_TI_STATE_MAX - 1));
+                        memcpy(transaction, &tt_range_0[0], size);
+                        transaction = tt->transaction +
+                                (IWL_TI_1 * (IWL_TI_STATE_MAX - 1));
+                        memcpy(transaction, &tt_range_1[0], size);
+                        transaction = tt->transaction +
+                                (IWL_TI_2 * (IWL_TI_STATE_MAX - 1));
+                        memcpy(transaction, &tt_range_2[0], size);
+                        transaction = tt->transaction +
+                                (IWL_TI_CT_KILL * (IWL_TI_STATE_MAX - 1));
+                        memcpy(transaction, &tt_range_3[0], size);
+                        size = sizeof(struct iwl_tt_restriction) *
+                                IWL_TI_STATE_MAX;
+                        memcpy(tt->restriction,
+                                &restriction_range[0], size);
+                        priv->thermal_throttle.advanced_tt = true;
+                }
+        } else {
+                IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
+                priv->thermal_throttle.advanced_tt = false;
+        }
+}
+EXPORT_SYMBOL(iwl_tt_initialize);
+
+/* cleanup thermal throttling management related memory and timer */
+void iwl_tt_exit(struct iwl_priv *priv)
+{
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+
+        /* stop ct_kill_exit_tm timer if activated */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
+        /* stop ct_kill_waiting_tm timer if activated */
+        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
+        cancel_work_sync(&priv->tt_work);
+        cancel_work_sync(&priv->ct_enter);
+        cancel_work_sync(&priv->ct_exit);
+
+        if (priv->thermal_throttle.advanced_tt) {
+                /* free advance thermal throttling memory */
+                kfree(tt->restriction);
+                tt->restriction = NULL;
+                kfree(tt->transaction);
+                tt->transaction = NULL;
+        }
+}
+EXPORT_SYMBOL(iwl_tt_exit);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tt.h b/drivers/net/wireless/iwlwifi/iwl-agn-tt.h
new file mode 100644
index 000000000000..d55060427cac
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tt.h
@@ -0,0 +1,129 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
+ *
+ * Portions of this file are derived from the ipw3945 project, as well
+ * as portions of the ieee80211 subsystem header files.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+#ifndef __iwl_tt_setting_h__
+#define __iwl_tt_setting_h__
+
+#include "iwl-commands.h"
+
+#define IWL_ABSOLUTE_ZERO               0
+#define IWL_ABSOLUTE_MAX                0xFFFFFFFF
+#define IWL_TT_INCREASE_MARGIN  5
+#define IWL_TT_CT_KILL_MARGIN   3
+
+enum iwl_antenna_ok {
+        IWL_ANT_OK_NONE,
+        IWL_ANT_OK_SINGLE,
+        IWL_ANT_OK_MULTI,
+};
+
+/* Thermal Throttling State Machine states */
+enum  iwl_tt_state {
+        IWL_TI_0,       /* normal temperature, system power state */
+        IWL_TI_1,       /* high temperature detect, low power state */
+        IWL_TI_2,       /* higher temperature detected, lower power state */
+        IWL_TI_CT_KILL, /* critical temperature detected, lowest power state */
+        IWL_TI_STATE_MAX
+};
+
+/**
+ * struct iwl_tt_restriction - Thermal Throttling restriction table
+ * @tx_stream: number of tx stream allowed
+ * @is_ht: ht enable/disable
+ * @rx_stream: number of rx stream allowed
+ *
+ * This table is used by advance thermal throttling management
+ * based on the current thermal throttling state, and determines
+ * the number of tx/rx streams and the status of HT operation.
+ */
+struct iwl_tt_restriction {
+        enum iwl_antenna_ok tx_stream;
+        enum iwl_antenna_ok rx_stream;
+        bool is_ht;
+};
+
+/**
+ * struct iwl_tt_trans - Thermal Throttling transaction table
+ * @next_state:  next thermal throttling mode
+ * @tt_low: low temperature threshold to change state
+ * @tt_high: high temperature threshold to change state
+ *
+ * This is used by the advanced thermal throttling algorithm
+ * to determine the next thermal state to go based on the
+ * current temperature.
+ */
+struct iwl_tt_trans {
+        enum iwl_tt_state next_state;
+        u32 tt_low;
+        u32 tt_high;
+};
+
+/**
+ * struct iwl_tt_mgnt - Thermal Throttling Management structure
+ * @advanced_tt:    advanced thermal throttle required
+ * @state:          current Thermal Throttling state
+ * @tt_power_mode:  Thermal Throttling power mode index
+ *                  being used to set power level when
+ *                  when thermal throttling state != IWL_TI_0
+ *                  the tt_power_mode should set to different
+ *                  power mode based on the current tt state
+ * @tt_previous_temperature: last measured temperature
+ * @iwl_tt_restriction: ptr to restriction tbl, used by advance
+ *                  thermal throttling to determine how many tx/rx streams
+ *                  should be used in tt state; and can HT be enabled or not
+ * @iwl_tt_trans: ptr to adv trans table, used by advance thermal throttling
+ *                  state transaction
+ * @ct_kill_toggle: used to toggle the CSR bit when checking uCode temperature
+ * @ct_kill_exit_tm: timer to exit thermal kill
+ */
+struct iwl_tt_mgmt {
+        enum iwl_tt_state state;
+        bool advanced_tt;
+        u8 tt_power_mode;
+        bool ct_kill_toggle;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        s32 tt_previous_temp;
+#endif
+        struct iwl_tt_restriction *restriction;
+        struct iwl_tt_trans *transaction;
+        struct timer_list ct_kill_exit_tm;
+        struct timer_list ct_kill_waiting_tm;
+};
+
+u8 iwl_tt_current_power_mode(struct iwl_priv *priv);
+bool iwl_tt_is_low_power_state(struct iwl_priv *priv);
+bool iwl_ht_enabled(struct iwl_priv *priv);
+bool iwl_check_for_ct_kill(struct iwl_priv *priv);
+enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv);
+enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv);
+void iwl_tt_enter_ct_kill(struct iwl_priv *priv);
+void iwl_tt_exit_ct_kill(struct iwl_priv *priv);
+void iwl_tt_handler(struct iwl_priv *priv);
+void iwl_tt_initialize(struct iwl_priv *priv);
+void iwl_tt_exit(struct iwl_priv *priv);
+
+#endif  /* __iwl_tt_setting_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 69155aa448fb..5950184d9860 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -71,18 +71,6 @@ static const u8 tid_to_ac[] = {
         2, 3, 3, 2, 1, 1, 0, 0
 };
 
-static const u8 ac_to_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-};
-
-static inline int get_fifo_from_ac(u8 ac)
-{
-        return ac_to_fifo[ac];
-}
-
 static inline int get_ac_from_tid(u16 tid)
 {
         if (likely(tid < ARRAY_SIZE(tid_to_ac)))
@@ -92,10 +80,10 @@ static inline int get_ac_from_tid(u16 tid)
         return -EINVAL;
 }
 
-static inline int get_fifo_from_tid(u16 tid)
+static inline int get_fifo_from_tid(struct iwl_rxon_context *ctx, u16 tid)
 {
         if (likely(tid < ARRAY_SIZE(tid_to_ac)))
-                return get_fifo_from_ac(tid_to_ac[tid]);
+                return ctx->ac_to_fifo[tid_to_ac[tid]];
 
         /* no support for TIDs 8-15 yet */
         return -EINVAL;
@@ -118,7 +106,7 @@ void iwlagn_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
 
         WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX);
 
-        if (txq_id != IWL_CMD_QUEUE_NUM) {
+        if (txq_id != priv->cmd_queue) {
                 sta_id = txq->cmd[txq->q.write_ptr]->cmd.tx.sta_id;
                 sec_ctl = txq->cmd[txq->q.write_ptr]->cmd.tx.sec_ctl;
 
@@ -155,7 +143,7 @@ void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
 
         WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
 
-        if (txq_id != IWL_CMD_QUEUE_NUM)
+        if (txq_id != priv->cmd_queue)
                 sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
 
         bc_ent = cpu_to_le16(1 | (sta_id << 12));
@@ -333,19 +321,15 @@ void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask)
         iwl_write_prph(priv, IWLAGN_SCD_TXFACT, mask);
 }
 
-static inline int get_queue_from_ac(u16 ac)
-{
-        return ac;
-}
-
 /*
  * handle build REPLY_TX command notification.
  */
 static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
-                                  struct iwl_tx_cmd *tx_cmd,
-                                  struct ieee80211_tx_info *info,
-                                  struct ieee80211_hdr *hdr,
-                                  u8 std_id)
+                                        struct sk_buff *skb,
+                                        struct iwl_tx_cmd *tx_cmd,
+                                        struct ieee80211_tx_info *info,
+                                        struct ieee80211_hdr *hdr,
+                                        u8 std_id)
 {
         __le16 fc = hdr->frame_control;
         __le32 tx_flags = tx_cmd->tx_flags;
@@ -365,6 +349,12 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
 
         if (ieee80211_is_back_req(fc))
                 tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
+        else if (info->band == IEEE80211_BAND_2GHZ &&
+                 priv->cfg->advanced_bt_coexist &&
+                 (ieee80211_is_auth(fc) || ieee80211_is_assoc_req(fc) ||
+                 ieee80211_is_reassoc_req(fc) ||
+                 skb->protocol == cpu_to_be16(ETH_P_PAE)))
+                tx_flags |= TX_CMD_FLG_IGNORE_BT;
 
 
         tx_cmd->sta_id = std_id;
@@ -454,7 +444,12 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
                 rate_flags |= RATE_MCS_CCK_MSK;
 
         /* Set up antennas */
-        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
+         if (priv->cfg->advanced_bt_coexist && priv->bt_full_concurrent) {
+                /* operated as 1x1 in full concurrency mode */
+                priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
+                                first_antenna(priv->hw_params.valid_tx_ant));
+        } else
+                priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
                                               priv->hw_params.valid_tx_ant);
         rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
@@ -470,8 +465,8 @@ static void iwlagn_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
 {
         struct ieee80211_key_conf *keyconf = info->control.hw_key;
 
-        switch (keyconf->alg) {
-        case ALG_CCMP:
+        switch (keyconf->cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
                 tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
                 memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
                 if (info->flags & IEEE80211_TX_CTL_AMPDU)
@@ -479,20 +474,20 @@ static void iwlagn_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
                 IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
                 break;
 
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
                 ieee80211_get_tkip_key(keyconf, skb_frag,
                         IEEE80211_TKIP_P2_KEY, tx_cmd->key);
                 IWL_DEBUG_TX(priv, "tx_cmd with tkip hwcrypto\n");
                 break;
 
-        case ALG_WEP:
+        case WLAN_CIPHER_SUITE_WEP104:
+                tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
+                /* fall through */
+        case WLAN_CIPHER_SUITE_WEP40:
                 tx_cmd->sec_ctl |= (TX_CMD_SEC_WEP |
                         (keyconf->keyidx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT);
 
-                if (keyconf->keylen == WEP_KEY_LEN_128)
-                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
-
                 memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
 
                 IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
@@ -500,7 +495,7 @@ static void iwlagn_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
                 break;
 
         default:
-                IWL_ERR(priv, "Unknown encode alg %d\n", keyconf->alg);
+                IWL_ERR(priv, "Unknown encode cipher %x\n", keyconf->cipher);
                 break;
         }
 }
@@ -519,6 +514,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         struct iwl_device_cmd *out_cmd;
         struct iwl_cmd_meta *out_meta;
         struct iwl_tx_cmd *tx_cmd;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         int swq_id, txq_id;
         dma_addr_t phys_addr;
         dma_addr_t txcmd_phys;
@@ -533,6 +529,9 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         u8 *qc = NULL;
         unsigned long flags;
 
+        if (info->control.vif)
+                ctx = iwl_rxon_ctx_from_vif(info->control.vif);
+
         spin_lock_irqsave(&priv->lock, flags);
         if (iwl_is_rfkill(priv)) {
                 IWL_DEBUG_DROP(priv, "Dropping - RF KILL\n");
@@ -553,7 +552,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find index into station table for destination station */
-        sta_id = iwl_sta_id_or_broadcast(priv, info->control.sta);
+        sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -565,8 +564,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (sta)
                 sta_priv = (void *)sta->drv_priv;
 
-        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
-            sta_priv->asleep) {
+        if (sta_priv && sta_priv->asleep) {
                 WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
                 /*
                  * This sends an asynchronous command to the device,
@@ -580,7 +578,20 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
         }
 
-        txq_id = get_queue_from_ac(skb_get_queue_mapping(skb));
+        /*
+         * Send this frame after DTIM -- there's a special queue
+         * reserved for this for contexts that support AP mode.
+         */
+        if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
+                txq_id = ctx->mcast_queue;
+                /*
+                 * The microcode will clear the more data
+                 * bit in the last frame it transmits.
+                 */
+                hdr->frame_control |=
+                        cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+        } else
+                txq_id = ctx->ac_to_queue[skb_get_queue_mapping(skb)];
 
         /* irqs already disabled/saved above when locking priv->lock */
         spin_lock(&priv->sta_lock);
@@ -625,6 +636,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
         txq->txb[q->write_ptr].skb = skb;
+        txq->txb[q->write_ptr].ctx = ctx;
 
         /* Set up first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[q->write_ptr];
@@ -655,7 +667,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 iwlagn_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
 
         /* TODO need this for burst mode later on */
-        iwlagn_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+        iwlagn_tx_cmd_build_basic(priv, skb, tx_cmd, info, hdr, sta_id);
         iwl_dbg_log_tx_data_frame(priv, len, hdr);
 
         iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, fc);
@@ -813,7 +825,7 @@ void iwlagn_hw_txq_ctx_free(struct iwl_priv *priv)
         /* Tx queues */
         if (priv->txq) {
                 for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                        if (txq_id == priv->cmd_queue)
                                 iwl_cmd_queue_free(priv);
                         else
                                 iwl_tx_queue_free(priv, txq_id);
@@ -870,9 +882,9 @@ int iwlagn_txq_ctx_alloc(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Alloc and init all Tx queues, including the command queue (#4) */
+        /* Alloc and init all Tx queues, including the command queue (#4/#9) */
         for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
+                slots_num = (txq_id == priv->cmd_queue) ?
                                         TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
                 ret = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
                                        txq_id);
@@ -910,7 +922,7 @@ void iwlagn_txq_ctx_reset(struct iwl_priv *priv)
 
         /* Alloc and init all Tx queues, including the command queue (#4) */
         for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
+                slots_num = txq_id == priv->cmd_queue ?
                             TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
                 iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
         }
@@ -968,7 +980,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
         unsigned long flags;
         struct iwl_tid_data *tid_data;
 
-        tx_fifo = get_fifo_from_tid(tid);
+        tx_fifo = get_fifo_from_tid(iwl_rxon_ctx_from_vif(vif), tid);
         if (unlikely(tx_fifo < 0))
                 return tx_fifo;
 
@@ -1024,12 +1036,12 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
 int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta, u16 tid)
 {
-        int tx_fifo_id, txq_id, sta_id, ssn = -1;
+        int tx_fifo_id, txq_id, sta_id, ssn;
         struct iwl_tid_data *tid_data;
         int write_ptr, read_ptr;
         unsigned long flags;
 
-        tx_fifo_id = get_fifo_from_tid(tid);
+        tx_fifo_id = get_fifo_from_tid(iwl_rxon_ctx_from_vif(vif), tid);
         if (unlikely(tx_fifo_id < 0))
                 return tx_fifo_id;
 
@@ -1042,21 +1054,26 @@ int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        if (priv->stations[sta_id].tid[tid].agg.state ==
-                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
-                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
-                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
-                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
-                return 0;
-        }
-
-        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
-                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
-
         tid_data = &priv->stations[sta_id].tid[tid];
         ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
         txq_id = tid_data->agg.txq_id;
+
+        switch (priv->stations[sta_id].tid[tid].agg.state) {
+        case IWL_EMPTYING_HW_QUEUE_ADDBA:
+                /*
+                 * This can happen if the peer stops aggregation
+                 * again before we've had a chance to drain the
+                 * queue we selected previously, i.e. before the
+                 * session was really started completely.
+                 */
+                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
+                goto turn_off;
+        case IWL_AGG_ON:
+                break;
+        default:
+                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
+        }
+
         write_ptr = priv->txq[txq_id].q.write_ptr;
         read_ptr = priv->txq[txq_id].q.read_ptr;
 
@@ -1070,6 +1087,7 @@ int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
         }
 
         IWL_DEBUG_HT(priv, "HW queue is empty\n");
+ turn_off:
         priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
 
         /* do not restore/save irqs */
@@ -1098,6 +1116,9 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
         struct iwl_queue *q = &priv->txq[txq_id].q;
         u8 *addr = priv->stations[sta_id].sta.sta.addr;
         struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
+        struct iwl_rxon_context *ctx;
+
+        ctx = &priv->contexts[priv->stations[sta_id].ctxid];
 
         lockdep_assert_held(&priv->sta_lock);
 
@@ -1108,12 +1129,12 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
                 if ((txq_id  == tid_data->agg.txq_id) &&
                     (q->read_ptr == q->write_ptr)) {
                         u16 ssn = SEQ_TO_SN(tid_data->seq_number);
-                        int tx_fifo = get_fifo_from_tid(tid);
+                        int tx_fifo = get_fifo_from_tid(ctx, tid);
                         IWL_DEBUG_HT(priv, "HW queue empty: continue DELBA flow\n");
                         priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
                                                              ssn, tx_fifo);
                         tid_data->agg.state = IWL_AGG_OFF;
-                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                        ieee80211_stop_tx_ba_cb_irqsafe(ctx->vif, addr, tid);
                 }
                 break;
         case IWL_EMPTYING_HW_QUEUE_ADDBA:
@@ -1121,7 +1142,7 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
                 if (tid_data->tfds_in_queue == 0) {
                         IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
                         tid_data->agg.state = IWL_AGG_ON;
-                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                        ieee80211_start_tx_ba_cb_irqsafe(ctx->vif, addr, tid);
                 }
                 break;
         }
@@ -1129,14 +1150,14 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
         return 0;
 }
 
-static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
+static void iwlagn_tx_status(struct iwl_priv *priv, struct iwl_tx_info *tx_info)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx_info->skb->data;
         struct ieee80211_sta *sta;
         struct iwl_station_priv *sta_priv;
 
         rcu_read_lock();
-        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+        sta = ieee80211_find_sta(tx_info->ctx->vif, hdr->addr1);
         if (sta) {
                 sta_priv = (void *)sta->drv_priv;
                 /* avoid atomic ops if this isn't a client */
@@ -1146,7 +1167,7 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
         }
         rcu_read_unlock();
 
-        ieee80211_tx_status_irqsafe(priv->hw, skb);
+        ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb);
 }
 
 int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
@@ -1169,7 +1190,7 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwlagn_tx_status(priv, tx_info->skb);
+                iwlagn_tx_status(priv, tx_info);
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
                 if (hdr && ieee80211_is_data_qos(hdr->frame_control))
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index 6f77441cb65a..8bfb0495a76b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -52,6 +52,19 @@ static const s8 iwlagn_default_queue_to_tx_fifo[] = {
         IWL_TX_FIFO_UNUSED,
 };
 
+static const s8 iwlagn_ipan_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+        IWL_TX_FIFO_BK_IPAN,
+        IWL_TX_FIFO_BE_IPAN,
+        IWL_TX_FIFO_VI_IPAN,
+        IWL_TX_FIFO_VO_IPAN,
+        IWL_TX_FIFO_BE_IPAN,
+        IWLAGN_CMD_FIFO_NUM,
+};
+
 static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
         {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
          0, COEX_UNASSOC_IDLE_FLAGS},
@@ -294,6 +307,17 @@ void iwlagn_init_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
+        if (priv->cfg->advanced_bt_coexist) {
+                /*
+                 * Tell uCode we are ready to perform calibration
+                 * need to perform this before any calibration
+                 * no need to close the envlope since we are going
+                 * to load the runtime uCode later.
+                 */
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+
+        }
         iwlagn_send_calib_cfg(priv);
         return;
 
@@ -329,8 +353,54 @@ static int iwlagn_send_wimax_coex(struct iwl_priv *priv)
                                 sizeof(coex_cmd), &coex_cmd);
 }
 
+static const u8 iwlagn_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
+        ((BT_COEX_PRIO_TBL_PRIO_BYPASS << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_BYPASS << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (1 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_LOW << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_LOW << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (1 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_HIGH << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_HIGH << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (1 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_BYPASS << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_COEX_OFF << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        ((BT_COEX_PRIO_TBL_PRIO_COEX_ON << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
+                (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
+        0, 0, 0, 0, 0, 0, 0
+};
+
+void iwlagn_send_prio_tbl(struct iwl_priv *priv)
+{
+        struct iwl_bt_coex_prio_table_cmd prio_tbl_cmd;
+
+        memcpy(prio_tbl_cmd.prio_tbl, iwlagn_bt_prio_tbl,
+                sizeof(iwlagn_bt_prio_tbl));
+        if (iwl_send_cmd_pdu(priv, REPLY_BT_COEX_PRIO_TABLE,
+                                sizeof(prio_tbl_cmd), &prio_tbl_cmd))
+                IWL_ERR(priv, "failed to send BT prio tbl command\n");
+}
+
+void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
+{
+        struct iwl_bt_coex_prot_env_cmd env_cmd;
+
+        env_cmd.action = action;
+        env_cmd.type = type;
+        if (iwl_send_cmd_pdu(priv, REPLY_BT_COEX_PROT_ENV,
+                             sizeof(env_cmd), &env_cmd))
+                IWL_ERR(priv, "failed to send BT env command\n");
+}
+
+
 int iwlagn_alive_notify(struct iwl_priv *priv)
 {
+        const s8 *queues;
         u32 a;
         unsigned long flags;
         int i, chan;
@@ -365,7 +435,7 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
                            reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
 
         iwl_write_prph(priv, IWLAGN_SCD_QUEUECHAIN_SEL,
-                IWLAGN_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
+                IWLAGN_SCD_QUEUECHAIN_SEL_ALL(priv));
         iwl_write_prph(priv, IWLAGN_SCD_AGGR_SEL, 0);
 
         /* initiate the queues */
@@ -391,7 +461,13 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
         /* Activate all Tx DMA/FIFO channels */
         priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 7));
 
-        iwlagn_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+        /* map queues to FIFOs */
+        if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
+                queues = iwlagn_ipan_queue_to_tx_fifo;
+        else
+                queues = iwlagn_default_queue_to_tx_fifo;
+
+        iwlagn_set_wr_ptrs(priv, priv->cmd_queue, 0);
 
         /* make sure all queue are not stopped */
         memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
@@ -400,11 +476,12 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
 
         /* reset to 0 to enable all the queue first */
         priv->txq_ctx_active_msk = 0;
-        /* map qos queues to fifos one-to-one */
+
         BUILD_BUG_ON(ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo) != 10);
+        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo) != 10);
 
-        for (i = 0; i < ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo); i++) {
-                int ac = iwlagn_default_queue_to_tx_fifo[i];
+        for (i = 0; i < 10; i++) {
+                int ac = queues[i];
 
                 iwl_txq_ctx_activate(priv, i);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 10d7b9b7f064..646864a26eaf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -33,6 +33,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -86,6 +87,9 @@ MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("iwl4965");
 
+static int iwlagn_ant_coupling;
+static bool iwlagn_bt_ch_announce = 1;
+
 /**
  * iwl_commit_rxon - commit staging_rxon to hardware
  *
@@ -94,21 +98,25 @@ MODULE_ALIAS("iwl4965");
  * function correctly transitions out of the RXON_ASSOC_MSK state if
  * a HW tune is required based on the RXON structure changes.
  */
-int iwl_commit_rxon(struct iwl_priv *priv)
+int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         /* cast away the const for active_rxon in this function */
-        struct iwl_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
+        struct iwl_rxon_cmd *active_rxon = (void *)&ctx->active;
         int ret;
         bool new_assoc =
-                !!(priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK);
+                !!(ctx->staging.filter_flags & RXON_FILTER_ASSOC_MSK);
+        bool old_assoc = !!(ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK);
 
         if (!iwl_is_alive(priv))
                 return -EBUSY;
 
+        if (!ctx->is_active)
+                return 0;
+
         /* always get timestamp with Rx frame */
-        priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
+        ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
 
-        ret = iwl_check_rxon_cmd(priv);
+        ret = iwl_check_rxon_cmd(priv, ctx);
         if (ret) {
                 IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
                 return -EINVAL;
@@ -119,7 +127,7 @@ int iwl_commit_rxon(struct iwl_priv *priv)
          * abort any previous channel switch if still in process
          */
         if (priv->switch_rxon.switch_in_progress &&
-            (priv->switch_rxon.channel != priv->staging_rxon.channel)) {
+            (priv->switch_rxon.channel != ctx->staging.channel)) {
                 IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
                       le16_to_cpu(priv->switch_rxon.channel));
                 iwl_chswitch_done(priv, false);
@@ -128,15 +136,15 @@ int iwl_commit_rxon(struct iwl_priv *priv)
         /* If we don't need to send a full RXON, we can use
          * iwl_rxon_assoc_cmd which is used to reconfigure filter
          * and other flags for the current radio configuration. */
-        if (!iwl_full_rxon_required(priv)) {
-                ret = iwl_send_rxon_assoc(priv);
+        if (!iwl_full_rxon_required(priv, ctx)) {
+                ret = iwl_send_rxon_assoc(priv, ctx);
                 if (ret) {
                         IWL_ERR(priv, "Error setting RXON_ASSOC (%d)\n", ret);
                         return ret;
                 }
 
-                memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
-                iwl_print_rx_config_cmd(priv);
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+                iwl_print_rx_config_cmd(priv, ctx);
                 return 0;
         }
 
@@ -144,13 +152,13 @@ int iwl_commit_rxon(struct iwl_priv *priv)
          * an RXON_ASSOC and the new config wants the associated mask enabled,
          * we must clear the associated from the active configuration
          * before we apply the new config */
-        if (iwl_is_associated(priv) && new_assoc) {
+        if (iwl_is_associated_ctx(ctx) && new_assoc) {
                 IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
 
-                ret = iwl_send_cmd_pdu(priv, REPLY_RXON,
-                                      sizeof(struct iwl_rxon_cmd),
-                                      &priv->active_rxon);
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                                       sizeof(struct iwl_rxon_cmd),
+                                       active_rxon);
 
                 /* If the mask clearing failed then we set
                  * active_rxon back to what it was previously */
@@ -159,9 +167,9 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                         IWL_ERR(priv, "Error clearing ASSOC_MSK (%d)\n", ret);
                         return ret;
                 }
-                iwl_clear_ucode_stations(priv);
-                iwl_restore_stations(priv);
-                ret = iwl_restore_default_wep_keys(priv);
+                iwl_clear_ucode_stations(priv, ctx);
+                iwl_restore_stations(priv, ctx);
+                ret = iwl_restore_default_wep_keys(priv, ctx);
                 if (ret) {
                         IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
                         return ret;
@@ -173,47 +181,65 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                        "* channel = %d\n"
                        "* bssid = %pM\n",
                        (new_assoc ? "" : "out"),
-                       le16_to_cpu(priv->staging_rxon.channel),
-                       priv->staging_rxon.bssid_addr);
+                       le16_to_cpu(ctx->staging.channel),
+                       ctx->staging.bssid_addr);
 
-        iwl_set_rxon_hwcrypto(priv, !priv->cfg->mod_params->sw_crypto);
+        iwl_set_rxon_hwcrypto(priv, ctx, !priv->cfg->mod_params->sw_crypto);
+
+        if (!old_assoc) {
+                /*
+                 * First of all, before setting associated, we need to
+                 * send RXON timing so the device knows about the DTIM
+                 * period and other timing values
+                 */
+                ret = iwl_send_rxon_timing(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting RXON timing!\n");
+                        return ret;
+                }
+        }
+
+        if (priv->cfg->ops->hcmd->set_pan_params) {
+                ret = priv->cfg->ops->hcmd->set_pan_params(priv);
+                if (ret)
+                        return ret;
+        }
 
         /* Apply the new configuration
          * RXON unassoc clears the station table in uCode so restoration of
          * stations is needed after it (the RXON command) completes
          */
         if (!new_assoc) {
-                ret = iwl_send_cmd_pdu(priv, REPLY_RXON,
-                              sizeof(struct iwl_rxon_cmd), &priv->staging_rxon);
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
                 if (ret) {
                         IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
                         return ret;
                 }
                 IWL_DEBUG_INFO(priv, "Return from !new_assoc RXON.\n");
-                memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
-                iwl_clear_ucode_stations(priv);
-                iwl_restore_stations(priv);
-                ret = iwl_restore_default_wep_keys(priv);
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+                iwl_clear_ucode_stations(priv, ctx);
+                iwl_restore_stations(priv, ctx);
+                ret = iwl_restore_default_wep_keys(priv, ctx);
                 if (ret) {
                         IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
                         return ret;
                 }
         }
-
-        priv->start_calib = 0;
         if (new_assoc) {
+                priv->start_calib = 0;
                 /* Apply the new configuration
                  * RXON assoc doesn't clear the station table in uCode,
                  */
-                ret = iwl_send_cmd_pdu(priv, REPLY_RXON,
-                              sizeof(struct iwl_rxon_cmd), &priv->staging_rxon);
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
                 if (ret) {
                         IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
                         return ret;
                 }
-                memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
         }
-        iwl_print_rx_config_cmd(priv);
+        iwl_print_rx_config_cmd(priv, ctx);
 
         iwl_init_sensitivity(priv);
 
@@ -230,10 +256,14 @@ int iwl_commit_rxon(struct iwl_priv *priv)
 
 void iwl_update_chain_flags(struct iwl_priv *priv)
 {
+        struct iwl_rxon_context *ctx;
 
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
-        iwlcore_commit_rxon(priv);
+        if (priv->cfg->ops->hcmd->set_rxon_chain) {
+                for_each_context(priv, ctx) {
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+                        iwlcore_commit_rxon(priv, ctx);
+                }
+        }
 }
 
 static void iwl_clear_free_frames(struct iwl_priv *priv)
@@ -337,6 +367,13 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
          * beacon contents.
          */
 
+        lockdep_assert_held(&priv->mutex);
+
+        if (!priv->beacon_ctx) {
+                IWL_ERR(priv, "trying to build beacon w/o beacon context!\n");
+                return 0;
+        }
+
         /* Initialize memory */
         tx_beacon_cmd = &frame->u.beacon;
         memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
@@ -349,7 +386,7 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 
         /* Set up TX command fields */
         tx_beacon_cmd->tx.len = cpu_to_le16((u16)frame_size);
-        tx_beacon_cmd->tx.sta_id = priv->hw_params.bcast_sta_id;
+        tx_beacon_cmd->tx.sta_id = priv->beacon_ctx->bcast_sta_id;
         tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
         tx_beacon_cmd->tx.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK |
                 TX_CMD_FLG_TSF_MSK | TX_CMD_FLG_STA_RATE_MSK;
@@ -359,7 +396,7 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
                         frame_size);
 
         /* Set up packet rate and flags */
-        rate = iwl_rate_get_lowest_plcp(priv);
+        rate = iwl_rate_get_lowest_plcp(priv, priv->beacon_ctx);
         priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
                                               priv->hw_params.valid_tx_ant);
         rate_flags = iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
@@ -592,23 +629,84 @@ static void iwl_bg_beacon_update(struct work_struct *work)
                 container_of(work, struct iwl_priv, beacon_update);
         struct sk_buff *beacon;
 
-        /* Pull updated AP beacon from mac80211. will fail if not in AP mode */
-        beacon = ieee80211_beacon_get(priv->hw, priv->vif);
+        mutex_lock(&priv->mutex);
+        if (!priv->beacon_ctx) {
+                IWL_ERR(priv, "updating beacon w/o beacon context!\n");
+                goto out;
+        }
+
+        if (priv->beacon_ctx->vif->type != NL80211_IFTYPE_AP) {
+                /*
+                 * The ucode will send beacon notifications even in
+                 * IBSS mode, but we don't want to process them. But
+                 * we need to defer the type check to here due to
+                 * requiring locking around the beacon_ctx access.
+                 */
+                goto out;
+        }
 
+        /* Pull updated AP beacon from mac80211. will fail if not in AP mode */
+        beacon = ieee80211_beacon_get(priv->hw, priv->beacon_ctx->vif);
         if (!beacon) {
                 IWL_ERR(priv, "update beacon failed\n");
-                return;
+                goto out;
         }
 
-        mutex_lock(&priv->mutex);
         /* new beacon skb is allocated every time; dispose previous.*/
         if (priv->ibss_beacon)
                 dev_kfree_skb(priv->ibss_beacon);
 
         priv->ibss_beacon = beacon;
-        mutex_unlock(&priv->mutex);
 
         iwl_send_beacon_cmd(priv);
+ out:
+        mutex_unlock(&priv->mutex);
+}
+
+static void iwl_bg_bt_runtime_config(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, bt_runtime_config);
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* dont send host command if rf-kill is on */
+        if (!iwl_is_ready_rf(priv))
+                return;
+        priv->cfg->ops->hcmd->send_bt_config(priv);
+}
+
+static void iwl_bg_bt_full_concurrency(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, bt_full_concurrency);
+        struct iwl_rxon_context *ctx;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* dont send host command if rf-kill is on */
+        if (!iwl_is_ready_rf(priv))
+                return;
+
+        IWL_DEBUG_INFO(priv, "BT coex in %s mode\n",
+                       priv->bt_full_concurrent ?
+                       "full concurrency" : "3-wire");
+
+        /*
+         * LQ & RXON updated cmds must be sent before BT Config cmd
+         * to avoid 3-wire collisions
+         */
+        mutex_lock(&priv->mutex);
+        for_each_context(priv, ctx) {
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+                iwlcore_commit_rxon(priv, ctx);
+        }
+        mutex_unlock(&priv->mutex);
+
+        priv->cfg->ops->hcmd->send_bt_config(priv);
 }
 
 /**
@@ -763,10 +861,10 @@ static void iwl_bg_ucode_trace(unsigned long data)
 static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-#ifdef CONFIG_IWLWIFI_DEBUG
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl4965_beacon_notif *beacon =
                 (struct iwl4965_beacon_notif *)pkt->u.raw;
+#ifdef CONFIG_IWLWIFI_DEBUG
         u8 rate = iwl_hw_get_rate(beacon->beacon_notify_hdr.rate_n_flags);
 
         IWL_DEBUG_RX(priv, "beacon status %x retries %d iss %d "
@@ -778,8 +876,9 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                 le32_to_cpu(beacon->low_tsf), rate);
 #endif
 
-        if ((priv->iw_mode == NL80211_IFTYPE_AP) &&
-            (!test_bit(STATUS_EXIT_PENDING, &priv->status)))
+        priv->ibss_manager = le32_to_cpu(beacon->ibss_mgr_status);
+
+        if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
                 queue_work(priv->workqueue, &priv->beacon_update);
 }
 
@@ -1181,7 +1280,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         " Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -1362,7 +1460,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         " Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -1650,30 +1747,44 @@ static void iwl_nic_start(struct iwl_priv *priv)
 struct iwlagn_ucode_capabilities {
         u32 max_probe_length;
         u32 standard_phy_calibration_size;
+        bool pan;
 };
 
 static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
 static int iwl_mac_setup_register(struct iwl_priv *priv,
                                   struct iwlagn_ucode_capabilities *capa);
 
+#define UCODE_EXPERIMENTAL_INDEX        100
+#define UCODE_EXPERIMENTAL_TAG          "exp"
+
 static int __must_check iwl_request_firmware(struct iwl_priv *priv, bool first)
 {
         const char *name_pre = priv->cfg->fw_name_pre;
+        char tag[8];
 
-        if (first)
+        if (first) {
+#ifdef CONFIG_IWLWIFI_DEBUG_EXPERIMENTAL_UCODE
+                priv->fw_index = UCODE_EXPERIMENTAL_INDEX;
+                strcpy(tag, UCODE_EXPERIMENTAL_TAG);
+        } else if (priv->fw_index == UCODE_EXPERIMENTAL_INDEX) {
+#endif
                 priv->fw_index = priv->cfg->ucode_api_max;
-        else
+                sprintf(tag, "%d", priv->fw_index);
+        } else {
                 priv->fw_index--;
+                sprintf(tag, "%d", priv->fw_index);
+        }
 
         if (priv->fw_index < priv->cfg->ucode_api_min) {
                 IWL_ERR(priv, "no suitable firmware found!\n");
                 return -ENOENT;
         }
 
-        sprintf(priv->firmware_name, "%s%d%s",
-                name_pre, priv->fw_index, ".ucode");
+        sprintf(priv->firmware_name, "%s%s%s", name_pre, tag, ".ucode");
 
-        IWL_DEBUG_INFO(priv, "attempting to load firmware '%s'\n",
+        IWL_DEBUG_INFO(priv, "attempting to load firmware %s'%s'\n",
+                       (priv->fw_index == UCODE_EXPERIMENTAL_INDEX)
+                                ? "EXPERIMENTAL " : "",
                        priv->firmware_name);
 
         return request_firmware_nowait(THIS_MODULE, 1, priv->firmware_name,
@@ -1874,6 +1985,11 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
                         capa->max_probe_length =
                                         le32_to_cpup((__le32 *)tlv_data);
                         break;
+                case IWL_UCODE_TLV_PAN:
+                        if (tlv_len)
+                                goto invalid_tlv_len;
+                        capa->pan = true;
+                        break;
                 case IWL_UCODE_TLV_INIT_EVTLOG_PTR:
                         if (tlv_len != sizeof(u32))
                                 goto invalid_tlv_len;
@@ -1968,8 +2084,10 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         memset(&pieces, 0, sizeof(pieces));
 
         if (!ucode_raw) {
-                IWL_ERR(priv, "request for firmware file '%s' failed.\n",
-                        priv->firmware_name);
+                if (priv->fw_index <= priv->cfg->ucode_api_max)
+                        IWL_ERR(priv,
+                                "request for firmware file '%s' failed.\n",
+                                priv->firmware_name);
                 goto try_again;
         }
 
@@ -2016,7 +2134,9 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                           api_max, api_ver);
 
         if (build)
-                sprintf(buildstr, " build %u", build);
+                sprintf(buildstr, " build %u%s", build,
+                       (priv->fw_index == UCODE_EXPERIMENTAL_INDEX)
+                                ? " (EXP)" : "");
         else
                 buildstr[0] = '\0';
 
@@ -2145,6 +2265,12 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                 priv->_agn.inst_evtlog_size = priv->cfg->max_event_log_size;
         priv->_agn.inst_errlog_ptr = pieces.inst_errlog_ptr;
 
+        if (ucode_capa.pan) {
+                priv->valid_contexts |= BIT(IWL_RXON_CTX_PAN);
+                priv->sta_key_max_num = STA_KEY_MAX_NUM_PAN;
+        } else
+                priv->sta_key_max_num = STA_KEY_MAX_NUM;
+
         /* Copy images into buffers for card's bus-master reads ... */
 
         /* Runtime instructions (first block of data in file) */
@@ -2341,6 +2467,7 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         }
 
         desc = iwl_read_targ_mem(priv, base + 1 * sizeof(u32));
+        priv->isr_stats.err_code = desc;
         pc = iwl_read_targ_mem(priv, base + 2 * sizeof(u32));
         blink1 = iwl_read_targ_mem(priv, base + 3 * sizeof(u32));
         blink2 = iwl_read_targ_mem(priv, base + 4 * sizeof(u32));
@@ -2543,6 +2670,9 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                 return pos;
         }
 
+        /* enable/disable bt channel announcement */
+        priv->bt_ch_announce = iwlagn_bt_ch_announce;
+
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
                 size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
@@ -2589,6 +2719,52 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         return pos;
 }
 
+static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
+{
+        struct iwl_ct_kill_config cmd;
+        struct iwl_ct_kill_throttling_config adv_cmd;
+        unsigned long flags;
+        int ret = 0;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
+                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->thermal_throttle.ct_kill_toggle = false;
+
+        if (priv->cfg->support_ct_kill_exit) {
+                adv_cmd.critical_temperature_enter =
+                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
+                adv_cmd.critical_temperature_exit =
+                        cpu_to_le32(priv->hw_params.ct_kill_exit_threshold);
+
+                ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
+                                       sizeof(adv_cmd), &adv_cmd);
+                if (ret)
+                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
+                else
+                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
+                                        "succeeded, "
+                                        "critical temperature enter is %d,"
+                                        "exit is %d\n",
+                                       priv->hw_params.ct_kill_threshold,
+                                       priv->hw_params.ct_kill_exit_threshold);
+        } else {
+                cmd.critical_temperature_R =
+                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
+
+                ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
+                                       sizeof(cmd), &cmd);
+                if (ret)
+                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
+                else
+                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
+                                        "succeeded, "
+                                        "critical temperature is %d\n",
+                                        priv->hw_params.ct_kill_threshold);
+        }
+}
+
 /**
  * iwl_alive_start - called after REPLY_ALIVE notification received
  *                   from protocol/runtime uCode (initialization uCode's
@@ -2597,6 +2773,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
 static void iwl_alive_start(struct iwl_priv *priv)
 {
         int ret = 0;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         IWL_DEBUG_INFO(priv, "Runtime Alive received.\n");
 
@@ -2637,6 +2814,22 @@ static void iwl_alive_start(struct iwl_priv *priv)
         if (iwl_is_rfkill(priv))
                 return;
 
+        if (priv->cfg->advanced_bt_coexist) {
+                /* Configure Bluetooth device coexistence support */
+                priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
+                priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
+                priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
+                priv->cfg->ops->hcmd->send_bt_config(priv);
+                priv->bt_valid = IWLAGN_BT_VALID_ENABLE_FLAGS;
+                if (bt_coex_active && priv->iw_mode != NL80211_IFTYPE_ADHOC)
+                        iwlagn_send_prio_tbl(priv);
+
+                /* FIXME: w/a to force change uCode BT state machine */
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+                iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
+                        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        }
         ieee80211_wake_queues(priv->hw);
 
         priv->active_rate = IWL_RATES_MASK;
@@ -2645,27 +2838,31 @@ static void iwl_alive_start(struct iwl_priv *priv)
         if (priv->cfg->ops->hcmd->set_tx_ant)
                 priv->cfg->ops->hcmd->set_tx_ant(priv, priv->cfg->valid_tx_ant);
 
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_associated_ctx(ctx)) {
                 struct iwl_rxon_cmd *active_rxon =
-                                (struct iwl_rxon_cmd *)&priv->active_rxon;
+                                (struct iwl_rxon_cmd *)&ctx->active;
                 /* apply any changes in staging */
-                priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         } else {
+                struct iwl_rxon_context *tmp;
                 /* Initialize our rx_config data */
-                iwl_connection_init_rx_config(priv, NULL);
+                for_each_context(priv, tmp)
+                        iwl_connection_init_rx_config(priv, tmp);
 
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
         }
 
-        /* Configure Bluetooth device coexistence support */
-        priv->cfg->ops->hcmd->send_bt_config(priv);
+        if (!priv->cfg->advanced_bt_coexist) {
+                /* Configure Bluetooth device coexistence support */
+                priv->cfg->ops->hcmd->send_bt_config(priv);
+        }
 
         iwl_reset_run_time_calib(priv);
 
         /* Configure the adapter for unassociated operation */
-        iwlcore_commit_rxon(priv);
+        iwlcore_commit_rxon(priv, ctx);
 
         /* At this point, the NIC is initialized and operational */
         iwl_rf_kill_ct_config(priv);
@@ -2695,13 +2892,26 @@ static void __iwl_down(struct iwl_priv *priv)
 
         IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
 
-        if (!exit_pending)
-                set_bit(STATUS_EXIT_PENDING, &priv->status);
+        iwl_scan_cancel_timeout(priv, 200);
 
-        iwl_clear_ucode_stations(priv);
-        iwl_dealloc_bcast_station(priv);
+        exit_pending = test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
+
+        /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
+         * to prevent rearm timer */
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
+
+        iwl_clear_ucode_stations(priv, NULL);
+        iwl_dealloc_bcast_stations(priv);
         iwl_clear_driver_stations(priv);
 
+        /* reset BT coex data */
+        priv->bt_status = 0;
+        priv->bt_traffic_load = priv->cfg->bt_init_traffic_load;
+        priv->bt_sco_active = false;
+        priv->bt_full_concurrent = false;
+        priv->bt_ci_compliance = 0;
+
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
 
@@ -2834,6 +3044,7 @@ static int iwl_prepare_card_hw(struct iwl_priv *priv)
 
 static int __iwl_up(struct iwl_priv *priv)
 {
+        struct iwl_rxon_context *ctx;
         int i;
         int ret;
 
@@ -2847,9 +3058,13 @@ static int __iwl_up(struct iwl_priv *priv)
                 return -EIO;
         }
 
-        ret = iwl_alloc_bcast_station(priv, true);
-        if (ret)
-                return ret;
+        for_each_context(priv, ctx) {
+                ret = iwl_alloc_bcast_station(priv, ctx, true);
+                if (ret) {
+                        iwl_dealloc_bcast_stations(priv);
+                        return ret;
+                }
+        }
 
         iwl_prepare_card_hw(priv);
 
@@ -2874,6 +3089,12 @@ static int __iwl_up(struct iwl_priv *priv)
 
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
+        /* must be initialised before iwl_hw_nic_init */
+        if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
+                priv->cmd_queue = IWL_IPAN_CMD_QUEUE_NUM;
+        else
+                priv->cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
+
         ret = iwlagn_hw_nic_init(priv);
         if (ret) {
                 IWL_ERR(priv, "Unable to init nic\n");
@@ -3004,11 +3225,42 @@ static void iwl_bg_restart(struct work_struct *data)
                 return;
 
         if (test_and_clear_bit(STATUS_FW_ERROR, &priv->status)) {
+                struct iwl_rxon_context *ctx;
+                bool bt_sco, bt_full_concurrent;
+                u8 bt_ci_compliance;
+                u8 bt_load;
+                u8 bt_status;
+
                 mutex_lock(&priv->mutex);
-                priv->vif = NULL;
+                for_each_context(priv, ctx)
+                        ctx->vif = NULL;
                 priv->is_open = 0;
+
+                /*
+                 * __iwl_down() will clear the BT status variables,
+                 * which is correct, but when we restart we really
+                 * want to keep them so restore them afterwards.
+                 *
+                 * The restart process will later pick them up and
+                 * re-configure the hw when we reconfigure the BT
+                 * command.
+                 */
+                bt_sco = priv->bt_sco_active;
+                bt_full_concurrent = priv->bt_full_concurrent;
+                bt_ci_compliance = priv->bt_ci_compliance;
+                bt_load = priv->bt_traffic_load;
+                bt_status = priv->bt_status;
+
+                __iwl_down(priv);
+
+                priv->bt_sco_active = bt_sco;
+                priv->bt_full_concurrent = bt_full_concurrent;
+                priv->bt_ci_compliance = bt_ci_compliance;
+                priv->bt_traffic_load = bt_load;
+                priv->bt_status = bt_status;
+
                 mutex_unlock(&priv->mutex);
-                iwl_down(priv);
+                iwl_cancel_deferred_work(priv);
                 ieee80211_restart_hw(priv->hw);
         } else {
                 iwl_down(priv);
@@ -3039,12 +3291,15 @@ static void iwl_bg_rx_replenish(struct work_struct *data)
 
 void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
+        struct iwl_rxon_context *ctx;
         struct ieee80211_conf *conf = NULL;
         int ret = 0;
 
         if (!vif || !priv->is_open)
                 return;
 
+        ctx = iwl_rxon_ctx_from_vif(vif);
+
         if (vif->type == NL80211_IFTYPE_AP) {
                 IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
                 return;
@@ -3057,44 +3312,42 @@ void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
-        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv);
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv, ctx);
 
-        iwl_setup_rxon_timing(priv, vif);
-        ret = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
-                              sizeof(priv->rxon_timing), &priv->rxon_timing);
+        ret = iwl_send_rxon_timing(priv, ctx);
         if (ret)
-                IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
+                IWL_WARN(priv, "RXON timing - "
                             "Attempting to continue.\n");
 
-        priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
+        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
 
         iwl_set_rxon_ht(priv, &priv->current_ht_config);
 
         if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
 
-        priv->staging_rxon.assoc_id = cpu_to_le16(vif->bss_conf.aid);
+        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
                         vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
         if (vif->bss_conf.use_short_preamble)
-                priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
-                priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
-        if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
+        if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
                 if (vif->bss_conf.use_short_slot)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
         }
 
-        iwlcore_commit_rxon(priv);
+        iwlcore_commit_rxon(priv, ctx);
 
         IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        vif->bss_conf.aid, priv->active_rxon.bssid_addr);
+                        vif->bss_conf.aid, ctx->active.bssid_addr);
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
@@ -3137,11 +3390,14 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
 {
         int ret;
         struct ieee80211_hw *hw = priv->hw;
+        struct iwl_rxon_context *ctx;
+
         hw->rate_control_algorithm = "iwl-agn-rs";
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_NEED_DTIM_PERIOD |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
         if (!priv->cfg->broken_powersave)
@@ -3155,9 +3411,10 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
         hw->sta_data_size = sizeof(struct iwl_station_priv);
         hw->vif_data_size = sizeof(struct iwl_vif_priv);
 
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
+        for_each_context(priv, ctx) {
+                hw->wiphy->interface_modes |= ctx->interface_modes;
+                hw->wiphy->interface_modes |= ctx->exclusive_interface_modes;
+        }
 
         hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
                             WIPHY_FLAG_DISABLE_BEACON_HINTS;
@@ -3247,15 +3504,6 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
 
         priv->is_open = 0;
 
-        if (iwl_is_ready_rf(priv) || test_bit(STATUS_SCAN_HW, &priv->status)) {
-                /* stop mac, cancel any scan request and clear
-                 * RXON_FILTER_ASSOC_MSK BIT
-                 */
-                mutex_lock(&priv->mutex);
-                iwl_scan_cancel_timeout(priv, 100);
-                mutex_unlock(&priv->mutex);
-        }
-
         iwl_down(priv);
 
         flush_workqueue(priv->workqueue);
@@ -3285,24 +3533,25 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
 void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
         int ret = 0;
 
+        lockdep_assert_held(&priv->mutex);
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         /* The following should be done only at AP bring up */
-        if (!iwl_is_associated(priv)) {
+        if (!iwl_is_associated_ctx(ctx)) {
 
                 /* RXON - unassoc (to set timing command) */
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
+                ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
 
                 /* RXON Timing */
-                iwl_setup_rxon_timing(priv, vif);
-                ret = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
-                                sizeof(priv->rxon_timing), &priv->rxon_timing);
+                ret = iwl_send_rxon_timing(priv, ctx);
                 if (ret)
-                        IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
+                        IWL_WARN(priv, "RXON timing failed - "
                                         "Attempting to continue.\n");
 
                 /* AP has all antennas */
@@ -3310,28 +3559,30 @@ void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
                         priv->hw_params.valid_rx_ant;
                 iwl_set_rxon_ht(priv, &priv->current_ht_config);
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
 
-                priv->staging_rxon.assoc_id = 0;
+                ctx->staging.assoc_id = 0;
 
                 if (vif->bss_conf.use_short_preamble)
-                        priv->staging_rxon.flags |=
+                        ctx->staging.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
-                        priv->staging_rxon.flags &=
+                        ctx->staging.flags &=
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
-                if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
+                if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
                         if (vif->bss_conf.use_short_slot)
-                                priv->staging_rxon.flags |=
+                                ctx->staging.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
-                                priv->staging_rxon.flags &=
+                                ctx->staging.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
                 }
+                /* need to send beacon cmd before committing assoc RXON! */
+                iwl_send_beacon_cmd(priv);
                 /* restore RXON assoc */
-                priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
         }
         iwl_send_beacon_cmd(priv);
 
@@ -3348,9 +3599,11 @@ static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
 {
 
         struct iwl_priv *priv = hw->priv;
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
-        iwl_update_tkip_key(priv, keyconf, sta,
+        iwl_update_tkip_key(priv, vif_priv->ctx, keyconf, sta,
                             iv32, phase1key);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -3362,6 +3615,8 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                            struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = hw->priv;
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+        struct iwl_rxon_context *ctx = vif_priv->ctx;
         int ret;
         u8 sta_id;
         bool is_default_wep_key = false;
@@ -3373,7 +3628,7 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
 
-        sta_id = iwl_sta_id_or_broadcast(priv, sta);
+        sta_id = iwl_sta_id_or_broadcast(priv, vif_priv->ctx, sta);
         if (sta_id == IWL_INVALID_STATION)
                 return -EINVAL;
 
@@ -3386,9 +3641,11 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
          * in 1X mode.
          * In legacy wep mode, we use another host command to the uCode.
          */
-        if (key->alg == ALG_WEP && !sta && vif->type != NL80211_IFTYPE_AP) {
+        if ((key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+             key->cipher == WLAN_CIPHER_SUITE_WEP104) &&
+            !sta) {
                 if (cmd == SET_KEY)
-                        is_default_wep_key = !priv->key_mapping_key;
+                        is_default_wep_key = !ctx->key_mapping_keys;
                 else
                         is_default_wep_key =
                                         (key->hw_key_idx == HW_KEY_DEFAULT);
@@ -3397,17 +3654,18 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         switch (cmd) {
         case SET_KEY:
                 if (is_default_wep_key)
-                        ret = iwl_set_default_wep_key(priv, key);
+                        ret = iwl_set_default_wep_key(priv, vif_priv->ctx, key);
                 else
-                        ret = iwl_set_dynamic_key(priv, key, sta_id);
+                        ret = iwl_set_dynamic_key(priv, vif_priv->ctx,
+                                                  key, sta_id);
 
                 IWL_DEBUG_MAC80211(priv, "enable hwcrypto key\n");
                 break;
         case DISABLE_KEY:
                 if (is_default_wep_key)
-                        ret = iwl_remove_default_wep_key(priv, key);
+                        ret = iwl_remove_default_wep_key(priv, ctx, key);
                 else
-                        ret = iwl_remove_dynamic_key(priv, key, sta_id);
+                        ret = iwl_remove_dynamic_key(priv, ctx, key, sta_id);
 
                 IWL_DEBUG_MAC80211(priv, "disable hwcrypto key\n");
                 break;
@@ -3476,8 +3734,8 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
 
                         sta_priv->lq_sta.lq.general_params.flags &=
                                 ~LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK;
-                        iwl_send_lq_cmd(priv, &sta_priv->lq_sta.lq,
-                                CMD_ASYNC, false);
+                        iwl_send_lq_cmd(priv, iwl_rxon_ctx_from_vif(vif),
+                                        &sta_priv->lq_sta.lq, CMD_ASYNC, false);
                 }
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
@@ -3492,8 +3750,8 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
 
                         sta_priv->lq_sta.lq.general_params.flags |=
                                 LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK;
-                        iwl_send_lq_cmd(priv, &sta_priv->lq_sta.lq,
-                                CMD_ASYNC, false);
+                        iwl_send_lq_cmd(priv, iwl_rxon_ctx_from_vif(vif),
+                                        &sta_priv->lq_sta.lq, CMD_ASYNC, false);
                 }
                 ret = 0;
                 break;
@@ -3539,6 +3797,7 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
 {
         struct iwl_priv *priv = hw->priv;
         struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
         bool is_ap = vif->type == NL80211_IFTYPE_STATION;
         int ret;
         u8 sta_id;
@@ -3554,8 +3813,8 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
         if (vif->type == NL80211_IFTYPE_AP)
                 sta_priv->client = true;
 
-        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
-                                     &sta_id);
+        ret = iwl_add_station_common(priv, vif_priv->ctx, sta->addr,
+                                     is_ap, sta, &sta_id);
         if (ret) {
                 IWL_ERR(priv, "Unable to add station %pM (%d)\n",
                         sta->addr, ret);
@@ -3581,7 +3840,17 @@ static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
         struct iwl_priv *priv = hw->priv;
         const struct iwl_channel_info *ch_info;
         struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_channel *channel = ch_switch->channel;
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        /*
+         * MULTI-FIXME
+         * When we add support for multiple interfaces, we need to
+         * revisit this. The channel switch command in the device
+         * only affects the BSS context, but what does that really
+         * mean? And what if we get a CSA on the second interface?
+         * This needs a lot of work.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         u16 ch;
         unsigned long flags = 0;
 
@@ -3594,7 +3863,7 @@ static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
             test_bit(STATUS_SCANNING, &priv->status))
                 goto out_exit;
 
-        if (!iwl_is_associated(priv))
+        if (!iwl_is_associated_ctx(ctx))
                 goto out_exit;
 
         /* channel switch in progress */
@@ -3604,11 +3873,10 @@ static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
         mutex_lock(&priv->mutex);
         if (priv->cfg->ops->lib->set_channel_switch) {
 
-                ch = ieee80211_frequency_to_channel(
-                        ch_switch->channel->center_freq);
-                if (le16_to_cpu(priv->active_rxon.channel) != ch) {
+                ch = channel->hw_value;
+                if (le16_to_cpu(ctx->active.channel) != ch) {
                         ch_info = iwl_get_channel_info(priv,
-                                                       conf->channel->band,
+                                                       channel->band,
                                                        ch);
                         if (!is_channel_valid(ch_info)) {
                                 IWL_DEBUG_MAC80211(priv, "invalid channel\n");
@@ -3619,34 +3887,31 @@ static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
                         priv->current_ht_config.smps = conf->smps_mode;
 
                         /* Configure HT40 channels */
-                        ht_conf->is_ht = conf_is_ht(conf);
-                        if (ht_conf->is_ht) {
+                        ctx->ht.enabled = conf_is_ht(conf);
+                        if (ctx->ht.enabled) {
                                 if (conf_is_ht40_minus(conf)) {
-                                        ht_conf->extension_chan_offset =
+                                        ctx->ht.extension_chan_offset =
                                                 IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                                        ht_conf->is_40mhz = true;
+                                        ctx->ht.is_40mhz = true;
                                 } else if (conf_is_ht40_plus(conf)) {
-                                        ht_conf->extension_chan_offset =
+                                        ctx->ht.extension_chan_offset =
                                                 IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                        ht_conf->is_40mhz = true;
+                                        ctx->ht.is_40mhz = true;
                                 } else {
-                                        ht_conf->extension_chan_offset =
+                                        ctx->ht.extension_chan_offset =
                                                 IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                        ht_conf->is_40mhz = false;
+                                        ctx->ht.is_40mhz = false;
                                 }
                         } else
-                                ht_conf->is_40mhz = false;
+                                ctx->ht.is_40mhz = false;
 
-                        /* if we are switching from ht to 2.4 clear flags
-                         * from any ht related info since 2.4 does not
-                         * support ht */
-                        if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
-                                priv->staging_rxon.flags = 0;
+                        if ((le16_to_cpu(ctx->staging.channel) != ch))
+                                ctx->staging.flags = 0;
 
-                        iwl_set_rxon_channel(priv, conf->channel);
+                        iwl_set_rxon_channel(priv, channel, ctx);
                         iwl_set_rxon_ht(priv, ht_conf);
-                        iwl_set_flags_for_band(priv, conf->channel->band,
-                                               priv->vif);
+                        iwl_set_flags_for_band(priv, ctx, channel->band,
+                                               ctx->vif);
                         spin_unlock_irqrestore(&priv->lock, flags);
 
                         iwl_set_rate(priv);
@@ -3663,7 +3928,7 @@ out:
         mutex_unlock(&priv->mutex);
 out_exit:
         if (!priv->switch_rxon.switch_in_progress)
-                ieee80211_chswitch_done(priv->vif, false);
+                ieee80211_chswitch_done(ctx->vif, false);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
@@ -3674,6 +3939,7 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
 {
         struct iwl_priv *priv = hw->priv;
         __le32 filter_or = 0, filter_nand = 0;
+        struct iwl_rxon_context *ctx;
 
 #define CHK(test, flag) do { \
         if (*total_flags & (test))              \
@@ -3693,10 +3959,11 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        priv->staging_rxon.filter_flags &= ~filter_nand;
-        priv->staging_rxon.filter_flags |= filter_or;
-
-        iwlcore_commit_rxon(priv);
+        for_each_context(priv, ctx) {
+                ctx->staging.filter_flags &= ~filter_nand;
+                ctx->staging.filter_flags |= filter_or;
+                iwlcore_commit_rxon(priv, ctx);
+        }
 
         mutex_unlock(&priv->mutex);
 
@@ -3765,6 +4032,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update);
         INIT_WORK(&priv->run_time_calib_work, iwl_bg_run_time_calib_work);
         INIT_WORK(&priv->tx_flush, iwl_bg_tx_flush);
+        INIT_WORK(&priv->bt_full_concurrency, iwl_bg_bt_full_concurrency);
+        INIT_WORK(&priv->bt_runtime_config, iwl_bg_bt_runtime_config);
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl_bg_alive_start);
 
@@ -3802,15 +4071,17 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
                 priv->cfg->ops->lib->cancel_deferred_work(priv);
 
         cancel_delayed_work_sync(&priv->init_alive_start);
-        cancel_delayed_work(&priv->scan_check);
-        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->run_time_calib_work);
         cancel_work_sync(&priv->beacon_update);
+
+        iwl_cancel_scan_deferred_work(priv);
+
+        cancel_work_sync(&priv->bt_full_concurrency);
+        cancel_work_sync(&priv->bt_runtime_config);
+
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
-        if (priv->cfg->ops->lib->recover_from_tx_stall)
-                del_timer_sync(&priv->monitor_recover);
 }
 
 static void iwl_init_hw_rates(struct iwl_priv *priv,
@@ -3865,10 +4136,22 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         /* Choose which receivers/antennas to use */
         if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                priv->cfg->ops->hcmd->set_rxon_chain(priv,
+                                        &priv->contexts[IWL_RXON_CTX_BSS]);
 
         iwl_init_scan_params(priv);
 
+        /* init bt coex */
+        if (priv->cfg->advanced_bt_coexist) {
+                priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
+                priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
+                priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
+                priv->bt_on_thresh = BT_ON_THRESHOLD_DEF;
+                priv->bt_duration = BT_DURATION_LIMIT_DEF;
+                priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
+                priv->dynamic_agg_thresh = BT_AGG_THRESHOLD_DEF;
+        }
+
         /* Set the tx_power_user_lmt to the lowest power level
          * this value will get overwritten by channel max power avg
          * from eeprom */
@@ -3923,11 +4206,60 @@ static struct ieee80211_ops iwl_hw_ops = {
         .sta_remove = iwl_mac_sta_remove,
         .channel_switch = iwl_mac_channel_switch,
         .flush = iwl_mac_flush,
+        .tx_last_beacon = iwl_mac_tx_last_beacon,
+};
+
+static void iwl_hw_detect(struct iwl_priv *priv)
+{
+        priv->hw_rev = _iwl_read32(priv, CSR_HW_REV);
+        priv->hw_wa_rev = _iwl_read32(priv, CSR_HW_REV_WA_REG);
+        pci_read_config_byte(priv->pci_dev, PCI_REVISION_ID, &priv->rev_id);
+        IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", priv->rev_id);
+}
+
+static int iwl_set_hw_params(struct iwl_priv *priv)
+{
+        priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
+        priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
+        if (priv->cfg->mod_params->amsdu_size_8K)
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
+        else
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
+
+        priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
+
+        if (priv->cfg->mod_params->disable_11n)
+                priv->cfg->sku &= ~IWL_SKU_N;
+
+        /* Device-specific setup */
+        return priv->cfg->ops->lib->set_hw_params(priv);
+}
+
+static const u8 iwlagn_bss_ac_to_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+};
+
+static const u8 iwlagn_bss_ac_to_queue[] = {
+        0, 1, 2, 3,
+};
+
+static const u8 iwlagn_pan_ac_to_fifo[] = {
+        IWL_TX_FIFO_VO_IPAN,
+        IWL_TX_FIFO_VI_IPAN,
+        IWL_TX_FIFO_BE_IPAN,
+        IWL_TX_FIFO_BK_IPAN,
+};
+
+static const u8 iwlagn_pan_ac_to_queue[] = {
+        7, 6, 5, 4,
 };
 
 static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
-        int err = 0;
+        int err = 0, i;
         struct iwl_priv *priv;
         struct ieee80211_hw *hw;
         struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
@@ -3955,6 +4287,53 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         priv = hw->priv;
         /* At this point both hw and priv are allocated. */
 
+        /*
+         * The default context is always valid,
+         * more may be discovered when firmware
+         * is loaded.
+         */
+        priv->valid_contexts = BIT(IWL_RXON_CTX_BSS);
+
+        for (i = 0; i < NUM_IWL_RXON_CTX; i++)
+                priv->contexts[i].ctxid = i;
+
+        priv->contexts[IWL_RXON_CTX_BSS].always_active = true;
+        priv->contexts[IWL_RXON_CTX_BSS].is_active = true;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_cmd = REPLY_RXON;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_timing_cmd = REPLY_RXON_TIMING;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_assoc_cmd = REPLY_RXON_ASSOC;
+        priv->contexts[IWL_RXON_CTX_BSS].qos_cmd = REPLY_QOS_PARAM;
+        priv->contexts[IWL_RXON_CTX_BSS].ap_sta_id = IWL_AP_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].wep_key_cmd = REPLY_WEPKEY;
+        priv->contexts[IWL_RXON_CTX_BSS].ac_to_fifo = iwlagn_bss_ac_to_fifo;
+        priv->contexts[IWL_RXON_CTX_BSS].ac_to_queue = iwlagn_bss_ac_to_queue;
+        priv->contexts[IWL_RXON_CTX_BSS].exclusive_interface_modes =
+                BIT(NL80211_IFTYPE_ADHOC);
+        priv->contexts[IWL_RXON_CTX_BSS].interface_modes =
+                BIT(NL80211_IFTYPE_STATION);
+        priv->contexts[IWL_RXON_CTX_BSS].ibss_devtype = RXON_DEV_TYPE_IBSS;
+        priv->contexts[IWL_RXON_CTX_BSS].station_devtype = RXON_DEV_TYPE_ESS;
+        priv->contexts[IWL_RXON_CTX_BSS].unused_devtype = RXON_DEV_TYPE_ESS;
+
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_cmd = REPLY_WIPAN_RXON;
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_timing_cmd = REPLY_WIPAN_RXON_TIMING;
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_assoc_cmd = REPLY_WIPAN_RXON_ASSOC;
+        priv->contexts[IWL_RXON_CTX_PAN].qos_cmd = REPLY_WIPAN_QOS_PARAM;
+        priv->contexts[IWL_RXON_CTX_PAN].ap_sta_id = IWL_AP_ID_PAN;
+        priv->contexts[IWL_RXON_CTX_PAN].wep_key_cmd = REPLY_WIPAN_WEPKEY;
+        priv->contexts[IWL_RXON_CTX_PAN].bcast_sta_id = IWLAGN_PAN_BCAST_ID;
+        priv->contexts[IWL_RXON_CTX_PAN].station_flags = STA_FLG_PAN_STATION;
+        priv->contexts[IWL_RXON_CTX_PAN].ac_to_fifo = iwlagn_pan_ac_to_fifo;
+        priv->contexts[IWL_RXON_CTX_PAN].ac_to_queue = iwlagn_pan_ac_to_queue;
+        priv->contexts[IWL_RXON_CTX_PAN].mcast_queue = IWL_IPAN_MCAST_QUEUE;
+        priv->contexts[IWL_RXON_CTX_PAN].interface_modes =
+                BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_AP);
+        priv->contexts[IWL_RXON_CTX_PAN].ap_devtype = RXON_DEV_TYPE_CP;
+        priv->contexts[IWL_RXON_CTX_PAN].station_devtype = RXON_DEV_TYPE_2STA;
+        priv->contexts[IWL_RXON_CTX_PAN].unused_devtype = RXON_DEV_TYPE_P2P;
+
+        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
+
         SET_IEEE80211_DEV(hw, &pdev->dev);
 
         IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
@@ -3962,12 +4341,23 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         priv->pci_dev = pdev;
         priv->inta_mask = CSR_INI_SET_MASK;
 
+        /* is antenna coupling more than 35dB ? */
+        priv->bt_ant_couple_ok =
+                (iwlagn_ant_coupling > IWL_BT_ANTENNA_COUPLING_THRESHOLD) ?
+                true : false;
+
+        /* enable/disable bt channel announcement */
+        priv->bt_ch_announce = iwlagn_bt_ch_announce;
+
         if (iwl_alloc_traffic_mem(priv))
                 IWL_ERR(priv, "Not enough memory to generate traffic log\n");
 
         /**************************
          * 2. Initializing PCI bus
          **************************/
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                                PCIE_LINK_STATE_CLKPM);
+
         if (pci_enable_device(pdev)) {
                 err = -ENODEV;
                 goto out_ieee80211_free_hw;
@@ -4492,3 +4882,11 @@ module_param_named(ucode_alternative, iwlagn_wanted_ucode_alternative, int,
                    S_IRUGO);
 MODULE_PARM_DESC(ucode_alternative,
                  "specify ucode alternative to use from ucode file");
+
+module_param_named(antenna_coupling, iwlagn_ant_coupling, int, S_IRUGO);
+MODULE_PARM_DESC(antenna_coupling,
+                 "specify antenna coupling in dB (defualt: 0 dB)");
+
+module_param_named(bt_ch_announce, iwlagn_bt_ch_announce, bool, S_IRUGO);
+MODULE_PARM_DESC(bt_ch_announce,
+                 "Enable BT channel announcement mode (default: enable)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index cc6464dc72e5..a372184ac210 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -95,6 +95,7 @@ extern struct iwl_cfg iwl1000_bg_cfg;
 
 extern struct iwl_mod_params iwlagn_mod_params;
 extern struct iwl_hcmd_ops iwlagn_hcmd;
+extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
 extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
 
 int iwl_reset_ict(struct iwl_priv *priv);
@@ -133,6 +134,8 @@ void iwlagn_rx_calib_complete(struct iwl_priv *priv,
 void iwlagn_init_alive_start(struct iwl_priv *priv);
 int iwlagn_alive_notify(struct iwl_priv *priv);
 int iwl_verify_ucode(struct iwl_priv *priv);
+void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
+void iwlagn_send_prio_tbl(struct iwl_priv *priv);
 
 /* lib */
 void iwl_check_abort_status(struct iwl_priv *priv,
@@ -216,14 +219,28 @@ void iwl_reply_statistics(struct iwl_priv *priv,
                           struct iwl_rx_mem_buffer *rxb);
 
 /* scan */
-void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
 
 /* station mgmt */
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
                                struct ieee80211_vif *vif, bool add);
 
 /* hcmd */
-int iwlagn_send_rxon_assoc(struct iwl_priv *priv);
+int iwlagn_send_rxon_assoc(struct iwl_priv *priv,
+                           struct iwl_rxon_context *ctx);
 int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant);
 
+/* bt coex */
+void iwlagn_send_advance_bt_config(struct iwl_priv *priv);
+void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
+                                  struct iwl_rx_mem_buffer *rxb);
+void iwlagn_bt_rx_handler_setup(struct iwl_priv *priv);
+void iwlagn_bt_setup_deferred_work(struct iwl_priv *priv);
+void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv);
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+const char *iwl_get_agg_tx_fail_reason(u16 status);
+#else
+static inline const char *iwl_get_agg_tx_fail_reason(u16 status) { return ""; }
+#endif
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 60725a5c1b69..27e250c8d4b5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -62,7 +62,7 @@
  *****************************************************************************/
 /*
  * Please use this file (iwl-commands.h) only for uCode API definitions.
- * Please use iwl-4965-hw.h for hardware-related definitions.
+ * Please use iwl-xxxx-hw.h for hardware-related definitions.
  * Please use iwl-dev.h for driver implementation definitions.
  */
 
@@ -173,6 +173,23 @@ enum {
         REPLY_RX_MPDU_CMD = 0xc1,
         REPLY_RX = 0xc3,
         REPLY_COMPRESSED_BA = 0xc5,
+
+        /* BT Coex */
+        REPLY_BT_COEX_PRIO_TABLE = 0xcc,
+        REPLY_BT_COEX_PROT_ENV = 0xcd,
+        REPLY_BT_COEX_PROFILE_NOTIF = 0xce,
+        REPLY_BT_COEX_SCO = 0xcf,
+
+        /* PAN commands */
+        REPLY_WIPAN_PARAMS = 0xb2,
+        REPLY_WIPAN_RXON = 0xb3,        /* use REPLY_RXON structure */
+        REPLY_WIPAN_RXON_TIMING = 0xb4, /* use REPLY_RXON_TIMING structure */
+        REPLY_WIPAN_RXON_ASSOC = 0xb6,  /* use REPLY_RXON_ASSOC structure */
+        REPLY_WIPAN_QOS_PARAM = 0xb7,   /* use REPLY_QOS_PARAM structure */
+        REPLY_WIPAN_WEPKEY = 0xb8,      /* use REPLY_WEPKEY structure */
+        REPLY_WIPAN_P2P_CHANNEL_SWITCH = 0xb9,
+        REPLY_WIPAN_NOA_NOTIFICATION = 0xbc,
+
         REPLY_MAX = 0xff
 };
 
@@ -600,6 +617,9 @@ enum {
         RXON_DEV_TYPE_ESS = 3,
         RXON_DEV_TYPE_IBSS = 4,
         RXON_DEV_TYPE_SNIFFER = 6,
+        RXON_DEV_TYPE_CP = 7,
+        RXON_DEV_TYPE_2STA = 8,
+        RXON_DEV_TYPE_P2P = 9,
 };
 
 
@@ -816,7 +836,8 @@ struct iwl_rxon_time_cmd {
         __le16 atim_window;
         __le32 beacon_init_val;
         __le16 listen_interval;
-        __le16 reserved;
+        u8 dtim_period;
+        u8 delta_cp_bss_tbtts;
 } __packed;
 
 /*
@@ -953,11 +974,13 @@ struct iwl_qosparam_cmd {
 
 /* Special, dedicated locations within device's station table */
 #define IWL_AP_ID               0
+#define IWL_AP_ID_PAN           1
 #define IWL_STA_ID              2
 #define IWL3945_BROADCAST_ID    24
 #define IWL3945_STATION_COUNT   25
 #define IWL4965_BROADCAST_ID    31
 #define IWL4965_STATION_COUNT   32
+#define IWLAGN_PAN_BCAST_ID     14
 #define IWLAGN_BROADCAST_ID     15
 #define IWLAGN_STATION_COUNT    16
 
@@ -966,6 +989,7 @@ struct iwl_qosparam_cmd {
 
 #define STA_FLG_TX_RATE_MSK             cpu_to_le32(1 << 2)
 #define STA_FLG_PWR_SAVE_MSK            cpu_to_le32(1 << 8)
+#define STA_FLG_PAN_STATION             cpu_to_le32(1 << 13)
 #define STA_FLG_RTS_MIMO_PROT_MSK       cpu_to_le32(1 << 17)
 #define STA_FLG_AGG_MPDU_8US_MSK        cpu_to_le32(1 << 18)
 #define STA_FLG_MAX_AGG_SIZE_POS        (19)
@@ -994,6 +1018,7 @@ struct iwl_qosparam_cmd {
 #define STA_KEY_FLG_KEY_SIZE_MSK     cpu_to_le16(0x1000)
 #define STA_KEY_MULTICAST_MSK        cpu_to_le16(0x4000)
 #define STA_KEY_MAX_NUM         8
+#define STA_KEY_MAX_NUM_PAN     16
 
 /* Flags indicate whether to modify vs. don't change various station params */
 #define STA_MODIFY_KEY_MASK             0x01
@@ -1056,7 +1081,8 @@ struct sta_id_modify {
  *
  * The device contains an internal table of per-station information,
  * with info on security keys, aggregation parameters, and Tx rates for
- * initial Tx attempt and any retries (4965 uses REPLY_TX_LINK_QUALITY_CMD,
+ * initial Tx attempt and any retries (agn devices uses
+ * REPLY_TX_LINK_QUALITY_CMD,
  * 3945 uses REPLY_RATE_SCALE to set up rate tables).
  *
  * REPLY_ADD_STA sets up the table entry for one station, either creating
@@ -1367,21 +1393,24 @@ struct iwl4965_rx_non_cfg_phy {
 } __packed;
 
 
-#define IWL50_RX_RES_PHY_CNT 8
-#define IWL50_RX_RES_AGC_IDX     1
-#define IWL50_RX_RES_RSSI_AB_IDX 2
-#define IWL50_RX_RES_RSSI_C_IDX  3
-#define IWL50_OFDM_AGC_MSK 0xfe00
-#define IWL50_OFDM_AGC_BIT_POS 9
-#define IWL50_OFDM_RSSI_A_MSK 0x00ff
-#define IWL50_OFDM_RSSI_A_BIT_POS 0
-#define IWL50_OFDM_RSSI_B_MSK 0xff0000
-#define IWL50_OFDM_RSSI_B_BIT_POS 16
-#define IWL50_OFDM_RSSI_C_MSK 0x00ff
-#define IWL50_OFDM_RSSI_C_BIT_POS 0
+#define IWLAGN_RX_RES_PHY_CNT 8
+#define IWLAGN_RX_RES_AGC_IDX     1
+#define IWLAGN_RX_RES_RSSI_AB_IDX 2
+#define IWLAGN_RX_RES_RSSI_C_IDX  3
+#define IWLAGN_OFDM_AGC_MSK 0xfe00
+#define IWLAGN_OFDM_AGC_BIT_POS 9
+#define IWLAGN_OFDM_RSSI_INBAND_A_BITMSK 0x00ff
+#define IWLAGN_OFDM_RSSI_ALLBAND_A_BITMSK 0xff00
+#define IWLAGN_OFDM_RSSI_A_BIT_POS 0
+#define IWLAGN_OFDM_RSSI_INBAND_B_BITMSK 0xff0000
+#define IWLAGN_OFDM_RSSI_ALLBAND_B_BITMSK 0xff000000
+#define IWLAGN_OFDM_RSSI_B_BIT_POS 16
+#define IWLAGN_OFDM_RSSI_INBAND_C_BITMSK 0x00ff
+#define IWLAGN_OFDM_RSSI_ALLBAND_C_BITMSK 0xff00
+#define IWLAGN_OFDM_RSSI_C_BIT_POS 0
 
-struct iwl5000_non_cfg_phy {
-        __le32 non_cfg_phy[IWL50_RX_RES_PHY_CNT];  /* up to 8 phy entries */
+struct iwlagn_non_cfg_phy {
+        __le32 non_cfg_phy[IWLAGN_RX_RES_PHY_CNT];  /* up to 8 phy entries */
 } __packed;
 
 
@@ -1401,7 +1430,7 @@ struct iwl_rx_phy_res {
         u8 non_cfg_phy_buf[32]; /* for various implementations of non_cfg_phy */
         __le32 rate_n_flags;    /* RATE_MCS_* */
         __le16 byte_count;      /* frame's byte-count */
-        __le16 reserved3;
+        __le16 frame_time;      /* frame's time on the air */
 } __packed;
 
 struct iwl_rx_mpdu_res_start {
@@ -1424,12 +1453,12 @@ struct iwl_rx_mpdu_res_start {
  * uCode handles all timing and protocol related to control frames
  * (RTS/CTS/ACK), based on flags in the Tx command.  uCode and Tx scheduler
  * handle reception of block-acks; uCode updates the host driver via
- * REPLY_COMPRESSED_BA (4965).
+ * REPLY_COMPRESSED_BA.
  *
  * uCode handles retrying Tx when an ACK is expected but not received.
  * This includes trying lower data rates than the one requested in the Tx
  * command, as set up by the REPLY_RATE_SCALE (for 3945) or
- * REPLY_TX_LINK_QUALITY_CMD (4965).
+ * REPLY_TX_LINK_QUALITY_CMD (agn).
  *
  * Driver sets up transmit power for various rates via REPLY_TX_PWR_TABLE_CMD.
  * This command must be executed after every RXON command, before Tx can occur.
@@ -1465,7 +1494,7 @@ struct iwl_rx_mpdu_res_start {
  * Set this for unicast frames, but not broadcast/multicast. */
 #define TX_CMD_FLG_ACK_MSK cpu_to_le32(1 << 3)
 
-/* For 4965:
+/* For agn devices:
  * 1: Use rate scale table (see REPLY_TX_LINK_QUALITY_CMD).
  *    Tx command's initial_rate_index indicates first rate to try;
  *    uCode walks through table for additional Tx attempts.
@@ -1484,7 +1513,7 @@ struct iwl_rx_mpdu_res_start {
  */
 #define TX_CMD_FLG_FULL_TXOP_PROT_MSK cpu_to_le32(1 << 7)
 
-/* Tx antenna selection field; used only for 3945, reserved (0) for 4965.
+/* Tx antenna selection field; used only for 3945, reserved (0) for agn devices.
  * Set field to "0" to allow 3945 uCode to select antenna (normal usage). */
 #define TX_CMD_FLG_ANT_SEL_MSK cpu_to_le32(0xf00)
 #define TX_CMD_FLG_ANT_A_MSK cpu_to_le32(1 << 8)
@@ -1791,13 +1820,8 @@ enum {
         TX_STATUS_FAIL_TID_DISABLE = 0x8d,
         TX_STATUS_FAIL_FIFO_FLUSHED = 0x8e,
         TX_STATUS_FAIL_INSUFFICIENT_CF_POLL = 0x8f,
-        /* uCode drop due to FW drop request */
-        TX_STATUS_FAIL_FW_DROP = 0x90,
-        /*
-         * uCode drop due to station color mismatch
-         * between tx command and station table
-         */
-        TX_STATUS_FAIL_STA_COLOR_MISMATCH_DROP = 0x91,
+        TX_STATUS_FAIL_PASSIVE_NO_RX = 0x90,
+        TX_STATUS_FAIL_NO_BEACON_ON_RADAR = 0x91,
 };
 
 #define TX_PACKET_MODE_REGULAR          0x0000
@@ -1839,6 +1863,9 @@ enum {
         AGG_TX_STATE_DELAY_TX_MSK = 0x400
 };
 
+#define AGG_TX_STATUS_MSK       0x00000fff      /* bits 0:11 */
+#define AGG_TX_TRY_MSK          0x0000f000      /* bits 12:15 */
+
 #define AGG_TX_STATE_LAST_SENT_MSK  (AGG_TX_STATE_LAST_SENT_TTL_MSK | \
                                      AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK | \
                                      AGG_TX_STATE_LAST_SENT_BT_KILL_MSK)
@@ -1867,9 +1894,10 @@ enum {
  *     frame in this new agg block failed in previous agg block(s).
  *
  *     Note that, for aggregation, ACK (block-ack) status is not delivered here;
- *     block-ack has not been received by the time the 4965 records this status.
+ *     block-ack has not been received by the time the agn device records
+ *     this status.
  *     This status relates to reasons the tx might have been blocked or aborted
- *     within the sending station (this 4965), rather than whether it was
+ *     within the sending station (this agn device), rather than whether it was
  *     received successfully by the destination station.
  */
 struct agg_tx_status {
@@ -2092,8 +2120,8 @@ struct iwl_link_qual_general_params {
 } __packed;
 
 #define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
-#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (65535)
-#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (0)
+#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
+#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (100)
 
 #define LINK_QUAL_AGG_DISABLE_START_DEF (3)
 #define LINK_QUAL_AGG_DISABLE_START_MAX (255)
@@ -2110,8 +2138,10 @@ struct iwl_link_qual_general_params {
  */
 struct iwl_link_qual_agg_params {
 
-        /* Maximum number of uSec in aggregation.
-         * Driver should set this to 4000 (4 milliseconds). */
+        /*
+         *Maximum number of uSec in aggregation.
+         * default set to 4000 (4 milliseconds) if not configured in .cfg
+         */
         __le16 agg_time_limit;
 
         /*
@@ -2135,14 +2165,16 @@ struct iwl_link_qual_agg_params {
 /*
  * REPLY_TX_LINK_QUALITY_CMD = 0x4e (command, has simple generic response)
  *
- * For 4965 only; 3945 uses REPLY_RATE_SCALE.
+ * For agn devices only; 3945 uses REPLY_RATE_SCALE.
  *
- * Each station in the 4965's internal station table has its own table of 16
+ * Each station in the agn device's internal station table has its own table
+ * of 16
  * Tx rates and modulation modes (e.g. legacy/SISO/MIMO) for retrying Tx when
  * an ACK is not received.  This command replaces the entire table for
  * one station.
  *
- * NOTE:  Station must already be in 4965's station table.  Use REPLY_ADD_STA.
+ * NOTE:  Station must already be in agn device's station table.
+ *        Use REPLY_ADD_STA.
  *
  * The rate scaling procedures described below work well.  Of course, other
  * procedures are possible, and may work better for particular environments.
@@ -2179,12 +2211,12 @@ struct iwl_link_qual_agg_params {
  *
  * ACCUMULATING HISTORY
  *
- * The rate scaling algorithm for 4965, as implemented in Linux driver, uses
- * two sets of frame Tx success history:  One for the current/active modulation
- * mode, and one for a speculative/search mode that is being attempted.  If the
- * speculative mode turns out to be more effective (i.e. actual transfer
- * rate is better), then the driver continues to use the speculative mode
- * as the new current active mode.
+ * The rate scaling algorithm for agn devices, as implemented in Linux driver,
+ * uses two sets of frame Tx success history:  One for the current/active
+ * modulation mode, and one for a speculative/search mode that is being
+ * attempted. If the speculative mode turns out to be more effective (i.e.
+ * actual transfer rate is better), then the driver continues to use the
+ * speculative mode as the new current active mode.
  *
  * Each history set contains, separately for each possible rate, data for a
  * sliding window of the 62 most recent tx attempts at that rate.  The data
@@ -2195,12 +2227,12 @@ struct iwl_link_qual_agg_params {
  * The driver uses the bit map to remove successes from the success sum, as
  * the oldest tx attempts fall out of the window.
  *
- * When the 4965 makes multiple tx attempts for a given frame, each attempt
- * might be at a different rate, and have different modulation characteristics
- * (e.g. antenna, fat channel, short guard interval), as set up in the rate
- * scaling table in the Link Quality command.  The driver must determine
- * which rate table entry was used for each tx attempt, to determine which
- * rate-specific history to update, and record only those attempts that
+ * When the agn device makes multiple tx attempts for a given frame, each
+ * attempt might be at a different rate, and have different modulation
+ * characteristics (e.g. antenna, fat channel, short guard interval), as set
+ * up in the rate scaling table in the Link Quality command.  The driver must
+ * determine which rate table entry was used for each tx attempt, to determine
+ * which rate-specific history to update, and record only those attempts that
  * match the modulation characteristics of the history set.
  *
  * When using block-ack (aggregation), all frames are transmitted at the same
@@ -2330,7 +2362,7 @@ struct iwl_link_quality_cmd {
         /*
          * Rate info; when using rate-scaling, Tx command's initial_rate_index
          * specifies 1st Tx rate attempted, via index into this table.
-         * 4965 works its way through table when retrying Tx.
+         * agn devices works its way through table when retrying Tx.
          */
         struct {
                 __le32 rate_n_flags;    /* RATE_MCS_*, IWL_RATE_* */
@@ -2363,10 +2395,26 @@ struct iwl_link_quality_cmd {
 #define BT_MAX_KILL_DEF (0x5)
 #define BT_MAX_KILL_MAX (0xFF)
 
+#define BT_DURATION_LIMIT_DEF   625
+#define BT_DURATION_LIMIT_MAX   1250
+#define BT_DURATION_LIMIT_MIN   625
+
+#define BT_ON_THRESHOLD_DEF     4
+#define BT_ON_THRESHOLD_MAX     1000
+#define BT_ON_THRESHOLD_MIN     1
+
+#define BT_FRAG_THRESHOLD_DEF   0
+#define BT_FRAG_THRESHOLD_MAX   0
+#define BT_FRAG_THRESHOLD_MIN   0
+
+#define BT_AGG_THRESHOLD_DEF    0
+#define BT_AGG_THRESHOLD_MAX    0
+#define BT_AGG_THRESHOLD_MIN    0
+
 /*
  * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)
  *
- * 3945 and 4965 support hardware handshake with Bluetooth device on
+ * 3945 and agn devices support hardware handshake with Bluetooth device on
  * same platform.  Bluetooth device alerts wireless device when it will Tx;
  * wireless device can delay or kill its own Tx to accommodate.
  */
@@ -2379,6 +2427,79 @@ struct iwl_bt_cmd {
         __le32 kill_cts_mask;
 } __packed;
 
+#define IWLAGN_BT_FLAG_CHANNEL_INHIBITION       BIT(0)
+
+#define IWLAGN_BT_FLAG_COEX_MODE_MASK           (BIT(3)|BIT(4)|BIT(5))
+#define IWLAGN_BT_FLAG_COEX_MODE_SHIFT          3
+#define IWLAGN_BT_FLAG_COEX_MODE_DISABLED       0
+#define IWLAGN_BT_FLAG_COEX_MODE_LEGACY_2W      1
+#define IWLAGN_BT_FLAG_COEX_MODE_3W             2
+#define IWLAGN_BT_FLAG_COEX_MODE_4W             3
+
+#define IWLAGN_BT_FLAG_UCODE_DEFAULT    BIT(6)
+#define IWLAGN_BT_FLAG_NOCOEX_NOTIF     BIT(7)
+
+#define IWLAGN_BT_PRIO_BOOST_MAX        0xFF
+#define IWLAGN_BT_PRIO_BOOST_MIN        0x00
+#define IWLAGN_BT_PRIO_BOOST_DEFAULT    0xF0
+
+#define IWLAGN_BT_MAX_KILL_DEFAULT      5
+
+#define IWLAGN_BT3_T7_DEFAULT           1
+
+#define IWLAGN_BT_KILL_ACK_MASK_DEFAULT cpu_to_le32(0xffffffff)
+#define IWLAGN_BT_KILL_CTS_MASK_DEFAULT cpu_to_le32(0xffffffff)
+
+#define IWLAGN_BT3_PRIO_SAMPLE_DEFAULT  2
+
+#define IWLAGN_BT3_T2_DEFAULT           0xc
+
+#define IWLAGN_BT_VALID_ENABLE_FLAGS    cpu_to_le16(BIT(0))
+#define IWLAGN_BT_VALID_BOOST           cpu_to_le16(BIT(1))
+#define IWLAGN_BT_VALID_MAX_KILL        cpu_to_le16(BIT(2))
+#define IWLAGN_BT_VALID_3W_TIMERS       cpu_to_le16(BIT(3))
+#define IWLAGN_BT_VALID_KILL_ACK_MASK   cpu_to_le16(BIT(4))
+#define IWLAGN_BT_VALID_KILL_CTS_MASK   cpu_to_le16(BIT(5))
+#define IWLAGN_BT_VALID_BT4_TIMES       cpu_to_le16(BIT(6))
+#define IWLAGN_BT_VALID_3W_LUT          cpu_to_le16(BIT(7))
+
+#define IWLAGN_BT_ALL_VALID_MSK         (IWLAGN_BT_VALID_ENABLE_FLAGS | \
+                                        IWLAGN_BT_VALID_BOOST | \
+                                        IWLAGN_BT_VALID_MAX_KILL | \
+                                        IWLAGN_BT_VALID_3W_TIMERS | \
+                                        IWLAGN_BT_VALID_KILL_ACK_MASK | \
+                                        IWLAGN_BT_VALID_KILL_CTS_MASK | \
+                                        IWLAGN_BT_VALID_BT4_TIMES | \
+                                        IWLAGN_BT_VALID_3W_LUT)
+
+struct iwlagn_bt_cmd {
+        u8 flags;
+        u8 ledtime; /* unused */
+        u8 max_kill;
+        u8 bt3_timer_t7_value;
+        __le32 kill_ack_mask;
+        __le32 kill_cts_mask;
+        u8 bt3_prio_sample_time;
+        u8 bt3_timer_t2_value;
+        __le16 bt4_reaction_time; /* unused */
+        __le32 bt3_lookup_table[12];
+        __le16 bt4_decision_time; /* unused */
+        __le16 valid;
+        u8 prio_boost;
+        /*
+         * set IWLAGN_BT_VALID_BOOST to "1" in "valid" bitmask
+         * if configure the following patterns
+         */
+        u8 tx_prio_boost;       /* SW boost of WiFi tx priority */
+        __le16 rx_prio_boost;   /* SW boost of WiFi rx priority */
+};
+
+#define IWLAGN_BT_SCO_ACTIVE    cpu_to_le32(BIT(0))
+
+struct iwlagn_bt_sco_cmd {
+        __le32 flags;
+};
+
 /******************************************************************************
  * (6)
  * Spectrum Management (802.11h) Commands, Responses, Notifications:
@@ -2567,7 +2688,7 @@ struct iwl_powertable_cmd {
 
 /*
  * PM_SLEEP_NOTIFICATION = 0x7A (notification only, not a command)
- * 3945 and 4965 identical.
+ * all devices identical.
  */
 struct iwl_sleep_notification {
         u8 pm_sleep_mode;
@@ -2578,7 +2699,7 @@ struct iwl_sleep_notification {
         __le32 bcon_timer;
 } __packed;
 
-/* Sleep states.  3945 and 4965 identical. */
+/* Sleep states.  all devices identical. */
 enum {
         IWL_PM_NO_SLEEP = 0,
         IWL_PM_SLP_MAC = 1,
@@ -2887,6 +3008,12 @@ struct iwl_scanstart_notification {
 #define  SCAN_OWNER_STATUS 0x1;
 #define  MEASURE_OWNER_STATUS 0x2;
 
+#define IWL_PROBE_STATUS_OK             0
+#define IWL_PROBE_STATUS_TX_FAILED      BIT(0)
+/* error statuses combined with TX_FAILED */
+#define IWL_PROBE_STATUS_FAIL_TTL       BIT(1)
+#define IWL_PROBE_STATUS_FAIL_BT        BIT(2)
+
 #define NUMBER_OF_STATISTICS 1  /* first __le32 is good CRC */
 /*
  * SCAN_RESULTS_NOTIFICATION = 0x83 (notification only, not a command)
@@ -2894,7 +3021,8 @@ struct iwl_scanstart_notification {
 struct iwl_scanresults_notification {
         u8 channel;
         u8 band;
-        u8 reserved[2];
+        u8 probe_status;
+        u8 num_probe_not_sent; /* not enough time to send */
         __le32 tsf_low;
         __le32 tsf_high;
         __le32 statistics[NUMBER_OF_STATISTICS];
@@ -2906,7 +3034,7 @@ struct iwl_scanresults_notification {
 struct iwl_scancomplete_notification {
         u8 scanned_channels;
         u8 status;
-        u8 reserved;
+        u8 bt_status;   /* BT On/Off status */
         u8 last_channel;
         __le32 tsf_low;
         __le32 tsf_high;
@@ -2919,6 +3047,11 @@ struct iwl_scancomplete_notification {
  *
  *****************************************************************************/
 
+enum iwl_ibss_manager {
+        IWL_NOT_IBSS_MANAGER = 0,
+        IWL_IBSS_MANAGER = 1,
+};
+
 /*
  * BEACON_NOTIFICATION = 0x90 (notification only, not a command)
  */
@@ -3260,7 +3393,7 @@ struct statistics_general_bt {
 
 /*
  * REPLY_STATISTICS_CMD = 0x9c,
- * 3945 and 4965 identical.
+ * all devices identical.
  *
  * This command triggers an immediate response containing uCode statistics.
  * The response is in the same format as STATISTICS_NOTIFICATION 0x9d, below.
@@ -3598,7 +3731,7 @@ struct iwl_enhance_sensitivity_cmd {
 /**
  * REPLY_PHY_CALIBRATION_CMD = 0xb0 (command, has simple generic response)
  *
- * This command sets the relative gains of 4965's 3 radio receiver chains.
+ * This command sets the relative gains of agn device's 3 radio receiver chains.
  *
  * After the first association, driver should accumulate signal and noise
  * statistics from the STATISTICS_NOTIFICATIONs that follow the first 20
@@ -3955,6 +4088,201 @@ struct iwl_coex_event_resp {
 
 
 /******************************************************************************
+ * Bluetooth Coexistence commands
+ *
+ *****************************************************************************/
+
+/*
+ * BT Status notification
+ * REPLY_BT_COEX_PROFILE_NOTIF = 0xce
+ */
+enum iwl_bt_coex_profile_traffic_load {
+        IWL_BT_COEX_TRAFFIC_LOAD_NONE =         0,
+        IWL_BT_COEX_TRAFFIC_LOAD_LOW =          1,
+        IWL_BT_COEX_TRAFFIC_LOAD_HIGH =         2,
+        IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS =   3,
+/*
+ * There are no more even though below is a u8, the
+ * indication from the BT device only has two bits.
+ */
+};
+
+#define BT_UART_MSG_FRAME1MSGTYPE_POS           (0)
+#define BT_UART_MSG_FRAME1MSGTYPE_MSK           \
+                (0x7 << BT_UART_MSG_FRAME1MSGTYPE_POS)
+#define BT_UART_MSG_FRAME1SSN_POS               (3)
+#define BT_UART_MSG_FRAME1SSN_MSK               \
+                (0x3 << BT_UART_MSG_FRAME1SSN_POS)
+#define BT_UART_MSG_FRAME1UPDATEREQ_POS         (5)
+#define BT_UART_MSG_FRAME1UPDATEREQ_MSK         \
+                (0x1 << BT_UART_MSG_FRAME1UPDATEREQ_POS)
+#define BT_UART_MSG_FRAME1RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME1RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME1RESERVED_POS)
+
+#define BT_UART_MSG_FRAME2OPENCONNECTIONS_POS   (0)
+#define BT_UART_MSG_FRAME2OPENCONNECTIONS_MSK   \
+                (0x3 << BT_UART_MSG_FRAME2OPENCONNECTIONS_POS)
+#define BT_UART_MSG_FRAME2TRAFFICLOAD_POS       (2)
+#define BT_UART_MSG_FRAME2TRAFFICLOAD_MSK       \
+                (0x3 << BT_UART_MSG_FRAME2TRAFFICLOAD_POS)
+#define BT_UART_MSG_FRAME2CHLSEQN_POS           (4)
+#define BT_UART_MSG_FRAME2CHLSEQN_MSK           \
+                (0x1 << BT_UART_MSG_FRAME2CHLSEQN_POS)
+#define BT_UART_MSG_FRAME2INBAND_POS            (5)
+#define BT_UART_MSG_FRAME2INBAND_MSK            \
+                (0x1 << BT_UART_MSG_FRAME2INBAND_POS)
+#define BT_UART_MSG_FRAME2RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME2RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME2RESERVED_POS)
+
+#define BT_UART_MSG_FRAME3SCOESCO_POS           (0)
+#define BT_UART_MSG_FRAME3SCOESCO_MSK           \
+                (0x1 << BT_UART_MSG_FRAME3SCOESCO_POS)
+#define BT_UART_MSG_FRAME3SNIFF_POS             (1)
+#define BT_UART_MSG_FRAME3SNIFF_MSK             \
+                (0x1 << BT_UART_MSG_FRAME3SNIFF_POS)
+#define BT_UART_MSG_FRAME3A2DP_POS              (2)
+#define BT_UART_MSG_FRAME3A2DP_MSK              \
+                (0x1 << BT_UART_MSG_FRAME3A2DP_POS)
+#define BT_UART_MSG_FRAME3ACL_POS               (3)
+#define BT_UART_MSG_FRAME3ACL_MSK               \
+                (0x1 << BT_UART_MSG_FRAME3ACL_POS)
+#define BT_UART_MSG_FRAME3MASTER_POS            (4)
+#define BT_UART_MSG_FRAME3MASTER_MSK            \
+                (0x1 << BT_UART_MSG_FRAME3MASTER_POS)
+#define BT_UART_MSG_FRAME3OBEX_POS              (5)
+#define BT_UART_MSG_FRAME3OBEX_MSK              \
+                (0x1 << BT_UART_MSG_FRAME3OBEX_POS)
+#define BT_UART_MSG_FRAME3RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME3RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME3RESERVED_POS)
+
+#define BT_UART_MSG_FRAME4IDLEDURATION_POS      (0)
+#define BT_UART_MSG_FRAME4IDLEDURATION_MSK      \
+                (0x3F << BT_UART_MSG_FRAME4IDLEDURATION_POS)
+#define BT_UART_MSG_FRAME4RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME4RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME4RESERVED_POS)
+
+#define BT_UART_MSG_FRAME5TXACTIVITY_POS        (0)
+#define BT_UART_MSG_FRAME5TXACTIVITY_MSK        \
+                (0x3 << BT_UART_MSG_FRAME5TXACTIVITY_POS)
+#define BT_UART_MSG_FRAME5RXACTIVITY_POS        (2)
+#define BT_UART_MSG_FRAME5RXACTIVITY_MSK        \
+                (0x3 << BT_UART_MSG_FRAME5RXACTIVITY_POS)
+#define BT_UART_MSG_FRAME5ESCORETRANSMIT_POS    (4)
+#define BT_UART_MSG_FRAME5ESCORETRANSMIT_MSK    \
+                (0x3 << BT_UART_MSG_FRAME5ESCORETRANSMIT_POS)
+#define BT_UART_MSG_FRAME5RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME5RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME5RESERVED_POS)
+
+#define BT_UART_MSG_FRAME6SNIFFINTERVAL_POS     (0)
+#define BT_UART_MSG_FRAME6SNIFFINTERVAL_MSK     \
+                (0x1F << BT_UART_MSG_FRAME6SNIFFINTERVAL_POS)
+#define BT_UART_MSG_FRAME6DISCOVERABLE_POS      (5)
+#define BT_UART_MSG_FRAME6DISCOVERABLE_MSK      \
+                (0x1 << BT_UART_MSG_FRAME6DISCOVERABLE_POS)
+#define BT_UART_MSG_FRAME6RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME6RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME6RESERVED_POS)
+
+#define BT_UART_MSG_FRAME7SNIFFACTIVITY_POS     (0)
+#define BT_UART_MSG_FRAME7SNIFFACTIVITY_MSK     \
+                (0x7 << BT_UART_MSG_FRAME7SNIFFACTIVITY_POS)
+#define BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_POS (3)
+#define BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_MSK \
+                (0x3 << BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_POS)
+#define BT_UART_MSG_FRAME7CONNECTABLE_POS       (5)
+#define BT_UART_MSG_FRAME7CONNECTABLE_MSK       \
+                (0x1 << BT_UART_MSG_FRAME7CONNECTABLE_POS)
+#define BT_UART_MSG_FRAME7RESERVED_POS          (6)
+#define BT_UART_MSG_FRAME7RESERVED_MSK          \
+                (0x3 << BT_UART_MSG_FRAME7RESERVED_POS)
+
+
+struct iwl_bt_uart_msg {
+        u8 header;
+        u8 frame1;
+        u8 frame2;
+        u8 frame3;
+        u8 frame4;
+        u8 frame5;
+        u8 frame6;
+        u8 frame7;
+} __attribute__((packed));
+
+struct iwl_bt_coex_profile_notif {
+        struct iwl_bt_uart_msg last_bt_uart_msg;
+        u8 bt_status; /* 0 - off, 1 - on */
+        u8 bt_traffic_load; /* 0 .. 3? */
+        u8 bt_ci_compliance; /* 0 - not complied, 1 - complied */
+        u8 reserved;
+} __attribute__((packed));
+
+#define IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS 0
+#define IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_MSK 0x1
+#define IWL_BT_COEX_PRIO_TBL_PRIO_POS           1
+#define IWL_BT_COEX_PRIO_TBL_PRIO_MASK          0x0e
+#define IWL_BT_COEX_PRIO_TBL_RESERVED_POS       4
+#define IWL_BT_COEX_PRIO_TBL_RESERVED_MASK      0xf0
+#define IWL_BT_COEX_PRIO_TBL_PRIO_SHIFT         1
+
+/*
+ * BT Coexistence Priority table
+ * REPLY_BT_COEX_PRIO_TABLE = 0xcc
+ */
+enum bt_coex_prio_table_events {
+        BT_COEX_PRIO_TBL_EVT_INIT_CALIB1 = 0,
+        BT_COEX_PRIO_TBL_EVT_INIT_CALIB2 = 1,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW1 = 2,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_LOW2 = 3, /* DC calib */
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH1 = 4,
+        BT_COEX_PRIO_TBL_EVT_PERIODIC_CALIB_HIGH2 = 5,
+        BT_COEX_PRIO_TBL_EVT_DTIM = 6,
+        BT_COEX_PRIO_TBL_EVT_SCAN52 = 7,
+        BT_COEX_PRIO_TBL_EVT_SCAN24 = 8,
+        BT_COEX_PRIO_TBL_EVT_RESERVED0 = 9,
+        BT_COEX_PRIO_TBL_EVT_RESERVED1 = 10,
+        BT_COEX_PRIO_TBL_EVT_RESERVED2 = 11,
+        BT_COEX_PRIO_TBL_EVT_RESERVED3 = 12,
+        BT_COEX_PRIO_TBL_EVT_RESERVED4 = 13,
+        BT_COEX_PRIO_TBL_EVT_RESERVED5 = 14,
+        BT_COEX_PRIO_TBL_EVT_RESERVED6 = 15,
+        /* BT_COEX_PRIO_TBL_EVT_MAX should always be last */
+        BT_COEX_PRIO_TBL_EVT_MAX,
+};
+
+enum bt_coex_prio_table_priorities {
+        BT_COEX_PRIO_TBL_DISABLED = 0,
+        BT_COEX_PRIO_TBL_PRIO_LOW = 1,
+        BT_COEX_PRIO_TBL_PRIO_HIGH = 2,
+        BT_COEX_PRIO_TBL_PRIO_BYPASS = 3,
+        BT_COEX_PRIO_TBL_PRIO_COEX_OFF = 4,
+        BT_COEX_PRIO_TBL_PRIO_COEX_ON = 5,
+        BT_COEX_PRIO_TBL_PRIO_RSRVD1 = 6,
+        BT_COEX_PRIO_TBL_PRIO_RSRVD2 = 7,
+        BT_COEX_PRIO_TBL_MAX,
+};
+
+struct iwl_bt_coex_prio_table_cmd {
+        u8 prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX];
+} __attribute__((packed));
+
+#define IWL_BT_COEX_ENV_CLOSE   0
+#define IWL_BT_COEX_ENV_OPEN    1
+/*
+ * BT Protection Envelope
+ * REPLY_BT_COEX_PROT_ENV = 0xcd
+ */
+struct iwl_bt_coex_prot_env_cmd {
+        u8 action; /* 0 = closed, 1 = open */
+        u8 type; /* 0 .. 15 */
+        u8 reserved[2];
+} __attribute__((packed));
+
+/******************************************************************************
  * (13)
  * Union of all expected notifications/responses:
  *
@@ -3993,6 +4321,7 @@ struct iwl_rx_packet {
                 struct iwl_missed_beacon_notif missed_beacon;
                 struct iwl_coex_medium_notification coex_medium_notif;
                 struct iwl_coex_event_resp coex_event;
+                struct iwl_bt_coex_profile_notif bt_coex_profile_notif;
                 __le32 status;
                 u8 raw[0];
         } u;
@@ -4000,4 +4329,94 @@ struct iwl_rx_packet {
 
 int iwl_agn_check_rxon_cmd(struct iwl_priv *priv);
 
+/*
+ * REPLY_WIPAN_PARAMS = 0xb2 (Commands and Notification)
+ */
+
+/**
+ * struct iwl_wipan_slot
+ * @width: Time in TU
+ * @type:
+ *   0 - BSS
+ *   1 - PAN
+ */
+struct iwl_wipan_slot {
+        __le16 width;
+        u8 type;
+        u8 reserved;
+} __packed;
+
+#define IWL_WIPAN_PARAMS_FLG_LEAVE_CHANNEL_CTS          BIT(1)  /* reserved */
+#define IWL_WIPAN_PARAMS_FLG_LEAVE_CHANNEL_QUIET        BIT(2)  /* reserved */
+#define IWL_WIPAN_PARAMS_FLG_SLOTTED_MODE               BIT(3)  /* reserved */
+#define IWL_WIPAN_PARAMS_FLG_FILTER_BEACON_NOTIF        BIT(4)
+#define IWL_WIPAN_PARAMS_FLG_FULL_SLOTTED_MODE          BIT(5)
+
+/**
+ * struct iwl_wipan_params_cmd
+ * @flags:
+ *   bit0: reserved
+ *   bit1: CP leave channel with CTS
+ *   bit2: CP leave channel qith Quiet
+ *   bit3: slotted mode
+ *     1 - work in slotted mode
+ *     0 - work in non slotted mode
+ *   bit4: filter beacon notification
+ *   bit5: full tx slotted mode. if this flag is set,
+ *         uCode will perform leaving channel methods in context switch
+ *         also when working in same channel mode
+ * @num_slots: 1 - 10
+ */
+struct iwl_wipan_params_cmd {
+        __le16 flags;
+        u8 reserved;
+        u8 num_slots;
+        struct iwl_wipan_slot slots[10];
+} __packed;
+
+/*
+ * REPLY_WIPAN_P2P_CHANNEL_SWITCH = 0xb9
+ *
+ * TODO: Figure out what this is used for,
+ *       it can only switch between 2.4 GHz
+ *       channels!!
+ */
+
+struct iwl_wipan_p2p_channel_switch_cmd {
+        __le16 channel;
+        __le16 reserved;
+};
+
+/*
+ * REPLY_WIPAN_NOA_NOTIFICATION = 0xbc
+ *
+ * This is used by the device to notify us of the
+ * NoA schedule it determined so we can forward it
+ * to userspace for inclusion in probe responses.
+ *
+ * In beacons, the NoA schedule is simply appended
+ * to the frame we give the device.
+ */
+
+struct iwl_wipan_noa_descriptor {
+        u8 count;
+        __le32 duration;
+        __le32 interval;
+        __le32 starttime;
+} __packed;
+
+struct iwl_wipan_noa_attribute {
+        u8 id;
+        __le16 length;
+        u8 index;
+        u8 ct_window;
+        struct iwl_wipan_noa_descriptor descr0, descr1;
+        u8 reserved;
+} __packed;
+
+struct iwl_wipan_noa_notification {
+        u32 noa_active;
+        struct iwl_wipan_noa_attribute noa_attribute;
+} __packed;
+
 #endif                          /* __iwl_commands_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index e23c4060a0f0..5c568933ce48 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -64,7 +64,8 @@ MODULE_LICENSE("GPL");
  *
  * default: bt_coex_active = true (BT_COEX_ENABLE)
  */
-static bool bt_coex_active = true;
+bool bt_coex_active = true;
+EXPORT_SYMBOL_GPL(bt_coex_active);
 module_param(bt_coex_active, bool, S_IRUGO);
 MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist");
 
@@ -146,6 +147,10 @@ u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
         int i;
         u8 ind = ant;
 
+        if (priv->band == IEEE80211_BAND_2GHZ &&
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
+                return 0;
+
         for (i = 0; i < RATE_ANT_NUM - 1; i++) {
                 ind = (ind + 1) < RATE_ANT_NUM ?  ind + 1 : 0;
                 if (valid & BIT(ind))
@@ -183,38 +188,33 @@ out:
 }
 EXPORT_SYMBOL(iwl_alloc_all);
 
-void iwl_hw_detect(struct iwl_priv *priv)
-{
-        priv->hw_rev = _iwl_read32(priv, CSR_HW_REV);
-        priv->hw_wa_rev = _iwl_read32(priv, CSR_HW_REV_WA_REG);
-        pci_read_config_byte(priv->pci_dev, PCI_REVISION_ID, &priv->rev_id);
-}
-EXPORT_SYMBOL(iwl_hw_detect);
-
 /*
  * QoS  support
 */
-static void iwl_update_qos(struct iwl_priv *priv)
+static void iwl_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        priv->qos_data.def_qos_parm.qos_flags = 0;
+        if (!ctx->is_active)
+                return;
+
+        ctx->qos_data.def_qos_parm.qos_flags = 0;
 
-        if (priv->qos_data.qos_active)
-                priv->qos_data.def_qos_parm.qos_flags |=
+        if (ctx->qos_data.qos_active)
+                ctx->qos_data.def_qos_parm.qos_flags |=
                         QOS_PARAM_FLG_UPDATE_EDCA_MSK;
 
-        if (priv->current_ht_config.is_ht)
-                priv->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
+        if (ctx->ht.enabled)
+                ctx->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
 
         IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
-                      priv->qos_data.qos_active,
-                      priv->qos_data.def_qos_parm.qos_flags);
+                      ctx->qos_data.qos_active,
+                      ctx->qos_data.def_qos_parm.qos_flags);
 
-        iwl_send_cmd_pdu_async(priv, REPLY_QOS_PARAM,
+        iwl_send_cmd_pdu_async(priv, ctx->qos_cmd,
                                sizeof(struct iwl_qosparam_cmd),
-                               &priv->qos_data.def_qos_parm, NULL);
+                               &ctx->qos_data.def_qos_parm, NULL);
 }
 
 #define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
@@ -247,7 +247,11 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
                 ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
 
         ht_info->ampdu_factor = CFG_HT_RX_AMPDU_FACTOR_DEF;
+        if (priv->cfg->ampdu_factor)
+                ht_info->ampdu_factor = priv->cfg->ampdu_factor;
         ht_info->ampdu_density = CFG_HT_MPDU_DENSITY_DEF;
+        if (priv->cfg->ampdu_density)
+                ht_info->ampdu_density = priv->cfg->ampdu_density;
 
         ht_info->mcs.rx_mask[0] = 0xFF;
         if (rx_chains_num >= 2)
@@ -440,15 +444,15 @@ static bool is_single_rx_stream(struct iwl_priv *priv)
                priv->current_ht_config.single_chain_sufficient;
 }
 
-static u8 iwl_is_channel_extension(struct iwl_priv *priv,
-                                   enum ieee80211_band band,
-                                   u16 channel, u8 extension_chan_offset)
+static bool iwl_is_channel_extension(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     u16 channel, u8 extension_chan_offset)
 {
         const struct iwl_channel_info *ch_info;
 
         ch_info = iwl_get_channel_info(priv, band, channel);
         if (!is_channel_valid(ch_info))
-                return 0;
+                return false;
 
         if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
                 return !(ch_info->ht40_extension_channel &
@@ -457,38 +461,59 @@ static u8 iwl_is_channel_extension(struct iwl_priv *priv,
                 return !(ch_info->ht40_extension_channel &
                                         IEEE80211_CHAN_NO_HT40MINUS);
 
-        return 0;
+        return false;
 }
 
-u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
-                         struct ieee80211_sta_ht_cap *sta_ht_inf)
+bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_sta_ht_cap *ht_cap)
 {
-        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
-
-        if (!ht_conf->is_ht || !ht_conf->is_40mhz)
-                return 0;
+        if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
+                return false;
 
-        /* We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
+        /*
+         * We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
          * the bit will not set if it is pure 40MHz case
          */
-        if (sta_ht_inf) {
-                if (!sta_ht_inf->ht_supported)
-                        return 0;
-        }
+        if (ht_cap && !ht_cap->ht_supported)
+                return false;
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         if (priv->disable_ht40)
-                return 0;
+                return false;
 #endif
+
         return iwl_is_channel_extension(priv, priv->band,
-                        le16_to_cpu(priv->staging_rxon.channel),
-                        ht_conf->extension_chan_offset);
+                        le16_to_cpu(ctx->staging.channel),
+                        ctx->ht.extension_chan_offset);
 }
 EXPORT_SYMBOL(iwl_is_ht40_tx_allowed);
 
 static u16 iwl_adjust_beacon_interval(u16 beacon_val, u16 max_beacon_val)
 {
-        u16 new_val = 0;
-        u16 beacon_factor = 0;
+        u16 new_val;
+        u16 beacon_factor;
+
+        /*
+         * If mac80211 hasn't given us a beacon interval, program
+         * the default into the device (not checking this here
+         * would cause the adjustment below to return the maximum
+         * value, which may break PAN.)
+         */
+        if (!beacon_val)
+                return DEFAULT_BEACON_INTERVAL;
+
+        /*
+         * If the beacon interval we obtained from the peer
+         * is too large, we'll have to wake up more often
+         * (and in IBSS case, we'll beacon too much)
+         *
+         * For example, if max_beacon_val is 4096, and the
+         * requested beacon interval is 7000, we'll have to
+         * use 3500 to be able to wake up on the beacons.
+         *
+         * This could badly influence beacon detection stats.
+         */
 
         beacon_factor = (beacon_val + max_beacon_val) / max_beacon_val;
         new_val = beacon_val / beacon_factor;
@@ -499,51 +524,76 @@ static u16 iwl_adjust_beacon_interval(u16 beacon_val, u16 max_beacon_val)
         return new_val;
 }
 
-void iwl_setup_rxon_timing(struct iwl_priv *priv, struct ieee80211_vif *vif)
+int iwl_send_rxon_timing(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         u64 tsf;
         s32 interval_tm, rem;
-        unsigned long flags;
         struct ieee80211_conf *conf = NULL;
         u16 beacon_int;
+        struct ieee80211_vif *vif = ctx->vif;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->rxon_timing.timestamp = cpu_to_le64(priv->timestamp);
-        priv->rxon_timing.listen_interval = cpu_to_le16(conf->listen_interval);
+        lockdep_assert_held(&priv->mutex);
 
-        beacon_int = vif->bss_conf.beacon_int;
+        memset(&ctx->timing, 0, sizeof(struct iwl_rxon_time_cmd));
 
-        if (vif->type == NL80211_IFTYPE_ADHOC) {
-                /* TODO: we need to get atim_window from upper stack
-                 * for now we set to 0 */
-                priv->rxon_timing.atim_window = 0;
-        } else {
-                priv->rxon_timing.atim_window = 0;
-        }
+        ctx->timing.timestamp = cpu_to_le64(priv->timestamp);
+        ctx->timing.listen_interval = cpu_to_le16(conf->listen_interval);
 
-        beacon_int = iwl_adjust_beacon_interval(beacon_int,
+        beacon_int = vif ? vif->bss_conf.beacon_int : 0;
+
+        /*
+         * TODO: For IBSS we need to get atim_window from mac80211,
+         *       for now just always use 0
+         */
+        ctx->timing.atim_window = 0;
+
+        if (ctx->ctxid == IWL_RXON_CTX_PAN &&
+            (!ctx->vif || ctx->vif->type != NL80211_IFTYPE_STATION) &&
+            iwl_is_associated(priv, IWL_RXON_CTX_BSS) &&
+            priv->contexts[IWL_RXON_CTX_BSS].vif &&
+            priv->contexts[IWL_RXON_CTX_BSS].vif->bss_conf.beacon_int) {
+                ctx->timing.beacon_interval =
+                        priv->contexts[IWL_RXON_CTX_BSS].timing.beacon_interval;
+                beacon_int = le16_to_cpu(ctx->timing.beacon_interval);
+        } else if (ctx->ctxid == IWL_RXON_CTX_BSS &&
+                   iwl_is_associated(priv, IWL_RXON_CTX_PAN) &&
+                   priv->contexts[IWL_RXON_CTX_PAN].vif &&
+                   priv->contexts[IWL_RXON_CTX_PAN].vif->bss_conf.beacon_int &&
+                   (!iwl_is_associated_ctx(ctx) || !ctx->vif ||
+                    !ctx->vif->bss_conf.beacon_int)) {
+                ctx->timing.beacon_interval =
+                        priv->contexts[IWL_RXON_CTX_PAN].timing.beacon_interval;
+                beacon_int = le16_to_cpu(ctx->timing.beacon_interval);
+        } else {
+                beacon_int = iwl_adjust_beacon_interval(beacon_int,
                                 priv->hw_params.max_beacon_itrvl * TIME_UNIT);
-        priv->rxon_timing.beacon_interval = cpu_to_le16(beacon_int);
+                ctx->timing.beacon_interval = cpu_to_le16(beacon_int);
+        }
 
         tsf = priv->timestamp; /* tsf is modifed by do_div: copy it */
         interval_tm = beacon_int * TIME_UNIT;
         rem = do_div(tsf, interval_tm);
-        priv->rxon_timing.beacon_init_val = cpu_to_le32(interval_tm - rem);
+        ctx->timing.beacon_init_val = cpu_to_le32(interval_tm - rem);
+
+        ctx->timing.dtim_period = vif ? (vif->bss_conf.dtim_period ?: 1) : 1;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
         IWL_DEBUG_ASSOC(priv,
                         "beacon interval %d beacon timer %d beacon tim %d\n",
-                        le16_to_cpu(priv->rxon_timing.beacon_interval),
-                        le32_to_cpu(priv->rxon_timing.beacon_init_val),
-                        le16_to_cpu(priv->rxon_timing.atim_window));
+                        le16_to_cpu(ctx->timing.beacon_interval),
+                        le32_to_cpu(ctx->timing.beacon_init_val),
+                        le16_to_cpu(ctx->timing.atim_window));
+
+        return iwl_send_cmd_pdu(priv, ctx->rxon_timing_cmd,
+                                sizeof(ctx->timing), &ctx->timing);
 }
-EXPORT_SYMBOL(iwl_setup_rxon_timing);
+EXPORT_SYMBOL(iwl_send_rxon_timing);
 
-void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, int hw_decrypt)
+void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           int hw_decrypt)
 {
-        struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
 
         if (hw_decrypt)
                 rxon->filter_flags &= ~RXON_FILTER_DIS_DECRYPT_MSK;
@@ -560,11 +610,11 @@ EXPORT_SYMBOL(iwl_set_rxon_hwcrypto);
  * be #ifdef'd out once the driver is stable and folks aren't actively
  * making changes
  */
-int iwl_check_rxon_cmd(struct iwl_priv *priv)
+int iwl_check_rxon_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         int error = 0;
         int counter = 1;
-        struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
 
         if (rxon->flags & RXON_FLG_BAND_24G_MSK) {
                 error |= le32_to_cpu(rxon->flags &
@@ -636,66 +686,83 @@ EXPORT_SYMBOL(iwl_check_rxon_cmd);
  * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
  * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
  */
-int iwl_full_rxon_required(struct iwl_priv *priv)
+int iwl_full_rxon_required(struct iwl_priv *priv,
+                           struct iwl_rxon_context *ctx)
 {
+        const struct iwl_rxon_cmd *staging = &ctx->staging;
+        const struct iwl_rxon_cmd *active = &ctx->active;
+
+#define CHK(cond)                                                       \
+        if ((cond)) {                                                   \
+                IWL_DEBUG_INFO(priv, "need full RXON - " #cond "\n");   \
+                return 1;                                               \
+        }
+
+#define CHK_NEQ(c1, c2)                                         \
+        if ((c1) != (c2)) {                                     \
+                IWL_DEBUG_INFO(priv, "need full RXON - "        \
+                               #c1 " != " #c2 " - %d != %d\n",  \
+                               (c1), (c2));                     \
+                return 1;                                       \
+        }
 
         /* These items are only settable from the full RXON command */
-        if (!(iwl_is_associated(priv)) ||
-            compare_ether_addr(priv->staging_rxon.bssid_addr,
-                               priv->active_rxon.bssid_addr) ||
-            compare_ether_addr(priv->staging_rxon.node_addr,
-                               priv->active_rxon.node_addr) ||
-            compare_ether_addr(priv->staging_rxon.wlap_bssid_addr,
-                               priv->active_rxon.wlap_bssid_addr) ||
-            (priv->staging_rxon.dev_type != priv->active_rxon.dev_type) ||
-            (priv->staging_rxon.channel != priv->active_rxon.channel) ||
-            (priv->staging_rxon.air_propagation !=
-             priv->active_rxon.air_propagation) ||
-            (priv->staging_rxon.ofdm_ht_single_stream_basic_rates !=
-             priv->active_rxon.ofdm_ht_single_stream_basic_rates) ||
-            (priv->staging_rxon.ofdm_ht_dual_stream_basic_rates !=
-             priv->active_rxon.ofdm_ht_dual_stream_basic_rates) ||
-            (priv->staging_rxon.ofdm_ht_triple_stream_basic_rates !=
-             priv->active_rxon.ofdm_ht_triple_stream_basic_rates) ||
-            (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
-                return 1;
+        CHK(!iwl_is_associated_ctx(ctx));
+        CHK(compare_ether_addr(staging->bssid_addr, active->bssid_addr));
+        CHK(compare_ether_addr(staging->node_addr, active->node_addr));
+        CHK(compare_ether_addr(staging->wlap_bssid_addr,
+                                active->wlap_bssid_addr));
+        CHK_NEQ(staging->dev_type, active->dev_type);
+        CHK_NEQ(staging->channel, active->channel);
+        CHK_NEQ(staging->air_propagation, active->air_propagation);
+        CHK_NEQ(staging->ofdm_ht_single_stream_basic_rates,
+                active->ofdm_ht_single_stream_basic_rates);
+        CHK_NEQ(staging->ofdm_ht_dual_stream_basic_rates,
+                active->ofdm_ht_dual_stream_basic_rates);
+        CHK_NEQ(staging->ofdm_ht_triple_stream_basic_rates,
+                active->ofdm_ht_triple_stream_basic_rates);
+        CHK_NEQ(staging->assoc_id, active->assoc_id);
 
         /* flags, filter_flags, ofdm_basic_rates, and cck_basic_rates can
          * be updated with the RXON_ASSOC command -- however only some
          * flag transitions are allowed using RXON_ASSOC */
 
         /* Check if we are not switching bands */
-        if ((priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) !=
-            (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK))
-                return 1;
+        CHK_NEQ(staging->flags & RXON_FLG_BAND_24G_MSK,
+                active->flags & RXON_FLG_BAND_24G_MSK);
 
         /* Check if we are switching association toggle */
-        if ((priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK) !=
-                (priv->active_rxon.filter_flags & RXON_FILTER_ASSOC_MSK))
-                return 1;
+        CHK_NEQ(staging->filter_flags & RXON_FILTER_ASSOC_MSK,
+                active->filter_flags & RXON_FILTER_ASSOC_MSK);
+
+#undef CHK
+#undef CHK_NEQ
 
         return 0;
 }
 EXPORT_SYMBOL(iwl_full_rxon_required);
 
-u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv)
+u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx)
 {
         /*
          * Assign the lowest rate -- should really get this from
          * the beacon skb from mac80211.
          */
-        if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)
+        if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK)
                 return IWL_RATE_1M_PLCP;
         else
                 return IWL_RATE_6M_PLCP;
 }
 EXPORT_SYMBOL(iwl_rate_get_lowest_plcp);
 
-void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
+static void _iwl_set_rxon_ht(struct iwl_priv *priv,
+                             struct iwl_ht_config *ht_conf,
+                             struct iwl_rxon_context *ctx)
 {
-        struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
 
-        if (!ht_conf->is_ht) {
+        if (!ctx->ht.enabled) {
                 rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
                         RXON_FLG_HT40_PROT_MSK |
@@ -703,22 +770,22 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
                 return;
         }
 
-        /* FIXME: if the definition of ht_protection changed, the "translation"
+        /* FIXME: if the definition of ht.protection changed, the "translation"
          * will be needed for rxon->flags
          */
-        rxon->flags |= cpu_to_le32(ht_conf->ht_protection << RXON_FLG_HT_OPERATING_MODE_POS);
+        rxon->flags |= cpu_to_le32(ctx->ht.protection << RXON_FLG_HT_OPERATING_MODE_POS);
 
         /* Set up channel bandwidth:
          * 20 MHz only, 20/40 mixed or pure 40 if ht40 ok */
         /* clear the HT channel mode before set the mode */
         rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                          RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
-        if (iwl_is_ht40_tx_allowed(priv, NULL)) {
+        if (iwl_is_ht40_tx_allowed(priv, ctx, NULL)) {
                 /* pure ht40 */
-                if (ht_conf->ht_protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
+                if (ctx->ht.protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
                         rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
                         /* Note: control channel is opposite of extension channel */
-                        switch (ht_conf->extension_chan_offset) {
+                        switch (ctx->ht.extension_chan_offset) {
                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                                 rxon->flags &= ~RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
                                 break;
@@ -728,7 +795,7 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
                         }
                 } else {
                         /* Note: control channel is opposite of extension channel */
-                        switch (ht_conf->extension_chan_offset) {
+                        switch (ctx->ht.extension_chan_offset) {
                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                                 rxon->flags &= ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
                                 rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
@@ -749,12 +816,20 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
         }
 
         if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
 
         IWL_DEBUG_ASSOC(priv, "rxon flags 0x%X operation mode :0x%X "
                         "extension channel offset 0x%x\n",
-                        le32_to_cpu(rxon->flags), ht_conf->ht_protection,
-                        ht_conf->extension_chan_offset);
+                        le32_to_cpu(rxon->flags), ctx->ht.protection,
+                        ctx->ht.extension_chan_offset);
+}
+
+void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
+{
+        struct iwl_rxon_context *ctx;
+
+        for_each_context(priv, ctx)
+                _iwl_set_rxon_ht(priv, ht_conf, ctx);
 }
 EXPORT_SYMBOL(iwl_set_rxon_ht);
 
@@ -775,6 +850,14 @@ EXPORT_SYMBOL(iwl_set_rxon_ht);
  */
 static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 {
+        if (priv->cfg->advanced_bt_coexist && (priv->bt_full_concurrent ||
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+                /*
+                 * only use chain 'A' in bt high traffic load or
+                 * full concurrency mode
+                 */
+                return IWL_NUM_RX_CHAINS_SINGLE;
+        }
         /* # of Rx chains to use when expecting MIMO. */
         if (is_single_rx_stream(priv))
                 return IWL_NUM_RX_CHAINS_SINGLE;
@@ -819,7 +902,7 @@ static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
  * Selects how many and which Rx receivers/antennas/chains to use.
  * This should not be used for scan command ... it puts data in wrong place.
  */
-void iwl_set_rxon_chain(struct iwl_priv *priv)
+void iwl_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         bool is_single = is_single_rx_stream(priv);
         bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
@@ -831,11 +914,20 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
          * Before first association, we assume all antennas are connected.
          * Just after first association, iwl_chain_noise_calibration()
          *    checks which antennas actually *are* connected. */
-         if (priv->chain_noise_data.active_chains)
+        if (priv->chain_noise_data.active_chains)
                 active_chains = priv->chain_noise_data.active_chains;
         else
                 active_chains = priv->hw_params.valid_rx_ant;
 
+        if (priv->cfg->advanced_bt_coexist && (priv->bt_full_concurrent ||
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+                /*
+                 * only use chain 'A' in bt high traffic load or
+                 * full concurrency mode
+                 */
+                active_chains = first_antenna(active_chains);
+        }
+
         rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
 
         /* How many receivers should we use? */
@@ -856,15 +948,15 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
         rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
         rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
 
-        priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
+        ctx->staging.rx_chain = cpu_to_le16(rx_chain);
 
         if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
-                priv->staging_rxon.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
+                ctx->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
         else
-                priv->staging_rxon.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
+                ctx->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
 
         IWL_DEBUG_ASSOC(priv, "rx_chain=0x%X active=%d idle=%d\n",
-                        priv->staging_rxon.rx_chain,
+                        ctx->staging.rx_chain,
                         active_rx_cnt, idle_rx_cnt);
 
         WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
@@ -872,39 +964,41 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
 
-/* Return valid channel */
+/* Return valid, unused, channel for a passive scan to reset the RF */
 u8 iwl_get_single_channel_number(struct iwl_priv *priv,
-                                  enum ieee80211_band band)
+                                 enum ieee80211_band band)
 {
         const struct iwl_channel_info *ch_info;
         int i;
         u8 channel = 0;
+        u8 min, max;
+        struct iwl_rxon_context *ctx;
 
-        /* only scan single channel, good enough to reset the RF */
-        /* pick the first valid not in-use channel */
         if (band == IEEE80211_BAND_5GHZ) {
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                channel = priv->channel_info[i].channel;
-                                ch_info = iwl_get_channel_info(priv,
-                                        band, channel);
-                                if (is_channel_valid(ch_info))
-                                        break;
-                        }
-                }
+                min = 14;
+                max = priv->channel_count;
         } else {
-                for (i = 0; i < 14; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                        channel =
-                                                priv->channel_info[i].channel;
-                                        ch_info = iwl_get_channel_info(priv,
-                                                band, channel);
-                                        if (is_channel_valid(ch_info))
-                                                break;
-                        }
+                min = 0;
+                max = 14;
+        }
+
+        for (i = min; i < max; i++) {
+                bool busy = false;
+
+                for_each_context(priv, ctx) {
+                        busy = priv->channel_info[i].channel ==
+                                le16_to_cpu(ctx->staging.channel);
+                        if (busy)
+                                break;
                 }
+
+                if (busy)
+                        continue;
+
+                channel = priv->channel_info[i].channel;
+                ch_info = iwl_get_channel_info(priv, band, channel);
+                if (is_channel_valid(ch_info))
+                        break;
         }
 
         return channel;
@@ -912,35 +1006,27 @@ u8 iwl_get_single_channel_number(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_get_single_channel_number);
 
 /**
- * iwl_set_rxon_channel - Set the phymode and channel values in staging RXON
- * @phymode: MODE_IEEE80211A sets to 5.2GHz; all else set to 2.4GHz
- * @channel: Any channel valid for the requested phymode
+ * iwl_set_rxon_channel - Set the band and channel values in staging RXON
+ * @ch: requested channel as a pointer to struct ieee80211_channel
 
- * In addition to setting the staging RXON, priv->phymode is also set.
- *
  * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
- * in the staging RXON flag structure based on the phymode
+ * in the staging RXON flag structure based on the ch->band
  */
-int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch)
+int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
+                         struct iwl_rxon_context *ctx)
 {
         enum ieee80211_band band = ch->band;
-        u16 channel = ieee80211_frequency_to_channel(ch->center_freq);
-
-        if (!iwl_get_channel_info(priv, band, channel)) {
-                IWL_DEBUG_INFO(priv, "Could not set channel to %d [%d]\n",
-                               channel, band);
-                return -EINVAL;
-        }
+        u16 channel = ch->hw_value;
 
-        if ((le16_to_cpu(priv->staging_rxon.channel) == channel) &&
+        if ((le16_to_cpu(ctx->staging.channel) == channel) &&
             (priv->band == band))
                 return 0;
 
-        priv->staging_rxon.channel = cpu_to_le16(channel);
+        ctx->staging.channel = cpu_to_le16(channel);
         if (band == IEEE80211_BAND_5GHZ)
-                priv->staging_rxon.flags &= ~RXON_FLG_BAND_24G_MSK;
+                ctx->staging.flags &= ~RXON_FLG_BAND_24G_MSK;
         else
-                priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
+                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
 
         priv->band = band;
 
@@ -951,24 +1037,25 @@ int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch)
 EXPORT_SYMBOL(iwl_set_rxon_channel);
 
 void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
                             enum ieee80211_band band,
                             struct ieee80211_vif *vif)
 {
         if (band == IEEE80211_BAND_5GHZ) {
-                priv->staging_rxon.flags &=
+                ctx->staging.flags &=
                     ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
                       | RXON_FLG_CCK_MSK);
-                priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
         } else {
                 /* Copied from iwl_post_associate() */
                 if (vif && vif->bss_conf.use_short_slot)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
-                priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
-                priv->staging_rxon.flags |= RXON_FLG_AUTO_DETECT_MSK;
-                priv->staging_rxon.flags &= ~RXON_FLG_CCK_MSK;
+                ctx->staging.flags |= RXON_FLG_BAND_24G_MSK;
+                ctx->staging.flags |= RXON_FLG_AUTO_DETECT_MSK;
+                ctx->staging.flags &= ~RXON_FLG_CCK_MSK;
         }
 }
 EXPORT_SYMBOL(iwl_set_flags_for_band);
@@ -977,35 +1064,34 @@ EXPORT_SYMBOL(iwl_set_flags_for_band);
  * initialize rxon structure with default values from eeprom
  */
 void iwl_connection_init_rx_config(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif)
+                                   struct iwl_rxon_context *ctx)
 {
         const struct iwl_channel_info *ch_info;
-        enum nl80211_iftype type = NL80211_IFTYPE_STATION;
-
-        if (vif)
-                type = vif->type;
 
-        memset(&priv->staging_rxon, 0, sizeof(priv->staging_rxon));
+        memset(&ctx->staging, 0, sizeof(ctx->staging));
 
-        switch (type) {
+        if (!ctx->vif) {
+                ctx->staging.dev_type = ctx->unused_devtype;
+        } else switch (ctx->vif->type) {
         case NL80211_IFTYPE_AP:
-                priv->staging_rxon.dev_type = RXON_DEV_TYPE_AP;
+                ctx->staging.dev_type = ctx->ap_devtype;
                 break;
 
         case NL80211_IFTYPE_STATION:
-                priv->staging_rxon.dev_type = RXON_DEV_TYPE_ESS;
-                priv->staging_rxon.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
+                ctx->staging.dev_type = ctx->station_devtype;
+                ctx->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
                 break;
 
         case NL80211_IFTYPE_ADHOC:
-                priv->staging_rxon.dev_type = RXON_DEV_TYPE_IBSS;
-                priv->staging_rxon.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
-                priv->staging_rxon.filter_flags = RXON_FILTER_BCON_AWARE_MSK |
+                ctx->staging.dev_type = ctx->ibss_devtype;
+                ctx->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.filter_flags = RXON_FILTER_BCON_AWARE_MSK |
                                                   RXON_FILTER_ACCEPT_GRP_MSK;
                 break;
 
         default:
-                IWL_ERR(priv, "Unsupported interface type %d\n", type);
+                IWL_ERR(priv, "Unsupported interface type %d\n",
+                        ctx->vif->type);
                 break;
         }
 
@@ -1013,37 +1099,36 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv,
         /* TODO:  Figure out when short_preamble would be set and cache from
          * that */
         if (!hw_to_local(priv->hw)->short_preamble)
-                priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
         else
-                priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
 #endif
 
         ch_info = iwl_get_channel_info(priv, priv->band,
-                                       le16_to_cpu(priv->active_rxon.channel));
+                                       le16_to_cpu(ctx->active.channel));
 
         if (!ch_info)
                 ch_info = &priv->channel_info[0];
 
-        priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
+        ctx->staging.channel = cpu_to_le16(ch_info->channel);
         priv->band = ch_info->band;
 
-        iwl_set_flags_for_band(priv, priv->band, vif);
+        iwl_set_flags_for_band(priv, ctx, priv->band, ctx->vif);
 
-        priv->staging_rxon.ofdm_basic_rates =
+        ctx->staging.ofdm_basic_rates =
             (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
-        priv->staging_rxon.cck_basic_rates =
+        ctx->staging.cck_basic_rates =
             (IWL_CCK_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
 
         /* clear both MIX and PURE40 mode flag */
-        priv->staging_rxon.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
+        ctx->staging.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
                                         RXON_FLG_CHANNEL_MODE_PURE_40);
+        if (ctx->vif)
+                memcpy(ctx->staging.node_addr, ctx->vif->addr, ETH_ALEN);
 
-        if (vif)
-                memcpy(priv->staging_rxon.node_addr, vif->addr, ETH_ALEN);
-
-        priv->staging_rxon.ofdm_ht_single_stream_basic_rates = 0xff;
-        priv->staging_rxon.ofdm_ht_dual_stream_basic_rates = 0xff;
-        priv->staging_rxon.ofdm_ht_triple_stream_basic_rates = 0xff;
+        ctx->staging.ofdm_ht_single_stream_basic_rates = 0xff;
+        ctx->staging.ofdm_ht_dual_stream_basic_rates = 0xff;
+        ctx->staging.ofdm_ht_triple_stream_basic_rates = 0xff;
 }
 EXPORT_SYMBOL(iwl_connection_init_rx_config);
 
@@ -1051,6 +1136,7 @@ void iwl_set_rate(struct iwl_priv *priv)
 {
         const struct ieee80211_supported_band *hw = NULL;
         struct ieee80211_rate *rate;
+        struct iwl_rxon_context *ctx;
         int i;
 
         hw = iwl_get_hw_mode(priv, priv->band);
@@ -1069,21 +1155,29 @@ void iwl_set_rate(struct iwl_priv *priv)
 
         IWL_DEBUG_RATE(priv, "Set active_rate = %0x\n", priv->active_rate);
 
-        priv->staging_rxon.cck_basic_rates =
-            (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
+        for_each_context(priv, ctx) {
+                ctx->staging.cck_basic_rates =
+                    (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
 
-        priv->staging_rxon.ofdm_basic_rates =
-           (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+                ctx->staging.ofdm_basic_rates =
+                   (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+        }
 }
 EXPORT_SYMBOL(iwl_set_rate);
 
 void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
 {
+        /*
+         * MULTI-FIXME
+         * See iwl_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         if (priv->switch_rxon.switch_in_progress) {
-                ieee80211_chswitch_done(priv->vif, is_success);
+                ieee80211_chswitch_done(ctx->vif, is_success);
                 mutex_lock(&priv->mutex);
                 priv->switch_rxon.switch_in_progress = false;
                 mutex_unlock(&priv->mutex);
@@ -1094,14 +1188,19 @@ EXPORT_SYMBOL(iwl_chswitch_done);
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_rxon_cmd *rxon = (void *)&priv->active_rxon;
         struct iwl_csa_notification *csa = &(pkt->u.csa_notif);
+        /*
+         * MULTI-FIXME
+         * See iwl_mac_channel_switch.
+         */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct iwl_rxon_cmd *rxon = (void *)&ctx->active;
 
         if (priv->switch_rxon.switch_in_progress) {
                 if (!le32_to_cpu(csa->status) &&
                     (csa->channel == priv->switch_rxon.channel)) {
                         rxon->channel = csa->channel;
-                        priv->staging_rxon.channel = csa->channel;
+                        ctx->staging.channel = csa->channel;
                         IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
                               le16_to_cpu(csa->channel));
                         iwl_chswitch_done(priv, true);
@@ -1115,9 +1214,10 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 EXPORT_SYMBOL(iwl_rx_csa);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-void iwl_print_rx_config_cmd(struct iwl_priv *priv)
+void iwl_print_rx_config_cmd(struct iwl_priv *priv,
+                             struct iwl_rxon_context *ctx)
 {
-        struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
+        struct iwl_rxon_cmd *rxon = &ctx->staging;
 
         IWL_DEBUG_RADIO(priv, "RX CONFIG:\n");
         iwl_print_hex_dump(priv, IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
@@ -1157,7 +1257,8 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
         priv->cfg->ops->lib->dump_nic_event_log(priv, false, NULL, false);
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS)
-                iwl_print_rx_config_cmd(priv);
+                iwl_print_rx_config_cmd(priv,
+                                        &priv->contexts[IWL_RXON_CTX_BSS]);
 #endif
 
         wake_up_interruptible(&priv->wait_command_queue);
@@ -1328,25 +1429,6 @@ out:
 EXPORT_SYMBOL(iwl_apm_init);
 
 
-int iwl_set_hw_params(struct iwl_priv *priv)
-{
-        priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
-        priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
-        if (priv->cfg->mod_params->amsdu_size_8K)
-                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
-        else
-                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
-
-        priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
-
-        if (priv->cfg->mod_params->disable_11n)
-                priv->cfg->sku &= ~IWL_SKU_N;
-
-        /* Device-specific setup */
-        return priv->cfg->ops->lib->set_hw_params(priv);
-}
-EXPORT_SYMBOL(iwl_set_hw_params);
-
 int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 {
         int ret = 0;
@@ -1496,76 +1578,6 @@ int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
 }
 EXPORT_SYMBOL(iwl_send_statistics_request);
 
-void iwl_rf_kill_ct_config(struct iwl_priv *priv)
-{
-        struct iwl_ct_kill_config cmd;
-        struct iwl_ct_kill_throttling_config adv_cmd;
-        unsigned long flags;
-        int ret = 0;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
-                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
-        spin_unlock_irqrestore(&priv->lock, flags);
-        priv->thermal_throttle.ct_kill_toggle = false;
-
-        if (priv->cfg->support_ct_kill_exit) {
-                adv_cmd.critical_temperature_enter =
-                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
-                adv_cmd.critical_temperature_exit =
-                        cpu_to_le32(priv->hw_params.ct_kill_exit_threshold);
-
-                ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
-                                       sizeof(adv_cmd), &adv_cmd);
-                if (ret)
-                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
-                else
-                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
-                                        "succeeded, "
-                                        "critical temperature enter is %d,"
-                                        "exit is %d\n",
-                                       priv->hw_params.ct_kill_threshold,
-                                       priv->hw_params.ct_kill_exit_threshold);
-        } else {
-                cmd.critical_temperature_R =
-                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
-
-                ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
-                                       sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
-                else
-                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
-                                        "succeeded, "
-                                        "critical temperature is %d\n",
-                                        priv->hw_params.ct_kill_threshold);
-        }
-}
-EXPORT_SYMBOL(iwl_rf_kill_ct_config);
-
-
-/*
- * CARD_STATE_CMD
- *
- * Use: Sets the device's internal card state to enable, disable, or halt
- *
- * When in the 'enable' state the card operates as normal.
- * When in the 'disable' state, the card enters into a low power mode.
- * When in the 'halt' state, the card is shut down and must be fully
- * restarted to come back on.
- */
-int iwl_send_card_state(struct iwl_priv *priv, u32 flags, u8 meta_flag)
-{
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_CARD_STATE_CMD,
-                .len = sizeof(u32),
-                .data = &flags,
-                .flags = meta_flag,
-        };
-
-        return iwl_send_cmd(priv, &cmd);
-}
-
 void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
                            struct iwl_rx_mem_buffer *rxb)
 {
@@ -1614,6 +1626,7 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                            const struct ieee80211_tx_queue_params *params)
 {
         struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx;
         unsigned long flags;
         int q;
 
@@ -1633,13 +1646,21 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        priv->qos_data.def_qos_parm.ac[q].cw_min = cpu_to_le16(params->cw_min);
-        priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
-        priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
-        priv->qos_data.def_qos_parm.ac[q].edca_txop =
-                        cpu_to_le16((params->txop * 32));
+        /*
+         * MULTI-FIXME
+         * This may need to be done per interface in nl80211/cfg80211/mac80211.
+         */
+        for_each_context(priv, ctx) {
+                ctx->qos_data.def_qos_parm.ac[q].cw_min =
+                        cpu_to_le16(params->cw_min);
+                ctx->qos_data.def_qos_parm.ac[q].cw_max =
+                        cpu_to_le16(params->cw_max);
+                ctx->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
+                ctx->qos_data.def_qos_parm.ac[q].edca_txop =
+                                cpu_to_le16((params->txop * 32));
 
-        priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
+                ctx->qos_data.def_qos_parm.ac[q].reserved1 = 0;
+        }
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -1648,21 +1669,30 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
 }
 EXPORT_SYMBOL(iwl_mac_conf_tx);
 
+int iwl_mac_tx_last_beacon(struct ieee80211_hw *hw)
+{
+        struct iwl_priv *priv = hw->priv;
+
+        return priv->ibss_manager == IWL_IBSS_MANAGER;
+}
+EXPORT_SYMBOL_GPL(iwl_mac_tx_last_beacon);
+
 static void iwl_ht_conf(struct iwl_priv *priv,
                         struct ieee80211_vif *vif)
 {
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
         struct ieee80211_sta *sta;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
         IWL_DEBUG_MAC80211(priv, "enter:\n");
 
-        if (!ht_conf->is_ht)
+        if (!ctx->ht.enabled)
                 return;
 
-        ht_conf->ht_protection =
+        ctx->ht.protection =
                 bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
-        ht_conf->non_GF_STA_present =
+        ctx->ht.non_gf_sta_present =
                 !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
 
         ht_conf->single_chain_sufficient = false;
@@ -1706,18 +1736,20 @@ static void iwl_ht_conf(struct iwl_priv *priv,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static inline void iwl_set_no_assoc(struct iwl_priv *priv)
+static inline void iwl_set_no_assoc(struct iwl_priv *priv,
+                                    struct ieee80211_vif *vif)
 {
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+
         iwl_led_disassociate(priv);
         /*
          * inform the ucode that there is no longer an
          * association and that no more packets should be
          * sent
          */
-        priv->staging_rxon.filter_flags &=
-                ~RXON_FILTER_ASSOC_MSK;
-        priv->staging_rxon.assoc_id = 0;
-        iwlcore_commit_rxon(priv);
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        ctx->staging.assoc_id = 0;
+        iwlcore_commit_rxon(priv, ctx);
 }
 
 static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
@@ -1728,6 +1760,14 @@ static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
+        lockdep_assert_held(&priv->mutex);
+
+        if (!priv->beacon_ctx) {
+                IWL_ERR(priv, "update beacon but no beacon context!\n");
+                dev_kfree_skb(skb);
+                return -EINVAL;
+        }
+
         if (!iwl_is_ready_rf(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
                 return -EIO;
@@ -1746,7 +1786,7 @@ static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
         IWL_DEBUG_MAC80211(priv, "leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        priv->cfg->ops->lib->post_associate(priv, priv->vif);
+        priv->cfg->ops->lib->post_associate(priv, priv->beacon_ctx->vif);
 
         return 0;
 }
@@ -1757,6 +1797,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                           u32 changes)
 {
         struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
         int ret;
 
         IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
@@ -1770,19 +1811,30 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 unsigned long flags;
 
                 spin_lock_irqsave(&priv->lock, flags);
-                priv->qos_data.qos_active = bss_conf->qos;
-                iwl_update_qos(priv);
+                ctx->qos_data.qos_active = bss_conf->qos;
+                iwl_update_qos(priv, ctx);
                 spin_unlock_irqrestore(&priv->lock, flags);
         }
 
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                /*
+                 * the add_interface code must make sure we only ever
+                 * have a single interface that could be beaconing at
+                 * any time.
+                 */
+                if (vif->bss_conf.enable_beacon)
+                        priv->beacon_ctx = ctx;
+                else
+                        priv->beacon_ctx = NULL;
+        }
+
         if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_AP) {
                 dev_kfree_skb(priv->ibss_beacon);
                 priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
         }
 
-        if (changes & BSS_CHANGED_BEACON_INT) {
-                /* TODO: in AP mode, do something to make this take effect */
-        }
+        if (changes & BSS_CHANGED_BEACON_INT && vif->type == NL80211_IFTYPE_AP)
+                iwl_send_rxon_timing(priv, ctx);
 
         if (changes & BSS_CHANGED_BSSID) {
                 IWL_DEBUG_MAC80211(priv, "BSSID %pM\n", bss_conf->bssid);
@@ -1801,13 +1853,13 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
 
                 /* mac80211 only sets assoc when in STATION mode */
                 if (vif->type == NL80211_IFTYPE_ADHOC || bss_conf->assoc) {
-                        memcpy(priv->staging_rxon.bssid_addr,
+                        memcpy(ctx->staging.bssid_addr,
                                bss_conf->bssid, ETH_ALEN);
 
                         /* currently needed in a few places */
                         memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
                 } else {
-                        priv->staging_rxon.filter_flags &=
+                        ctx->staging.filter_flags &=
                                 ~RXON_FILTER_ASSOC_MSK;
                 }
 
@@ -1830,21 +1882,21 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
                                    bss_conf->use_short_preamble);
                 if (bss_conf->use_short_preamble)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+                        ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
         }
 
         if (changes & BSS_CHANGED_ERP_CTS_PROT) {
                 IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n", bss_conf->use_cts_prot);
                 if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
-                        priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
+                        ctx->staging.flags |= RXON_FLG_TGG_PROTECT_MSK;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+                        ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
                 if (bss_conf->use_cts_prot)
-                        priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
+                        ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+                        ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
         }
 
         if (changes & BSS_CHANGED_BASIC_RATES) {
@@ -1854,12 +1906,12 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                  * like this here:
                  *
                 if (A-band)
-                        priv->staging_rxon.ofdm_basic_rates =
+                        ctx->staging.ofdm_basic_rates =
                                 bss_conf->basic_rates;
                 else
-                        priv->staging_rxon.ofdm_basic_rates =
+                        ctx->staging.ofdm_basic_rates =
                                 bss_conf->basic_rates >> 4;
-                        priv->staging_rxon.cck_basic_rates =
+                        ctx->staging.cck_basic_rates =
                                 bss_conf->basic_rates & 0xF;
                  */
         }
@@ -1868,7 +1920,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 iwl_ht_conf(priv, vif);
 
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
         }
 
         if (changes & BSS_CHANGED_ASSOC) {
@@ -1881,29 +1933,29 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                         if (!iwl_is_rfkill(priv))
                                 priv->cfg->ops->lib->post_associate(priv, vif);
                 } else
-                        iwl_set_no_assoc(priv);
+                        iwl_set_no_assoc(priv, vif);
         }
 
-        if (changes && iwl_is_associated(priv) && bss_conf->aid) {
+        if (changes && iwl_is_associated_ctx(ctx) && bss_conf->aid) {
                 IWL_DEBUG_MAC80211(priv, "Changes (%#x) while associated\n",
                                    changes);
-                ret = iwl_send_rxon_assoc(priv);
+                ret = iwl_send_rxon_assoc(priv, ctx);
                 if (!ret) {
                         /* Sync active_rxon with latest change. */
-                        memcpy((void *)&priv->active_rxon,
-                                &priv->staging_rxon,
+                        memcpy((void *)&ctx->active,
+                                &ctx->staging,
                                 sizeof(struct iwl_rxon_cmd));
                 }
         }
 
         if (changes & BSS_CHANGED_BEACON_ENABLED) {
                 if (vif->bss_conf.enable_beacon) {
-                        memcpy(priv->staging_rxon.bssid_addr,
+                        memcpy(ctx->staging.bssid_addr,
                                bss_conf->bssid, ETH_ALEN);
                         memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
                         iwlcore_config_ap(priv, vif);
                 } else
-                        iwl_set_no_assoc(priv);
+                        iwl_set_no_assoc(priv, vif);
         }
 
         if (changes & BSS_CHANGED_IBSS) {
@@ -1915,6 +1967,12 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                 bss_conf->bssid);
         }
 
+        if (changes & BSS_CHANGED_IDLE &&
+            priv->cfg->ops->hcmd->set_pan_params) {
+                if (priv->cfg->ops->hcmd->set_pan_params(priv))
+                        IWL_ERR(priv, "failed to update PAN params\n");
+        }
+
         mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -1923,17 +1981,21 @@ EXPORT_SYMBOL(iwl_bss_info_changed);
 
 static int iwl_set_mode(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
-        iwl_connection_init_rx_config(priv, vif);
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+
+        iwl_connection_init_rx_config(priv, ctx);
 
         if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
 
-        return iwlcore_commit_rxon(priv);
+        return iwlcore_commit_rxon(priv, ctx);
 }
 
 int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+        struct iwl_rxon_context *tmp, *ctx = NULL;
         int err = 0;
 
         IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
@@ -1946,23 +2008,65 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
                 goto out;
         }
 
-        if (priv->vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
+        for_each_context(priv, tmp) {
+                u32 possible_modes =
+                        tmp->interface_modes | tmp->exclusive_interface_modes;
+
+                if (tmp->vif) {
+                        /* check if this busy context is exclusive */
+                        if (tmp->exclusive_interface_modes &
+                                                BIT(tmp->vif->type)) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        continue;
+                }
+
+                if (!(possible_modes & BIT(vif->type)))
+                        continue;
+
+                /* have maybe usable context w/o interface */
+                ctx = tmp;
+                break;
+        }
+
+        if (!ctx) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        priv->vif = vif;
+        vif_priv->ctx = ctx;
+        ctx->vif = vif;
+        /*
+         * This variable will be correct only when there's just
+         * a single context, but all code using it is for hardware
+         * that supports only one context.
+         */
         priv->iw_mode = vif->type;
 
+        ctx->is_active = true;
+
         err = iwl_set_mode(priv, vif);
-        if (err)
+        if (err) {
+                if (!ctx->always_active)
+                        ctx->is_active = false;
                 goto out_err;
+        }
+
+        if (priv->cfg->advanced_bt_coexist &&
+            vif->type == NL80211_IFTYPE_ADHOC) {
+                /*
+                 * pretend to have high BT traffic as long as we
+                 * are operating in IBSS mode, as this will cause
+                 * the rate scaling etc. to behave as intended.
+                 */
+                priv->bt_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_HIGH;
+        }
 
         goto out;
 
  out_err:
-        priv->vif = NULL;
+        ctx->vif = NULL;
         priv->iw_mode = NL80211_IFTYPE_STATION;
  out:
         mutex_unlock(&priv->mutex);
@@ -1976,30 +2080,36 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
-        bool scan_completed = false;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
         mutex_lock(&priv->mutex);
 
-        if (iwl_is_ready_rf(priv)) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
-        }
-        if (priv->vif == vif) {
-                priv->vif = NULL;
-                if (priv->scan_vif == vif) {
-                        scan_completed = true;
-                        priv->scan_vif = NULL;
-                        priv->scan_request = NULL;
-                }
-                memset(priv->bssid, 0, ETH_ALEN);
+        WARN_ON(ctx->vif != vif);
+        ctx->vif = NULL;
+
+        if (priv->scan_vif == vif) {
+                iwl_scan_cancel_timeout(priv, 200);
+                iwl_force_scan_end(priv);
         }
-        mutex_unlock(&priv->mutex);
+        iwl_set_mode(priv, vif);
+
+        if (!ctx->always_active)
+                ctx->is_active = false;
+
+        /*
+         * When removing the IBSS interface, overwrite the
+         * BT traffic load with the stored one from the last
+         * notification, if any. If this is a device that
+         * doesn't implement this, this has no effect since
+         * both values are the same and zero.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC)
+                priv->bt_traffic_load = priv->notif_bt_traffic_load;
 
-        if (scan_completed)
-                ieee80211_scan_completed(priv->hw, true);
+        memset(priv->bssid, 0, ETH_ALEN);
+        mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
@@ -2014,7 +2124,9 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct iwl_priv *priv = hw->priv;
         const struct iwl_channel_info *ch_info;
         struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_channel *channel = conf->channel;
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        struct iwl_rxon_context *ctx;
         unsigned long flags = 0;
         int ret = 0;
         u16 ch;
@@ -2023,7 +2135,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         mutex_lock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
-                                        conf->channel->hw_value, changed);
+                                        channel->hw_value, changed);
 
         if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
                         test_bit(STATUS_SCANNING, &priv->status))) {
@@ -2044,7 +2156,8 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                  * configured.
                  */
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+                        for_each_context(priv, ctx)
+                                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
         }
 
         /* during scanning mac80211 will delay channel setting until
@@ -2054,8 +2167,8 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 if (scan_active)
                         goto set_ch_out;
 
-                ch = ieee80211_frequency_to_channel(conf->channel->center_freq);
-                ch_info = iwl_get_channel_info(priv, conf->channel->band, ch);
+                ch = channel->hw_value;
+                ch_info = iwl_get_channel_info(priv, channel->band, ch);
                 if (!is_channel_valid(ch_info)) {
                         IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
                         ret = -EINVAL;
@@ -2064,42 +2177,49 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 
                 spin_lock_irqsave(&priv->lock, flags);
 
-                /* Configure HT40 channels */
-                ht_conf->is_ht = conf_is_ht(conf);
-                if (ht_conf->is_ht) {
-                        if (conf_is_ht40_minus(conf)) {
-                                ht_conf->extension_chan_offset =
-                                        IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                                ht_conf->is_40mhz = true;
-                        } else if (conf_is_ht40_plus(conf)) {
-                                ht_conf->extension_chan_offset =
-                                        IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                ht_conf->is_40mhz = true;
-                        } else {
-                                ht_conf->extension_chan_offset =
-                                        IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                ht_conf->is_40mhz = false;
-                        }
-                } else
-                        ht_conf->is_40mhz = false;
-                /* Default to no protection. Protection mode will later be set
-                 * from BSS config in iwl_ht_conf */
-                ht_conf->ht_protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+                for_each_context(priv, ctx) {
+                        /* Configure HT40 channels */
+                        ctx->ht.enabled = conf_is_ht(conf);
+                        if (ctx->ht.enabled) {
+                                if (conf_is_ht40_minus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                                        ctx->ht.is_40mhz = true;
+                                } else if (conf_is_ht40_plus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                                        ctx->ht.is_40mhz = true;
+                                } else {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                                        ctx->ht.is_40mhz = false;
+                                }
+                        } else
+                                ctx->ht.is_40mhz = false;
 
-                /* if we are switching from ht to 2.4 clear flags
-                 * from any ht related info since 2.4 does not
-                 * support ht */
-                if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
-                        priv->staging_rxon.flags = 0;
+                        /*
+                         * Default to no protection. Protection mode will
+                         * later be set from BSS config in iwl_ht_conf
+                         */
+                        ctx->ht.protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+
+                        /* if we are switching from ht to 2.4 clear flags
+                         * from any ht related info since 2.4 does not
+                         * support ht */
+                        if ((le16_to_cpu(ctx->staging.channel) != ch))
+                                ctx->staging.flags = 0;
 
-                iwl_set_rxon_channel(priv, conf->channel);
-                iwl_set_rxon_ht(priv, ht_conf);
+                        iwl_set_rxon_channel(priv, channel, ctx);
+                        iwl_set_rxon_ht(priv, ht_conf);
+
+                        iwl_set_flags_for_band(priv, ctx, channel->band,
+                                               ctx->vif);
+                }
 
-                iwl_set_flags_for_band(priv, conf->channel->band, priv->vif);
                 spin_unlock_irqrestore(&priv->lock, flags);
 
-                if (priv->cfg->ops->lib->update_bcast_station)
-                        ret = priv->cfg->ops->lib->update_bcast_station(priv);
+                if (priv->cfg->ops->lib->update_bcast_stations)
+                        ret = priv->cfg->ops->lib->update_bcast_stations(priv);
 
  set_ch_out:
                 /* The list of supported rates and rate mask can be different
@@ -2130,12 +2250,13 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
         if (scan_active)
                 goto out;
 
-        if (memcmp(&priv->active_rxon,
-                   &priv->staging_rxon, sizeof(priv->staging_rxon)))
-                iwlcore_commit_rxon(priv);
-        else
-                IWL_DEBUG_INFO(priv, "Not re-sending same RXON configuration.\n");
-
+        for_each_context(priv, ctx) {
+                if (memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging)))
+                        iwlcore_commit_rxon(priv, ctx);
+                else
+                        IWL_DEBUG_INFO(priv,
+                                "Not re-sending same RXON configuration.\n");
+        }
 
 out:
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -2148,6 +2269,8 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
         unsigned long flags;
+        /* IBSS can only be the IWL_RXON_CTX_BSS context */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "enter\n");
@@ -2168,6 +2291,7 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
+        iwl_scan_cancel_timeout(priv, 100);
         if (!iwl_is_ready_rf(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 mutex_unlock(&priv->mutex);
@@ -2177,9 +2301,8 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         /* we are restarting association process
          * clear RXON_FILTER_ASSOC_MSK bit
          */
-        iwl_scan_cancel_timeout(priv, 100);
-        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv);
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv, ctx);
 
         iwl_set_rate(priv);
 
@@ -2588,7 +2711,7 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if (!iwl_is_associated(priv)) {
+        if (!iwl_is_any_associated(priv)) {
                 IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
                 return;
         }
@@ -2719,10 +2842,14 @@ static int iwl_check_stuck_queue(struct iwl_priv *priv, int cnt)
                                                 "queue %d, not read %d time\n",
                                                 q->id,
                                                 q->repeat_same_read_ptr);
-                                mod_timer(&priv->monitor_recover, jiffies +
-                                        msecs_to_jiffies(IWL_ONE_HUNDRED_MSECS));
+                                if (!priv->cfg->advanced_bt_coexist) {
+                                        mod_timer(&priv->monitor_recover,
+                                                jiffies + msecs_to_jiffies(
+                                                IWL_ONE_HUNDRED_MSECS));
+                                        return 1;
+                                }
                         }
-                        return 1;
+                        return 0;
                 } else {
                         q->last_read_ptr = q->read_ptr;
                         q->repeat_same_read_ptr = 0;
@@ -2740,25 +2867,27 @@ void iwl_bg_monitor_recover(unsigned long data)
                 return;
 
         /* monitor and check for stuck cmd queue */
-        if (iwl_check_stuck_queue(priv, IWL_CMD_QUEUE_NUM))
+        if (iwl_check_stuck_queue(priv, priv->cmd_queue))
                 return;
 
         /* monitor and check for other stuck queues */
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_any_associated(priv)) {
                 for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
                         /* skip as we already checked the command queue */
-                        if (cnt == IWL_CMD_QUEUE_NUM)
+                        if (cnt == priv->cmd_queue)
                                 continue;
                         if (iwl_check_stuck_queue(priv, cnt))
                                 return;
                 }
         }
-        /*
-         * Reschedule the timer to occur in
-         * priv->cfg->monitor_recover_period
-         */
-        mod_timer(&priv->monitor_recover,
-                jiffies + msecs_to_jiffies(priv->cfg->monitor_recover_period));
+        if (priv->cfg->monitor_recover_period) {
+                /*
+                 * Reschedule the timer to occur in
+                 * priv->cfg->monitor_recover_period
+                 */
+                mod_timer(&priv->monitor_recover, jiffies + msecs_to_jiffies(
+                          priv->cfg->monitor_recover_period));
+        }
 }
 EXPORT_SYMBOL(iwl_bg_monitor_recover);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 5e6ee3da6bbf..f0302bfe85f5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -88,11 +88,13 @@ struct iwl_cmd;
 #define IWL_CMD(x) case x: return #x
 
 struct iwl_hcmd_ops {
-        int (*rxon_assoc)(struct iwl_priv *priv);
-        int (*commit_rxon)(struct iwl_priv *priv);
-        void (*set_rxon_chain)(struct iwl_priv *priv);
+        int (*rxon_assoc)(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+        int (*commit_rxon)(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+        void (*set_rxon_chain)(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx);
         int (*set_tx_ant)(struct iwl_priv *priv, u8 valid_tx_ant);
         void (*send_bt_config)(struct iwl_priv *priv);
+        int (*set_pan_params)(struct iwl_priv *priv);
 };
 
 struct iwl_hcmd_utils_ops {
@@ -109,7 +111,7 @@ struct iwl_hcmd_utils_ops {
                                   __le16 fc, __le32 *tx_flags);
         int  (*calc_rssi)(struct iwl_priv *priv,
                           struct iwl_rx_phy_res *rx_resp);
-        void (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
+        int (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
 };
 
 struct iwl_apm_ops {
@@ -128,6 +130,8 @@ struct iwl_debugfs_ops {
                                       size_t count, loff_t *ppos);
         ssize_t (*bt_stats_read)(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos);
+        ssize_t (*reply_tx_error)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
 };
 
 struct iwl_temp_ops {
@@ -136,6 +140,12 @@ struct iwl_temp_ops {
         void (*set_calib_version)(struct iwl_priv *priv);
 };
 
+struct iwl_tt_ops {
+        bool (*lower_power_detection)(struct iwl_priv *priv);
+        u8 (*tt_power_mode)(struct iwl_priv *priv);
+        bool (*ct_kill_check)(struct iwl_priv *priv);
+};
+
 struct iwl_lib_ops {
         /* set hw dependent parameters */
         int (*set_hw_params)(struct iwl_priv *priv);
@@ -199,7 +209,7 @@ struct iwl_lib_ops {
         /* station management */
         int (*manage_ibss_station)(struct iwl_priv *priv,
                                    struct ieee80211_vif *vif, bool add);
-        int (*update_bcast_station)(struct iwl_priv *priv);
+        int (*update_bcast_stations)(struct iwl_priv *priv);
         /* recover from tx queue stall */
         void (*recover_from_tx_stall)(unsigned long data);
         /* check for plcp health */
@@ -212,6 +222,9 @@ struct iwl_lib_ops {
         void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
 
         struct iwl_debugfs_ops debugfs_ops;
+
+        /* thermal throttling */
+        struct iwl_tt_ops tt_ops;
 };
 
 struct iwl_led_ops {
@@ -269,6 +282,14 @@ struct iwl_mod_params {
  * @chain_noise_calib_by_driver: driver has the capability to perform
  *      chain noise calibration operation
  * @scan_antennas: available antenna for scan operation
+ * @advanced_bt_coexist: support advanced bt coexist
+ * @bt_init_traffic_load: specify initial bt traffic load
+ * @bt_prio_boost: default bt priority boost value
+ * @need_dc_calib: need to perform init dc calibration
+ * @bt_statistics: use BT version of statistics notification
+ * @agg_time_limit: maximum number of uSec in aggregation
+ * @ampdu_factor: Maximum A-MPDU length factor
+ * @ampdu_density: Minimum A-MPDU spacing
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -337,8 +358,14 @@ struct iwl_cfg {
         const bool chain_noise_calib_by_driver;
         u8 scan_rx_antennas[IEEE80211_NUM_BANDS];
         u8 scan_tx_antennas[IEEE80211_NUM_BANDS];
+        bool advanced_bt_coexist;
+        u8 bt_init_traffic_load;
+        u8 bt_prio_boost;
         const bool need_dc_calib;
         const bool bt_statistics;
+        u16 agg_time_limit;
+        u8 ampdu_factor;
+        u8 ampdu_density;
 };
 
 /***************************
@@ -347,38 +374,41 @@ struct iwl_cfg {
 
 struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
                 struct ieee80211_ops *hw_ops);
-void iwl_hw_detect(struct iwl_priv *priv);
 void iwl_activate_qos(struct iwl_priv *priv);
 int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                     const struct ieee80211_tx_queue_params *params);
-void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, int hw_decrypt);
-int iwl_check_rxon_cmd(struct iwl_priv *priv);
-int iwl_full_rxon_required(struct iwl_priv *priv);
-void iwl_set_rxon_chain(struct iwl_priv *priv);
-int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
+int iwl_mac_tx_last_beacon(struct ieee80211_hw *hw);
+void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           int hw_decrypt);
+int iwl_check_rxon_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+int iwl_full_rxon_required(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwl_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch,
+                         struct iwl_rxon_context *ctx);
 void iwl_set_flags_for_band(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
                             enum ieee80211_band band,
                             struct ieee80211_vif *vif);
 u8 iwl_get_single_channel_number(struct iwl_priv *priv,
                                   enum ieee80211_band band);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
-u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
-                         struct ieee80211_sta_ht_cap *sta_ht_inf);
+bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
+                            struct ieee80211_sta_ht_cap *ht_cap);
 void iwl_connection_init_rx_config(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif);
+                                   struct iwl_rxon_context *ctx);
 void iwl_set_rate(struct iwl_priv *priv);
 int iwl_set_decrypted_flag(struct iwl_priv *priv,
                            struct ieee80211_hdr *hdr,
                            u32 decrypt_res,
                            struct ieee80211_rx_status *stats);
 void iwl_irq_handle_error(struct iwl_priv *priv);
-int iwl_set_hw_params(struct iwl_priv *priv);
 void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif);
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_bss_conf *bss_conf,
                                      u32 changes);
-int iwl_commit_rxon(struct iwl_priv *priv);
+int iwl_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
@@ -496,7 +526,8 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
 
 int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
 
-u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv);
+u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx);
 
 u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
 
@@ -524,10 +555,10 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
+void iwl_force_scan_end(struct iwl_priv *priv);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                     struct ieee80211_vif *vif,
                     struct cfg80211_scan_request *req);
-void iwl_bg_start_internal_scan(struct work_struct *work);
 void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode, bool external);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
@@ -539,10 +570,8 @@ u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
 u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
                                enum ieee80211_band band,
                                struct ieee80211_vif *vif);
-void iwl_bg_scan_check(struct work_struct *data);
-void iwl_bg_abort_scan(struct work_struct *work);
-void iwl_bg_scan_completed(struct work_struct *work);
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
+void iwl_cancel_scan_deferred_work(struct iwl_priv *priv);
 
 /* For faster active scanning, scan will move to the next channel if fewer than
  * PLCP_QUIET_THRESH packets are heard on this channel within
@@ -580,8 +609,6 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv, u8 id, u16 len,
 
 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd);
 
-int iwl_send_card_state(struct iwl_priv *priv, u32 flags,
-                        u8 meta_flag);
 
 /*****************************************************
  * PCI                                               *
@@ -616,9 +643,11 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv,
 void iwl_dump_csr(struct iwl_priv *priv);
 int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display);
 #ifdef CONFIG_IWLWIFI_DEBUG
-void iwl_print_rx_config_cmd(struct iwl_priv *priv);
+void iwl_print_rx_config_cmd(struct iwl_priv *priv,
+                             struct iwl_rxon_context *ctx);
 #else
-static inline void iwl_print_rx_config_cmd(struct iwl_priv *priv)
+static inline void iwl_print_rx_config_cmd(struct iwl_priv *priv,
+                                           struct iwl_rxon_context *ctx)
 {
 }
 #endif
@@ -695,23 +724,24 @@ static inline int iwl_is_ready_rf(struct iwl_priv *priv)
         return iwl_is_ready(priv);
 }
 
-extern void iwl_rf_kill_ct_config(struct iwl_priv *priv);
 extern void iwl_send_bt_config(struct iwl_priv *priv);
 extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
-extern int iwl_send_lq_cmd(struct iwl_priv *priv,
+extern int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                 struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 void iwl_apm_stop(struct iwl_priv *priv);
 int iwl_apm_init(struct iwl_priv *priv);
 
-void iwl_setup_rxon_timing(struct iwl_priv *priv, struct ieee80211_vif *vif);
-static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
+int iwl_send_rxon_timing(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+static inline int iwl_send_rxon_assoc(struct iwl_priv *priv,
+                                      struct iwl_rxon_context *ctx)
 {
-        return priv->cfg->ops->hcmd->rxon_assoc(priv);
+        return priv->cfg->ops->hcmd->rxon_assoc(priv, ctx);
 }
-static inline int iwlcore_commit_rxon(struct iwl_priv *priv)
+static inline int iwlcore_commit_rxon(struct iwl_priv *priv,
+                                      struct iwl_rxon_context *ctx)
 {
-        return priv->cfg->ops->hcmd->commit_rxon(priv);
+        return priv->cfg->ops->hcmd->commit_rxon(priv, ctx);
 }
 static inline void iwlcore_config_ap(struct iwl_priv *priv,
                                      struct ieee80211_vif *vif)
@@ -723,4 +753,8 @@ static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
 {
         return priv->hw->wiphy->bands[band];
 }
+
+extern bool bt_coex_active;
+extern bool bt_siso_mode;
+
 #endif /* __iwl_core_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index e96a1bb12783..265ad01a443f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -467,8 +467,7 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                 for (i = 0; i < supp_band->n_channels; i++)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         "%d: %ddBm: BSS%s%s, %s.\n",
-                                        ieee80211_frequency_to_channel(
-                                        channels[i].center_freq),
+                                        channels[i].hw_value,
                                         channels[i].max_power,
                                         channels[i].flags & IEEE80211_CHAN_RADAR ?
                                         " (IEEE 802.11h required)" : "",
@@ -491,8 +490,7 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                 for (i = 0; i < supp_band->n_channels; i++)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         "%d: %ddBm: BSS%s%s, %s.\n",
-                                        ieee80211_frequency_to_channel(
-                                        channels[i].center_freq),
+                                        channels[i].hw_value,
                                         channels[i].max_power,
                                         channels[i].flags & IEEE80211_CHAN_RADAR ?
                                         " (IEEE 802.11h required)" : "",
@@ -577,10 +575,10 @@ static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
                 priv->isr_stats.hw);
         pos += scnprintf(buf + pos, bufsz - pos, "SW Error:\t\t\t %u\n",
                 priv->isr_stats.sw);
-        if (priv->isr_stats.sw > 0) {
+        if (priv->isr_stats.sw || priv->isr_stats.hw) {
                 pos += scnprintf(buf + pos, bufsz - pos,
                         "\tLast Restarting Code:  0x%X\n",
-                        priv->isr_stats.sw_err);
+                        priv->isr_stats.err_code);
         }
 #ifdef CONFIG_IWLWIFI_DEBUG
         pos += scnprintf(buf + pos, bufsz - pos, "Frame transmitted:\t\t %u\n",
@@ -645,19 +643,25 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
+        struct iwl_rxon_context *ctx;
         int pos = 0, i;
-        char buf[256];
+        char buf[256 * NUM_IWL_RXON_CTX];
         const size_t bufsz = sizeof(buf);
 
-        for (i = 0; i < AC_NUM; i++) {
-                pos += scnprintf(buf + pos, bufsz - pos,
-                        "\tcw_min\tcw_max\taifsn\ttxop\n");
-                pos += scnprintf(buf + pos, bufsz - pos,
+        for_each_context(priv, ctx) {
+                pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
+                                 ctx->ctxid);
+                for (i = 0; i < AC_NUM; i++) {
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                "\tcw_min\tcw_max\taifsn\ttxop\n");
+                        pos += scnprintf(buf + pos, bufsz - pos,
                                 "AC[%d]\t%u\t%u\t%u\t%u\n", i,
-                                priv->qos_data.def_qos_parm.ac[i].cw_min,
-                                priv->qos_data.def_qos_parm.ac[i].cw_max,
-                                priv->qos_data.def_qos_parm.ac[i].aifsn,
-                                priv->qos_data.def_qos_parm.ac[i].edca_txop);
+                                ctx->qos_data.def_qos_parm.ac[i].cw_min,
+                                ctx->qos_data.def_qos_parm.ac[i].cw_max,
+                                ctx->qos_data.def_qos_parm.ac[i].aifsn,
+                                ctx->qos_data.def_qos_parm.ac[i].edca_txop);
+                }
+                pos += scnprintf(buf + pos, bufsz - pos, "\n");
         }
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -732,7 +736,7 @@ static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
                 return -EFAULT;
         if (sscanf(buf, "%d", &ht40) != 1)
                 return -EFAULT;
-        if (!iwl_is_associated(priv))
+        if (!iwl_is_any_associated(priv))
                 priv->disable_ht40 = ht40 ? true : false;
         else {
                 IWL_ERR(priv, "Sta associated with AP - "
@@ -1321,7 +1325,8 @@ static ssize_t iwl_dbgfs_rxon_flags_read(struct file *file,
         int len = 0;
         char buf[20];
 
-        len = sprintf(buf, "0x%04X\n", le32_to_cpu(priv->active_rxon.flags));
+        len = sprintf(buf, "0x%04X\n",
+                le32_to_cpu(priv->contexts[IWL_RXON_CTX_BSS].active.flags));
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -1334,7 +1339,7 @@ static ssize_t iwl_dbgfs_rxon_filter_flags_read(struct file *file,
         char buf[20];
 
         len = sprintf(buf, "0x%04X\n",
-                      le32_to_cpu(priv->active_rxon.filter_flags));
+                le32_to_cpu(priv->contexts[IWL_RXON_CTX_BSS].active.filter_flags));
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -1529,6 +1534,126 @@ static ssize_t iwl_dbgfs_ucode_bt_stats_read(struct file *file,
                         user_buf, count, ppos);
 }
 
+static ssize_t iwl_dbgfs_monitor_period_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int period;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &period) != 1)
+                return -EINVAL;
+        if (period < 0 || period > IWL_MAX_MONITORING_PERIOD)
+                priv->cfg->monitor_recover_period = IWL_DEF_MONITORING_PERIOD;
+        else
+                priv->cfg->monitor_recover_period = period;
+
+        if (priv->cfg->monitor_recover_period)
+                mod_timer(&priv->monitor_recover, jiffies + msecs_to_jiffies(
+                          priv->cfg->monitor_recover_period));
+        else
+                del_timer_sync(&priv->monitor_recover);
+        return count;
+}
+
+static ssize_t iwl_dbgfs_bt_traffic_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[200];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "BT in %s mode\n",
+                priv->bt_full_concurrent ? "full concurrency" : "3-wire");
+        pos += scnprintf(buf + pos, bufsz - pos, "BT status: %s, "
+                         "last traffic notif: %d\n",
+                priv->bt_status ? "On" : "Off", priv->notif_bt_traffic_load);
+        pos += scnprintf(buf + pos, bufsz - pos, "ch_announcement: %d, "
+                         "sco_active: %d, kill_ack_mask: %x, "
+                         "kill_cts_mask: %x\n",
+                priv->bt_ch_announce, priv->bt_sco_active,
+                priv->kill_ack_mask, priv->kill_cts_mask);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "bluetooth traffic load: ");
+        switch (priv->bt_traffic_load) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                pos += scnprintf(buf + pos, bufsz - pos, "Continuous\n");
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+                pos += scnprintf(buf + pos, bufsz - pos, "High\n");
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                pos += scnprintf(buf + pos, bufsz - pos, "Low\n");
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+        default:
+                pos += scnprintf(buf + pos, bufsz - pos, "None\n");
+                break;
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_protection_mode_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+
+        int pos = 0;
+        char buf[40];
+        const size_t bufsz = sizeof(buf);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "use %s for aggregation\n",
+                         (priv->cfg->use_rts_for_aggregation) ? "rts/cts" :
+                         "cts-to-self");
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_protection_mode_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int rts;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &rts) != 1)
+                return -EINVAL;
+        if (rts)
+                priv->cfg->use_rts_for_aggregation = true;
+        else
+                priv->cfg->use_rts_for_aggregation = false;
+        return count;
+}
+
+static ssize_t iwl_dbgfs_reply_tx_error_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+
+        if (priv->cfg->ops->lib->debugfs_ops.reply_tx_error)
+                return priv->cfg->ops->lib->debugfs_ops.reply_tx_error(
+                        file, user_buf, count, ppos);
+        else
+                return -ENODATA;
+}
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1552,6 +1677,10 @@ DEBUGFS_READ_FILE_OPS(rxon_flags);
 DEBUGFS_READ_FILE_OPS(rxon_filter_flags);
 DEBUGFS_WRITE_FILE_OPS(txfifo_flush);
 DEBUGFS_READ_FILE_OPS(ucode_bt_stats);
+DEBUGFS_WRITE_FILE_OPS(monitor_period);
+DEBUGFS_READ_FILE_OPS(bt_traffic);
+DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
+DEBUGFS_READ_FILE_OPS(reply_tx_error);
 
 /*
  * Create the debugfs files and directories
@@ -1612,6 +1741,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
         if (priv->cfg->ops->lib->dev_txfifo_flush)
                 DEBUGFS_ADD_FILE(txfifo_flush, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(protection_mode, dir_debug, S_IWUSR | S_IRUSR);
 
         if (priv->cfg->sensitivity_calib_by_driver)
                 DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
@@ -1621,8 +1751,12 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
                 DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
         if (priv->cfg->bt_statistics)
                 DEBUGFS_ADD_FILE(ucode_bt_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(reply_tx_error, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(monitor_period, dir_debug, S_IWUSR);
+        if (priv->cfg->advanced_bt_coexist)
+                DEBUGFS_ADD_FILE(bt_traffic, dir_debug, S_IRUSR);
         if (priv->cfg->sensitivity_calib_by_driver)
                 DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf,
                                  &priv->disable_sens_cal);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 2e97cd2fa98a..74d25bcbfcb2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -47,6 +47,7 @@
 #include "iwl-led.h"
 #include "iwl-power.h"
 #include "iwl-agn-rs.h"
+#include "iwl-agn-tt.h"
 
 struct iwl_tx_queue;
 
@@ -143,6 +144,7 @@ struct iwl_queue {
 /* One for each TFD */
 struct iwl_tx_info {
         struct sk_buff *skb;
+        struct iwl_rxon_context *ctx;
 };
 
 /**
@@ -252,10 +254,14 @@ struct iwl_channel_info {
         struct iwl3945_scan_power_info scan_pwr_info[IWL_NUM_SCAN_RATES];
 };
 
-#define IWL_TX_FIFO_BK          0
+#define IWL_TX_FIFO_BK          0       /* shared */
 #define IWL_TX_FIFO_BE          1
-#define IWL_TX_FIFO_VI          2
+#define IWL_TX_FIFO_VI          2       /* shared */
 #define IWL_TX_FIFO_VO          3
+#define IWL_TX_FIFO_BK_IPAN     IWL_TX_FIFO_BK
+#define IWL_TX_FIFO_BE_IPAN     4
+#define IWL_TX_FIFO_VI_IPAN     IWL_TX_FIFO_VI
+#define IWL_TX_FIFO_VO_IPAN     5
 #define IWL_TX_FIFO_UNUSED      -1
 
 /* Minimum number of queues. MAX_NUM is defined in hw specific files.
@@ -264,11 +270,17 @@ struct iwl_channel_info {
 #define IWL_MIN_NUM_QUEUES      10
 
 /*
- * Queue #4 is the command queue for 3945/4965/5x00/1000/6x00,
- * the driver maps it into the appropriate device FIFO for the
- * uCode.
+ * Command queue depends on iPAN support.
  */
-#define IWL_CMD_QUEUE_NUM       4
+#define IWL_DEFAULT_CMD_QUEUE_NUM       4
+#define IWL_IPAN_CMD_QUEUE_NUM          9
+
+/*
+ * This queue number is required for proper operation
+ * because the ucode will stop/start the scheduler as
+ * required.
+ */
+#define IWL_IPAN_MCAST_QUEUE            8
 
 /* Power management (not Tx power) structures */
 
@@ -420,7 +432,7 @@ struct iwl_tid_data {
 };
 
 struct iwl_hw_key {
-        enum ieee80211_key_alg alg;
+        u32 cipher;
         int keylen;
         u8 keyidx;
         u8 key[32];
@@ -434,7 +446,13 @@ union iwl_ht_rate_supp {
         };
 };
 
-#define CFG_HT_RX_AMPDU_FACTOR_DEF  (0x3)
+#define CFG_HT_RX_AMPDU_FACTOR_8K   (0x0)
+#define CFG_HT_RX_AMPDU_FACTOR_16K  (0x1)
+#define CFG_HT_RX_AMPDU_FACTOR_32K  (0x2)
+#define CFG_HT_RX_AMPDU_FACTOR_64K  (0x3)
+#define CFG_HT_RX_AMPDU_FACTOR_DEF  CFG_HT_RX_AMPDU_FACTOR_64K
+#define CFG_HT_RX_AMPDU_FACTOR_MAX  CFG_HT_RX_AMPDU_FACTOR_64K
+#define CFG_HT_RX_AMPDU_FACTOR_MIN  CFG_HT_RX_AMPDU_FACTOR_8K
 
 /*
  * Maximal MPDU density for TX aggregation
@@ -443,19 +461,17 @@ union iwl_ht_rate_supp {
  * 6 - 8us density
  * 7 - 16us density
  */
+#define CFG_HT_MPDU_DENSITY_2USEC   (0x4)
 #define CFG_HT_MPDU_DENSITY_4USEC   (0x5)
+#define CFG_HT_MPDU_DENSITY_8USEC   (0x6)
+#define CFG_HT_MPDU_DENSITY_16USEC  (0x7)
 #define CFG_HT_MPDU_DENSITY_DEF CFG_HT_MPDU_DENSITY_4USEC
+#define CFG_HT_MPDU_DENSITY_MAX CFG_HT_MPDU_DENSITY_16USEC
+#define CFG_HT_MPDU_DENSITY_MIN     (0x1)
 
 struct iwl_ht_config {
-        /* self configuration data */
-        bool is_ht;
-        bool is_40mhz;
         bool single_chain_sufficient;
         enum ieee80211_smps_mode smps; /* current smps mode */
-        /* BSS related data */
-        u8 extension_chan_offset;
-        u8 ht_protection;
-        u8 non_GF_STA_present;
 };
 
 /* QoS structures */
@@ -473,12 +489,13 @@ struct iwl_qos_info {
 struct iwl_station_entry {
         struct iwl_addsta_cmd sta;
         struct iwl_tid_data tid[MAX_TID_COUNT];
-        u8 used;
+        u8 used, ctxid;
         struct iwl_hw_key keyinfo;
         struct iwl_link_quality_cmd *lq;
 };
 
 struct iwl_station_priv_common {
+        struct iwl_rxon_context *ctx;
         u8 sta_id;
 };
 
@@ -507,6 +524,7 @@ struct iwl_station_priv {
  * space for us to put data into.
  */
 struct iwl_vif_priv {
+        struct iwl_rxon_context *ctx;
         u8 ibss_bssid_sta_id;
 };
 
@@ -564,6 +582,7 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_INIT_DATA         = 4,
         IWL_UCODE_TLV_BOOT              = 5,
         IWL_UCODE_TLV_PROBE_MAX_LEN     = 6, /* a u32 value */
+        IWL_UCODE_TLV_PAN               = 7,
         IWL_UCODE_TLV_RUNT_EVTLOG_PTR   = 8,
         IWL_UCODE_TLV_RUNT_EVTLOG_SIZE  = 9,
         IWL_UCODE_TLV_RUNT_ERRLOG_PTR   = 10,
@@ -658,7 +677,6 @@ struct iwl_sensitivity_ranges {
  * @rx_page_order: Rx buffer page order
  * @rx_wrt_ptr_reg: FH{39}_RSCSR_CHNL0_WPTR
  * @max_stations:
- * @bcast_sta_id:
  * @ht40_channel: is 40MHz width possible in band 2.4
  * BIT(IEEE80211_BAND_5GHZ) BIT(IEEE80211_BAND_5GHZ)
  * @sw_crypto: 0 for hw, 1 for sw
@@ -682,7 +700,6 @@ struct iwl_hw_params {
         u32 rx_page_order;
         u32 rx_wrt_ptr_reg;
         u8  max_stations;
-        u8  bcast_sta_id;
         u8  ht40_channel;
         u8  max_beacon_itrvl;   /* in 1024 ms */
         u32 max_inst_size;
@@ -928,7 +945,7 @@ enum iwl_pa_type {
 struct isr_statistics {
         u32 hw;
         u32 sw;
-        u32 sw_err;
+        u32 err_code;
         u32 sch;
         u32 alive;
         u32 rfkill;
@@ -940,6 +957,50 @@ struct isr_statistics {
         u32 unhandled;
 };
 
+/* reply_tx_statistics (for _agn devices) */
+struct reply_tx_error_statistics {
+        u32 pp_delay;
+        u32 pp_few_bytes;
+        u32 pp_bt_prio;
+        u32 pp_quiet_period;
+        u32 pp_calc_ttak;
+        u32 int_crossed_retry;
+        u32 short_limit;
+        u32 long_limit;
+        u32 fifo_underrun;
+        u32 drain_flow;
+        u32 rfkill_flush;
+        u32 life_expire;
+        u32 dest_ps;
+        u32 host_abort;
+        u32 bt_retry;
+        u32 sta_invalid;
+        u32 frag_drop;
+        u32 tid_disable;
+        u32 fifo_flush;
+        u32 insuff_cf_poll;
+        u32 fail_hw_drop;
+        u32 sta_color_mismatch;
+        u32 unknown;
+};
+
+/* reply_agg_tx_statistics (for _agn devices) */
+struct reply_agg_tx_error_statistics {
+        u32 underrun;
+        u32 bt_prio;
+        u32 few_bytes;
+        u32 abort;
+        u32 last_sent_ttl;
+        u32 last_sent_try;
+        u32 last_sent_bt_kill;
+        u32 scd_query;
+        u32 bad_crc32;
+        u32 response;
+        u32 dump_tx;
+        u32 delay_tx;
+        u32 unknown;
+};
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 /* management statistics */
 enum iwl_mgmt_stats {
@@ -1052,7 +1113,10 @@ struct iwl_event_log {
 #define IWL_DEF_MONITORING_PERIOD       (1000)
 #define IWL_LONG_MONITORING_PERIOD      (5000)
 #define IWL_ONE_HUNDRED_MSECS   (100)
-#define IWL_SIXTY_SECS          (60000)
+#define IWL_MAX_MONITORING_PERIOD       (60000)
+
+/* BT Antenna Coupling Threshold (dB) */
+#define IWL_BT_ANTENNA_COUPLING_THRESHOLD       (35)
 
 enum iwl_reset {
         IWL_RF_RESET = 0,
@@ -1082,6 +1146,64 @@ struct iwl_force_reset {
  */
 #define IWLAGN_EXT_BEACON_TIME_POS      22
 
+enum iwl_rxon_context_id {
+        IWL_RXON_CTX_BSS,
+        IWL_RXON_CTX_PAN,
+
+        NUM_IWL_RXON_CTX
+};
+
+struct iwl_rxon_context {
+        struct ieee80211_vif *vif;
+
+        const u8 *ac_to_fifo;
+        const u8 *ac_to_queue;
+        u8 mcast_queue;
+
+        /*
+         * We could use the vif to indicate active, but we
+         * also need it to be active during disabling when
+         * we already removed the vif for type setting.
+         */
+        bool always_active, is_active;
+
+        enum iwl_rxon_context_id ctxid;
+
+        u32 interface_modes, exclusive_interface_modes;
+        u8 unused_devtype, ap_devtype, ibss_devtype, station_devtype;
+
+        /*
+         * We declare this const so it can only be
+         * changed via explicit cast within the
+         * routines that actually update the physical
+         * hardware.
+         */
+        const struct iwl_rxon_cmd active;
+        struct iwl_rxon_cmd staging;
+
+        struct iwl_rxon_time_cmd timing;
+
+        struct iwl_qos_info qos_data;
+
+        u8 bcast_sta_id, ap_sta_id;
+
+        u8 rxon_cmd, rxon_assoc_cmd, rxon_timing_cmd;
+        u8 qos_cmd;
+        u8 wep_key_cmd;
+
+        struct iwl_wep_key wep_keys[WEP_KEYS_MAX];
+        u8 key_mapping_keys;
+
+        __le32 station_flags;
+
+        struct {
+                bool non_gf_sta_present;
+                u8 protection;
+                bool enabled, is_40mhz;
+                u8 extension_chan_offset;
+        } ht;
+};
+
 struct iwl_priv {
 
         /* ieee device used by generic ieee processing code */
@@ -1110,6 +1232,9 @@ struct iwl_priv {
         u32 ucode_beacon_time;
         int missed_beacon_threshold;
 
+        /* track IBSS manager (last beacon) status */
+        u32 ibss_manager;
+
         /* storing the jiffies when the plcp error rate is received */
         unsigned long plcp_jiffies;
 
@@ -1155,6 +1280,15 @@ struct iwl_priv {
         u32  hw_wa_rev;
         u8   rev_id;
 
+        /* microcode/device supports multiple contexts */
+        u8 valid_contexts;
+
+        /* command queue number */
+        u8 cmd_queue;
+
+        /* max number of station keys */
+        u8 sta_key_max_num;
+
         /* EEPROM MAC addresses */
         struct mac_address addresses[2];
 
@@ -1172,15 +1306,7 @@ struct iwl_priv {
         u8 ucode_write_complete;        /* the image write is complete */
         char firmware_name[25];
 
-
-        struct iwl_rxon_time_cmd rxon_timing;
-
-        /* We declare this const so it can only be
-         * changed via explicit cast within the
-         * routines that actually update the physical
-         * hardware */
-        const struct iwl_rxon_cmd active_rxon;
-        struct iwl_rxon_cmd staging_rxon;
+        struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
 
         struct iwl_switch_rxon switch_rxon;
 
@@ -1242,8 +1368,6 @@ struct iwl_priv {
         spinlock_t sta_lock;
         int num_stations;
         struct iwl_station_entry stations[IWL_STATION_COUNT];
-        struct iwl_wep_key wep_keys[WEP_KEYS_MAX]; /* protected by mutex */
-        u8 key_mapping_key;
         unsigned long ucode_key_table;
 
         /* queue refcounts */
@@ -1268,7 +1392,6 @@ struct iwl_priv {
 
         /* Last Rx'd beacon timestamp */
         u64 timestamp;
-        struct ieee80211_vif *vif;
 
         union {
 #if defined(CONFIG_IWL3945) || defined(CONFIG_IWL3945_MODULE)
@@ -1336,6 +1459,9 @@ struct iwl_priv {
 
                         struct iwl_notif_statistics statistics;
                         struct iwl_bt_notif_statistics statistics_bt;
+                        /* counts reply_tx error */
+                        struct reply_tx_error_statistics reply_tx_stats;
+                        struct reply_agg_tx_error_statistics reply_agg_tx_stats;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
                         struct iwl_notif_statistics accum_statistics;
                         struct iwl_notif_statistics delta_statistics;
@@ -1348,12 +1474,27 @@ struct iwl_priv {
 #endif
         };
 
+        /* bt coex */
+        u8 bt_status;
+        u8 bt_traffic_load, notif_bt_traffic_load;
+        bool bt_ch_announce;
+        bool bt_sco_active;
+        bool bt_full_concurrent;
+        bool bt_ant_couple_ok;
+        __le32 kill_ack_mask;
+        __le32 kill_cts_mask;
+        __le16 bt_valid;
+        u16 bt_on_thresh;
+        u16 bt_duration;
+        u16 dynamic_frag_thresh;
+        u16 dynamic_agg_thresh;
+        u8 bt_ci_compliance;
+        struct work_struct bt_traffic_change_work;
+
         struct iwl_hw_params hw_params;
 
         u32 inta_mask;
 
-        struct iwl_qos_info qos_data;
-
         struct workqueue_struct *workqueue;
 
         struct work_struct restart;
@@ -1361,11 +1502,15 @@ struct iwl_priv {
         struct work_struct rx_replenish;
         struct work_struct abort_scan;
         struct work_struct beacon_update;
+        struct iwl_rxon_context *beacon_ctx;
+
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
         struct work_struct start_internal_scan;
         struct work_struct tx_flush;
+        struct work_struct bt_full_concurrency;
+        struct work_struct bt_runtime_config;
 
         struct tasklet_struct irq_tasklet;
 
@@ -1453,10 +1598,34 @@ static inline struct ieee80211_hdr *iwl_tx_queue_get_hdr(struct iwl_priv *priv,
         return NULL;
 }
 
+static inline struct iwl_rxon_context *
+iwl_rxon_ctx_from_vif(struct ieee80211_vif *vif)
+{
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+
+        return vif_priv->ctx;
+}
+
+#define for_each_context(priv, ctx)                             \
+        for (ctx = &priv->contexts[IWL_RXON_CTX_BSS];           \
+             ctx < &priv->contexts[NUM_IWL_RXON_CTX]; ctx++)    \
+                if (priv->valid_contexts & BIT(ctx->ctxid))
+
+static inline int iwl_is_associated(struct iwl_priv *priv,
+                                    enum iwl_rxon_context_id ctxid)
+{
+        return (priv->contexts[ctxid].active.filter_flags &
+                        RXON_FILTER_ASSOC_MSK) ? 1 : 0;
+}
+
+static inline int iwl_is_any_associated(struct iwl_priv *priv)
+{
+        return iwl_is_associated(priv, IWL_RXON_CTX_BSS);
+}
 
-static inline int iwl_is_associated(struct iwl_priv *priv)
+static inline int iwl_is_associated_ctx(struct iwl_rxon_context *ctx)
 {
-        return (priv->active_rxon.filter_flags & RXON_FILTER_ASSOC_MSK) ? 1 : 0;
+        return (ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK) ? 1 : 0;
 }
 
 static inline int is_channel_valid(const struct iwl_channel_info *ch_info)
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 258d059ef41f..c373b53babea 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -97,6 +97,17 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(REPLY_TX_POWER_DBM_CMD);
                 IWL_CMD(TEMPERATURE_NOTIFICATION);
                 IWL_CMD(TX_ANT_CONFIGURATION_CMD);
+                IWL_CMD(REPLY_BT_COEX_PROFILE_NOTIF);
+                IWL_CMD(REPLY_BT_COEX_PRIO_TABLE);
+                IWL_CMD(REPLY_BT_COEX_PROT_ENV);
+                IWL_CMD(REPLY_WIPAN_PARAMS);
+                IWL_CMD(REPLY_WIPAN_RXON);
+                IWL_CMD(REPLY_WIPAN_RXON_TIMING);
+                IWL_CMD(REPLY_WIPAN_RXON_ASSOC);
+                IWL_CMD(REPLY_WIPAN_QOS_PARAM);
+                IWL_CMD(REPLY_WIPAN_WEPKEY);
+                IWL_CMD(REPLY_WIPAN_P2P_CHANNEL_SWITCH);
+                IWL_CMD(REPLY_WIPAN_NOA_NOTIFICATION);
         default:
                 return "UNKNOWN";
 
@@ -229,7 +240,7 @@ cancel:
                  * in later, it will possibly set an invalid
                  * address (cmd->meta.source).
                  */
-                priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_idx].flags &=
+                priv->txq[priv->cmd_queue].meta[cmd_idx].flags &=
                                                         ~CMD_WANT_SKB;
         }
 fail:
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index cda6a94d6cc9..63c0ab46261f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -192,47 +192,6 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         IWL_DEBUG_POWER(priv, "Sleep command for index %d\n", lvl + 1);
 }
 
-/* default Thermal Throttling transaction table
- * Current state   |         Throttling Down               |  Throttling Up
- *=============================================================================
- *                 Condition Nxt State  Condition Nxt State Condition Nxt State
- *-----------------------------------------------------------------------------
- *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
- *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
- *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
- *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
- *=============================================================================
- */
-static const struct iwl_tt_trans tt_range_0[IWL_TI_STATE_MAX - 1] = {
-        {IWL_TI_0, IWL_ABSOLUTE_ZERO, 104},
-        {IWL_TI_1, 105, CT_KILL_THRESHOLD - 1},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
-};
-static const struct iwl_tt_trans tt_range_1[IWL_TI_STATE_MAX - 1] = {
-        {IWL_TI_0, IWL_ABSOLUTE_ZERO, 95},
-        {IWL_TI_2, 110, CT_KILL_THRESHOLD - 1},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
-};
-static const struct iwl_tt_trans tt_range_2[IWL_TI_STATE_MAX - 1] = {
-        {IWL_TI_1, IWL_ABSOLUTE_ZERO, 100},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX},
-        {IWL_TI_CT_KILL, CT_KILL_THRESHOLD, IWL_ABSOLUTE_MAX}
-};
-static const struct iwl_tt_trans tt_range_3[IWL_TI_STATE_MAX - 1] = {
-        {IWL_TI_0, IWL_ABSOLUTE_ZERO, CT_KILL_EXIT_THRESHOLD},
-        {IWL_TI_CT_KILL, CT_KILL_EXIT_THRESHOLD + 1, IWL_ABSOLUTE_MAX},
-        {IWL_TI_CT_KILL, CT_KILL_EXIT_THRESHOLD + 1, IWL_ABSOLUTE_MAX}
-};
-
-/* Advance Thermal Throttling default restriction table */
-static const struct iwl_tt_restriction restriction_range[IWL_TI_STATE_MAX] = {
-        {IWL_ANT_OK_MULTI, IWL_ANT_OK_MULTI, true },
-        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_MULTI, true },
-        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_SINGLE, false },
-        {IWL_ANT_OK_NONE, IWL_ANT_OK_NONE, false }
-};
-
-
 static void iwl_power_sleep_cam_cmd(struct iwl_priv *priv,
                                     struct iwl_powertable_cmd *cmd)
 {
@@ -308,7 +267,6 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
 int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 {
         int ret = 0;
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         bool enabled = priv->hw->conf.flags & IEEE80211_CONF_PS;
         bool update_chains;
         struct iwl_powertable_cmd cmd;
@@ -325,9 +283,13 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
         else if (priv->cfg->supports_idle &&
                  priv->hw->conf.flags & IEEE80211_CONF_IDLE)
                 iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_5, 20);
-        else if (tt->state >= IWL_TI_1)
-                iwl_static_sleep_cmd(priv, &cmd, tt->tt_power_mode, dtimper);
-        else if (!enabled)
+        else if (priv->cfg->ops->lib->tt_ops.lower_power_detection &&
+                 priv->cfg->ops->lib->tt_ops.tt_power_mode &&
+                 priv->cfg->ops->lib->tt_ops.lower_power_detection(priv)) {
+                /* in thermal throttling low power state */
+                iwl_static_sleep_cmd(priv, &cmd,
+                    priv->cfg->ops->lib->tt_ops.tt_power_mode(priv), dtimper);
+        } else if (!enabled)
                 iwl_power_sleep_cam_cmd(priv, &cmd);
         else if (priv->power_data.debug_sleep_level_override >= 0)
                 iwl_static_sleep_cmd(priv, &cmd,
@@ -367,592 +329,6 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 }
 EXPORT_SYMBOL(iwl_power_update_mode);
 
-bool iwl_ht_enabled(struct iwl_priv *priv)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        struct iwl_tt_restriction *restriction;
-
-        if (!priv->thermal_throttle.advanced_tt)
-                return true;
-        restriction = tt->restriction + tt->state;
-        return restriction->is_ht;
-}
-EXPORT_SYMBOL(iwl_ht_enabled);
-
-bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
-{
-        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
-        bool within_margin = false;
-
-        if (priv->cfg->temperature_kelvin)
-                temp = KELVIN_TO_CELSIUS(priv->temperature);
-
-        if (!priv->thermal_throttle.advanced_tt)
-                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
-                                CT_KILL_THRESHOLD_LEGACY) ? true : false;
-        else
-                within_margin = ((temp + IWL_TT_CT_KILL_MARGIN) >=
-                                CT_KILL_THRESHOLD) ? true : false;
-        return within_margin;
-}
-
-enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        struct iwl_tt_restriction *restriction;
-
-        if (!priv->thermal_throttle.advanced_tt)
-                return IWL_ANT_OK_MULTI;
-        restriction = tt->restriction + tt->state;
-        return restriction->tx_stream;
-}
-EXPORT_SYMBOL(iwl_tx_ant_restriction);
-
-enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        struct iwl_tt_restriction *restriction;
-
-        if (!priv->thermal_throttle.advanced_tt)
-                return IWL_ANT_OK_MULTI;
-        restriction = tt->restriction + tt->state;
-        return restriction->rx_stream;
-}
-
-#define CT_KILL_EXIT_DURATION (5)       /* 5 seconds duration */
-#define CT_KILL_WAITING_DURATION (300)  /* 300ms duration */
-
-/*
- * toggle the bit to wake up uCode and check the temperature
- * if the temperature is below CT, uCode will stay awake and send card
- * state notification with CT_KILL bit clear to inform Thermal Throttling
- * Management to change state. Otherwise, uCode will go back to sleep
- * without doing anything, driver should continue the 5 seconds timer
- * to wake up uCode for temperature check until temperature drop below CT
- */
-static void iwl_tt_check_exit_ct_kill(unsigned long data)
-{
-        struct iwl_priv *priv = (struct iwl_priv *)data;
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        unsigned long flags;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (tt->state == IWL_TI_CT_KILL) {
-                if (priv->thermal_throttle.ct_kill_toggle) {
-                        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
-                                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
-                        priv->thermal_throttle.ct_kill_toggle = false;
-                } else {
-                        iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
-                                    CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
-                        priv->thermal_throttle.ct_kill_toggle = true;
-                }
-                iwl_read32(priv, CSR_UCODE_DRV_GP1);
-                spin_lock_irqsave(&priv->reg_lock, flags);
-                if (!iwl_grab_nic_access(priv))
-                        iwl_release_nic_access(priv);
-                spin_unlock_irqrestore(&priv->reg_lock, flags);
-
-                /* Reschedule the ct_kill timer to occur in
-                 * CT_KILL_EXIT_DURATION seconds to ensure we get a
-                 * thermal update */
-                IWL_DEBUG_POWER(priv, "schedule ct_kill exit timer\n");
-                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm, jiffies +
-                          CT_KILL_EXIT_DURATION * HZ);
-        }
-}
-
-static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
-                           bool stop)
-{
-        if (stop) {
-                IWL_DEBUG_POWER(priv, "Stop all queues\n");
-                if (priv->mac80211_registered)
-                        ieee80211_stop_queues(priv->hw);
-                IWL_DEBUG_POWER(priv,
-                                "Schedule 5 seconds CT_KILL Timer\n");
-                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm, jiffies +
-                          CT_KILL_EXIT_DURATION * HZ);
-        } else {
-                IWL_DEBUG_POWER(priv, "Wake all queues\n");
-                if (priv->mac80211_registered)
-                        ieee80211_wake_queues(priv->hw);
-        }
-}
-
-static void iwl_tt_ready_for_ct_kill(unsigned long data)
-{
-        struct iwl_priv *priv = (struct iwl_priv *)data;
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        /* temperature timer expired, ready to go into CT_KILL state */
-        if (tt->state != IWL_TI_CT_KILL) {
-                IWL_DEBUG_POWER(priv, "entering CT_KILL state when temperature timer expired\n");
-                tt->state = IWL_TI_CT_KILL;
-                set_bit(STATUS_CT_KILL, &priv->status);
-                iwl_perform_ct_kill_task(priv, true);
-        }
-}
-
-static void iwl_prepare_ct_kill_task(struct iwl_priv *priv)
-{
-        IWL_DEBUG_POWER(priv, "Prepare to enter IWL_TI_CT_KILL\n");
-        /* make request to retrieve statistics information */
-        iwl_send_statistics_request(priv, CMD_SYNC, false);
-        /* Reschedule the ct_kill wait timer */
-        mod_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
-                 jiffies + msecs_to_jiffies(CT_KILL_WAITING_DURATION));
-}
-
-#define IWL_MINIMAL_POWER_THRESHOLD             (CT_KILL_THRESHOLD_LEGACY)
-#define IWL_REDUCED_PERFORMANCE_THRESHOLD_2     (100)
-#define IWL_REDUCED_PERFORMANCE_THRESHOLD_1     (90)
-
-/*
- * Legacy thermal throttling
- * 1) Avoid NIC destruction due to high temperatures
- *      Chip will identify dangerously high temperatures that can
- *      harm the device and will power down
- * 2) Avoid the NIC power down due to high temperature
- *      Throttle early enough to lower the power consumption before
- *      drastic steps are needed
- */
-static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        enum iwl_tt_state old_state;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if ((tt->tt_previous_temp) &&
-            (temp > tt->tt_previous_temp) &&
-            ((temp - tt->tt_previous_temp) >
-            IWL_TT_INCREASE_MARGIN)) {
-                IWL_DEBUG_POWER(priv,
-                        "Temperature increase %d degree Celsius\n",
-                        (temp - tt->tt_previous_temp));
-        }
-#endif
-        old_state = tt->state;
-        /* in Celsius */
-        if (temp >= IWL_MINIMAL_POWER_THRESHOLD)
-                tt->state = IWL_TI_CT_KILL;
-        else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_2)
-                tt->state = IWL_TI_2;
-        else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_1)
-                tt->state = IWL_TI_1;
-        else
-                tt->state = IWL_TI_0;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        tt->tt_previous_temp = temp;
-#endif
-        /* stop ct_kill_waiting_tm timer */
-        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
-        if (tt->state != old_state) {
-                switch (tt->state) {
-                case IWL_TI_0:
-                        /*
-                         * When the system is ready to go back to IWL_TI_0
-                         * we only have to call iwl_power_update_mode() to
-                         * do so.
-                         */
-                        break;
-                case IWL_TI_1:
-                        tt->tt_power_mode = IWL_POWER_INDEX_3;
-                        break;
-                case IWL_TI_2:
-                        tt->tt_power_mode = IWL_POWER_INDEX_4;
-                        break;
-                default:
-                        tt->tt_power_mode = IWL_POWER_INDEX_5;
-                        break;
-                }
-                mutex_lock(&priv->mutex);
-                if (old_state == IWL_TI_CT_KILL)
-                        clear_bit(STATUS_CT_KILL, &priv->status);
-                if (tt->state != IWL_TI_CT_KILL &&
-                    iwl_power_update_mode(priv, true)) {
-                        /* TT state not updated
-                         * try again during next temperature read
-                         */
-                        if (old_state == IWL_TI_CT_KILL)
-                                set_bit(STATUS_CT_KILL, &priv->status);
-                        tt->state = old_state;
-                        IWL_ERR(priv, "Cannot update power mode, "
-                                        "TT state not updated\n");
-                } else {
-                        if (tt->state == IWL_TI_CT_KILL) {
-                                if (force) {
-                                        set_bit(STATUS_CT_KILL, &priv->status);
-                                        iwl_perform_ct_kill_task(priv, true);
-                                } else {
-                                        iwl_prepare_ct_kill_task(priv);
-                                        tt->state = old_state;
-                                }
-                        } else if (old_state == IWL_TI_CT_KILL &&
-                                 tt->state != IWL_TI_CT_KILL)
-                                iwl_perform_ct_kill_task(priv, false);
-                        IWL_DEBUG_POWER(priv, "Temperature state changed %u\n",
-                                        tt->state);
-                        IWL_DEBUG_POWER(priv, "Power Index change to %u\n",
-                                        tt->tt_power_mode);
-                }
-                mutex_unlock(&priv->mutex);
-        }
-}
-
-/*
- * Advance thermal throttling
- * 1) Avoid NIC destruction due to high temperatures
- *      Chip will identify dangerously high temperatures that can
- *      harm the device and will power down
- * 2) Avoid the NIC power down due to high temperature
- *      Throttle early enough to lower the power consumption before
- *      drastic steps are needed
- *      Actions include relaxing the power down sleep thresholds and
- *      decreasing the number of TX streams
- * 3) Avoid throughput performance impact as much as possible
- *
- *=============================================================================
- *                 Condition Nxt State  Condition Nxt State Condition Nxt State
- *-----------------------------------------------------------------------------
- *     IWL_TI_0     T >= 114   CT_KILL  114>T>=105   TI_1      N/A      N/A
- *     IWL_TI_1     T >= 114   CT_KILL  114>T>=110   TI_2     T<=95     TI_0
- *     IWL_TI_2     T >= 114   CT_KILL                        T<=100    TI_1
- *    IWL_CT_KILL      N/A       N/A       N/A        N/A     T<=95     TI_0
- *=============================================================================
- */
-static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp, bool force)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        int i;
-        bool changed = false;
-        enum iwl_tt_state old_state;
-        struct iwl_tt_trans *transaction;
-
-        old_state = tt->state;
-        for (i = 0; i < IWL_TI_STATE_MAX - 1; i++) {
-                /* based on the current TT state,
-                 * find the curresponding transaction table
-                 * each table has (IWL_TI_STATE_MAX - 1) entries
-                 * tt->transaction + ((old_state * (IWL_TI_STATE_MAX - 1))
-                 * will advance to the correct table.
-                 * then based on the current temperature
-                 * find the next state need to transaction to
-                 * go through all the possible (IWL_TI_STATE_MAX - 1) entries
-                 * in the current table to see if transaction is needed
-                 */
-                transaction = tt->transaction +
-                        ((old_state * (IWL_TI_STATE_MAX - 1)) + i);
-                if (temp >= transaction->tt_low &&
-                    temp <= transaction->tt_high) {
-#ifdef CONFIG_IWLWIFI_DEBUG
-                        if ((tt->tt_previous_temp) &&
-                            (temp > tt->tt_previous_temp) &&
-                            ((temp - tt->tt_previous_temp) >
-                            IWL_TT_INCREASE_MARGIN)) {
-                                IWL_DEBUG_POWER(priv,
-                                        "Temperature increase %d "
-                                        "degree Celsius\n",
-                                        (temp - tt->tt_previous_temp));
-                        }
-                        tt->tt_previous_temp = temp;
-#endif
-                        if (old_state !=
-                            transaction->next_state) {
-                                changed = true;
-                                tt->state =
-                                        transaction->next_state;
-                        }
-                        break;
-                }
-        }
-        /* stop ct_kill_waiting_tm timer */
-        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
-        if (changed) {
-                struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
-
-                if (tt->state >= IWL_TI_1) {
-                        /* force PI = IWL_POWER_INDEX_5 in the case of TI > 0 */
-                        tt->tt_power_mode = IWL_POWER_INDEX_5;
-                        if (!iwl_ht_enabled(priv))
-                                /* disable HT */
-                                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
-                                        RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
-                                        RXON_FLG_HT40_PROT_MSK |
-                                        RXON_FLG_HT_PROT_MSK);
-                        else {
-                                /* check HT capability and set
-                                 * according to the system HT capability
-                                 * in case get disabled before */
-                                iwl_set_rxon_ht(priv, &priv->current_ht_config);
-                        }
-
-                } else {
-                        /*
-                         * restore system power setting -- it will be
-                         * recalculated automatically.
-                         */
-
-                        /* check HT capability and set
-                         * according to the system HT capability
-                         * in case get disabled before */
-                        iwl_set_rxon_ht(priv, &priv->current_ht_config);
-                }
-                mutex_lock(&priv->mutex);
-                if (old_state == IWL_TI_CT_KILL)
-                        clear_bit(STATUS_CT_KILL, &priv->status);
-                if (tt->state != IWL_TI_CT_KILL &&
-                    iwl_power_update_mode(priv, true)) {
-                        /* TT state not updated
-                         * try again during next temperature read
-                         */
-                        IWL_ERR(priv, "Cannot update power mode, "
-                                        "TT state not updated\n");
-                        if (old_state == IWL_TI_CT_KILL)
-                                set_bit(STATUS_CT_KILL, &priv->status);
-                        tt->state = old_state;
-                } else {
-                        IWL_DEBUG_POWER(priv,
-                                        "Thermal Throttling to new state: %u\n",
-                                        tt->state);
-                        if (old_state != IWL_TI_CT_KILL &&
-                            tt->state == IWL_TI_CT_KILL) {
-                                if (force) {
-                                        IWL_DEBUG_POWER(priv,
-                                                "Enter IWL_TI_CT_KILL\n");
-                                        set_bit(STATUS_CT_KILL, &priv->status);
-                                        iwl_perform_ct_kill_task(priv, true);
-                                } else {
-                                        iwl_prepare_ct_kill_task(priv);
-                                        tt->state = old_state;
-                                }
-                        } else if (old_state == IWL_TI_CT_KILL &&
-                                  tt->state != IWL_TI_CT_KILL) {
-                                IWL_DEBUG_POWER(priv, "Exit IWL_TI_CT_KILL\n");
-                                iwl_perform_ct_kill_task(priv, false);
-                        }
-                }
-                mutex_unlock(&priv->mutex);
-        }
-}
-
-/* Card State Notification indicated reach critical temperature
- * if PSP not enable, no Thermal Throttling function will be performed
- * just set the GP1 bit to acknowledge the event
- * otherwise, go into IWL_TI_CT_KILL state
- * since Card State Notification will not provide any temperature reading
- * for Legacy mode
- * so just pass the CT_KILL temperature to iwl_legacy_tt_handler()
- * for advance mode
- * pass CT_KILL_THRESHOLD+1 to make sure move into IWL_TI_CT_KILL state
- */
-static void iwl_bg_ct_enter(struct work_struct *work)
-{
-        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_enter);
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (!iwl_is_ready(priv))
-                return;
-
-        if (tt->state != IWL_TI_CT_KILL) {
-                IWL_ERR(priv, "Device reached critical temperature "
-                              "- ucode going to sleep!\n");
-                if (!priv->thermal_throttle.advanced_tt)
-                        iwl_legacy_tt_handler(priv,
-                                              IWL_MINIMAL_POWER_THRESHOLD,
-                                              true);
-                else
-                        iwl_advance_tt_handler(priv,
-                                               CT_KILL_THRESHOLD + 1, true);
-        }
-}
-
-/* Card State Notification indicated out of critical temperature
- * since Card State Notification will not provide any temperature reading
- * so pass the IWL_REDUCED_PERFORMANCE_THRESHOLD_2 temperature
- * to iwl_legacy_tt_handler() to get out of IWL_CT_KILL state
- */
-static void iwl_bg_ct_exit(struct work_struct *work)
-{
-        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_exit);
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (!iwl_is_ready(priv))
-                return;
-
-        /* stop ct_kill_exit_tm timer */
-        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
-
-        if (tt->state == IWL_TI_CT_KILL) {
-                IWL_ERR(priv,
-                        "Device temperature below critical"
-                        "- ucode awake!\n");
-                /*
-                 * exit from CT_KILL state
-                 * reset the current temperature reading
-                 */
-                priv->temperature = 0;
-                if (!priv->thermal_throttle.advanced_tt)
-                        iwl_legacy_tt_handler(priv,
-                                              IWL_REDUCED_PERFORMANCE_THRESHOLD_2,
-                                              true);
-                else
-                        iwl_advance_tt_handler(priv, CT_KILL_EXIT_THRESHOLD,
-                                               true);
-        }
-}
-
-void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        IWL_DEBUG_POWER(priv, "Queueing critical temperature enter.\n");
-        queue_work(priv->workqueue, &priv->ct_enter);
-}
-EXPORT_SYMBOL(iwl_tt_enter_ct_kill);
-
-void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        IWL_DEBUG_POWER(priv, "Queueing critical temperature exit.\n");
-        queue_work(priv->workqueue, &priv->ct_exit);
-}
-EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
-
-static void iwl_bg_tt_work(struct work_struct *work)
-{
-        struct iwl_priv *priv = container_of(work, struct iwl_priv, tt_work);
-        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (priv->cfg->temperature_kelvin)
-                temp = KELVIN_TO_CELSIUS(priv->temperature);
-
-        if (!priv->thermal_throttle.advanced_tt)
-                iwl_legacy_tt_handler(priv, temp, false);
-        else
-                iwl_advance_tt_handler(priv, temp, false);
-}
-
-void iwl_tt_handler(struct iwl_priv *priv)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        IWL_DEBUG_POWER(priv, "Queueing thermal throttling work.\n");
-        queue_work(priv->workqueue, &priv->tt_work);
-}
-EXPORT_SYMBOL(iwl_tt_handler);
-
-/* Thermal throttling initialization
- * For advance thermal throttling:
- *     Initialize Thermal Index and temperature threshold table
- *     Initialize thermal throttling restriction table
- */
-void iwl_tt_initialize(struct iwl_priv *priv)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        int size = sizeof(struct iwl_tt_trans) * (IWL_TI_STATE_MAX - 1);
-        struct iwl_tt_trans *transaction;
-
-        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling\n");
-
-        memset(tt, 0, sizeof(struct iwl_tt_mgmt));
-
-        tt->state = IWL_TI_0;
-        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
-        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_exit_tm.function =
-                iwl_tt_check_exit_ct_kill;
-        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
-        priv->thermal_throttle.ct_kill_waiting_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_waiting_tm.function =
-                iwl_tt_ready_for_ct_kill;
-        /* setup deferred ct kill work */
-        INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
-        INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
-        INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
-
-        if (priv->cfg->adv_thermal_throttle) {
-                IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
-                tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
-                                         IWL_TI_STATE_MAX, GFP_KERNEL);
-                tt->transaction = kzalloc(sizeof(struct iwl_tt_trans) *
-                        IWL_TI_STATE_MAX * (IWL_TI_STATE_MAX - 1),
-                        GFP_KERNEL);
-                if (!tt->restriction || !tt->transaction) {
-                        IWL_ERR(priv, "Fallback to Legacy Throttling\n");
-                        priv->thermal_throttle.advanced_tt = false;
-                        kfree(tt->restriction);
-                        tt->restriction = NULL;
-                        kfree(tt->transaction);
-                        tt->transaction = NULL;
-                } else {
-                        transaction = tt->transaction +
-                                (IWL_TI_0 * (IWL_TI_STATE_MAX - 1));
-                        memcpy(transaction, &tt_range_0[0], size);
-                        transaction = tt->transaction +
-                                (IWL_TI_1 * (IWL_TI_STATE_MAX - 1));
-                        memcpy(transaction, &tt_range_1[0], size);
-                        transaction = tt->transaction +
-                                (IWL_TI_2 * (IWL_TI_STATE_MAX - 1));
-                        memcpy(transaction, &tt_range_2[0], size);
-                        transaction = tt->transaction +
-                                (IWL_TI_CT_KILL * (IWL_TI_STATE_MAX - 1));
-                        memcpy(transaction, &tt_range_3[0], size);
-                        size = sizeof(struct iwl_tt_restriction) *
-                                IWL_TI_STATE_MAX;
-                        memcpy(tt->restriction,
-                                &restriction_range[0], size);
-                        priv->thermal_throttle.advanced_tt = true;
-                }
-        } else {
-                IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
-                priv->thermal_throttle.advanced_tt = false;
-        }
-}
-EXPORT_SYMBOL(iwl_tt_initialize);
-
-/* cleanup thermal throttling management related memory and timer */
-void iwl_tt_exit(struct iwl_priv *priv)
-{
-        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-
-        /* stop ct_kill_exit_tm timer if activated */
-        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
-        /* stop ct_kill_waiting_tm timer if activated */
-        del_timer_sync(&priv->thermal_throttle.ct_kill_waiting_tm);
-        cancel_work_sync(&priv->tt_work);
-        cancel_work_sync(&priv->ct_enter);
-        cancel_work_sync(&priv->ct_exit);
-
-        if (priv->thermal_throttle.advanced_tt) {
-                /* free advance thermal throttling memory */
-                kfree(tt->restriction);
-                tt->restriction = NULL;
-                kfree(tt->transaction);
-                tt->transaction = NULL;
-        }
-}
-EXPORT_SYMBOL(iwl_tt_exit);
-
 /* initialize to default */
 void iwl_power_initialize(struct iwl_priv *priv)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index 5db91c10dcc8..df81565a7cc4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -30,90 +30,6 @@
 
 #include "iwl-commands.h"
 
-#define IWL_ABSOLUTE_ZERO               0
-#define IWL_ABSOLUTE_MAX                0xFFFFFFFF
-#define IWL_TT_INCREASE_MARGIN  5
-#define IWL_TT_CT_KILL_MARGIN   3
-
-enum iwl_antenna_ok {
-        IWL_ANT_OK_NONE,
-        IWL_ANT_OK_SINGLE,
-        IWL_ANT_OK_MULTI,
-};
-
-/* Thermal Throttling State Machine states */
-enum  iwl_tt_state {
-        IWL_TI_0,       /* normal temperature, system power state */
-        IWL_TI_1,       /* high temperature detect, low power state */
-        IWL_TI_2,       /* higher temperature detected, lower power state */
-        IWL_TI_CT_KILL, /* critical temperature detected, lowest power state */
-        IWL_TI_STATE_MAX
-};
-
-/**
- * struct iwl_tt_restriction - Thermal Throttling restriction table
- * @tx_stream: number of tx stream allowed
- * @is_ht: ht enable/disable
- * @rx_stream: number of rx stream allowed
- *
- * This table is used by advance thermal throttling management
- * based on the current thermal throttling state, and determines
- * the number of tx/rx streams and the status of HT operation.
- */
-struct iwl_tt_restriction {
-        enum iwl_antenna_ok tx_stream;
-        enum iwl_antenna_ok rx_stream;
-        bool is_ht;
-};
-
-/**
- * struct iwl_tt_trans - Thermal Throttling transaction table
- * @next_state:  next thermal throttling mode
- * @tt_low: low temperature threshold to change state
- * @tt_high: high temperature threshold to change state
- *
- * This is used by the advanced thermal throttling algorithm
- * to determine the next thermal state to go based on the
- * current temperature.
- */
-struct iwl_tt_trans {
-        enum iwl_tt_state next_state;
-        u32 tt_low;
-        u32 tt_high;
-};
-
-/**
- * struct iwl_tt_mgnt - Thermal Throttling Management structure
- * @advanced_tt:    advanced thermal throttle required
- * @state:          current Thermal Throttling state
- * @tt_power_mode:  Thermal Throttling power mode index
- *                  being used to set power level when
- *                  when thermal throttling state != IWL_TI_0
- *                  the tt_power_mode should set to different
- *                  power mode based on the current tt state
- * @tt_previous_temperature: last measured temperature
- * @iwl_tt_restriction: ptr to restriction tbl, used by advance
- *                  thermal throttling to determine how many tx/rx streams
- *                  should be used in tt state; and can HT be enabled or not
- * @iwl_tt_trans: ptr to adv trans table, used by advance thermal throttling
- *                  state transaction
- * @ct_kill_toggle: used to toggle the CSR bit when checking uCode temperature
- * @ct_kill_exit_tm: timer to exit thermal kill
- */
-struct iwl_tt_mgmt {
-        enum iwl_tt_state state;
-        bool advanced_tt;
-        u8 tt_power_mode;
-        bool ct_kill_toggle;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        s32 tt_previous_temp;
-#endif
-        struct iwl_tt_restriction *restriction;
-        struct iwl_tt_trans *transaction;
-        struct timer_list ct_kill_exit_tm;
-        struct timer_list ct_kill_waiting_tm;
-};
-
 enum iwl_power_level {
         IWL_POWER_INDEX_1,
         IWL_POWER_INDEX_2,
@@ -130,15 +46,6 @@ struct iwl_power_mgr {
 };
 
 int iwl_power_update_mode(struct iwl_priv *priv, bool force);
-bool iwl_ht_enabled(struct iwl_priv *priv);
-bool iwl_within_ct_kill_margin(struct iwl_priv *priv);
-enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv);
-enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv);
-void iwl_tt_enter_ct_kill(struct iwl_priv *priv);
-void iwl_tt_exit_ct_kill(struct iwl_priv *priv);
-void iwl_tt_handler(struct iwl_priv *priv);
-void iwl_tt_initialize(struct iwl_priv *priv);
-void iwl_tt_exit(struct iwl_priv *priv);
 void iwl_power_initialize(struct iwl_priv *priv);
 
 extern bool no_sleep_autoadjust;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index b1f101caf19d..5469655646ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -306,7 +306,7 @@
  *     at a time, until receiving ACK from receiving station, or reaching
  *     retry limit and giving up.
  *
- *     The command queue (#4) must use this mode!
+ *     The command queue (#4/#9) must use this mode!
  *     This mode does not require use of the Byte Count table in host DRAM.
  *
  * Driver controls scheduler operation via 3 means:
@@ -322,7 +322,7 @@
  *     (1024 bytes for each queue).
  *
  * After receiving "Alive" response from uCode, driver must initialize
- * the scheduler (especially for queue #4, the command queue, otherwise
+ * the scheduler (especially for queue #4/#9, the command queue, otherwise
  * the driver can't issue commands!):
  */
 
@@ -555,8 +555,9 @@
 #define IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
         ((IWLAGN_SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffc)
 
-#define IWLAGN_SCD_QUEUECHAIN_SEL_ALL(x)                (((1<<(x)) - 1) &\
-        (~(1<<IWL_CMD_QUEUE_NUM)))
+#define IWLAGN_SCD_QUEUECHAIN_SEL_ALL(priv)     \
+        (((1<<(priv)->hw_params.max_txq_num) - 1) &\
+        (~(1<<(priv)->cmd_queue)))
 
 #define IWLAGN_SCD_BASE                 (PRPH_BASE + 0xa02c00)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 79773e353baa..10be197b0f22 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -228,7 +228,7 @@ void iwl_recover_from_statistics(struct iwl_priv *priv,
 {
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_any_associated(priv)) {
                 if (priv->cfg->ops->lib->check_ack_health) {
                         if (!priv->cfg->ops->lib->check_ack_health(
                             priv, pkt)) {
@@ -266,7 +266,12 @@ int iwl_set_decrypted_flag(struct iwl_priv *priv,
 {
         u16 fc = le16_to_cpu(hdr->frame_control);
 
-        if (priv->active_rxon.filter_flags & RXON_FILTER_DIS_DECRYPT_MSK)
+        /*
+         * All contexts have the same setting here due to it being
+         * a module parameter, so OK to check any context.
+         */
+        if (priv->contexts[IWL_RXON_CTX_BSS].active.filter_flags &
+                                                RXON_FILTER_DIS_DECRYPT_MSK)
                 return 0;
 
         if (!(fc & IEEE80211_FCTL_PROTECTED))
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index a4b3663a262f..c54c20023e7c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -54,100 +54,134 @@
 #define IWL_PASSIVE_DWELL_BASE      (100)
 #define IWL_CHANNEL_TUNE_TIME       5
 
+static int iwl_send_scan_abort(struct iwl_priv *priv)
+{
+        int ret;
+        struct iwl_rx_packet *pkt;
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_SCAN_ABORT_CMD,
+                .flags = CMD_WANT_SKB,
+        };
 
+        /* Exit instantly with error when device is not ready
+         * to receive scan abort command or it does not perform
+         * hardware scan currently */
+        if (!test_bit(STATUS_READY, &priv->status) ||
+            !test_bit(STATUS_GEO_CONFIGURED, &priv->status) ||
+            !test_bit(STATUS_SCAN_HW, &priv->status) ||
+            test_bit(STATUS_FW_ERROR, &priv->status) ||
+            test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return -EIO;
 
-/**
- * iwl_scan_cancel - Cancel any currently executing HW scan
- *
- * NOTE: priv->mutex is not required before calling this function
- */
-int iwl_scan_cancel(struct iwl_priv *priv)
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret)
+                return ret;
+
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->u.status != CAN_ABORT_STATUS) {
+                /* The scan abort will return 1 for success or
+                 * 2 for "failure".  A failure condition can be
+                 * due to simply not being in an active scan which
+                 * can occur if we send the scan abort before we
+                 * the microcode has notified us that a scan is
+                 * completed. */
+                IWL_DEBUG_SCAN(priv, "SCAN_ABORT ret %d.\n", pkt->u.status);
+                ret = -EIO;
+        }
+
+        iwl_free_pages(priv, cmd.reply_page);
+        return ret;
+}
+
+static void iwl_complete_scan(struct iwl_priv *priv, bool aborted)
 {
-        if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
-                clear_bit(STATUS_SCANNING, &priv->status);
-                return 0;
+        /* check if scan was requested from mac80211 */
+        if (priv->scan_request) {
+                IWL_DEBUG_SCAN(priv, "Complete scan in mac80211\n");
+                ieee80211_scan_completed(priv->hw, aborted);
         }
 
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
-                if (!test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                        IWL_DEBUG_SCAN(priv, "Queuing scan abort.\n");
-                        queue_work(priv->workqueue, &priv->abort_scan);
+        priv->is_internal_short_scan = false;
+        priv->scan_vif = NULL;
+        priv->scan_request = NULL;
+}
 
-                } else
-                        IWL_DEBUG_SCAN(priv, "Scan abort already in progress.\n");
+void iwl_force_scan_end(struct iwl_priv *priv)
+{
+        lockdep_assert_held(&priv->mutex);
 
-                return test_bit(STATUS_SCANNING, &priv->status);
+        if (!test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Forcing scan end while not scanning\n");
+                return;
         }
 
+        IWL_DEBUG_SCAN(priv, "Forcing scan end\n");
+        clear_bit(STATUS_SCANNING, &priv->status);
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCAN_ABORTING, &priv->status);
+        iwl_complete_scan(priv, true);
+}
+EXPORT_SYMBOL(iwl_force_scan_end);
+
+static void iwl_do_scan_abort(struct iwl_priv *priv)
+{
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (!test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Not performing scan to abort\n");
+                return;
+        }
+
+        if (test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan abort in progress\n");
+                return;
+        }
+
+        ret = iwl_send_scan_abort(priv);
+        if (ret) {
+                IWL_DEBUG_SCAN(priv, "Send scan abort failed %d\n", ret);
+                iwl_force_scan_end(priv);
+        } else
+                IWL_DEBUG_SCAN(priv, "Sucessfully send scan abort\n");
+}
+
+/**
+ * iwl_scan_cancel - Cancel any currently executing HW scan
+ */
+int iwl_scan_cancel(struct iwl_priv *priv)
+{
+        IWL_DEBUG_SCAN(priv, "Queuing abort scan\n");
+        queue_work(priv->workqueue, &priv->abort_scan);
         return 0;
 }
 EXPORT_SYMBOL(iwl_scan_cancel);
+
 /**
  * iwl_scan_cancel_timeout - Cancel any currently executing HW scan
  * @ms: amount of time to wait (in milliseconds) for scan to abort
  *
- * NOTE: priv->mutex must be held before calling this function
  */
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms)
 {
-        unsigned long now = jiffies;
-        int ret;
-
-        ret = iwl_scan_cancel(priv);
-        if (ret && ms) {
-                mutex_unlock(&priv->mutex);
-                while (!time_after(jiffies, now + msecs_to_jiffies(ms)) &&
-                                test_bit(STATUS_SCANNING, &priv->status))
-                        msleep(1);
-                mutex_lock(&priv->mutex);
-
-                return test_bit(STATUS_SCANNING, &priv->status);
-        }
+        unsigned long timeout = jiffies + msecs_to_jiffies(ms);
 
-        return ret;
-}
-EXPORT_SYMBOL(iwl_scan_cancel_timeout);
+        lockdep_assert_held(&priv->mutex);
 
-static int iwl_send_scan_abort(struct iwl_priv *priv)
-{
-        int ret = 0;
-        struct iwl_rx_packet *pkt;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SCAN_ABORT_CMD,
-                .flags = CMD_WANT_SKB,
-        };
+        IWL_DEBUG_SCAN(priv, "Scan cancel timeout\n");
 
-        /* If there isn't a scan actively going on in the hardware
-         * then we are in between scan bands and not actually
-         * actively scanning, so don't send the abort command */
-        if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                return 0;
-        }
+        iwl_do_scan_abort(priv);
 
-        ret = iwl_send_cmd_sync(priv, &cmd);
-        if (ret) {
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                return ret;
+        while (time_before_eq(jiffies, timeout)) {
+                if (!test_bit(STATUS_SCAN_HW, &priv->status))
+                        break;
+                msleep(20);
         }
 
-        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (pkt->u.status != CAN_ABORT_STATUS) {
-                /* The scan abort will return 1 for success or
-                 * 2 for "failure".  A failure condition can be
-                 * due to simply not being in an active scan which
-                 * can occur if we send the scan abort before we
-                 * the microcode has notified us that a scan is
-                 * completed. */
-                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", pkt->u.status);
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-                clear_bit(STATUS_SCAN_HW, &priv->status);
-        }
-
-        iwl_free_pages(priv, cmd.reply_page);
-
-        return ret;
+        return test_bit(STATUS_SCAN_HW, &priv->status);
 }
+EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 
 /* Service response to REPLY_SCAN_CMD (0x80) */
 static void iwl_rx_reply_scan(struct iwl_priv *priv,
@@ -158,7 +192,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
         struct iwl_scanreq_notification *notif =
             (struct iwl_scanreq_notification *)pkt->u.raw;
 
-        IWL_DEBUG_RX(priv, "Scan request status = 0x%x\n", notif->status);
+        IWL_DEBUG_SCAN(priv, "Scan request status = 0x%x\n", notif->status);
 #endif
 }
 
@@ -206,7 +240,6 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
 static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb)
 {
-#ifdef CONFIG_IWLWIFI_DEBUG
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
 
@@ -214,29 +247,37 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                        scan_notif->scanned_channels,
                        scan_notif->tsf_low,
                        scan_notif->tsf_high, scan_notif->status);
-#endif
 
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan on %sGHz took %dms\n",
+        IWL_DEBUG_SCAN(priv, "Scan on %sGHz took %dms\n",
                        (priv->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
                                         (priv->scan_start, jiffies)));
 
-        /*
-         * If a request to abort was given, or the scan did not succeed
-         * then we reset the scan state machine and terminate,
-         * re-queuing another scan if one has been requested
-         */
-        if (test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status))
-                IWL_DEBUG_INFO(priv, "Aborted scan completed.\n");
-
-        IWL_DEBUG_INFO(priv, "Setting scan to off\n");
-
-        clear_bit(STATUS_SCANNING, &priv->status);
-
         queue_work(priv->workqueue, &priv->scan_completed);
+
+        if (priv->iw_mode != NL80211_IFTYPE_ADHOC &&
+            priv->cfg->advanced_bt_coexist &&
+            priv->bt_status != scan_notif->bt_status) {
+                if (scan_notif->bt_status) {
+                        /* BT on */
+                        if (!priv->bt_ch_announce)
+                                priv->bt_traffic_load =
+                                        IWL_BT_COEX_TRAFFIC_LOAD_HIGH;
+                        /*
+                         * otherwise, no traffic load information provided
+                         * no changes made
+                         */
+                } else {
+                        /* BT off */
+                        priv->bt_traffic_load =
+                                IWL_BT_COEX_TRAFFIC_LOAD_NONE;
+                }
+                priv->bt_status = scan_notif->bt_status;
+                queue_work(priv->workqueue, &priv->bt_traffic_change_work);
+        }
 }
 
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
@@ -268,18 +309,28 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
                                enum ieee80211_band band,
                                struct ieee80211_vif *vif)
 {
+        struct iwl_rxon_context *ctx;
         u16 passive = (band == IEEE80211_BAND_2GHZ) ?
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
 
-        if (iwl_is_associated(priv)) {
-                /* If we're associated, we clamp the maximum passive
-                 * dwell time to be 98% of the beacon interval (minus
-                 * 2 * channel tune time) */
-                passive = vif ? vif->bss_conf.beacon_int : 0;
-                if ((passive > IWL_PASSIVE_DWELL_BASE) || !passive)
-                        passive = IWL_PASSIVE_DWELL_BASE;
-                passive = (passive * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
+        if (iwl_is_any_associated(priv)) {
+                /*
+                 * If we're associated, we clamp the maximum passive
+                 * dwell time to be 98% of the smallest beacon interval
+                 * (minus 2 * channel tune time)
+                 */
+                for_each_context(priv, ctx) {
+                        u16 value;
+
+                        if (!iwl_is_associated_ctx(ctx))
+                                continue;
+                        value = ctx->vif ? ctx->vif->bss_conf.beacon_int : 0;
+                        if ((value > IWL_PASSIVE_DWELL_BASE) || !value)
+                                value = IWL_PASSIVE_DWELL_BASE;
+                        value = (value * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
+                        passive = min(value, passive);
+                }
         }
 
         return passive;
@@ -296,19 +347,53 @@ void iwl_init_scan_params(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_init_scan_params);
 
-static int iwl_scan_initiate(struct iwl_priv *priv, struct ieee80211_vif *vif)
+static int __must_check iwl_scan_initiate(struct iwl_priv *priv,
+                                          struct ieee80211_vif *vif,
+                                          bool internal,
+                                          enum ieee80211_band band)
 {
+        int ret;
+
         lockdep_assert_held(&priv->mutex);
 
-        IWL_DEBUG_INFO(priv, "Starting scan...\n");
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                return -EOPNOTSUPP;
+
+        cancel_delayed_work(&priv->scan_check);
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_WARN(priv, "Request scan called when driver not ready.\n");
+                return -EIO;
+        }
+
+        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                IWL_DEBUG_SCAN(priv,
+                        "Multiple concurrent scan requests in parallel.\n");
+                return -EBUSY;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan request while abort pending.\n");
+                return -EBUSY;
+        }
+
+        IWL_DEBUG_SCAN(priv, "Starting %sscan...\n",
+                        internal ? "internal short " : "");
+
         set_bit(STATUS_SCANNING, &priv->status);
-        priv->is_internal_short_scan = false;
+        priv->is_internal_short_scan = internal;
         priv->scan_start = jiffies;
+        priv->scan_band = band;
 
-        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
-                return -EOPNOTSUPP;
+        ret = priv->cfg->ops->utils->request_scan(priv, vif);
+        if (ret) {
+                clear_bit(STATUS_SCANNING, &priv->status);
+                priv->is_internal_short_scan = false;
+                return ret;
+        }
 
-        priv->cfg->ops->utils->request_scan(priv, vif);
+        queue_delayed_work(priv->workqueue, &priv->scan_check,
+                           IWL_SCAN_CHECK_WATCHDOG);
 
         return 0;
 }
@@ -327,12 +412,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
-                IWL_DEBUG_MAC80211(priv, "leave - not ready or exit pending\n");
-                goto out_unlock;
-        }
-
         if (test_bit(STATUS_SCANNING, &priv->status) &&
             !priv->is_internal_short_scan) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
@@ -340,14 +419,7 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-
         /* mac80211 will only ask for one band at a time */
-        priv->scan_band = req->channels[0]->band;
         priv->scan_request = req;
         priv->scan_vif = vif;
 
@@ -355,10 +427,12 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
          * If an internal scan is in progress, just set
          * up the scan_request as per above.
          */
-        if (priv->is_internal_short_scan)
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
                 ret = 0;
-        else
-                ret = iwl_scan_initiate(priv, vif);
+        } else
+                ret = iwl_scan_initiate(priv, vif, false,
+                                        req->channels[0]->band);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
@@ -378,11 +452,13 @@ void iwl_internal_short_hw_scan(struct iwl_priv *priv)
         queue_work(priv->workqueue, &priv->start_internal_scan);
 }
 
-void iwl_bg_start_internal_scan(struct work_struct *work)
+static void iwl_bg_start_internal_scan(struct work_struct *work)
 {
         struct iwl_priv *priv =
                 container_of(work, struct iwl_priv, start_internal_scan);
 
+        IWL_DEBUG_SCAN(priv, "Start internal scan\n");
+
         mutex_lock(&priv->mutex);
 
         if (priv->is_internal_short_scan == true) {
@@ -390,56 +466,31 @@ void iwl_bg_start_internal_scan(struct work_struct *work)
                 goto unlock;
         }
 
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto unlock;
-        }
-
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
                 goto unlock;
         }
 
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                goto unlock;
-        }
-
-        priv->scan_band = priv->band;
-
-        IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
-        set_bit(STATUS_SCANNING, &priv->status);
-        priv->is_internal_short_scan = true;
-
-        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
-                goto unlock;
-
-        priv->cfg->ops->utils->request_scan(priv, NULL);
+        if (iwl_scan_initiate(priv, NULL, true, priv->band))
+                IWL_DEBUG_SCAN(priv, "failed to start internal short scan\n");
  unlock:
         mutex_unlock(&priv->mutex);
 }
-EXPORT_SYMBOL(iwl_bg_start_internal_scan);
 
-void iwl_bg_scan_check(struct work_struct *data)
+static void iwl_bg_scan_check(struct work_struct *data)
 {
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, scan_check.work);
 
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+        IWL_DEBUG_SCAN(priv, "Scan check work\n");
 
+        /* Since we are here firmware does not finish scan and
+         * most likely is in bad shape, so we don't bother to
+         * send abort command, just force scan complete to mac80211 */
         mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            !test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan completion watchdog (%dms)\n",
-                               jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
-
-                if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
-                        iwl_send_scan_abort(priv);
-        }
+        iwl_force_scan_end(priv);
         mutex_unlock(&priv->mutex);
 }
-EXPORT_SYMBOL(iwl_bg_scan_check);
 
 /**
  * iwl_fill_probe_req - fill in all required fields and IE for probe request
@@ -489,48 +540,69 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
 }
 EXPORT_SYMBOL(iwl_fill_probe_req);
 
-void iwl_bg_abort_scan(struct work_struct *work)
+static void iwl_bg_abort_scan(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
 
-        if (!test_bit(STATUS_READY, &priv->status) ||
-            !test_bit(STATUS_GEO_CONFIGURED, &priv->status))
-                return;
-
-        cancel_delayed_work(&priv->scan_check);
+        IWL_DEBUG_SCAN(priv, "Abort scan work\n");
 
+        /* We keep scan_check work queued in case when firmware will not
+         * report back scan completed notification */
         mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status))
-                iwl_send_scan_abort(priv);
+        iwl_scan_cancel_timeout(priv, 200);
         mutex_unlock(&priv->mutex);
 }
-EXPORT_SYMBOL(iwl_bg_abort_scan);
 
-void iwl_bg_scan_completed(struct work_struct *work)
+static void iwl_bg_scan_completed(struct work_struct *work)
 {
         struct iwl_priv *priv =
             container_of(work, struct iwl_priv, scan_completed);
-        bool internal = false;
+        bool aborted;
+        struct iwl_rxon_context *ctx;
 
-        IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
+        IWL_DEBUG_SCAN(priv, "Completed %sscan.\n",
+                       priv->is_internal_short_scan ? "internal short " : "");
 
         cancel_delayed_work(&priv->scan_check);
 
         mutex_lock(&priv->mutex);
-        if (priv->is_internal_short_scan) {
-                priv->is_internal_short_scan = false;
-                IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
-                internal = true;
-        } else {
-                priv->scan_request = NULL;
-                priv->scan_vif = NULL;
+
+        aborted = test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status);
+        if (aborted)
+                IWL_DEBUG_SCAN(priv, "Aborted scan completed.\n");
+
+        if (!test_and_clear_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan already completed.\n");
+                goto out_settings;
         }
 
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+        if (priv->is_internal_short_scan && !aborted) {
+                int err;
+
+                /* Check if mac80211 requested scan during our internal scan */
+                if (priv->scan_request == NULL)
+                        goto out_complete;
+
+                /* If so request a new scan */
+                err = iwl_scan_initiate(priv, priv->scan_vif, false,
+                                        priv->scan_request->channels[0]->band);
+                if (err) {
+                        IWL_DEBUG_SCAN(priv,
+                                "failed to initiate pending scan: %d\n", err);
+                        aborted = true;
+                        goto out_complete;
+                }
+
                 goto out;
+        }
 
-        if (internal && priv->scan_request)
-                iwl_scan_initiate(priv, priv->scan_vif);
+out_complete:
+        iwl_complete_scan(priv, aborted);
+
+out_settings:
+        /* Can we still talk to firmware ? */
+        if (!iwl_is_ready_rf(priv))
+                goto out;
 
         /* Since setting the TXPOWER may have been deferred while
          * performing the scan, fire one off */
@@ -540,22 +612,15 @@ void iwl_bg_scan_completed(struct work_struct *work)
          * Since setting the RXON may have been deferred while
          * performing the scan, fire one off if needed
          */
-        if (memcmp(&priv->active_rxon,
-                   &priv->staging_rxon, sizeof(priv->staging_rxon)))
-                iwlcore_commit_rxon(priv);
+        for_each_context(priv, ctx)
+                iwlcore_commit_rxon(priv, ctx);
+
+        if (priv->cfg->ops->hcmd->set_pan_params)
+                priv->cfg->ops->hcmd->set_pan_params(priv);
 
  out:
         mutex_unlock(&priv->mutex);
-
-        /*
-         * Do not hold mutex here since this will cause mac80211 to call
-         * into driver again into functions that will attempt to take
-         * mutex.
-         */
-        if (!internal)
-                ieee80211_scan_completed(priv->hw, false);
 }
-EXPORT_SYMBOL(iwl_bg_scan_completed);
 
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 {
@@ -566,3 +631,16 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
 
+void iwl_cancel_scan_deferred_work(struct iwl_priv *priv)
+{
+        cancel_work_sync(&priv->start_internal_scan);
+        cancel_work_sync(&priv->abort_scan);
+        cancel_work_sync(&priv->scan_completed);
+
+        if (cancel_delayed_work_sync(&priv->scan_check)) {
+                mutex_lock(&priv->mutex);
+                iwl_force_scan_end(priv);
+                mutex_unlock(&priv->mutex);
+        }
+}
+EXPORT_SYMBOL(iwl_cancel_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 7e0829be5e78..6edd0341dfe2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -172,12 +172,14 @@ int iwl_send_add_sta(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_send_add_sta);
 
 static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
-                                   struct ieee80211_sta_ht_cap *sta_ht_inf)
+                                   struct ieee80211_sta *sta,
+                                   struct iwl_rxon_context *ctx)
 {
+        struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
         __le32 sta_flags;
         u8 mimo_ps_mode;
 
-        if (!sta_ht_inf || !sta_ht_inf->ht_supported)
+        if (!sta || !sta_ht_inf->ht_supported)
                 goto done;
 
         mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
@@ -211,7 +213,7 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
         sta_flags |= cpu_to_le32(
               (u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
 
-        if (iwl_is_ht40_tx_allowed(priv, sta_ht_inf))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
                 sta_flags |= STA_FLG_HT40_EN_MSK;
         else
                 sta_flags &= ~STA_FLG_HT40_EN_MSK;
@@ -226,9 +228,9 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
  *
  * should be called with sta_lock held
  */
-static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
-                           bool is_ap,
-                           struct ieee80211_sta_ht_cap *ht_info)
+static u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           const u8 *addr, bool is_ap,
+                           struct ieee80211_sta *sta)
 {
         struct iwl_station_entry *station;
         int i;
@@ -236,9 +238,9 @@ static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
         u16 rate;
 
         if (is_ap)
-                sta_id = IWL_AP_ID;
+                sta_id = ctx->ap_sta_id;
         else if (is_broadcast_ether_addr(addr))
-                sta_id = priv->hw_params.bcast_sta_id;
+                sta_id = ctx->bcast_sta_id;
         else
                 for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++) {
                         if (!compare_ether_addr(priv->stations[i].sta.sta.addr,
@@ -289,14 +291,22 @@ static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
         memcpy(station->sta.sta.addr, addr, ETH_ALEN);
         station->sta.mode = 0;
         station->sta.sta.sta_id = sta_id;
-        station->sta.station_flags = 0;
+        station->sta.station_flags = ctx->station_flags;
+        station->ctxid = ctx->ctxid;
+
+        if (sta) {
+                struct iwl_station_priv_common *sta_priv;
+
+                sta_priv = (void *)sta->drv_priv;
+                sta_priv->ctx = ctx;
+        }
 
         /*
          * OK to call unconditionally, since local stations (IBSS BSSID
-         * STA and broadcast STA) pass in a NULL ht_info, and mac80211
+         * STA and broadcast STA) pass in a NULL sta, and mac80211
          * doesn't allow HT IBSS.
          */
-        iwl_set_ht_add_station(priv, sta_id, ht_info);
+        iwl_set_ht_add_station(priv, sta_id, sta, ctx);
 
         /* 3945 only */
         rate = (priv->band == IEEE80211_BAND_5GHZ) ?
@@ -313,10 +323,9 @@ static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
 /**
  * iwl_add_station_common -
  */
-int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
-                                  bool is_ap,
-                                  struct ieee80211_sta_ht_cap *ht_info,
-                                  u8 *sta_id_r)
+int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           const u8 *addr, bool is_ap,
+                           struct ieee80211_sta *sta, u8 *sta_id_r)
 {
         unsigned long flags_spin;
         int ret = 0;
@@ -325,7 +334,7 @@ int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
 
         *sta_id_r = 0;
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
-        sta_id = iwl_prep_station(priv, addr, is_ap, ht_info);
+        sta_id = iwl_prep_station(priv, ctx, addr, is_ap, sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_ERR(priv, "Unable to prepare station %pM for addition\n",
                         addr);
@@ -377,7 +386,8 @@ static struct iwl_link_quality_cmd *iwl_sta_alloc_lq(struct iwl_priv *priv,
 {
         int i, r;
         struct iwl_link_quality_cmd *link_cmd;
-        u32 rate_flags;
+        u32 rate_flags = 0;
+        __le32 rate_n_flags;
 
         link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
         if (!link_cmd) {
@@ -391,18 +401,14 @@ static struct iwl_link_quality_cmd *iwl_sta_alloc_lq(struct iwl_priv *priv,
         else
                 r = IWL_RATE_1M_INDEX;
 
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
+        if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                rate_flags |= RATE_MCS_CCK_MSK;
 
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+        rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
                                 RATE_MCS_ANT_POS;
-
-                link_cmd->rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
-        }
+        rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
+                link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
 
         link_cmd->general_params.single_stream_ant_msk =
                                 first_antenna(priv->hw_params.valid_tx_ant);
@@ -431,8 +437,8 @@ static struct iwl_link_quality_cmd *iwl_sta_alloc_lq(struct iwl_priv *priv,
  *
  * Function sleeps.
  */
-int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
-                          u8 *sta_id_r)
+int iwl_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                          const u8 *addr, bool init_rs, u8 *sta_id_r)
 {
         int ret;
         u8 sta_id;
@@ -442,7 +448,7 @@ int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
         if (sta_id_r)
                 *sta_id_r = IWL_INVALID_STATION;
 
-        ret = iwl_add_station_common(priv, addr, 0, NULL, &sta_id);
+        ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
         if (ret) {
                 IWL_ERR(priv, "Unable to add station %pM\n", addr);
                 return ret;
@@ -464,7 +470,7 @@ int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
                         return -ENOMEM;
                 }
 
-                ret = iwl_send_lq_cmd(priv, link_cmd, CMD_SYNC, true);
+                ret = iwl_send_lq_cmd(priv, ctx, link_cmd, CMD_SYNC, true);
                 if (ret)
                         IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
 
@@ -616,7 +622,8 @@ EXPORT_SYMBOL_GPL(iwl_remove_station);
  * other than explicit station management would cause this in
  * the ucode, e.g. unassociated RXON.
  */
-void iwl_clear_ucode_stations(struct iwl_priv *priv)
+void iwl_clear_ucode_stations(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx)
 {
         int i;
         unsigned long flags_spin;
@@ -626,6 +633,9 @@ void iwl_clear_ucode_stations(struct iwl_priv *priv)
 
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
         for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if (ctx && ctx->ctxid != priv->stations[i].ctxid)
+                        continue;
+
                 if (priv->stations[i].used & IWL_STA_UCODE_ACTIVE) {
                         IWL_DEBUG_INFO(priv, "Clearing ucode active for station %d\n", i);
                         priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
@@ -647,7 +657,7 @@ EXPORT_SYMBOL(iwl_clear_ucode_stations);
  *
  * Function sleeps.
  */
-void iwl_restore_stations(struct iwl_priv *priv)
+void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
         struct iwl_addsta_cmd sta_cmd;
         struct iwl_link_quality_cmd lq;
@@ -665,6 +675,8 @@ void iwl_restore_stations(struct iwl_priv *priv)
         IWL_DEBUG_ASSOC(priv, "Restoring all known stations ... start.\n");
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
         for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if (ctx->ctxid != priv->stations[i].ctxid)
+                        continue;
                 if ((priv->stations[i].used & IWL_STA_DRIVER_ACTIVE) &&
                             !(priv->stations[i].used & IWL_STA_UCODE_ACTIVE)) {
                         IWL_DEBUG_ASSOC(priv, "Restoring sta %pM\n",
@@ -700,7 +712,7 @@ void iwl_restore_stations(struct iwl_priv *priv)
                          * current LQ command
                          */
                         if (send_lq)
-                                iwl_send_lq_cmd(priv, &lq, CMD_SYNC, true);
+                                iwl_send_lq_cmd(priv, ctx, &lq, CMD_SYNC, true);
                         spin_lock_irqsave(&priv->sta_lock, flags_spin);
                         priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
                 }
@@ -718,7 +730,7 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 {
         int i;
 
-        for (i = 0; i < STA_KEY_MAX_NUM; i++)
+        for (i = 0; i < priv->sta_key_max_num; i++)
                 if (!test_and_set_bit(i, &priv->ucode_key_table))
                         return i;
 
@@ -726,7 +738,9 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_get_free_ucode_key_index);
 
-static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
+static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
+                                      struct iwl_rxon_context *ctx,
+                                      bool send_if_empty)
 {
         int i, not_empty = 0;
         u8 buff[sizeof(struct iwl_wep_cmd) +
@@ -734,7 +748,7 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
         struct iwl_wep_cmd *wep_cmd = (struct iwl_wep_cmd *)buff;
         size_t cmd_size  = sizeof(struct iwl_wep_cmd);
         struct iwl_host_cmd cmd = {
-                .id = REPLY_WEPKEY,
+                .id = ctx->wep_key_cmd,
                 .data = wep_cmd,
                 .flags = CMD_SYNC,
         };
@@ -746,16 +760,16 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
 
         for (i = 0; i < WEP_KEYS_MAX ; i++) {
                 wep_cmd->key[i].key_index = i;
-                if (priv->wep_keys[i].key_size) {
+                if (ctx->wep_keys[i].key_size) {
                         wep_cmd->key[i].key_offset = i;
                         not_empty = 1;
                 } else {
                         wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
                 }
 
-                wep_cmd->key[i].key_size = priv->wep_keys[i].key_size;
-                memcpy(&wep_cmd->key[i].key[3], priv->wep_keys[i].key,
-                                priv->wep_keys[i].key_size);
+                wep_cmd->key[i].key_size = ctx->wep_keys[i].key_size;
+                memcpy(&wep_cmd->key[i].key[3], ctx->wep_keys[i].key,
+                                ctx->wep_keys[i].key_size);
         }
 
         wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
@@ -771,15 +785,17 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
                 return 0;
 }
 
-int iwl_restore_default_wep_keys(struct iwl_priv *priv)
+int iwl_restore_default_wep_keys(struct iwl_priv *priv,
+                                 struct iwl_rxon_context *ctx)
 {
         lockdep_assert_held(&priv->mutex);
 
-        return iwl_send_static_wepkey_cmd(priv, 0);
+        return iwl_send_static_wepkey_cmd(priv, ctx, false);
 }
 EXPORT_SYMBOL(iwl_restore_default_wep_keys);
 
 int iwl_remove_default_wep_key(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx,
                                struct ieee80211_key_conf *keyconf)
 {
         int ret;
@@ -789,13 +805,13 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
         IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
                       keyconf->keyidx);
 
-        memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
+        memset(&ctx->wep_keys[keyconf->keyidx], 0, sizeof(ctx->wep_keys[0]));
         if (iwl_is_rfkill(priv)) {
                 IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
                 /* but keys in device are clear anyway so return success */
                 return 0;
         }
-        ret = iwl_send_static_wepkey_cmd(priv, 1);
+        ret = iwl_send_static_wepkey_cmd(priv, ctx, 1);
         IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                       keyconf->keyidx, ret);
 
@@ -804,6 +820,7 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_remove_default_wep_key);
 
 int iwl_set_default_wep_key(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
                             struct ieee80211_key_conf *keyconf)
 {
         int ret;
@@ -818,13 +835,13 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
 
         keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
         keyconf->hw_key_idx = HW_KEY_DEFAULT;
-        priv->stations[IWL_AP_ID].keyinfo.alg = ALG_WEP;
+        priv->stations[ctx->ap_sta_id].keyinfo.cipher = keyconf->cipher;
 
-        priv->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
-        memcpy(&priv->wep_keys[keyconf->keyidx].key, &keyconf->key,
+        ctx->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
+        memcpy(&ctx->wep_keys[keyconf->keyidx].key, &keyconf->key,
                                                         keyconf->keylen);
 
-        ret = iwl_send_static_wepkey_cmd(priv, 0);
+        ret = iwl_send_static_wepkey_cmd(priv, ctx, false);
         IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
                 keyconf->keylen, keyconf->keyidx, ret);
 
@@ -833,8 +850,9 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_set_default_wep_key);
 
 static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
-                                struct ieee80211_key_conf *keyconf,
-                                u8 sta_id)
+                                        struct iwl_rxon_context *ctx,
+                                        struct ieee80211_key_conf *keyconf,
+                                        u8 sta_id)
 {
         unsigned long flags;
         __le16 key_flags = 0;
@@ -851,12 +869,12 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
         if (keyconf->keylen == WEP_KEY_LEN_128)
                 key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
 
-        if (sta_id == priv->hw_params.bcast_sta_id)
+        if (sta_id == ctx->bcast_sta_id)
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
         priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
         priv->stations[sta_id].keyinfo.keyidx = keyconf->keyidx;
 
@@ -887,8 +905,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
 }
 
 static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
-                                   struct ieee80211_key_conf *keyconf,
-                                   u8 sta_id)
+                                         struct iwl_rxon_context *ctx,
+                                         struct ieee80211_key_conf *keyconf,
+                                         u8 sta_id)
 {
         unsigned long flags;
         __le16 key_flags = 0;
@@ -900,13 +919,13 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
         key_flags &= ~STA_KEY_FLG_INVALID;
 
-        if (sta_id == priv->hw_params.bcast_sta_id)
+        if (sta_id == ctx->bcast_sta_id)
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
         priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
 
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
@@ -936,8 +955,9 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 }
 
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
-                                   struct ieee80211_key_conf *keyconf,
-                                   u8 sta_id)
+                                         struct iwl_rxon_context *ctx,
+                                         struct ieee80211_key_conf *keyconf,
+                                         u8 sta_id)
 {
         unsigned long flags;
         int ret = 0;
@@ -947,7 +967,7 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
         key_flags &= ~STA_KEY_FLG_INVALID;
 
-        if (sta_id == priv->hw_params.bcast_sta_id)
+        if (sta_id == ctx->bcast_sta_id)
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
@@ -955,7 +975,7 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
         priv->stations[sta_id].keyinfo.keylen = 16;
 
         if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
@@ -982,8 +1002,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 }
 
 void iwl_update_tkip_key(struct iwl_priv *priv,
-                        struct ieee80211_key_conf *keyconf,
-                        struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
+                         struct iwl_rxon_context *ctx,
+                         struct ieee80211_key_conf *keyconf,
+                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
 {
         u8 sta_id;
         unsigned long flags;
@@ -995,7 +1016,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                 return;
         }
 
-        sta_id = iwl_sta_id_or_broadcast(priv, sta);
+        sta_id = iwl_sta_id_or_broadcast(priv, ctx, sta);
         if (sta_id == IWL_INVALID_STATION)
                 return;
 
@@ -1018,8 +1039,9 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_update_tkip_key);
 
 int iwl_remove_dynamic_key(struct iwl_priv *priv,
-                                struct ieee80211_key_conf *keyconf,
-                                u8 sta_id)
+                           struct iwl_rxon_context *ctx,
+                           struct ieee80211_key_conf *keyconf,
+                           u8 sta_id)
 {
         unsigned long flags;
         u16 key_flags;
@@ -1028,7 +1050,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
 
         lockdep_assert_held(&priv->mutex);
 
-        priv->key_mapping_key--;
+        ctx->key_mapping_keys--;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         key_flags = le16_to_cpu(priv->stations[sta_id].sta.key.key_flags);
@@ -1080,34 +1102,36 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_remove_dynamic_key);
 
-int iwl_set_dynamic_key(struct iwl_priv *priv,
-                                struct ieee80211_key_conf *keyconf, u8 sta_id)
+int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                        struct ieee80211_key_conf *keyconf, u8 sta_id)
 {
         int ret;
 
         lockdep_assert_held(&priv->mutex);
 
-        priv->key_mapping_key++;
+        ctx->key_mapping_keys++;
         keyconf->hw_key_idx = HW_KEY_DYNAMIC;
 
-        switch (keyconf->alg) {
-        case ALG_CCMP:
-                ret = iwl_set_ccmp_dynamic_key_info(priv, keyconf, sta_id);
+        switch (keyconf->cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
+                ret = iwl_set_ccmp_dynamic_key_info(priv, ctx, keyconf, sta_id);
                 break;
-        case ALG_TKIP:
-                ret = iwl_set_tkip_dynamic_key_info(priv, keyconf, sta_id);
+        case WLAN_CIPHER_SUITE_TKIP:
+                ret = iwl_set_tkip_dynamic_key_info(priv, ctx, keyconf, sta_id);
                 break;
-        case ALG_WEP:
-                ret = iwl_set_wep_dynamic_key_info(priv, keyconf, sta_id);
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                ret = iwl_set_wep_dynamic_key_info(priv, ctx, keyconf, sta_id);
                 break;
         default:
                 IWL_ERR(priv,
-                        "Unknown alg: %s alg = %d\n", __func__, keyconf->alg);
+                        "Unknown alg: %s cipher = %x\n", __func__,
+                        keyconf->cipher);
                 ret = -EINVAL;
         }
 
-        IWL_DEBUG_WEP(priv, "Set dynamic key: alg= %d len=%d idx=%d sta=%d ret=%d\n",
-                      keyconf->alg, keyconf->keylen, keyconf->keyidx,
+        IWL_DEBUG_WEP(priv, "Set dynamic key: cipher=%x len=%d idx=%d sta=%d ret=%d\n",
+                      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
                       sta_id, ret);
 
         return ret;
@@ -1147,16 +1171,16 @@ static inline void iwl_dump_lq_cmd(struct iwl_priv *priv,
  * RXON flags are updated and when LQ command is updated.
  */
 static bool is_lq_table_valid(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx,
                               struct iwl_link_quality_cmd *lq)
 {
         int i;
-        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
 
-        if (ht_conf->is_ht)
+        if (ctx->ht.enabled)
                 return true;
 
         IWL_DEBUG_INFO(priv, "Channel %u is not an HT channel\n",
-                       priv->active_rxon.channel);
+                       ctx->active.channel);
         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
                 if (le32_to_cpu(lq->rs_table[i].rate_n_flags) & RATE_MCS_HT_MSK) {
                         IWL_DEBUG_INFO(priv,
@@ -1178,7 +1202,7 @@ static bool is_lq_table_valid(struct iwl_priv *priv,
  * this case to clear the state indicating that station creation is in
  * progress.
  */
-int iwl_send_lq_cmd(struct iwl_priv *priv,
+int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                     struct iwl_link_quality_cmd *lq, u8 flags, bool init)
 {
         int ret = 0;
@@ -1197,7 +1221,7 @@ int iwl_send_lq_cmd(struct iwl_priv *priv,
         iwl_dump_lq_cmd(priv, lq);
         BUG_ON(init && (cmd.flags & CMD_ASYNC));
 
-        if (is_lq_table_valid(priv, lq))
+        if (is_lq_table_valid(priv, ctx, lq))
                 ret = iwl_send_cmd(priv, &cmd);
         else
                 ret = -EINVAL;
@@ -1223,14 +1247,15 @@ EXPORT_SYMBOL(iwl_send_lq_cmd);
  * and marks it driver active, so that it will be restored to the
  * device at the next best time.
  */
-int iwl_alloc_bcast_station(struct iwl_priv *priv, bool init_lq)
+int iwl_alloc_bcast_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                            bool init_lq)
 {
         struct iwl_link_quality_cmd *link_cmd;
         unsigned long flags;
         u8 sta_id;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        sta_id = iwl_prep_station(priv, iwl_bcast_addr, false, NULL);
+        sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_ERR(priv, "Unable to prepare broadcast station\n");
                 spin_unlock_irqrestore(&priv->sta_lock, flags);
@@ -1265,11 +1290,12 @@ EXPORT_SYMBOL_GPL(iwl_alloc_bcast_station);
  * Only used by iwlagn. Placed here to have all bcast station management
  * code together.
  */
-int iwl_update_bcast_station(struct iwl_priv *priv)
+static int iwl_update_bcast_station(struct iwl_priv *priv,
+                                    struct iwl_rxon_context *ctx)
 {
         unsigned long flags;
         struct iwl_link_quality_cmd *link_cmd;
-        u8 sta_id = priv->hw_params.bcast_sta_id;
+        u8 sta_id = ctx->bcast_sta_id;
 
         link_cmd = iwl_sta_alloc_lq(priv, sta_id);
         if (!link_cmd) {
@@ -1287,9 +1313,23 @@ int iwl_update_bcast_station(struct iwl_priv *priv)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(iwl_update_bcast_station);
 
-void iwl_dealloc_bcast_station(struct iwl_priv *priv)
+int iwl_update_bcast_stations(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx;
+        int ret = 0;
+
+        for_each_context(priv, ctx) {
+                ret = iwl_update_bcast_station(priv, ctx);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(iwl_update_bcast_stations);
+
+void iwl_dealloc_bcast_stations(struct iwl_priv *priv)
 {
         unsigned long flags;
         int i;
@@ -1307,7 +1347,7 @@ void iwl_dealloc_bcast_station(struct iwl_priv *priv)
         }
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
-EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_station);
+EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_stations);
 
 /**
  * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index d38a350ba0bd..56bad3f60d81 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -44,32 +44,37 @@
 
 
 int iwl_remove_default_wep_key(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx,
                                struct ieee80211_key_conf *key);
 int iwl_set_default_wep_key(struct iwl_priv *priv,
+                            struct iwl_rxon_context *ctx,
                             struct ieee80211_key_conf *key);
-int iwl_restore_default_wep_keys(struct iwl_priv *priv);
-int iwl_set_dynamic_key(struct iwl_priv *priv,
+int iwl_restore_default_wep_keys(struct iwl_priv *priv,
+                                 struct iwl_rxon_context *ctx);
+int iwl_set_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                         struct ieee80211_key_conf *key, u8 sta_id);
-int iwl_remove_dynamic_key(struct iwl_priv *priv,
+int iwl_remove_dynamic_key(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                            struct ieee80211_key_conf *key, u8 sta_id);
 void iwl_update_tkip_key(struct iwl_priv *priv,
-                        struct ieee80211_key_conf *keyconf,
-                        struct ieee80211_sta *sta, u32 iv32, u16 *phase1key);
-
-void iwl_restore_stations(struct iwl_priv *priv);
-void iwl_clear_ucode_stations(struct iwl_priv *priv);
-int iwl_alloc_bcast_station(struct iwl_priv *priv, bool init_lq);
-void iwl_dealloc_bcast_station(struct iwl_priv *priv);
-int iwl_update_bcast_station(struct iwl_priv *priv);
+                         struct iwl_rxon_context *ctx,
+                         struct ieee80211_key_conf *keyconf,
+                         struct ieee80211_sta *sta, u32 iv32, u16 *phase1key);
+
+void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+void iwl_clear_ucode_stations(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx);
+int iwl_alloc_bcast_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                            bool init_lq);
+void iwl_dealloc_bcast_stations(struct iwl_priv *priv);
+int iwl_update_bcast_stations(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
-                          u8 *sta_id_r);
-int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
-                                  bool is_ap,
-                                  struct ieee80211_sta_ht_cap *ht_info,
-                                  u8 *sta_id_r);
+int iwl_add_bssid_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                          const u8 *addr, bool init_rs, u8 *sta_id_r);
+int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+                           const u8 *addr, bool is_ap,
+                           struct ieee80211_sta *sta, u8 *sta_id_r);
 int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
                        const u8 *addr);
 int iwl_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -94,20 +99,25 @@ void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
 static inline void iwl_clear_driver_stations(struct iwl_priv *priv)
 {
         unsigned long flags;
+        struct iwl_rxon_context *ctx;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         memset(priv->stations, 0, sizeof(priv->stations));
         priv->num_stations = 0;
 
-        /*
-         * Remove all key information that is not stored as part of station
-         * information since mac80211 may not have had a
-         * chance to remove all the keys. When device is reconfigured by
-         * mac80211 after an error all keys will be reconfigured.
-         */
         priv->ucode_key_table = 0;
-        priv->key_mapping_key = 0;
-        memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
+
+        for_each_context(priv, ctx) {
+                /*
+                 * Remove all key information that is not stored as part
+                 * of station information since mac80211 may not have had
+                 * a chance to remove all the keys. When device is
+                 * reconfigured by mac80211 after an error all keys will
+                 * be reconfigured.
+                 */
+                memset(ctx->wep_keys, 0, sizeof(ctx->wep_keys));
+                ctx->key_mapping_keys = 0;
+        }
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
@@ -123,6 +133,7 @@ static inline int iwl_sta_id(struct ieee80211_sta *sta)
 /**
  * iwl_sta_id_or_broadcast - return sta_id or broadcast sta
  * @priv: iwl priv
+ * @context: the current context
  * @sta: mac80211 station
  *
  * In certain circumstances mac80211 passes a station pointer
@@ -131,12 +142,13 @@ static inline int iwl_sta_id(struct ieee80211_sta *sta)
  * inline wraps that pattern.
  */
 static inline int iwl_sta_id_or_broadcast(struct iwl_priv *priv,
+                                          struct iwl_rxon_context *context,
                                           struct ieee80211_sta *sta)
 {
         int sta_id;
 
         if (!sta)
-                return priv->hw_params.bcast_sta_id;
+                return context->bcast_sta_id;
 
         sta_id = iwl_sta_id(sta);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index a81989c06983..3290b1552f5a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -134,7 +134,7 @@ EXPORT_SYMBOL(iwl_tx_queue_free);
  */
 void iwl_cmd_queue_free(struct iwl_priv *priv)
 {
-        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+        struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
         struct iwl_queue *q = &txq->q;
         struct device *dev = &priv->pci_dev->dev;
         int i;
@@ -271,7 +271,7 @@ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
 
         /* Driver private data, only for Tx (not command) queues,
          * not shared with device. */
-        if (id != IWL_CMD_QUEUE_NUM) {
+        if (id != priv->cmd_queue) {
                 txq->txb = kzalloc(sizeof(txq->txb[0]) *
                                    TFD_QUEUE_SIZE_MAX, GFP_KERNEL);
                 if (!txq->txb) {
@@ -314,13 +314,13 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 
         /*
          * Alloc buffer array for commands (Tx or other types of commands).
-         * For the command queue (#4), allocate command space + one big
+         * For the command queue (#4/#9), allocate command space + one big
          * command for scan, since scan command is very huge; the system will
          * not have two scans at the same time, so only one is needed.
          * For normal Tx queues (all other queues), no super-size command
          * space is needed.
          */
-        if (txq_id == IWL_CMD_QUEUE_NUM)
+        if (txq_id == priv->cmd_queue)
                 actual_slots++;
 
         txq->meta = kzalloc(sizeof(struct iwl_cmd_meta) * actual_slots,
@@ -355,7 +355,7 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
          * need an swq_id so don't set one to catch errors, all others can
          * be set up to the identity mapping.
          */
-        if (txq_id != IWL_CMD_QUEUE_NUM)
+        if (txq_id != priv->cmd_queue)
                 txq->swq_id = txq_id;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
@@ -385,7 +385,7 @@ void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 {
         int actual_slots = slots_num;
 
-        if (txq_id == IWL_CMD_QUEUE_NUM)
+        if (txq_id == priv->cmd_queue)
                 actual_slots++;
 
         memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
@@ -413,7 +413,7 @@ EXPORT_SYMBOL(iwl_tx_queue_reset);
  */
 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 {
-        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+        struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
         struct iwl_queue *q = &txq->q;
         struct iwl_device_cmd *out_cmd;
         struct iwl_cmd_meta *out_meta;
@@ -422,6 +422,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         int len;
         u32 idx;
         u16 fix_size;
+        bool is_ct_kill = false;
 
         cmd->len = priv->cfg->ops->utils->get_hcmd_size(cmd->id, cmd->len);
         fix_size = (u16)(cmd->len + sizeof(out_cmd->hdr));
@@ -443,9 +444,11 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
                 IWL_ERR(priv, "No space in command queue\n");
-                if (iwl_within_ct_kill_margin(priv))
-                        iwl_tt_enter_ct_kill(priv);
-                else {
+                if (priv->cfg->ops->lib->tt_ops.ct_kill_check) {
+                        is_ct_kill =
+                                priv->cfg->ops->lib->tt_ops.ct_kill_check(priv);
+                }
+                if (!is_ct_kill) {
                         IWL_ERR(priv, "Restarting adapter due to queue full\n");
                         queue_work(priv->workqueue, &priv->restart);
                 }
@@ -480,7 +483,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
          * information */
 
         out_cmd->hdr.flags = 0;
-        out_cmd->hdr.sequence = cpu_to_le16(QUEUE_TO_SEQ(IWL_CMD_QUEUE_NUM) |
+        out_cmd->hdr.sequence = cpu_to_le16(QUEUE_TO_SEQ(priv->cmd_queue) |
                         INDEX_TO_SEQ(q->write_ptr));
         if (cmd->flags & CMD_SIZE_HUGE)
                 out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
@@ -497,15 +500,15 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                                 get_cmd_string(out_cmd->hdr.cmd),
                                 out_cmd->hdr.cmd,
                                 le16_to_cpu(out_cmd->hdr.sequence), fix_size,
-                                q->write_ptr, idx, IWL_CMD_QUEUE_NUM);
-                                break;
+                                q->write_ptr, idx, priv->cmd_queue);
+                break;
         default:
                 IWL_DEBUG_HC(priv, "Sending command %s (#%x), seq: 0x%04X, "
                                 "%d bytes at %d[%d]:%d\n",
                                 get_cmd_string(out_cmd->hdr.cmd),
                                 out_cmd->hdr.cmd,
                                 le16_to_cpu(out_cmd->hdr.sequence), fix_size,
-                                q->write_ptr, idx, IWL_CMD_QUEUE_NUM);
+                                q->write_ptr, idx, priv->cmd_queue);
         }
 #endif
         txq->need_update = 1;
@@ -584,16 +587,16 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
         struct iwl_device_cmd *cmd;
         struct iwl_cmd_meta *meta;
-        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+        struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
 
         /* If a Tx command is being handled and it isn't in the actual
          * command queue then there a command routing bug has been introduced
          * in the queue management code. */
-        if (WARN(txq_id != IWL_CMD_QUEUE_NUM,
-                 "wrong command queue %d, sequence 0x%X readp=%d writep=%d\n",
-                  txq_id, sequence,
-                  priv->txq[IWL_CMD_QUEUE_NUM].q.read_ptr,
-                  priv->txq[IWL_CMD_QUEUE_NUM].q.write_ptr)) {
+        if (WARN(txq_id != priv->cmd_queue,
+                 "wrong command queue %d (should be %d), sequence 0x%X readp=%d writep=%d\n",
+                  txq_id, priv->cmd_queue, sequence,
+                  priv->txq[priv->cmd_queue].q.read_ptr,
+                  priv->txq[priv->cmd_queue].q.write_ptr)) {
                 iwl_print_hex_error(priv, pkt, 32);
                 return;
         }
@@ -663,8 +666,8 @@ const char *iwl_get_tx_fail_reason(u32 status)
                 TX_STATUS_FAIL(TID_DISABLE);
                 TX_STATUS_FAIL(FIFO_FLUSHED);
                 TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
-                TX_STATUS_FAIL(FW_DROP);
-                TX_STATUS_FAIL(STA_COLOR_MISMATCH_DROP);
+                TX_STATUS_FAIL(PASSIVE_NO_RX);
+                TX_STATUS_FAIL(NO_BEACON_ON_RADAR);
         }
 
         return "UNKNOWN";
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 59a308b02f95..116777122a79 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -33,6 +33,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -143,7 +144,7 @@ static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
 
-        if (sta_id == priv->hw_params.bcast_sta_id)
+        if (sta_id == priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id)
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
@@ -151,7 +152,7 @@ static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         key_flags &= ~STA_KEY_FLG_INVALID;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.cipher = keyconf->cipher;
         priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
                keyconf->keylen);
@@ -222,23 +223,25 @@ static int iwl3945_set_dynamic_key(struct iwl_priv *priv,
 
         keyconf->hw_key_idx = HW_KEY_DYNAMIC;
 
-        switch (keyconf->alg) {
-        case ALG_CCMP:
+        switch (keyconf->cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
                 ret = iwl3945_set_ccmp_dynamic_key_info(priv, keyconf, sta_id);
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 ret = iwl3945_set_tkip_dynamic_key_info(priv, keyconf, sta_id);
                 break;
-        case ALG_WEP:
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 ret = iwl3945_set_wep_dynamic_key_info(priv, keyconf, sta_id);
                 break;
         default:
-                IWL_ERR(priv, "Unknown alg: %s alg = %d\n", __func__, keyconf->alg);
+                IWL_ERR(priv, "Unknown alg: %s alg=%x\n", __func__,
+                        keyconf->cipher);
                 ret = -EINVAL;
         }
 
-        IWL_DEBUG_WEP(priv, "Set dynamic key: alg= %d len=%d idx=%d sta=%d ret=%d\n",
-                      keyconf->alg, keyconf->keylen, keyconf->keyidx,
+        IWL_DEBUG_WEP(priv, "Set dynamic key: alg=%x len=%d idx=%d sta=%d ret=%d\n",
+                      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
                       sta_id, ret);
 
         return ret;
@@ -254,10 +257,11 @@ static int iwl3945_remove_static_key(struct iwl_priv *priv)
 static int iwl3945_set_static_key(struct iwl_priv *priv,
                                 struct ieee80211_key_conf *key)
 {
-        if (key->alg == ALG_WEP)
+        if (key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+            key->cipher == WLAN_CIPHER_SUITE_WEP104)
                 return -EOPNOTSUPP;
 
-        IWL_ERR(priv, "Static key invalid: alg %d\n", key->alg);
+        IWL_ERR(priv, "Static key invalid: cipher %x\n", key->cipher);
         return -EINVAL;
 }
 
@@ -313,7 +317,7 @@ unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
                                 int left)
 {
 
-        if (!iwl_is_associated(priv) || !priv->ibss_beacon)
+        if (!iwl_is_associated(priv, IWL_RXON_CTX_BSS) || !priv->ibss_beacon)
                 return 0;
 
         if (priv->ibss_beacon->len > left)
@@ -339,7 +343,8 @@ static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
                 return -ENOMEM;
         }
 
-        rate = iwl_rate_get_lowest_plcp(priv);
+        rate = iwl_rate_get_lowest_plcp(priv,
+                                &priv->contexts[IWL_RXON_CTX_BSS]);
 
         frame_size = iwl3945_hw_get_beacon_cmd(priv, frame, rate);
 
@@ -369,23 +374,25 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
         struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
         struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
 
-        switch (keyinfo->alg) {
-        case ALG_CCMP:
+        tx_cmd->sec_ctl = 0;
+
+        switch (keyinfo->cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
                 tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
                 memcpy(tx_cmd->key, keyinfo->key, keyinfo->keylen);
                 IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
                 break;
 
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 break;
 
-        case ALG_WEP:
-                tx_cmd->sec_ctl = TX_CMD_SEC_WEP |
+        case WLAN_CIPHER_SUITE_WEP104:
+                tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
+                /* fall through */
+        case WLAN_CIPHER_SUITE_WEP40:
+                tx_cmd->sec_ctl |= TX_CMD_SEC_WEP |
                     (info->control.hw_key->hw_key_idx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT;
 
-                if (keyinfo->keylen == 13)
-                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
-
                 memcpy(&tx_cmd->key[3], keyinfo->key, keyinfo->keylen);
 
                 IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
@@ -393,7 +400,7 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                 break;
 
         default:
-                IWL_ERR(priv, "Unknown encode alg %d\n", keyinfo->alg);
+                IWL_ERR(priv, "Unknown encode cipher %x\n", keyinfo->cipher);
                 break;
         }
 }
@@ -506,7 +513,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find index into station table for destination station */
-        sta_id = iwl_sta_id_or_broadcast(priv, info->control.sta);
+        sta_id = iwl_sta_id_or_broadcast(
+                        priv, &priv->contexts[IWL_RXON_CTX_BSS],
+                        info->control.sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -536,6 +545,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
         txq->txb[q->write_ptr].skb = skb;
+        txq->txb[q->write_ptr].ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         /* Init first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[idx];
@@ -677,11 +687,12 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         int rc;
         int spectrum_resp_status;
         int duration = le16_to_cpu(params->duration);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
-        if (iwl_is_associated(priv))
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS))
                 add_time = iwl_usecs_to_beacons(priv,
                         le64_to_cpu(params->start_time) - priv->_3945.last_tsf,
-                        le16_to_cpu(priv->rxon_timing.beacon_interval));
+                        le16_to_cpu(ctx->timing.beacon_interval));
 
         memset(&spectrum, 0, sizeof(spectrum));
 
@@ -692,18 +703,18 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         cmd.len = sizeof(spectrum);
         spectrum.len = cpu_to_le16(cmd.len - sizeof(spectrum.len));
 
-        if (iwl_is_associated(priv))
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS))
                 spectrum.start_time =
                         iwl_add_beacon_time(priv,
                                 priv->_3945.last_beacon_time, add_time,
-                                le16_to_cpu(priv->rxon_timing.beacon_interval));
+                                le16_to_cpu(ctx->timing.beacon_interval));
         else
                 spectrum.start_time = 0;
 
         spectrum.channels[0].duration = cpu_to_le32(duration * TIME_UNIT);
         spectrum.channels[0].channel = params->channel;
         spectrum.channels[0].type = type;
-        if (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK)
+        if (ctx->active.flags & RXON_FLG_BAND_24G_MSK)
                 spectrum.flags |= RXON_FLG_BAND_24G_MSK |
                     RXON_FLG_AUTO_DETECT_MSK | RXON_FLG_TGG_PROTECT_MSK;
 
@@ -792,7 +803,8 @@ static void iwl3945_bg_beacon_update(struct work_struct *work)
         struct sk_buff *beacon;
 
         /* Pull updated AP beacon from mac80211. will fail if not in AP mode */
-        beacon = ieee80211_beacon_get(priv->hw, priv->vif);
+        beacon = ieee80211_beacon_get(priv->hw,
+                        priv->contexts[IWL_RXON_CTX_BSS].vif);
 
         if (!beacon) {
                 IWL_ERR(priv, "update beacon failed\n");
@@ -813,9 +825,9 @@ static void iwl3945_bg_beacon_update(struct work_struct *work)
 static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-#ifdef CONFIG_IWLWIFI_DEBUG
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl3945_beacon_notif *beacon = &(pkt->u.beacon_status);
+#ifdef CONFIG_IWLWIFI_DEBUG
         u8 rate = beacon->beacon_notify_hdr.rate;
 
         IWL_DEBUG_RX(priv, "beacon status %x retries %d iss %d "
@@ -827,6 +839,8 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                 le32_to_cpu(beacon->low_tsf), rate);
 #endif
 
+        priv->ibss_manager = le32_to_cpu(beacon->ibss_mgr_status);
+
         if ((priv->iw_mode == NL80211_IFTYPE_AP) &&
             (!test_bit(STATUS_EXIT_PENDING, &priv->status)))
                 queue_work(priv->workqueue, &priv->beacon_update);
@@ -1716,7 +1730,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode SW error detected. "
                         "Restarting 0x%X.\n", inta);
                 priv->isr_stats.sw++;
-                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -2460,6 +2473,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
 {
         int thermal_spin = 0;
         u32 rfkill;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         IWL_DEBUG_INFO(priv, "Runtime Alive received.\n");
 
@@ -2517,22 +2531,22 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
 
         iwl_power_update_mode(priv, true);
 
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS)) {
                 struct iwl3945_rxon_cmd *active_rxon =
-                                (struct iwl3945_rxon_cmd *)(&priv->active_rxon);
+                                (struct iwl3945_rxon_cmd *)(&ctx->active);
 
-                priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         } else {
                 /* Initialize our rx_config data */
-                iwl_connection_init_rx_config(priv, NULL);
+                iwl_connection_init_rx_config(priv, ctx);
         }
 
         /* Configure Bluetooth device coexistence support */
         priv->cfg->ops->hcmd->send_bt_config(priv);
 
         /* Configure the adapter for unassociated operation */
-        iwlcore_commit_rxon(priv);
+        iwlcore_commit_rxon(priv, ctx);
 
         iwl3945_reg_txpower_periodic(priv);
 
@@ -2553,19 +2567,22 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv);
 static void __iwl3945_down(struct iwl_priv *priv)
 {
         unsigned long flags;
-        int exit_pending = test_bit(STATUS_EXIT_PENDING, &priv->status);
-        struct ieee80211_conf *conf = NULL;
+        int exit_pending;
 
         IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
 
-        conf = ieee80211_get_hw_conf(priv->hw);
+        iwl_scan_cancel_timeout(priv, 200);
 
-        if (!exit_pending)
-                set_bit(STATUS_EXIT_PENDING, &priv->status);
+        exit_pending = test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
+
+        /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
+         * to prevent rearm timer */
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
 
         /* Station information will now be cleared in device */
-        iwl_clear_ucode_stations(priv);
-        iwl_dealloc_bcast_station(priv);
+        iwl_clear_ucode_stations(priv, NULL);
+        iwl_dealloc_bcast_stations(priv);
         iwl_clear_driver_stations(priv);
 
         /* Unblock any waiting calls */
@@ -2647,7 +2664,8 @@ static int __iwl3945_up(struct iwl_priv *priv)
 {
         int rc, i;
 
-        rc = iwl_alloc_bcast_station(priv, false);
+        rc = iwl_alloc_bcast_station(priv, &priv->contexts[IWL_RXON_CTX_BSS],
+                                     false);
         if (rc)
                 return rc;
 
@@ -2799,7 +2817,7 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 
 }
 
-void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
@@ -2807,61 +2825,19 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 .flags = CMD_SIZE_HUGE,
         };
         struct iwl3945_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
         u8 n_probes = 0;
         enum ieee80211_band band;
         bool is_active = false;
+        int ret;
 
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests  "
-                                "Ignoring second request.\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv,
-                        "Scan request while abort pending. Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
-
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv,
-                        "Scan request while uninitialized. Queuing.\n");
-                goto done;
-        }
+        lockdep_assert_held(&priv->mutex);
 
         if (!priv->scan_cmd) {
                 priv->scan_cmd = kmalloc(sizeof(struct iwl3945_scan_cmd) +
                                          IWL_MAX_SCAN_SIZE, GFP_KERNEL);
                 if (!priv->scan_cmd) {
                         IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
-                        goto done;
+                        return -ENOMEM;
                 }
         }
         scan = priv->scan_cmd;
@@ -2870,7 +2846,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 
-        if (iwl_is_associated(priv)) {
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS)) {
                 u16 interval = 0;
                 u32 extra;
                 u32 suspend_time = 100;
@@ -2931,7 +2907,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         /* We don't build a direct scan probe request; the uCode will do
          * that based on the direct_mask added to each channel entry */
         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
-        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
+        scan->tx_cmd.sta_id = priv->contexts[IWL_RXON_CTX_BSS].bcast_sta_id;
         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 
         /* flags + rate selection */
@@ -2956,7 +2932,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 break;
         default:
                 IWL_WARN(priv, "Invalid scan band\n");
-                goto done;
+                return -EIO;
         }
 
         if (!priv->is_internal_short_scan) {
@@ -2991,7 +2967,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
+                return -EIO;
         }
 
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
@@ -3000,25 +2976,10 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         scan->len = cpu_to_le16(cmd.len);
 
         set_bit(STATUS_SCAN_HW, &priv->status);
-        if (iwl_send_cmd_sync(priv, &cmd))
-                goto done;
-
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
-
-        return;
-
- done:
-        /* can not perform scan make sure we clear scanning
-         * bits from status so next scan request can be performed.
-         * if we dont clear scanning status bit here all next scan
-         * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        ret = iwl_send_cmd_sync(priv, &cmd);
+        if (ret)
+                clear_bit(STATUS_SCAN_HW, &priv->status);
+        return ret;
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -3029,8 +2990,10 @@ static void iwl3945_bg_restart(struct work_struct *data)
                 return;
 
         if (test_and_clear_bit(STATUS_FW_ERROR, &priv->status)) {
+                struct iwl_rxon_context *ctx;
                 mutex_lock(&priv->mutex);
-                priv->vif = NULL;
+                for_each_context(priv, ctx)
+                        ctx->vif = NULL;
                 priv->is_open = 0;
                 mutex_unlock(&priv->mutex);
                 iwl3945_down(priv);
@@ -3064,6 +3027,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         int rc = 0;
         struct ieee80211_conf *conf = NULL;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         if (!vif || !priv->is_open)
                 return;
@@ -3074,7 +3038,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
         }
 
         IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        vif->bss_conf.aid, priv->active_rxon.bssid_addr);
+                        vif->bss_conf.aid, ctx->active.bssid_addr);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -3083,37 +3047,34 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
-        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv);
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv, ctx);
 
-        memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
-        iwl_setup_rxon_timing(priv, vif);
-        rc = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
-                              sizeof(priv->rxon_timing), &priv->rxon_timing);
+        rc = iwl_send_rxon_timing(priv, ctx);
         if (rc)
                 IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
                             "Attempting to continue.\n");
 
-        priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
+        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
 
-        priv->staging_rxon.assoc_id = cpu_to_le16(vif->bss_conf.aid);
+        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
                         vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
         if (vif->bss_conf.use_short_preamble)
-                priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
-                priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
-        if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
+        if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
                 if (vif->bss_conf.use_short_slot)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
         }
 
-        iwlcore_commit_rxon(priv);
+        iwlcore_commit_rxon(priv, ctx);
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
@@ -3212,15 +3173,6 @@ static void iwl3945_mac_stop(struct ieee80211_hw *hw)
 
         priv->is_open = 0;
 
-        if (iwl_is_ready_rf(priv)) {
-                /* stop mac, cancel any scan request and clear
-                 * RXON_FILTER_ASSOC_MSK BIT
-                 */
-                mutex_lock(&priv->mutex);
-                iwl_scan_cancel_timeout(priv, 100);
-                mutex_unlock(&priv->mutex);
-        }
-
         iwl3945_down(priv);
 
         flush_workqueue(priv->workqueue);
@@ -3250,48 +3202,45 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
 void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         int rc = 0;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         /* The following should be done only at AP bring up */
-        if (!(iwl_is_associated(priv))) {
+        if (!(iwl_is_associated(priv, IWL_RXON_CTX_BSS))) {
 
                 /* RXON - unassoc (to set timing command) */
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
+                ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
 
                 /* RXON Timing */
-                memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
-                iwl_setup_rxon_timing(priv, vif);
-                rc = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
-                                      sizeof(priv->rxon_timing),
-                                      &priv->rxon_timing);
+                rc = iwl_send_rxon_timing(priv, ctx);
                 if (rc)
                         IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
                                         "Attempting to continue.\n");
 
-                priv->staging_rxon.assoc_id = 0;
+                ctx->staging.assoc_id = 0;
 
                 if (vif->bss_conf.use_short_preamble)
-                        priv->staging_rxon.flags |=
+                        ctx->staging.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
-                        priv->staging_rxon.flags &=
+                        ctx->staging.flags &=
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
-                if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
+                if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
                         if (vif->bss_conf.use_short_slot)
-                                priv->staging_rxon.flags |=
+                                ctx->staging.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
-                                priv->staging_rxon.flags &=
+                                ctx->staging.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
                 }
                 /* restore RXON assoc */
-                priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3317,10 +3266,11 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
 
-        static_key = !iwl_is_associated(priv);
+        static_key = !iwl_is_associated(priv, IWL_RXON_CTX_BSS);
 
         if (!static_key) {
-                sta_id = iwl_sta_id_or_broadcast(priv, sta);
+                sta_id = iwl_sta_id_or_broadcast(
+                                priv, &priv->contexts[IWL_RXON_CTX_BSS], sta);
                 if (sta_id == IWL_INVALID_STATION)
                         return -EINVAL;
         }
@@ -3371,8 +3321,8 @@ static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
         sta_priv->common.sta_id = IWL_INVALID_STATION;
 
 
-        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
-                                     &sta_id);
+        ret = iwl_add_station_common(priv, &priv->contexts[IWL_RXON_CTX_BSS],
+                                     sta->addr, is_ap, sta, &sta_id);
         if (ret) {
                 IWL_ERR(priv, "Unable to add station %pM (%d)\n",
                         sta->addr, ret);
@@ -3399,6 +3349,7 @@ static void iwl3945_configure_filter(struct ieee80211_hw *hw,
 {
         struct iwl_priv *priv = hw->priv;
         __le32 filter_or = 0, filter_nand = 0;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
 #define CHK(test, flag) do { \
         if (*total_flags & (test))              \
@@ -3418,8 +3369,8 @@ static void iwl3945_configure_filter(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        priv->staging_rxon.filter_flags &= ~filter_nand;
-        priv->staging_rxon.filter_flags |= filter_or;
+        ctx->staging.filter_flags &= ~filter_nand;
+        ctx->staging.filter_flags |= filter_or;
 
         /*
          * Committing directly here breaks for some reason,
@@ -3533,8 +3484,9 @@ static ssize_t show_flags(struct device *d,
                           struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
-        return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
+        return sprintf(buf, "0x%04X\n", ctx->active.flags);
 }
 
 static ssize_t store_flags(struct device *d,
@@ -3543,17 +3495,18 @@ static ssize_t store_flags(struct device *d,
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
         u32 flags = simple_strtoul(buf, NULL, 0);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.flags) != flags) {
+        if (le32_to_cpu(ctx->staging.flags) != flags) {
                 /* Cancel any currently running scans... */
                 if (iwl_scan_cancel_timeout(priv, 100))
                         IWL_WARN(priv, "Could not cancel scan.\n");
                 else {
                         IWL_DEBUG_INFO(priv, "Committing rxon.flags = 0x%04X\n",
                                        flags);
-                        priv->staging_rxon.flags = cpu_to_le32(flags);
-                        iwlcore_commit_rxon(priv);
+                        ctx->staging.flags = cpu_to_le32(flags);
+                        iwlcore_commit_rxon(priv, ctx);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3567,9 +3520,10 @@ static ssize_t show_filter_flags(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
         return sprintf(buf, "0x%04X\n",
-                le32_to_cpu(priv->active_rxon.filter_flags));
+                le32_to_cpu(ctx->active.filter_flags));
 }
 
 static ssize_t store_filter_flags(struct device *d,
@@ -3577,19 +3531,20 @@ static ssize_t store_filter_flags(struct device *d,
                                   const char *buf, size_t count)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         u32 filter_flags = simple_strtoul(buf, NULL, 0);
 
         mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.filter_flags) != filter_flags) {
+        if (le32_to_cpu(ctx->staging.filter_flags) != filter_flags) {
                 /* Cancel any currently running scans... */
                 if (iwl_scan_cancel_timeout(priv, 100))
                         IWL_WARN(priv, "Could not cancel scan.\n");
                 else {
                         IWL_DEBUG_INFO(priv, "Committing rxon.filter_flags = "
                                        "0x%04X\n", filter_flags);
-                        priv->staging_rxon.filter_flags =
+                        ctx->staging.filter_flags =
                                 cpu_to_le32(filter_flags);
-                        iwlcore_commit_rxon(priv);
+                        iwlcore_commit_rxon(priv, ctx);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3637,8 +3592,9 @@ static ssize_t store_measurement(struct device *d,
                                  const char *buf, size_t count)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct ieee80211_measurement_params params = {
-                .channel = le16_to_cpu(priv->active_rxon.channel),
+                .channel = le16_to_cpu(ctx->active.channel),
                 .start_time = cpu_to_le64(priv->_3945.last_tsf),
                 .duration = cpu_to_le16(1),
         };
@@ -3785,10 +3741,8 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl3945_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
         INIT_DELAYED_WORK(&priv->_3945.rfkill_poll, iwl3945_rfkill_poll);
-        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
-        INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
-        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
-        INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
+
+        iwl_setup_scan_deferred_work(priv);
 
         iwl3945_hw_setup_deferred_work(priv);
 
@@ -3808,12 +3762,10 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv)
         iwl3945_hw_cancel_deferred_work(priv);
 
         cancel_delayed_work_sync(&priv->init_alive_start);
-        cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
-        cancel_work_sync(&priv->start_internal_scan);
         cancel_work_sync(&priv->beacon_update);
-        if (priv->cfg->ops->lib->recover_from_tx_stall)
-                del_timer_sync(&priv->monitor_recover);
+
+        iwl_cancel_scan_deferred_work(priv);
 }
 
 static struct attribute *iwl3945_sysfs_entries[] = {
@@ -3853,6 +3805,7 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .hw_scan = iwl_mac_hw_scan,
         .sta_add = iwl3945_mac_sta_add,
         .sta_remove = iwl_mac_sta_remove,
+        .tx_last_beacon = iwl_mac_tx_last_beacon,
 };
 
 static int iwl3945_init_drv(struct iwl_priv *priv)
@@ -3933,8 +3886,7 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
                              IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
+                priv->contexts[IWL_RXON_CTX_BSS].interface_modes;
 
         hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
                             WIPHY_FLAG_DISABLE_BEACON_HINTS;
@@ -3966,7 +3918,7 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
 static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
-        int err = 0;
+        int err = 0, i;
         struct iwl_priv *priv;
         struct ieee80211_hw *hw;
         struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
@@ -3988,6 +3940,27 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         priv = hw->priv;
         SET_IEEE80211_DEV(hw, &pdev->dev);
 
+        priv->cmd_queue = IWL39_CMD_QUEUE_NUM;
+
+        /* 3945 has only one valid context */
+        priv->valid_contexts = BIT(IWL_RXON_CTX_BSS);
+
+        for (i = 0; i < NUM_IWL_RXON_CTX; i++)
+                priv->contexts[i].ctxid = i;
+
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_cmd = REPLY_RXON;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_timing_cmd = REPLY_RXON_TIMING;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_assoc_cmd = REPLY_RXON_ASSOC;
+        priv->contexts[IWL_RXON_CTX_BSS].qos_cmd = REPLY_QOS_PARAM;
+        priv->contexts[IWL_RXON_CTX_BSS].ap_sta_id = IWL_AP_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].wep_key_cmd = REPLY_WEPKEY;
+        priv->contexts[IWL_RXON_CTX_BSS].interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
+        priv->contexts[IWL_RXON_CTX_BSS].ibss_devtype = RXON_DEV_TYPE_IBSS;
+        priv->contexts[IWL_RXON_CTX_BSS].station_devtype = RXON_DEV_TYPE_ESS;
+        priv->contexts[IWL_RXON_CTX_BSS].unused_devtype = RXON_DEV_TYPE_ESS;
+
         /*
          * Disabling hardware scan means that mac80211 will perform scans
          * "the hard way", rather than using device's scan.
@@ -4009,6 +3982,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         /***************************
          * 2. Initializing PCI bus
          * *************************/
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                                PCIE_LINK_STATE_CLKPM);
+
         if (pci_enable_device(pdev)) {
                 err = -ENODEV;
                 goto out_ieee80211_free_hw;
@@ -4120,7 +4096,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         }
 
         iwl_set_rxon_channel(priv,
-                             &priv->bands[IEEE80211_BAND_2GHZ].channels[5]);
+                             &priv->bands[IEEE80211_BAND_2GHZ].channels[5],
+                             &priv->contexts[IWL_RXON_CTX_BSS]);
         iwl3945_setup_deferred_work(priv);
         iwl3945_setup_rx_handlers(priv);
         iwl_power_initialize(priv);
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index c02fcedea9fa..a944893ae3ca 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1195,11 +1195,8 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
         IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
                     "oid is 0x%x\n", hdr->oid);
 
-        if (hdr->oid <= WIFI_IF_NTFY_MAX) {
-                set_bit(hdr->oid, &iwm->wifi_ntfy[0]);
-                wake_up_interruptible(&iwm->wifi_ntfy_queue);
-        } else
-                return -EINVAL;
+        set_bit(hdr->oid, &iwm->wifi_ntfy[0]);
+        wake_up_interruptible(&iwm->wifi_ntfy_queue);
 
         switch (hdr->oid) {
         case UMAC_WIFI_IF_CMD_SET_PROFILE:
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 3e82f1627209..1bbdb14f7d76 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -10,6 +10,7 @@
 #include <linux/wait.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/wait.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
 #include <asm/unaligned.h>
@@ -480,7 +481,6 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
         struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
         int bsssize;
         const u8 *pos;
-        u16 nr_sets;
         const u8 *tsfdesc;
         int tsfsize;
         int i;
@@ -489,12 +489,11 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
         lbs_deb_enter(LBS_DEB_CFG80211);
 
         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
-        nr_sets = le16_to_cpu(scanresp->nr_sets);
 
         lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
-                        nr_sets, bsssize, le16_to_cpu(resp->size));
+                        scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));
 
-        if (nr_sets == 0) {
+        if (scanresp->nr_sets == 0) {
                 ret = 0;
                 goto done;
         }
@@ -526,20 +525,31 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
 
         pos = scanresp->bssdesc_and_tlvbuffer;
 
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_RSP", scanresp->bssdesc_and_tlvbuffer,
+                        scanresp->bssdescriptsize);
+
         tsfdesc = pos + bsssize;
         tsfsize = 4 + 8 * scanresp->nr_sets;
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TSF", (u8 *) tsfdesc, tsfsize);
 
         /* Validity check: we expect a Marvell-Local TLV */
         i = get_unaligned_le16(tsfdesc);
         tsfdesc += 2;
-        if (i != TLV_TYPE_TSFTIMESTAMP)
+        if (i != TLV_TYPE_TSFTIMESTAMP) {
+                lbs_deb_scan("scan response: invalid TSF Timestamp %d\n", i);
                 goto done;
+        }
+
         /* Validity check: the TLV holds TSF values with 8 bytes each, so
          * the size in the TLV must match the nr_sets value */
         i = get_unaligned_le16(tsfdesc);
         tsfdesc += 2;
-        if (i / 8 != scanresp->nr_sets)
+        if (i / 8 != scanresp->nr_sets) {
+                lbs_deb_scan("scan response: invalid number of TSF timestamp "
+                             "sets (expected %d got %d)\n", scanresp->nr_sets,
+                             i / 8);
                 goto done;
+        }
 
         for (i = 0; i < scanresp->nr_sets; i++) {
                 const u8 *bssid;
@@ -581,8 +591,11 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         id = *pos++;
                         elen = *pos++;
                         left -= 2;
-                        if (elen > left || elen == 0)
+                        if (elen > left || elen == 0) {
+                                lbs_deb_scan("scan response: invalid IE fmt\n");
                                 goto done;
+                        }
+
                         if (id == WLAN_EID_DS_PARAMS)
                                 chan_no = *pos;
                         if (id == WLAN_EID_SSID) {
@@ -613,7 +626,9 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                                         capa, intvl, ie, ielen,
                                         LBS_SCAN_RSSI_TO_MBM(rssi),
                                         GFP_KERNEL);
-                }
+                } else
+                        lbs_deb_scan("scan response: missing BSS channel IE\n");
+
                 tsfdesc += 8;
         }
         ret = 0;
@@ -1103,7 +1118,7 @@ static int lbs_associate(struct lbs_private *priv,
         lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
 
         /* add auth type TLV */
-        if (priv->fwrelease >= 0x09000000)
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) >= 9)
                 pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
 
         /* add WPA/WPA2 TLV */
@@ -1114,6 +1129,9 @@ static int lbs_associate(struct lbs_private *priv,
                 (u16)(pos - (u8 *) &cmd->iebuf);
         cmd->hdr.size = cpu_to_le16(len);
 
+        lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_CMD", (u8 *) cmd,
+                        le16_to_cpu(cmd->hdr.size));
+
         /* store for later use */
         memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
 
@@ -1121,14 +1139,28 @@ static int lbs_associate(struct lbs_private *priv,
         if (ret)
                 goto done;
 
-
         /* generate connect message to cfg80211 */
 
         resp = (void *) cmd; /* recast for easier field access */
         status = le16_to_cpu(resp->statuscode);
 
-        /* Convert statis code of old firmware */
-        if (priv->fwrelease < 0x09000000)
+        /* Older FW versions map the IEEE 802.11 Status Code in the association
+         * response to the following values returned in resp->statuscode:
+         *
+         *    IEEE Status Code                Marvell Status Code
+         *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
+         *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
+         *
+         * Other response codes:
+         *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
+         *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
+         *                                    association response from the AP)
+         */
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
                 switch (status) {
                 case 0:
                         break;
@@ -1150,11 +1182,16 @@ static int lbs_associate(struct lbs_private *priv,
                         break;
                 default:
                         lbs_deb_assoc("association failure %d\n", status);
-                        status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+                        /* v5 OLPC firmware does return the AP status code if
+                         * it's not one of the values above.  Let that through.
+                         */
+                        break;
+                }
         }
 
-        lbs_deb_assoc("status %d, capability 0x%04x\n", status,
-                      le16_to_cpu(resp->capability));
+        lbs_deb_assoc("status %d, statuscode 0x%04x, capability 0x%04x, "
+                      "aid 0x%04x\n", status, le16_to_cpu(resp->statuscode),
+                      le16_to_cpu(resp->capability), le16_to_cpu(resp->aid));
 
         resp_ie_len = le16_to_cpu(resp->hdr.size)
                 - sizeof(resp->hdr)
@@ -1174,7 +1211,6 @@ static int lbs_associate(struct lbs_private *priv,
                         netif_tx_wake_all_queues(priv->dev);
         }
 
-
 done:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index 1d141fefd767..2ae752d10065 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -8,7 +8,14 @@
 #define _LBS_DECL_H_
 
 #include <linux/netdevice.h>
+#include <linux/firmware.h>
 
+/* Should be terminated by a NULL entry */
+struct lbs_fw_table {
+        int model;
+        const char *helper;
+        const char *fwname;
+};
 
 struct lbs_private;
 struct sk_buff;
@@ -53,4 +60,10 @@ int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
 u32 lbs_fw_index_to_data_rate(u8 index);
 u8 lbs_data_rate_to_fw_index(u32 rate);
 
+int lbs_get_firmware(struct device *dev, const char *user_helper,
+                        const char *user_mainfw, u32 card_model,
+                        const struct lbs_fw_table *fw_table,
+                        const struct firmware **helper,
+                        const struct firmware **mainfw);
+
 #endif
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 9c298396be50..e213a5dc049d 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -48,7 +48,6 @@
 MODULE_AUTHOR("Holger Schurig <hs4233@mail.mn-solutions.de>");
 MODULE_DESCRIPTION("Driver for Marvell 83xx compact flash WLAN cards");
 MODULE_LICENSE("GPL");
-MODULE_FIRMWARE("libertas_cs_helper.fw");
 
 
 
@@ -61,9 +60,34 @@ struct if_cs_card {
         struct lbs_private *priv;
         void __iomem *iobase;
         bool align_regs;
+        u32 model;
 };
 
 
+enum {
+        MODEL_UNKNOWN = 0x00,
+        MODEL_8305 = 0x01,
+        MODEL_8381 = 0x02,
+        MODEL_8385 = 0x03
+};
+
+static const struct lbs_fw_table fw_table[] = {
+        { MODEL_8305, "libertas/cf8305.bin", NULL },
+        { MODEL_8305, "libertas_cs_helper.fw", NULL },
+        { MODEL_8381, "libertas/cf8381_helper.bin", "libertas/cf8381.bin" },
+        { MODEL_8381, "libertas_cs_helper.fw", "libertas_cs.fw" },
+        { MODEL_8385, "libertas/cf8385_helper.bin", "libertas/cf8385.bin" },
+        { MODEL_8385, "libertas_cs_helper.fw", "libertas_cs.fw" },
+        { 0, NULL, NULL }
+};
+MODULE_FIRMWARE("libertas/cf8305.bin");
+MODULE_FIRMWARE("libertas/cf8381_helper.bin");
+MODULE_FIRMWARE("libertas/cf8381.bin");
+MODULE_FIRMWARE("libertas/cf8385_helper.bin");
+MODULE_FIRMWARE("libertas/cf8385.bin");
+MODULE_FIRMWARE("libertas_cs_helper.fw");
+MODULE_FIRMWARE("libertas_cs.fw");
+
 
 /********************************************************************/
 /* Hardware access                                                  */
@@ -289,22 +313,19 @@ static int if_cs_poll_while_fw_download(struct if_cs_card *card, uint addr, u8 r
 #define CF8385_MANFID           0x02df
 #define CF8385_CARDID           0x8103
 
-static inline int if_cs_hw_is_cf8305(struct pcmcia_device *p_dev)
-{
-        return (p_dev->manf_id == CF8305_MANFID &&
-                p_dev->card_id == CF8305_CARDID);
-}
-
-static inline int if_cs_hw_is_cf8381(struct pcmcia_device *p_dev)
-{
-        return (p_dev->manf_id == CF8381_MANFID &&
-                p_dev->card_id == CF8381_CARDID);
-}
-
-static inline int if_cs_hw_is_cf8385(struct pcmcia_device *p_dev)
+/* FIXME: just use the 'driver_info' field of 'struct pcmcia_device_id' when
+ * that gets fixed.  Currently there's no way to access it from the probe hook.
+ */
+static inline u32 get_model(u16 manf_id, u16 card_id)
 {
-        return (p_dev->manf_id == CF8385_MANFID &&
-                p_dev->card_id == CF8385_CARDID);
+        /* NOTE: keep in sync with if_cs_ids */
+        if (manf_id == CF8305_MANFID && card_id == CF8305_CARDID)
+                return MODEL_8305;
+        else if (manf_id == CF8381_MANFID && card_id == CF8381_CARDID)
+                return MODEL_8381;
+        else if (manf_id == CF8385_MANFID && card_id == CF8385_CARDID)
+                return MODEL_8385;
+        return MODEL_UNKNOWN;
 }
 
 /********************************************************************/
@@ -558,12 +579,11 @@ static irqreturn_t if_cs_interrupt(int irq, void *data)
  *
  * Return 0 on success
  */
-static int if_cs_prog_helper(struct if_cs_card *card)
+static int if_cs_prog_helper(struct if_cs_card *card, const struct firmware *fw)
 {
         int ret = 0;
         int sent = 0;
         u8  scratch;
-        const struct firmware *fw;
 
         lbs_deb_enter(LBS_DEB_CS);
 
@@ -589,14 +609,6 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                 goto done;
         }
 
-        /* TODO: make firmware file configurable */
-        ret = request_firmware(&fw, "libertas_cs_helper.fw",
-                &card->p_dev->dev);
-        if (ret) {
-                lbs_pr_err("can't load helper firmware\n");
-                ret = -ENODEV;
-                goto done;
-        }
         lbs_deb_cs("helper size %td\n", fw->size);
 
         /* "Set the 5 bytes of the helper image to 0" */
@@ -635,7 +647,7 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                 if (ret < 0) {
                         lbs_pr_err("can't download helper at 0x%x, ret %d\n",
                                 sent, ret);
-                        goto err_release;
+                        goto done;
                 }
 
                 if (count == 0)
@@ -644,17 +656,14 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                 sent += count;
         }
 
-err_release:
-        release_firmware(fw);
 done:
         lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
         return ret;
 }
 
 
-static int if_cs_prog_real(struct if_cs_card *card)
+static int if_cs_prog_real(struct if_cs_card *card, const struct firmware *fw)
 {
-        const struct firmware *fw;
         int ret = 0;
         int retry = 0;
         int len = 0;
@@ -662,21 +671,13 @@ static int if_cs_prog_real(struct if_cs_card *card)
 
         lbs_deb_enter(LBS_DEB_CS);
 
-        /* TODO: make firmware file configurable */
-        ret = request_firmware(&fw, "libertas_cs.fw",
-                &card->p_dev->dev);
-        if (ret) {
-                lbs_pr_err("can't load firmware\n");
-                ret = -ENODEV;
-                goto done;
-        }
         lbs_deb_cs("fw size %td\n", fw->size);
 
         ret = if_cs_poll_while_fw_download(card, IF_CS_SQ_READ_LOW,
                 IF_CS_SQ_HELPER_OK);
         if (ret < 0) {
                 lbs_pr_err("helper firmware doesn't answer\n");
-                goto err_release;
+                goto done;
         }
 
         for (sent = 0; sent < fw->size; sent += len) {
@@ -691,7 +692,7 @@ static int if_cs_prog_real(struct if_cs_card *card)
                 if (retry > 20) {
                         lbs_pr_err("could not download firmware\n");
                         ret = -ENODEV;
-                        goto err_release;
+                        goto done;
                 }
                 if (retry) {
                         sent -= len;
@@ -710,7 +711,7 @@ static int if_cs_prog_real(struct if_cs_card *card)
                         IF_CS_BIT_COMMAND);
                 if (ret < 0) {
                         lbs_pr_err("can't download firmware at 0x%x\n", sent);
-                        goto err_release;
+                        goto done;
                 }
         }
 
@@ -718,9 +719,6 @@ static int if_cs_prog_real(struct if_cs_card *card)
         if (ret < 0)
                 lbs_pr_err("firmware download failed\n");
 
-err_release:
-        release_firmware(fw);
-
 done:
         lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
         return ret;
@@ -824,6 +822,8 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
         unsigned int prod_id;
         struct lbs_private *priv;
         struct if_cs_card *card;
+        const struct firmware *helper = NULL;
+        const struct firmware *mainfw = NULL;
 
         lbs_deb_enter(LBS_DEB_CS);
 
@@ -843,7 +843,6 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
                 goto out1;
         }
 
-
         /*
          * Allocate an interrupt line.  Note that this does not assign
          * a handler to the interrupt, unless the 'Handler' member of
@@ -881,34 +880,47 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
          */
         card->align_regs = 0;
 
+        card->model = get_model(p_dev->manf_id, p_dev->card_id);
+        if (card->model == MODEL_UNKNOWN) {
+                lbs_pr_err("unsupported manf_id 0x%04x / card_id 0x%04x\n",
+                           p_dev->manf_id, p_dev->card_id);
+                goto out2;
+        }
+
         /* Check if we have a current silicon */
         prod_id = if_cs_read8(card, IF_CS_PRODUCT_ID);
-        if (if_cs_hw_is_cf8305(p_dev)) {
+        if (card->model == MODEL_8305) {
                 card->align_regs = 1;
                 if (prod_id < IF_CS_CF8305_B1_REV) {
-                        lbs_pr_err("old chips like 8305 rev B3 "
-                                "aren't supported\n");
+                        lbs_pr_err("8305 rev B0 and older are not supported\n");
                         ret = -ENODEV;
                         goto out2;
                 }
         }
 
-        if (if_cs_hw_is_cf8381(p_dev) && prod_id < IF_CS_CF8381_B3_REV) {
-                lbs_pr_err("old chips like 8381 rev B3 aren't supported\n");
+        if ((card->model == MODEL_8381) && prod_id < IF_CS_CF8381_B3_REV) {
+                lbs_pr_err("8381 rev B2 and older are not supported\n");
                 ret = -ENODEV;
                 goto out2;
         }
 
-        if (if_cs_hw_is_cf8385(p_dev) && prod_id < IF_CS_CF8385_B1_REV) {
-                lbs_pr_err("old chips like 8385 rev B1 aren't supported\n");
+        if ((card->model == MODEL_8385) && prod_id < IF_CS_CF8385_B1_REV) {
+                lbs_pr_err("8385 rev B0 and older are not supported\n");
                 ret = -ENODEV;
                 goto out2;
         }
 
+        ret = lbs_get_firmware(&p_dev->dev, NULL, NULL, card->model,
+                                &fw_table[0], &helper, &mainfw);
+        if (ret) {
+                lbs_pr_err("failed to find firmware (%d)\n", ret);
+                goto out2;
+        }
+
         /* Load the firmware early, before calling into libertas.ko */
-        ret = if_cs_prog_helper(card);
-        if (ret == 0 && !if_cs_hw_is_cf8305(p_dev))
-                ret = if_cs_prog_real(card);
+        ret = if_cs_prog_helper(card, helper);
+        if (ret == 0 && (card->model != MODEL_8305))
+                ret = if_cs_prog_real(card, mainfw);
         if (ret)
                 goto out2;
 
@@ -957,6 +969,11 @@ out2:
 out1:
         pcmcia_disable_device(p_dev);
 out:
+        if (helper)
+                release_firmware(helper);
+        if (mainfw)
+                release_firmware(mainfw);
+
         lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
         return ret;
 }
@@ -993,6 +1010,7 @@ static struct pcmcia_device_id if_cs_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(CF8305_MANFID, CF8305_CARDID),
         PCMCIA_DEVICE_MANF_CARD(CF8381_MANFID, CF8381_CARDID),
         PCMCIA_DEVICE_MANF_CARD(CF8385_MANFID, CF8385_CARDID),
+        /* NOTE: keep in sync with get_model() */
         PCMCIA_DEVICE_NULL,
 };
 MODULE_DEVICE_TABLE(pcmcia, if_cs_ids);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 87b634978b35..296fd00a5129 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -76,36 +76,32 @@ static const struct sdio_device_id if_sdio_ids[] = {
 
 MODULE_DEVICE_TABLE(sdio, if_sdio_ids);
 
-struct if_sdio_model {
-        int model;
-        const char *helper;
-        const char *firmware;
-};
-
-static struct if_sdio_model if_sdio_models[] = {
-        {
-                /* 8385 */
-                .model = IF_SDIO_MODEL_8385,
-                .helper = "sd8385_helper.bin",
-                .firmware = "sd8385.bin",
-        },
-        {
-                /* 8686 */
-                .model = IF_SDIO_MODEL_8686,
-                .helper = "sd8686_helper.bin",
-                .firmware = "sd8686.bin",
-        },
-        {
-                /* 8688 */
-                .model = IF_SDIO_MODEL_8688,
-                .helper = "sd8688_helper.bin",
-                .firmware = "sd8688.bin",
-        },
+#define MODEL_8385      0x04
+#define MODEL_8686      0x0b
+#define MODEL_8688      0x10
+
+static const struct lbs_fw_table fw_table[] = {
+        { MODEL_8385, "libertas/sd8385_helper.bin", "libertas/sd8385.bin" },
+        { MODEL_8385, "sd8385_helper.bin", "sd8385.bin" },
+        { MODEL_8686, "libertas/sd8686_v9_helper.bin", "libertas/sd8686_v9.bin" },
+        { MODEL_8686, "libertas/sd8686_v8_helper.bin", "libertas/sd8686_v8.bin" },
+        { MODEL_8686, "sd8686_helper.bin", "sd8686.bin" },
+        { MODEL_8688, "libertas/sd8688_helper.bin", "libertas/sd8688.bin" },
+        { MODEL_8688, "sd8688_helper.bin", "sd8688.bin" },
+        { 0, NULL, NULL }
 };
+MODULE_FIRMWARE("libertas/sd8385_helper.bin");
+MODULE_FIRMWARE("libertas/sd8385.bin");
 MODULE_FIRMWARE("sd8385_helper.bin");
 MODULE_FIRMWARE("sd8385.bin");
+MODULE_FIRMWARE("libertas/sd8686_v9_helper.bin");
+MODULE_FIRMWARE("libertas/sd8686_v9.bin");
+MODULE_FIRMWARE("libertas/sd8686_v8_helper.bin");
+MODULE_FIRMWARE("libertas/sd8686_v8.bin");
 MODULE_FIRMWARE("sd8686_helper.bin");
 MODULE_FIRMWARE("sd8686.bin");
+MODULE_FIRMWARE("libertas/sd8688_helper.bin");
+MODULE_FIRMWARE("libertas/sd8688.bin");
 MODULE_FIRMWARE("sd8688_helper.bin");
 MODULE_FIRMWARE("sd8688.bin");
 
@@ -187,11 +183,11 @@ static u16 if_sdio_read_rx_len(struct if_sdio_card *card, int *err)
         u16 rx_len;
 
         switch (card->model) {
-        case IF_SDIO_MODEL_8385:
-        case IF_SDIO_MODEL_8686:
+        case MODEL_8385:
+        case MODEL_8686:
                 rx_len = if_sdio_read_scratch(card, &ret);
                 break;
-        case IF_SDIO_MODEL_8688:
+        case MODEL_8688:
         default: /* for newer chipsets */
                 rx_len = sdio_readb(card->func, IF_SDIO_RX_LEN, &ret);
                 if (!ret)
@@ -288,7 +284,7 @@ static int if_sdio_handle_event(struct if_sdio_card *card,
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
-        if (card->model == IF_SDIO_MODEL_8385) {
+        if (card->model == MODEL_8385) {
                 event = sdio_readb(card->func, IF_SDIO_EVENT, &ret);
                 if (ret)
                         goto out;
@@ -466,10 +462,10 @@ static void if_sdio_host_to_card_worker(struct work_struct *work)
 
 #define FW_DL_READY_STATUS (IF_SDIO_IO_RDY | IF_SDIO_DL_RDY)
 
-static int if_sdio_prog_helper(struct if_sdio_card *card)
+static int if_sdio_prog_helper(struct if_sdio_card *card,
+                                const struct firmware *fw)
 {
         int ret;
-        const struct firmware *fw;
         unsigned long timeout;
         u8 *chunk_buffer;
         u32 chunk_size;
@@ -478,16 +474,10 @@ static int if_sdio_prog_helper(struct if_sdio_card *card)
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
-        ret = request_firmware(&fw, card->helper, &card->func->dev);
-        if (ret) {
-                lbs_pr_err("can't load helper firmware\n");
-                goto out;
-        }
-
         chunk_buffer = kzalloc(64, GFP_KERNEL);
         if (!chunk_buffer) {
                 ret = -ENOMEM;
-                goto release_fw;
+                goto out;
         }
 
         sdio_claim_host(card->func);
@@ -562,22 +552,19 @@ static int if_sdio_prog_helper(struct if_sdio_card *card)
 release:
         sdio_release_host(card->func);
         kfree(chunk_buffer);
-release_fw:
-        release_firmware(fw);
 
 out:
         if (ret)
                 lbs_pr_err("failed to load helper firmware\n");
 
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
-
         return ret;
 }
 
-static int if_sdio_prog_real(struct if_sdio_card *card)
+static int if_sdio_prog_real(struct if_sdio_card *card,
+                                const struct firmware *fw)
 {
         int ret;
-        const struct firmware *fw;
         unsigned long timeout;
         u8 *chunk_buffer;
         u32 chunk_size;
@@ -586,16 +573,10 @@ static int if_sdio_prog_real(struct if_sdio_card *card)
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
-        ret = request_firmware(&fw, card->firmware, &card->func->dev);
-        if (ret) {
-                lbs_pr_err("can't load firmware\n");
-                goto out;
-        }
-
         chunk_buffer = kzalloc(512, GFP_KERNEL);
         if (!chunk_buffer) {
                 ret = -ENOMEM;
-                goto release_fw;
+                goto out;
         }
 
         sdio_claim_host(card->func);
@@ -685,15 +666,12 @@ static int if_sdio_prog_real(struct if_sdio_card *card)
 release:
         sdio_release_host(card->func);
         kfree(chunk_buffer);
-release_fw:
-        release_firmware(fw);
 
 out:
         if (ret)
                 lbs_pr_err("failed to load firmware\n");
 
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
-
         return ret;
 }
 
@@ -701,6 +679,8 @@ static int if_sdio_prog_firmware(struct if_sdio_card *card)
 {
         int ret;
         u16 scratch;
+        const struct firmware *helper = NULL;
+        const struct firmware *mainfw = NULL;
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
@@ -718,11 +698,18 @@ static int if_sdio_prog_firmware(struct if_sdio_card *card)
                 goto success;
         }
 
-        ret = if_sdio_prog_helper(card);
+        ret = lbs_get_firmware(&card->func->dev, lbs_helper_name, lbs_fw_name,
+                                card->model, &fw_table[0], &helper, &mainfw);
+        if (ret) {
+                lbs_pr_err("failed to find firmware (%d)\n", ret);
+                goto out;
+        }
+
+        ret = if_sdio_prog_helper(card, helper);
         if (ret)
                 goto out;
 
-        ret = if_sdio_prog_real(card);
+        ret = if_sdio_prog_real(card, mainfw);
         if (ret)
                 goto out;
 
@@ -733,8 +720,12 @@ success:
         ret = 0;
 
 out:
-        lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
+        if (helper)
+                release_firmware(helper);
+        if (mainfw)
+                release_firmware(mainfw);
 
+        lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
         return ret;
 }
 
@@ -938,7 +929,7 @@ static int if_sdio_probe(struct sdio_func *func,
                                 "ID: %x", &model) == 1)
                         break;
                 if (!strcmp(func->card->info[i], "IBIS Wireless SDIO Card")) {
-                        model = IF_SDIO_MODEL_8385;
+                        model = MODEL_8385;
                         break;
                 }
         }
@@ -956,13 +947,13 @@ static int if_sdio_probe(struct sdio_func *func,
         card->model = model;
 
         switch (card->model) {
-        case IF_SDIO_MODEL_8385:
+        case MODEL_8385:
                 card->scratch_reg = IF_SDIO_SCRATCH_OLD;
                 break;
-        case IF_SDIO_MODEL_8686:
+        case MODEL_8686:
                 card->scratch_reg = IF_SDIO_SCRATCH;
                 break;
-        case IF_SDIO_MODEL_8688:
+        case MODEL_8688:
         default: /* for newer chipsets */
                 card->scratch_reg = IF_SDIO_FW_STATUS;
                 break;
@@ -972,49 +963,17 @@ static int if_sdio_probe(struct sdio_func *func,
         card->workqueue = create_workqueue("libertas_sdio");
         INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
 
-        for (i = 0;i < ARRAY_SIZE(if_sdio_models);i++) {
-                if (card->model == if_sdio_models[i].model)
+        /* Check if we support this card */
+        for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
+                if (card->model == fw_table[i].model)
                         break;
         }
-
-        if (i == ARRAY_SIZE(if_sdio_models)) {
+        if (i == ARRAY_SIZE(fw_table)) {
                 lbs_pr_err("unknown card model 0x%x\n", card->model);
                 ret = -ENODEV;
                 goto free;
         }
 
-        card->helper = if_sdio_models[i].helper;
-        card->firmware = if_sdio_models[i].firmware;
-
-        kparam_block_sysfs_write(helper_name);
-        if (lbs_helper_name) {
-                char *helper = kstrdup(lbs_helper_name, GFP_KERNEL);
-                if (!helper) {
-                        kparam_unblock_sysfs_write(helper_name);
-                        ret = -ENOMEM;
-                        goto free;
-                }
-                lbs_deb_sdio("overriding helper firmware: %s\n",
-                        lbs_helper_name);
-                card->helper = helper;
-                card->helper_allocated = true;
-        }
-        kparam_unblock_sysfs_write(helper_name);
-
-        kparam_block_sysfs_write(fw_name);
-        if (lbs_fw_name) {
-                char *fw_name = kstrdup(lbs_fw_name, GFP_KERNEL);
-                if (!fw_name) {
-                        kparam_unblock_sysfs_write(fw_name);
-                        ret = -ENOMEM;
-                        goto free;
-                }
-                lbs_deb_sdio("overriding firmware: %s\n", lbs_fw_name);
-                card->firmware = fw_name;
-                card->firmware_allocated = true;
-        }
-        kparam_unblock_sysfs_write(fw_name);
-
         sdio_claim_host(func);
 
         ret = sdio_enable_func(func);
@@ -1028,7 +987,7 @@ static int if_sdio_probe(struct sdio_func *func,
         /* For 1-bit transfers to the 8686 model, we need to enable the
          * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
          * bit to allow access to non-vendor registers. */
-        if ((card->model == IF_SDIO_MODEL_8686) &&
+        if ((card->model == MODEL_8686) &&
             (host->caps & MMC_CAP_SDIO_IRQ) &&
             (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
                 u8 reg;
@@ -1091,8 +1050,8 @@ static int if_sdio_probe(struct sdio_func *func,
          * Get rx_unit if the chip is SD8688 or newer.
          * SD8385 & SD8686 do not have rx_unit.
          */
-        if ((card->model != IF_SDIO_MODEL_8385)
-                        && (card->model != IF_SDIO_MODEL_8686))
+        if ((card->model != MODEL_8385)
+                        && (card->model != MODEL_8686))
                 card->rx_unit = if_sdio_read_rx_unit(card);
         else
                 card->rx_unit = 0;
@@ -1108,7 +1067,7 @@ static int if_sdio_probe(struct sdio_func *func,
         /*
          * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
          */
-        if (card->model == IF_SDIO_MODEL_8688) {
+        if (card->model == MODEL_8688) {
                 struct cmd_header cmd;
 
                 memset(&cmd, 0, sizeof(cmd));
@@ -1165,7 +1124,7 @@ static void if_sdio_remove(struct sdio_func *func)
 
         card = sdio_get_drvdata(func);
 
-        if (user_rmmod && (card->model == IF_SDIO_MODEL_8688)) {
+        if (user_rmmod && (card->model == MODEL_8688)) {
                 /*
                  * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
                  * multiple functions
diff --git a/drivers/net/wireless/libertas/if_sdio.h b/drivers/net/wireless/libertas/if_sdio.h
index 12179c1dc9c9..62fda3592f67 100644
--- a/drivers/net/wireless/libertas/if_sdio.h
+++ b/drivers/net/wireless/libertas/if_sdio.h
@@ -12,10 +12,6 @@
 #ifndef _LBS_IF_SDIO_H
 #define _LBS_IF_SDIO_H
 
-#define IF_SDIO_MODEL_8385      0x04
-#define IF_SDIO_MODEL_8686      0x0b
-#define IF_SDIO_MODEL_8688      0x10
-
 #define IF_SDIO_IOPORT          0x00
 
 #define IF_SDIO_H_INT_MASK      0x04
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index fe3f08028eb3..79bcb4e5d2ca 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -39,9 +39,6 @@ struct if_spi_card {
         struct lbs_private              *priv;
         struct libertas_spi_platform_data *pdata;
 
-        char                            helper_fw_name[IF_SPI_FW_NAME_MAX];
-        char                            main_fw_name[IF_SPI_FW_NAME_MAX];
-
         /* The card ID and card revision, as reported by the hardware. */
         u16                             card_id;
         u8                              card_rev;
@@ -70,10 +67,28 @@ static void free_if_spi_card(struct if_spi_card *card)
         kfree(card);
 }
 
-static struct chip_ident chip_id_to_device_name[] = {
-        { .chip_id = 0x04, .name = 8385 },
-        { .chip_id = 0x0b, .name = 8686 },
+#define MODEL_8385      0x04
+#define MODEL_8686      0x0b
+#define MODEL_8688      0x10
+
+static const struct lbs_fw_table fw_table[] = {
+        { MODEL_8385, "libertas/gspi8385_helper.bin", "libertas/gspi8385.bin" },
+        { MODEL_8385, "libertas/gspi8385_hlp.bin", "libertas/gspi8385.bin" },
+        { MODEL_8686, "libertas/gspi8686_v9_helper.bin", "libertas/gspi8686_v9.bin" },
+        { MODEL_8686, "libertas/gspi8686_hlp.bin", "libertas/gspi8686.bin" },
+        { MODEL_8688, "libertas/gspi8688_helper.bin", "libertas/gspi8688.bin" },
+        { 0, NULL, NULL }
 };
+MODULE_FIRMWARE("libertas/gspi8385_helper.bin");
+MODULE_FIRMWARE("libertas/gspi8385_hlp.bin");
+MODULE_FIRMWARE("libertas/gspi8385.bin");
+MODULE_FIRMWARE("libertas/gspi8686_v9_helper.bin");
+MODULE_FIRMWARE("libertas/gspi8686_v9.bin");
+MODULE_FIRMWARE("libertas/gspi8686_hlp.bin");
+MODULE_FIRMWARE("libertas/gspi8686.bin");
+MODULE_FIRMWARE("libertas/gspi8688_helper.bin");
+MODULE_FIRMWARE("libertas/gspi8688.bin");
+
 
 /*
  * SPI Interface Unit Routines
@@ -399,26 +414,20 @@ static int spu_init(struct if_spi_card *card, int use_dummy_writes)
  * Firmware Loading
  */
 
-static int if_spi_prog_helper_firmware(struct if_spi_card *card)
+static int if_spi_prog_helper_firmware(struct if_spi_card *card,
+                                        const struct firmware *firmware)
 {
         int err = 0;
-        const struct firmware *firmware = NULL;
         int bytes_remaining;
         const u8 *fw;
         u8 temp[HELPER_FW_LOAD_CHUNK_SZ];
-        struct spi_device *spi = card->spi;
 
         lbs_deb_enter(LBS_DEB_SPI);
 
         err = spu_set_interrupt_mode(card, 1, 0);
         if (err)
                 goto out;
-        /* Get helper firmware image */
-        err = request_firmware(&firmware, card->helper_fw_name, &spi->dev);
-        if (err) {
-                lbs_pr_err("request_firmware failed with err = %d\n", err);
-                goto out;
-        }
+
         bytes_remaining = firmware->size;
         fw = firmware->data;
 
@@ -429,13 +438,13 @@ static int if_spi_prog_helper_firmware(struct if_spi_card *card)
                 err = spu_write_u16(card, IF_SPI_SCRATCH_1_REG,
                                         HELPER_FW_LOAD_CHUNK_SZ);
                 if (err)
-                        goto release_firmware;
+                        goto out;
 
                 err = spu_wait_for_u16(card, IF_SPI_HOST_INT_STATUS_REG,
                                         IF_SPI_HIST_CMD_DOWNLOAD_RDY,
                                         IF_SPI_HIST_CMD_DOWNLOAD_RDY);
                 if (err)
-                        goto release_firmware;
+                        goto out;
 
                 /* Feed the data into the command read/write port reg
                  * in chunks of 64 bytes */
@@ -446,16 +455,16 @@ static int if_spi_prog_helper_firmware(struct if_spi_card *card)
                 err = spu_write(card, IF_SPI_CMD_RDWRPORT_REG,
                                         temp, HELPER_FW_LOAD_CHUNK_SZ);
                 if (err)
-                        goto release_firmware;
+                        goto out;
 
                 /* Interrupt the boot code */
                 err = spu_write_u16(card, IF_SPI_HOST_INT_STATUS_REG, 0);
                 if (err)
-                        goto release_firmware;
+                        goto out;
                 err = spu_write_u16(card, IF_SPI_CARD_INT_CAUSE_REG,
                                        IF_SPI_CIC_CMD_DOWNLOAD_OVER);
                 if (err)
-                        goto release_firmware;
+                        goto out;
                 bytes_remaining -= HELPER_FW_LOAD_CHUNK_SZ;
                 fw += HELPER_FW_LOAD_CHUNK_SZ;
         }
@@ -465,18 +474,16 @@ static int if_spi_prog_helper_firmware(struct if_spi_card *card)
          * bootloader. This completes the helper download. */
         err = spu_write_u16(card, IF_SPI_SCRATCH_1_REG, FIRMWARE_DNLD_OK);
         if (err)
-                goto release_firmware;
+                goto out;
         err = spu_write_u16(card, IF_SPI_HOST_INT_STATUS_REG, 0);
         if (err)
-                goto release_firmware;
+                goto out;
         err = spu_write_u16(card, IF_SPI_CARD_INT_CAUSE_REG,
                                 IF_SPI_CIC_CMD_DOWNLOAD_OVER);
-                goto release_firmware;
+                goto out;
 
         lbs_deb_spi("waiting for helper to boot...\n");
 
-release_firmware:
-        release_firmware(firmware);
 out:
         if (err)
                 lbs_pr_err("failed to load helper firmware (err=%d)\n", err);
@@ -523,13 +530,12 @@ static int if_spi_prog_main_firmware_check_len(struct if_spi_card *card,
         return len;
 }
 
-static int if_spi_prog_main_firmware(struct if_spi_card *card)
+static int if_spi_prog_main_firmware(struct if_spi_card *card,
+                                        const struct firmware *firmware)
 {
         int len, prev_len;
         int bytes, crc_err = 0, err = 0;
-        const struct firmware *firmware = NULL;
         const u8 *fw;
-        struct spi_device *spi = card->spi;
         u16 num_crc_errs;
 
         lbs_deb_enter(LBS_DEB_SPI);
@@ -538,19 +544,11 @@ static int if_spi_prog_main_firmware(struct if_spi_card *card)
         if (err)
                 goto out;
 
-        /* Get firmware image */
-        err = request_firmware(&firmware, card->main_fw_name, &spi->dev);
-        if (err) {
-                lbs_pr_err("%s: can't get firmware '%s' from kernel. "
-                        "err = %d\n", __func__, card->main_fw_name, err);
-                goto out;
-        }
-
         err = spu_wait_for_u16(card, IF_SPI_SCRATCH_1_REG, 0, 0);
         if (err) {
                 lbs_pr_err("%s: timed out waiting for initial "
                            "scratch reg = 0\n", __func__);
-                goto release_firmware;
+                goto out;
         }
 
         num_crc_errs = 0;
@@ -560,7 +558,7 @@ static int if_spi_prog_main_firmware(struct if_spi_card *card)
         while ((len = if_spi_prog_main_firmware_check_len(card, &crc_err))) {
                 if (len < 0) {
                         err = len;
-                        goto release_firmware;
+                        goto out;
                 }
                 if (bytes < 0) {
                         /* If there are no more bytes left, we would normally
@@ -575,7 +573,7 @@ static int if_spi_prog_main_firmware(struct if_spi_card *card)
                                 lbs_pr_err("Too many CRC errors encountered "
                                            "in firmware load.\n");
                                 err = -EIO;
-                                goto release_firmware;
+                                goto out;
                         }
                 } else {
                         /* Previous transfer succeeded. Advance counters. */
@@ -590,15 +588,15 @@ static int if_spi_prog_main_firmware(struct if_spi_card *card)
 
                 err = spu_write_u16(card, IF_SPI_HOST_INT_STATUS_REG, 0);
                 if (err)
-                        goto release_firmware;
+                        goto out;
                 err = spu_write(card, IF_SPI_CMD_RDWRPORT_REG,
                                 card->cmd_buffer, len);
                 if (err)
-                        goto release_firmware;
+                        goto out;
                 err = spu_write_u16(card, IF_SPI_CARD_INT_CAUSE_REG ,
                                         IF_SPI_CIC_CMD_DOWNLOAD_OVER);
                 if (err)
-                        goto release_firmware;
+                        goto out;
                 prev_len = len;
         }
         if (bytes > prev_len) {
@@ -611,12 +609,9 @@ static int if_spi_prog_main_firmware(struct if_spi_card *card)
                                         SUCCESSFUL_FW_DOWNLOAD_MAGIC);
         if (err) {
                 lbs_pr_err("failed to confirm the firmware download\n");
-                goto release_firmware;
+                goto out;
         }
 
-release_firmware:
-        release_firmware(firmware);
-
 out:
         if (err)
                 lbs_pr_err("failed to load firmware (err=%d)\n", err);
@@ -800,14 +795,16 @@ static int lbs_spi_thread(void *data)
                         goto err;
                 }
 
-                if (hiStatus & IF_SPI_HIST_CMD_UPLOAD_RDY)
+                if (hiStatus & IF_SPI_HIST_CMD_UPLOAD_RDY) {
                         err = if_spi_c2h_cmd(card);
                         if (err)
                                 goto err;
-                if (hiStatus & IF_SPI_HIST_RX_UPLOAD_RDY)
+                }
+                if (hiStatus & IF_SPI_HIST_RX_UPLOAD_RDY) {
                         err = if_spi_c2h_data(card);
                         if (err)
                                 goto err;
+                }
 
                 /* workaround: in PS mode, the card does not set the Command
                  * Download Ready bit, but it sets TX Download Ready. */
@@ -886,37 +883,16 @@ static irqreturn_t if_spi_host_interrupt(int irq, void *dev_id)
  * SPI callbacks
  */
 
-static int if_spi_calculate_fw_names(u16 card_id,
-                              char *helper_fw, char *main_fw)
-{
-        int i;
-        for (i = 0; i < ARRAY_SIZE(chip_id_to_device_name); ++i) {
-                if (card_id == chip_id_to_device_name[i].chip_id)
-                        break;
-        }
-        if (i == ARRAY_SIZE(chip_id_to_device_name)) {
-                lbs_pr_err("Unsupported chip_id: 0x%02x\n", card_id);
-                return -EAFNOSUPPORT;
-        }
-        snprintf(helper_fw, IF_SPI_FW_NAME_MAX, "libertas/gspi%d_hlp.bin",
-                 chip_id_to_device_name[i].name);
-        snprintf(main_fw, IF_SPI_FW_NAME_MAX, "libertas/gspi%d.bin",
-                 chip_id_to_device_name[i].name);
-        return 0;
-}
-MODULE_FIRMWARE("libertas/gspi8385_hlp.bin");
-MODULE_FIRMWARE("libertas/gspi8385.bin");
-MODULE_FIRMWARE("libertas/gspi8686_hlp.bin");
-MODULE_FIRMWARE("libertas/gspi8686.bin");
-
 static int __devinit if_spi_probe(struct spi_device *spi)
 {
         struct if_spi_card *card;
         struct lbs_private *priv = NULL;
         struct libertas_spi_platform_data *pdata = spi->dev.platform_data;
-        int err = 0;
+        int err = 0, i;
         u32 scratch;
         struct sched_param param = { .sched_priority = 1 };
+        const struct firmware *helper = NULL;
+        const struct firmware *mainfw = NULL;
 
         lbs_deb_enter(LBS_DEB_SPI);
 
@@ -961,10 +937,25 @@ static int __devinit if_spi_probe(struct spi_device *spi)
                 lbs_deb_spi("Firmware is already loaded for "
                             "Marvell WLAN 802.11 adapter\n");
         else {
-                err = if_spi_calculate_fw_names(card->card_id,
-                                card->helper_fw_name, card->main_fw_name);
-                if (err)
+                /* Check if we support this card */
+                for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
+                        if (card->card_id == fw_table[i].model)
+                                break;
+                }
+                if (i == ARRAY_SIZE(fw_table)) {
+                        lbs_pr_err("Unsupported chip_id: 0x%02x\n",
+                                        card->card_id);
+                        err = -ENODEV;
                         goto free_card;
+                }
+
+                err = lbs_get_firmware(&card->spi->dev, NULL, NULL,
+                                        card->card_id, &fw_table[0], &helper,
+                                        &mainfw);
+                if (err) {
+                        lbs_pr_err("failed to find firmware (%d)\n", err);
+                        goto free_card;
+                }
 
                 lbs_deb_spi("Initializing FW for Marvell WLAN 802.11 adapter "
                                 "(chip_id = 0x%04x, chip_rev = 0x%02x) "
@@ -973,10 +964,10 @@ static int __devinit if_spi_probe(struct spi_device *spi)
                                 card->card_id, card->card_rev,
                                 spi->master->bus_num, spi->chip_select,
                                 spi->max_speed_hz);
-                err = if_spi_prog_helper_firmware(card);
+                err = if_spi_prog_helper_firmware(card, helper);
                 if (err)
                         goto free_card;
-                err = if_spi_prog_main_firmware(card);
+                err = if_spi_prog_main_firmware(card, mainfw);
                 if (err)
                         goto free_card;
                 lbs_deb_spi("loaded FW for Marvell WLAN 802.11 adapter\n");
@@ -1044,6 +1035,11 @@ remove_card:
 free_card:
         free_if_spi_card(card);
 out:
+        if (helper)
+                release_firmware(helper);
+        if (mainfw)
+                release_firmware(mainfw);
+
         lbs_deb_leave_args(LBS_DEB_SPI, "err %d\n", err);
         return err;
 }
diff --git a/drivers/net/wireless/libertas/if_spi.h b/drivers/net/wireless/libertas/if_spi.h
index f87eec410848..8b1417d3b71b 100644
--- a/drivers/net/wireless/libertas/if_spi.h
+++ b/drivers/net/wireless/libertas/if_spi.h
@@ -25,11 +25,6 @@
 
 #define IF_SPI_FW_NAME_MAX 30
 
-struct chip_ident {
-        u16 chip_id;
-        u16 name;
-};
-
 #define MAX_MAIN_FW_LOAD_CRC_ERR 10
 
 /* Chunk size when loading the helper firmware */
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 3ff61063671a..e906616232a2 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -26,15 +26,25 @@
 
 #define MESSAGE_HEADER_LEN      4
 
-static char *lbs_fw_name = "usb8388.bin";
+static char *lbs_fw_name = NULL;
 module_param_named(fw_name, lbs_fw_name, charp, 0644);
 
+MODULE_FIRMWARE("libertas/usb8388_v9.bin");
+MODULE_FIRMWARE("libertas/usb8388_v5.bin");
+MODULE_FIRMWARE("libertas/usb8388.bin");
+MODULE_FIRMWARE("libertas/usb8682.bin");
 MODULE_FIRMWARE("usb8388.bin");
 
+enum {
+        MODEL_UNKNOWN = 0x0,
+        MODEL_8388 = 0x1,
+        MODEL_8682 = 0x2
+};
+
 static struct usb_device_id if_usb_table[] = {
         /* Enter the device signature inside */
-        { USB_DEVICE(0x1286, 0x2001) },
-        { USB_DEVICE(0x05a3, 0x8388) },
+        { USB_DEVICE(0x1286, 0x2001), .driver_info = MODEL_8388 },
+        { USB_DEVICE(0x05a3, 0x8388), .driver_info = MODEL_8388 },
         {}      /* Terminating entry */
 };
 
@@ -66,6 +76,8 @@ static ssize_t if_usb_firmware_set(struct device *dev,
         struct if_usb_card *cardp = priv->card;
         int ret;
 
+        BUG_ON(buf == NULL);
+
         ret = if_usb_prog_firmware(cardp, buf, BOOT_CMD_UPDATE_FW);
         if (ret == 0)
                 return count;
@@ -91,6 +103,8 @@ static ssize_t if_usb_boot2_set(struct device *dev,
         struct if_usb_card *cardp = priv->card;
         int ret;
 
+        BUG_ON(buf == NULL);
+
         ret = if_usb_prog_firmware(cardp, buf, BOOT_CMD_UPDATE_BOOT2);
         if (ret == 0)
                 return count;
@@ -244,6 +258,7 @@ static int if_usb_probe(struct usb_interface *intf,
         init_waitqueue_head(&cardp->fw_wq);
 
         cardp->udev = udev;
+        cardp->model = (uint32_t) id->driver_info;
         iface_desc = intf->cur_altsetting;
 
         lbs_deb_usbd(&udev->dev, "bcdUSB = 0x%X bDeviceClass = 0x%X"
@@ -924,6 +939,38 @@ static int if_usb_prog_firmware(struct if_usb_card *cardp,
         return ret;
 }
 
+/* table of firmware file names */
+static const struct {
+        u32 model;
+        const char *fwname;
+} fw_table[] = {
+        { MODEL_8388, "libertas/usb8388_v9.bin" },
+        { MODEL_8388, "libertas/usb8388_v5.bin" },
+        { MODEL_8388, "libertas/usb8388.bin" },
+        { MODEL_8388, "usb8388.bin" },
+        { MODEL_8682, "libertas/usb8682.bin" }
+};
+
+static int get_fw(struct if_usb_card *cardp, const char *fwname)
+{
+        int i;
+
+        /* Try user-specified firmware first */
+        if (fwname)
+                return request_firmware(&cardp->fw, fwname, &cardp->udev->dev);
+
+        /* Otherwise search for firmware to use */
+        for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
+                if (fw_table[i].model != cardp->model)
+                        continue;
+                if (request_firmware(&cardp->fw, fw_table[i].fwname,
+                                        &cardp->udev->dev) == 0)
+                        return 0;
+        }
+
+        return -ENOENT;
+}
+
 static int __if_usb_prog_firmware(struct if_usb_card *cardp,
                                         const char *fwname, int cmd)
 {
@@ -933,10 +980,9 @@ static int __if_usb_prog_firmware(struct if_usb_card *cardp,
 
         lbs_deb_enter(LBS_DEB_USB);
 
-        ret = request_firmware(&cardp->fw, fwname, &cardp->udev->dev);
-        if (ret < 0) {
-                lbs_pr_err("request_firmware() failed with %#x\n", ret);
-                lbs_pr_err("firmware %s not found\n", fwname);
+        ret = get_fw(cardp, fwname);
+        if (ret) {
+                lbs_pr_err("failed to find firmware (%d)\n", ret);
                 goto done;
         }
 
diff --git a/drivers/net/wireless/libertas/if_usb.h b/drivers/net/wireless/libertas/if_usb.h
index 5ba0aee0eb2f..d819e7e3c9aa 100644
--- a/drivers/net/wireless/libertas/if_usb.h
+++ b/drivers/net/wireless/libertas/if_usb.h
@@ -43,6 +43,7 @@ struct bootcmdresp
 /** USB card description structure*/
 struct if_usb_card {
         struct usb_device *udev;
+        uint32_t model;  /* MODEL_* */
         struct urb *rx_urb, *tx_urb;
         struct lbs_private *priv;
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 24958a86747b..47ce5a6ba120 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1047,6 +1047,111 @@ void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx)
 }
 EXPORT_SYMBOL_GPL(lbs_notify_command_response);
 
+/**
+ *  @brief Retrieves two-stage firmware
+ *
+ *  @param dev          A pointer to device structure
+ *  @param user_helper  User-defined helper firmware file
+ *  @param user_mainfw  User-defined main firmware file
+ *  @param card_model   Bus-specific card model ID used to filter firmware table
+ *                         elements
+ *  @param fw_table     Table of firmware file names and device model numbers
+ *                         terminated by an entry with a NULL helper name
+ *  @param helper       On success, the helper firmware; caller must free
+ *  @param mainfw       On success, the main firmware; caller must free
+ *
+ *  @return             0 on success, non-zero on failure
+ */
+int lbs_get_firmware(struct device *dev, const char *user_helper,
+                        const char *user_mainfw, u32 card_model,
+                        const struct lbs_fw_table *fw_table,
+                        const struct firmware **helper,
+                        const struct firmware **mainfw)
+{
+        const struct lbs_fw_table *iter;
+        int ret;
+
+        BUG_ON(helper == NULL);
+        BUG_ON(mainfw == NULL);
+
+        /* Try user-specified firmware first */
+        if (user_helper) {
+                ret = request_firmware(helper, user_helper, dev);
+                if (ret) {
+                        lbs_pr_err("couldn't find helper firmware %s",
+                                        user_helper);
+                        goto fail;
+                }
+        }
+        if (user_mainfw) {
+                ret = request_firmware(mainfw, user_mainfw, dev);
+                if (ret) {
+                        lbs_pr_err("couldn't find main firmware %s",
+                                        user_mainfw);
+                        goto fail;
+                }
+        }
+
+        if (*helper && *mainfw)
+                return 0;
+
+        /* Otherwise search for firmware to use.  If neither the helper or
+         * the main firmware were specified by the user, then we need to
+         * make sure that found helper & main are from the same entry in
+         * fw_table.
+         */
+        iter = fw_table;
+        while (iter && iter->helper) {
+                if (iter->model != card_model)
+                        goto next;
+
+                if (*helper == NULL) {
+                        ret = request_firmware(helper, iter->helper, dev);
+                        if (ret)
+                                goto next;
+
+                        /* If the device has one-stage firmware (ie cf8305) and
+                         * we've got it then we don't need to bother with the
+                         * main firmware.
+                         */
+                        if (iter->fwname == NULL)
+                                return 0;
+                }
+
+                if (*mainfw == NULL) {
+                        ret = request_firmware(mainfw, iter->fwname, dev);
+                        if (ret && !user_helper) {
+                                /* Clear the helper if it wasn't user-specified
+                                 * and the main firmware load failed, to ensure
+                                 * we don't have mismatched firmware pairs.
+                                 */
+                                release_firmware(*helper);
+                                *helper = NULL;
+                        }
+                }
+
+                if (*helper && *mainfw)
+                        return 0;
+
+  next:
+                iter++;
+        }
+
+  fail:
+        /* Failed */
+        if (*helper) {
+                release_firmware(*helper);
+                *helper = NULL;
+        }
+        if (*mainfw) {
+                release_firmware(*mainfw);
+                *mainfw = NULL;
+        }
+
+        return -ENOENT;
+}
+EXPORT_SYMBOL_GPL(lbs_get_firmware);
+
 static int __init lbs_init_module(void)
 {
         lbs_deb_enter(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 194762ab0142..acf3bf63ee33 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -574,7 +574,7 @@ int lbs_mesh_bt_set_inverted(struct lbs_private *priv, bool inverted)
         memset(&cmd, 0, sizeof(cmd));
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_BT_ACCESS_SET_INVERT);
-        cmd.id = !!inverted;
+        cmd.id = cpu_to_le32(!!inverted);
 
         ret = lbs_cmd_with_response(priv, CMD_BT_ACCESS, &cmd);
 
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 41a4f214ade1..ba7d96584cb6 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -54,7 +54,7 @@ static int if_usb_reset_device(struct if_usb_card *cardp);
 /**
  *  if_usb_wrike_bulk_callback -  call back to handle URB status
  *
- *  @param urb          pointer to urb structure
+ *  @param urb          pointer to urb structure
  */
 static void if_usb_write_bulk_callback(struct urb *urb)
 {
@@ -178,16 +178,19 @@ static int if_usb_probe(struct usb_interface *intf,
                                 le16_to_cpu(endpoint->wMaxPacketSize);
                         cardp->ep_in = usb_endpoint_num(endpoint);
 
-                        lbtf_deb_usbd(&udev->dev, "in_endpoint = %d\n", cardp->ep_in);
-                        lbtf_deb_usbd(&udev->dev, "Bulk in size is %d\n", cardp->ep_in_size);
+                        lbtf_deb_usbd(&udev->dev, "in_endpoint = %d\n",
+                                cardp->ep_in);
+                        lbtf_deb_usbd(&udev->dev, "Bulk in size is %d\n",
+                                cardp->ep_in_size);
                 } else if (usb_endpoint_is_bulk_out(endpoint)) {
                         cardp->ep_out_size =
                                 le16_to_cpu(endpoint->wMaxPacketSize);
                         cardp->ep_out = usb_endpoint_num(endpoint);
 
-                        lbtf_deb_usbd(&udev->dev, "out_endpoint = %d\n", cardp->ep_out);
+                        lbtf_deb_usbd(&udev->dev, "out_endpoint = %d\n",
+                                cardp->ep_out);
                         lbtf_deb_usbd(&udev->dev, "Bulk out size is %d\n",
-                                      cardp->ep_out_size);
+                                cardp->ep_out_size);
                 }
         }
         if (!cardp->ep_out_size || !cardp->ep_in_size) {
@@ -318,10 +321,12 @@ static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
 
         if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_DATA_TO_RECV)) {
                 lbtf_deb_usb2(&cardp->udev->dev, "There are data to follow\n");
-                lbtf_deb_usb2(&cardp->udev->dev, "seqnum = %d totalbytes = %d\n",
-                             cardp->fwseqnum, cardp->totalbytes);
+                lbtf_deb_usb2(&cardp->udev->dev,
+                        "seqnum = %d totalbytes = %d\n",
+                        cardp->fwseqnum, cardp->totalbytes);
         } else if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK)) {
-                lbtf_deb_usb2(&cardp->udev->dev, "Host has finished FW downloading\n");
+                lbtf_deb_usb2(&cardp->udev->dev,
+                        "Host has finished FW downloading\n");
                 lbtf_deb_usb2(&cardp->udev->dev, "Donwloading FW JUMP BLOCK\n");
 
                 /* Host has finished FW downloading
@@ -367,7 +372,7 @@ EXPORT_SYMBOL_GPL(if_usb_reset_device);
 /**
  *  usb_tx_block - transfer data to the device
  *
- *  @priv       pointer to struct lbtf_private
+ *  @priv       pointer to struct lbtf_private
  *  @payload    pointer to payload data
  *  @nb         data length
  *  @data       non-zero for data, zero for commands
@@ -400,7 +405,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
         urb->transfer_flags |= URB_ZERO_PACKET;
 
         if (usb_submit_urb(urb, GFP_ATOMIC)) {
-                lbtf_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
+                lbtf_deb_usbd(&cardp->udev->dev,
+                        "usb_submit_urb failed: %d\n", ret);
                 goto tx_ret;
         }
 
@@ -438,10 +444,12 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
 
         cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
 
-        lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
+        lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n",
+                cardp->rx_urb);
         ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC);
         if (ret) {
-                lbtf_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
+                lbtf_deb_usbd(&cardp->udev->dev,
+                        "Submit Rx URB failed: %d\n", ret);
                 kfree_skb(skb);
                 cardp->rx_skb = NULL;
                 lbtf_deb_leave(LBTF_DEB_USB);
@@ -522,14 +530,14 @@ static void if_usb_receive_fwload(struct urb *urb)
                         }
                 } else if (bcmdresp.cmd != BOOT_CMD_FW_BY_USB) {
                         pr_info("boot cmd response cmd_tag error (%d)\n",
-                                    bcmdresp.cmd);
+                                bcmdresp.cmd);
                 } else if (bcmdresp.result != BOOT_CMD_RESP_OK) {
                         pr_info("boot cmd response result error (%d)\n",
-                                    bcmdresp.result);
+                                bcmdresp.result);
                 } else {
                         cardp->bootcmdresp = 1;
                         lbtf_deb_usbd(&cardp->udev->dev,
-                                     "Received valid boot command response\n");
+                                "Received valid boot command response\n");
                 }
 
                 kfree_skb(skb);
@@ -541,19 +549,23 @@ static void if_usb_receive_fwload(struct urb *urb)
         syncfwheader = kmemdup(skb->data, sizeof(struct fwsyncheader),
                                GFP_ATOMIC);
         if (!syncfwheader) {
-                lbtf_deb_usbd(&cardp->udev->dev, "Failure to allocate syncfwheader\n");
+                lbtf_deb_usbd(&cardp->udev->dev,
+                        "Failure to allocate syncfwheader\n");
                 kfree_skb(skb);
                 lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
 
         if (!syncfwheader->cmd) {
-                lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk with correct CRC\n");
-                lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk seqnum = %d\n",
-                             le32_to_cpu(syncfwheader->seqnum));
+                lbtf_deb_usb2(&cardp->udev->dev,
+                        "FW received Blk with correct CRC\n");
+                lbtf_deb_usb2(&cardp->udev->dev,
+                        "FW received Blk seqnum = %d\n",
+                        le32_to_cpu(syncfwheader->seqnum));
                 cardp->CRC_OK = 1;
         } else {
-                lbtf_deb_usbd(&cardp->udev->dev, "FW received Blk with CRC error\n");
+                lbtf_deb_usbd(&cardp->udev->dev,
+                        "FW received Blk with CRC error\n");
                 cardp->CRC_OK = 0;
         }
 
@@ -666,7 +678,8 @@ static void if_usb_receive(struct urb *urb)
         {
                 /* Event cause handling */
                 u32 event_cause = le32_to_cpu(pkt[1]);
-                lbtf_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n", event_cause);
+                lbtf_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n",
+                        event_cause);
 
                 /* Icky undocumented magic special case */
                 if (event_cause & 0xffff0000) {
@@ -689,7 +702,7 @@ static void if_usb_receive(struct urb *urb)
         }
         default:
                 lbtf_deb_usbd(&cardp->udev->dev,
-                         "libertastf: unknown command type 0x%X\n", recvtype);
+                        "libertastf: unknown command type 0x%X\n", recvtype);
                 kfree_skb(skb);
                 break;
         }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 86fa8abdd66f..7eaaa3bab547 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -9,7 +9,8 @@
 
 /*
  * TODO:
- * - IBSS mode simulation (Beacon transmission with competition for "air time")
+ * - Add TSF sync and fix IBSS beacon transmission by adding
+ *   competition for "air time" at TBTT
  * - RX filtering based on filter configuration (data->rx_filter)
  */
 
@@ -594,17 +595,34 @@ static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif)
 {
         wiphy_debug(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
-                    __func__, vif->type, vif->addr);
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    vif->addr);
         hwsim_set_magic(vif);
         return 0;
 }
 
 
+static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
+                                           struct ieee80211_vif *vif,
+                                           enum nl80211_iftype newtype,
+                                           bool newp2p)
+{
+        newtype = ieee80211_iftype_p2p(newtype, newp2p);
+        wiphy_debug(hw->wiphy,
+                    "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    newtype, vif->addr);
+        hwsim_check_magic(vif);
+
+        return 0;
+}
+
 static void mac80211_hwsim_remove_interface(
         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         wiphy_debug(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
-                    __func__, vif->type, vif->addr);
+                    __func__, ieee80211_vif_type_p2p(vif),
+                    vif->addr);
         hwsim_check_magic(vif);
         hwsim_clear_magic(vif);
 }
@@ -620,7 +638,8 @@ static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
         hwsim_check_magic(vif);
 
         if (vif->type != NL80211_IFTYPE_AP &&
-            vif->type != NL80211_IFTYPE_MESH_POINT)
+            vif->type != NL80211_IFTYPE_MESH_POINT &&
+            vif->type != NL80211_IFTYPE_ADHOC)
                 return;
 
         skb = ieee80211_beacon_get(hw, vif);
@@ -1025,6 +1044,7 @@ static struct ieee80211_ops mac80211_hwsim_ops =
         .start = mac80211_hwsim_start,
         .stop = mac80211_hwsim_stop,
         .add_interface = mac80211_hwsim_add_interface,
+        .change_interface = mac80211_hwsim_change_interface,
         .remove_interface = mac80211_hwsim_remove_interface,
         .config = mac80211_hwsim_config,
         .configure_filter = mac80211_hwsim_configure_filter,
@@ -1295,6 +1315,9 @@ static int __init init_mac80211_hwsim(void)
                 hw->wiphy->interface_modes =
                         BIT(NL80211_IFTYPE_STATION) |
                         BIT(NL80211_IFTYPE_AP) |
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO) |
+                        BIT(NL80211_IFTYPE_ADHOC) |
                         BIT(NL80211_IFTYPE_MESH_POINT);
 
                 hw->flags = IEEE80211_HW_MFP_CAPABLE |
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 077baa86756b..b4772c1c6135 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -762,14 +762,17 @@ int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate)
         case FIRMWARE_TYPE_INTERSIL: /* Intersil style rate */
         case FIRMWARE_TYPE_SYMBOL: /* Symbol style rate */
                 for (i = 0; i < BITRATE_TABLE_SIZE; i++)
-                        if (bitrate_table[i].intersil_txratectrl == val)
+                        if (bitrate_table[i].intersil_txratectrl == val) {
+                                *bitrate = bitrate_table[i].bitrate * 100000;
                                 break;
+                        }
 
-                if (i >= BITRATE_TABLE_SIZE)
+                if (i >= BITRATE_TABLE_SIZE) {
                         printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
                                priv->ndev->name, val);
+                        err = -EIO;
+                }
 
-                *bitrate = bitrate_table[i].bitrate * 100000;
                 break;
         default:
                 BUG();
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index cf7be1eb6124..93505f93bf97 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -589,8 +589,15 @@ static int orinoco_ioctl_getrate(struct net_device *dev,
 
         /* If the interface is running we try to find more about the
            current mode */
-        if (netif_running(dev))
-                err = orinoco_hw_get_act_bitrate(priv, &bitrate);
+        if (netif_running(dev)) {
+                int act_bitrate;
+                int lerr;
+
+                /* Ignore errors if we can't get the actual bitrate */
+                lerr = orinoco_hw_get_act_bitrate(priv, &act_bitrate);
+                if (!lerr)
+                        bitrate = act_bitrate;
+        }
 
         orinoco_unlock(priv, &flags);
 
diff --git a/drivers/net/wireless/p54/Kconfig b/drivers/net/wireless/p54/Kconfig
index b0342a520bf1..e5f45cb2a7a2 100644
--- a/drivers/net/wireless/p54/Kconfig
+++ b/drivers/net/wireless/p54/Kconfig
@@ -2,6 +2,7 @@ config P54_COMMON
         tristate "Softmac Prism54 support"
         depends on MAC80211 && EXPERIMENTAL
         select FW_LOADER
+        select CRC_CCITT
         ---help---
           This is common code for isl38xx/stlc45xx based modules.
           This module does nothing by itself - the USB/PCI/SPI front-ends
@@ -48,6 +49,23 @@ config P54_SPI
 
           If you choose to build a module, it'll be called p54spi.
 
+config P54_SPI_DEFAULT_EEPROM
+        bool "Include fallback EEPROM blob"
+        depends on P54_SPI
+        default n
+        ---help---
+         Unlike the PCI or USB devices, the SPI variants don't have
+         a dedicated EEPROM chip to store all device specific values
+         for calibration, country and interface settings.
+
+         The driver will try to load the image "3826.eeprom", if the
+         file is put at the right place. (usually /lib/firmware.)
+
+         Only if this request fails, this option will provide a
+         backup set of generic values to get the device working.
+
+         Enabling this option adds about 4k to p54spi.
+
 config P54_LEDS
         bool
         depends on P54_COMMON && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = P54_COMMON)
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 78347041ec40..8c05266d37f4 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 
 #include <net/mac80211.h>
+#include <linux/crc-ccitt.h>
 
 #include "p54.h"
 #include "eeprom.h"
@@ -540,6 +541,7 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         int err;
         u8 *end = (u8 *)eeprom + len;
         u16 synth = 0;
+        u16 crc16 = ~0;
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
         entry = (void *)wrap->data + le16_to_cpu(wrap->len);
@@ -655,16 +657,29 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         }
                         break;
                 case PDR_END:
-                        /* make it overrun */
-                        entry_len = len;
+                        crc16 = ~crc_ccitt(crc16, (u8 *) entry, sizeof(*entry));
+                        if (crc16 != le16_to_cpup((__le16 *)entry->data)) {
+                                wiphy_err(dev->wiphy, "eeprom failed checksum "
+                                         "test!\n");
+                                err = -ENOMSG;
+                                goto err;
+                        } else {
+                                goto good_eeprom;
+                        }
                         break;
                 default:
                         break;
                 }
 
-                entry = (void *)entry + (entry_len + 1)*2;
+                crc16 = crc_ccitt(crc16, (u8 *)entry, (entry_len + 1) * 2);
+                entry = (void *)entry + (entry_len + 1) * 2;
         }
 
+        wiphy_err(dev->wiphy, "unexpected end of eeprom data.\n");
+        err = -ENODATA;
+        goto err;
+
+good_eeprom:
         if (!synth || !priv->iq_autocal || !priv->output_limit ||
             !priv->curve_data) {
                 wiphy_err(dev->wiphy,
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index 15b20c29a604..92b9b1f05fd5 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -123,10 +123,14 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
                 bootrec = (struct bootrec *)&bootrec->data[len];
         }
 
-        if (fw_version)
+        if (fw_version) {
                 wiphy_info(priv->hw->wiphy,
                            "FW rev %s - Softmac protocol %x.%x\n",
                            fw_version, priv->fw_var >> 8, priv->fw_var & 0xff);
+                snprintf(dev->wiphy->fw_version, sizeof(dev->wiphy->fw_version),
+                                "%s - %x.%x", fw_version,
+                                priv->fw_var >> 8, priv->fw_var & 0xff);
+        }
 
         if (priv->fw_var < 0x500)
                 wiphy_info(priv->hw->wiphy,
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 47db439b63bf..622d27b6d8f2 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -429,8 +429,8 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
 
         mutex_lock(&priv->conf_mutex);
         if (cmd == SET_KEY) {
-                switch (key->alg) {
-                case ALG_TKIP:
+                switch (key->cipher) {
+                case WLAN_CIPHER_SUITE_TKIP:
                         if (!(priv->privacy_caps & (BR_DESC_PRIV_CAP_MICHAEL |
                               BR_DESC_PRIV_CAP_TKIP))) {
                                 ret = -EOPNOTSUPP;
@@ -439,7 +439,8 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                         algo = P54_CRYPTO_TKIPMICHAEL;
                         break;
-                case ALG_WEP:
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
                         if (!(priv->privacy_caps & BR_DESC_PRIV_CAP_WEP)) {
                                 ret = -EOPNOTSUPP;
                                 goto out_unlock;
@@ -447,7 +448,7 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                         algo = P54_CRYPTO_WEP;
                         break;
-                case ALG_CCMP:
+                case WLAN_CIPHER_SUITE_CCMP:
                         if (!(priv->privacy_caps & BR_DESC_PRIV_CAP_AESCCMP)) {
                                 ret = -EOPNOTSUPP;
                                 goto out_unlock;
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 087bf0698a5a..18d24b7b1e34 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -32,11 +32,14 @@
 #include <linux/slab.h>
 
 #include "p54spi.h"
-#include "p54spi_eeprom.h"
 #include "p54.h"
 
 #include "lmac.h"
 
+#ifdef CONFIG_P54_SPI_DEFAULT_EEPROM
+#include "p54spi_eeprom.h"
+#endif /* CONFIG_P54_SPI_DEFAULT_EEPROM */
+
 MODULE_FIRMWARE("3826.arm");
 MODULE_ALIAS("stlc45xx");
 
@@ -195,9 +198,13 @@ static int p54spi_request_eeprom(struct ieee80211_hw *dev)
 
         ret = request_firmware(&eeprom, "3826.eeprom", &priv->spi->dev);
         if (ret < 0) {
+#ifdef CONFIG_P54_SPI_DEFAULT_EEPROM
                 dev_info(&priv->spi->dev, "loading default eeprom...\n");
                 ret = p54_parse_eeprom(dev, (void *) p54spi_eeprom,
                                        sizeof(p54spi_eeprom));
+#else
+                dev_err(&priv->spi->dev, "Failed to request user eeprom\n");
+#endif /* CONFIG_P54_SPI_DEFAULT_EEPROM */
         } else {
                 dev_info(&priv->spi->dev, "loading user eeprom...\n");
                 ret = p54_parse_eeprom(dev, (void *) eeprom->data,
diff --git a/drivers/net/wireless/p54/p54spi_eeprom.h b/drivers/net/wireless/p54/p54spi_eeprom.h
index 1ea1050911d9..d592cbd34d78 100644
--- a/drivers/net/wireless/p54/p54spi_eeprom.h
+++ b/drivers/net/wireless/p54/p54spi_eeprom.h
@@ -671,7 +671,7 @@ static unsigned char p54spi_eeprom[] = {
         0xa8, 0x09, 0x25, 0x00, 0xf5, 0xff, 0xf9, 0xff, 0x00, 0x01,
 
 0x02, 0x00, 0x00, 0x00,         /* PDR_END */
-        0xa8, 0xf5                      /* bogus data */
+        0x67, 0x99,
 };
 
 #endif /* P54SPI_EEPROM_H */
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index ad595958b7df..063248b35069 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -930,8 +930,8 @@ static int __devinit p54u_probe(struct usb_interface *intf,
 #ifdef CONFIG_PM
                 /* ISL3887 needs a full reset on resume */
                 udev->reset_resume = 1;
+#endif /* CONFIG_PM */
                 err = p54u_device_reset(dev);
-#endif
 
                 priv->hw_type = P54U_3887;
                 dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 0e937dc0c9c4..76b2318a7dc7 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -275,15 +275,15 @@ static int p54_rssi_to_dbm(struct p54_common *priv, int rssi)
 {
         int band = priv->hw->conf.channel->band;
 
-        if (priv->rxhw != 5)
+        if (priv->rxhw != 5) {
                 return ((rssi * priv->rssical_db[band].mul) / 64 +
                          priv->rssical_db[band].add) / 4;
-        else
+        } else {
                 /*
                  * TODO: find the correct formula
                  */
-                return ((rssi * priv->rssical_db[band].mul) / 64 +
-                         priv->rssical_db[band].add) / 4;
+                return rssi / 2 - 110;
+        }
 }
 
 /*
@@ -683,14 +683,15 @@ static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
         }
 }
 
-static u8 p54_convert_algo(enum ieee80211_key_alg alg)
+static u8 p54_convert_algo(u32 cipher)
 {
-        switch (alg) {
-        case ALG_WEP:
+        switch (cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 return P54_CRYPTO_WEP;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 return P54_CRYPTO_TKIPMICHAEL;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 return P54_CRYPTO_AESCCMP;
         default:
                 return 0;
@@ -731,7 +732,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
 
         if (info->control.hw_key) {
                 crypt_offset = ieee80211_get_hdrlen_from_skb(skb);
-                if (info->control.hw_key->alg == ALG_TKIP) {
+                if (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                         u8 *iv = (u8 *)(skb->data + crypt_offset);
                         /*
                          * The firmware excepts that the IV has to have
@@ -827,10 +828,10 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
         hdr->tries = ridx;
         txhdr->rts_rate_idx = 0;
         if (info->control.hw_key) {
-                txhdr->key_type = p54_convert_algo(info->control.hw_key->alg);
+                txhdr->key_type = p54_convert_algo(info->control.hw_key->cipher);
                 txhdr->key_len = min((u8)16, info->control.hw_key->keylen);
                 memcpy(txhdr->key, info->control.hw_key->key, txhdr->key_len);
-                if (info->control.hw_key->alg == ALG_TKIP) {
+                if (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                         /* reserve space for the MIC key */
                         len += 8;
                         memcpy(skb_put(skb, 8), &(info->control.hw_key->key
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 77cd65db8500..d97a2caf582b 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -3234,7 +3234,7 @@ prism54_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd)
         switch (cmd) {
                 case PRISM54_HOSTAPD:
                 if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
+                        return -EPERM;
                 ret = prism54_hostapd(ndev, &wrq->u.data);
                 return ret;
         }
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 88560d0ae50a..5ca624a64c42 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -43,7 +43,6 @@
 #include <linux/if_arp.h>
 #include <linux/ioport.h>
 #include <linux/skbuff.h>
-#include <linux/ethtool.h>
 #include <linux/ieee80211.h>
 
 #include <pcmcia/cs.h>
@@ -80,8 +79,6 @@ static int ray_dev_config(struct net_device *dev, struct ifmap *map);
 static struct net_device_stats *ray_get_stats(struct net_device *dev);
 static int ray_dev_init(struct net_device *dev);
 
-static const struct ethtool_ops netdev_ethtool_ops;
-
 static int ray_open(struct net_device *dev);
 static netdev_tx_t ray_dev_start_xmit(struct sk_buff *skb,
                                             struct net_device *dev);
@@ -197,7 +194,7 @@ module_param(bc, int, 0);
 module_param(phy_addr, charp, 0);
 module_param(ray_mem_speed, int, 0);
 
-static UCHAR b5_default_startup_parms[] = {
+static const UCHAR b5_default_startup_parms[] = {
         0, 0,                   /* Adhoc station */
         'L', 'I', 'N', 'U', 'X', 0, 0, 0,       /* 32 char ESSID */
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -232,7 +229,7 @@ static UCHAR b5_default_startup_parms[] = {
         2, 0, 0, 0, 0, 0, 0, 0  /* basic rate set */
 };
 
-static UCHAR b4_default_startup_parms[] = {
+static const UCHAR b4_default_startup_parms[] = {
         0, 0,                   /* Adhoc station */
         'L', 'I', 'N', 'U', 'X', 0, 0, 0,       /* 32 char ESSID */
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -264,9 +261,9 @@ static UCHAR b4_default_startup_parms[] = {
 };
 
 /*===========================================================================*/
-static unsigned char eth2_llc[] = { 0xaa, 0xaa, 3, 0, 0, 0 };
+static const u8 eth2_llc[] = { 0xaa, 0xaa, 3, 0, 0, 0 };
 
-static char hop_pattern_length[] = { 1,
+static const char hop_pattern_length[] = { 1,
         USA_HOP_MOD, EUROPE_HOP_MOD,
         JAPAN_HOP_MOD, KOREA_HOP_MOD,
         SPAIN_HOP_MOD, FRANCE_HOP_MOD,
@@ -274,7 +271,7 @@ static char hop_pattern_length[] = { 1,
         JAPAN_TEST_HOP_MOD
 };
 
-static char rcsid[] =
+static const char rcsid[] =
     "Raylink/WebGear wireless LAN - Corey <Thomas corey@world.std.com>";
 
 static const struct net_device_ops ray_netdev_ops = {
@@ -333,7 +330,6 @@ static int ray_probe(struct pcmcia_device *p_dev)
 
         /* Raylink entries in the device structure */
         dev->netdev_ops = &ray_netdev_ops;
-        SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
         dev->wireless_handlers = &ray_handler_def;
 #ifdef WIRELESS_SPY
         local->wireless_data.spy_data = &local->spy_data;
@@ -608,7 +604,7 @@ static int dl_startup_params(struct net_device *dev)
         /* Start kernel timer to wait for dl startup to complete. */
         local->timer.expires = jiffies + HZ / 2;
         local->timer.data = (long)local;
-        local->timer.function = &verify_dl_startup;
+        local->timer.function = verify_dl_startup;
         add_timer(&local->timer);
         dev_dbg(&link->dev,
               "ray_cs dl_startup_params started timer for verify_dl_startup\n");
@@ -1062,18 +1058,6 @@ AP to AP	1	1	dest AP		src AP		dest	source
         }
 } /* end encapsulate_frame */
 
-/*===========================================================================*/
-
-static void netdev_get_drvinfo(struct net_device *dev,
-                               struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, "ray_cs");
-}
-
-static const struct ethtool_ops netdev_ethtool_ops = {
-        .get_drvinfo = netdev_get_drvinfo,
-};
-
 /*====================================================================*/
 
 /*------------------------------------------------------------------*/
@@ -1997,12 +1981,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" start failed\n",
                                               local->sparm.b4.a_current_ess_id);
-                                        local->timer.function = &start_net;
+                                        local->timer.function = start_net;
                                 } else {
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" join failed\n",
                                               local->sparm.b4.a_current_ess_id);
-                                        local->timer.function = &join_net;
+                                        local->timer.function = join_net;
                                 }
                                 add_timer(&local->timer);
                         }
@@ -2470,9 +2454,9 @@ static void authenticate(ray_dev_t *local)
 
         del_timer(&local->timer);
         if (build_auth_frame(local, local->bss_id, OPEN_AUTH_REQUEST)) {
-                local->timer.function = &join_net;
+                local->timer.function = join_net;
         } else {
-                local->timer.function = &authenticate_timeout;
+                local->timer.function = authenticate_timeout;
         }
         local->timer.expires = jiffies + HZ * 2;
         local->timer.data = (long)local;
@@ -2557,7 +2541,7 @@ static void associate(ray_dev_t *local)
                 del_timer(&local->timer);
                 local->timer.expires = jiffies + HZ * 2;
                 local->timer.data = (long)local;
-                local->timer.function = &join_net;
+                local->timer.function = join_net;
                 add_timer(&local->timer);
                 local->card_status = CARD_ASSOC_FAILED;
                 return;
@@ -2591,7 +2575,7 @@ static void clear_interrupt(ray_dev_t *local)
 #ifdef CONFIG_PROC_FS
 #define MAXDATA (PAGE_SIZE - 80)
 
-static char *card_status[] = {
+static const char *card_status[] = {
         "Card inserted - uninitialized",        /* 0 */
         "Card not downloaded",                  /* 1 */
         "Waiting for download parameters",      /* 2 */
@@ -2608,8 +2592,8 @@ static char *card_status[] = {
         "Association failed"                    /* 16 */
 };
 
-static char *nettype[] = { "Adhoc", "Infra " };
-static char *framing[] = { "Encapsulation", "Translation" }
+static const char *nettype[] = { "Adhoc", "Infra " };
+static const char *framing[] = { "Encapsulation", "Translation" }
 
 ;
 /*===========================================================================*/
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 5063e01410e5..d49e830fa1da 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -321,7 +321,8 @@ static void rt2400pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         int preamble_mask;
         u32 reg;
@@ -329,59 +330,72 @@ static void rt2400pci_config_erp(struct rt2x00_dev *rt2x00dev,
         /*
          * When short preamble is enabled, we should set bit 0x08
          */
-        preamble_mask = erp->short_preamble << 3;
-
-        rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x1ff);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0x13a);
-        rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-        rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
-        rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
-        rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 10));
-        rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
-        rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 20));
-        rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
-        rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 55));
-        rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
-        rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 110));
-        rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
-
-        rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                preamble_mask = erp->short_preamble << 3;
+
+                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x1ff);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0x13a);
+                rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
+                rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
+                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
+                rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 10));
+                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 20));
+                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 55));
+                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 110));
+                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
-        rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
 
-        rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
-        rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL, erp->beacon_int * 16);
-        rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION, erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
-        rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-        rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
+                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+
+                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
+                rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
-        rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
-        rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        }
 }
 
 static void rt2400pci_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1007,12 +1021,11 @@ static int rt2400pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
+static void rt2400pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1096,7 +1109,7 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         /*
          * Write the TX descriptor for the beacon.
          */
-        rt2400pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        rt2400pci_write_tx_desc(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -1112,24 +1125,24 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 }
 
-static void rt2400pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid queue)
+static void rt2400pci_kick_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
-        rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue == QID_AC_BE));
-        rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue == QID_AC_BK));
-        rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, (queue == QID_ATIM));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue->qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue->qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, (queue->qid == QID_ATIM));
         rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
 }
 
-static void rt2400pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid qid)
+static void rt2400pci_kill_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
-        if (qid == QID_BEACON) {
+        if (queue->qid == QID_BEACON) {
                 rt2x00pci_register_write(rt2x00dev, CSR14, 0);
         } else {
                 rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
@@ -1481,15 +1494,17 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = TXPOWER_FROM_DEV(MAX_TXPOWER);
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index c2a555d5376b..2214c3231727 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -327,7 +327,8 @@ static void rt2500pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         int preamble_mask;
         u32 reg;
@@ -335,59 +336,73 @@ static void rt2500pci_config_erp(struct rt2x00_dev *rt2x00dev,
         /*
          * When short preamble is enabled, we should set bit 0x08
          */
-        preamble_mask = erp->short_preamble << 3;
-
-        rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x162);
-        rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0xa2);
-        rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
-        rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
-        rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
-        rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 10));
-        rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
-        rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 20));
-        rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
-        rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 55));
-        rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
-
-        rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
-        rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
-        rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
-        rt2x00_set_field32(&reg, ARCSR2_LENGTH, GET_DURATION(ACK_SIZE, 110));
-        rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
-
-        rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                preamble_mask = erp->short_preamble << 3;
+
+                rt2x00pci_register_read(rt2x00dev, TXCSR1, &reg);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_TIMEOUT, 0x162);
+                rt2x00_set_field32(&reg, TXCSR1_ACK_CONSUME_TIME, 0xa2);
+                rt2x00_set_field32(&reg, TXCSR1_TSF_OFFSET, IEEE80211_HEADER);
+                rt2x00_set_field32(&reg, TXCSR1_AUTORESPONDER, 1);
+                rt2x00pci_register_write(rt2x00dev, TXCSR1, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR2, &reg);
+                rt2x00_set_field32(&reg, ARCSR2_SIGNAL, 0x00);
+                rt2x00_set_field32(&reg, ARCSR2_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 10));
+                rt2x00pci_register_write(rt2x00dev, ARCSR2, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR3, &reg);
+                rt2x00_set_field32(&reg, ARCSR3_SIGNAL, 0x01 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR3_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 20));
+                rt2x00pci_register_write(rt2x00dev, ARCSR3, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR4, &reg);
+                rt2x00_set_field32(&reg, ARCSR4_SIGNAL, 0x02 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR4_SERVICE, 0x04);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 55));
+                rt2x00pci_register_write(rt2x00dev, ARCSR4, reg);
+
+                rt2x00pci_register_read(rt2x00dev, ARCSR5, &reg);
+                rt2x00_set_field32(&reg, ARCSR5_SIGNAL, 0x03 | preamble_mask);
+                rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
+                rt2x00_set_field32(&reg, ARCSR2_LENGTH,
+                                   GET_DURATION(ACK_SIZE, 110));
+                rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
-        rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, CSR11, reg);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, ARCSR1, erp->basic_rates);
 
-        rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
-        rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL, erp->beacon_int * 16);
-        rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION, erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
+                rt2x00_set_field32(&reg, CSR11_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 
-        rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
-        rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
-        rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+                rt2x00pci_register_read(rt2x00dev, CSR18, &reg);
+                rt2x00_set_field32(&reg, CSR18_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, CSR18_PIFS, erp->pifs);
+                rt2x00pci_register_write(rt2x00dev, CSR18, reg);
+
+                rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
+                rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
+                rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, CSR19, reg);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, CSR12, &reg);
+                rt2x00_set_field32(&reg, CSR12_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00_set_field32(&reg, CSR12_CFP_MAX_DURATION,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, CSR12, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, CSR19, &reg);
-        rt2x00_set_field32(&reg, CSR19_DIFS, erp->difs);
-        rt2x00_set_field32(&reg, CSR19_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, CSR19, reg);
 }
 
 static void rt2500pci_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1161,12 +1176,11 @@ static int rt2500pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
+static void rt2500pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1249,7 +1263,7 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         /*
          * Write the TX descriptor for the beacon.
          */
-        rt2500pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        rt2500pci_write_tx_desc(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -1265,24 +1279,24 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 }
 
-static void rt2500pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid queue)
+static void rt2500pci_kick_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
-        rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue == QID_AC_BE));
-        rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue == QID_AC_BK));
-        rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, (queue == QID_ATIM));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_PRIO, (queue->qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_TX, (queue->qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM, (queue->qid == QID_ATIM));
         rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
 }
 
-static void rt2500pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid qid)
+static void rt2500pci_kill_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
-        if (qid == QID_BEACON) {
+        if (queue->qid == QID_BEACON) {
                 rt2x00pci_register_write(rt2x00dev, CSR14, 0);
         } else {
                 rt2x00pci_register_read(rt2x00dev, TXCSR0, &reg);
@@ -1795,19 +1809,23 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index cdaf93f48263..6e94356265b3 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -355,7 +355,9 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                  * it is known that not work at least on some hardware.
                  * SW crypto will be used in that case.
                  */
-                if (key->alg == ALG_WEP && key->keyidx != 0)
+                if ((key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                     key->cipher == WLAN_CIPHER_SUITE_WEP104) &&
+                    key->keyidx != 0)
                         return -EOPNOTSUPP;
 
                 /*
@@ -492,24 +494,34 @@ static void rt2500usb_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500usb_config_erp(struct rt2x00_dev *rt2x00dev,
-                                 struct rt2x00lib_erp *erp)
+                                 struct rt2x00lib_erp *erp,
+                                 u32 changed)
 {
         u16 reg;
 
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR10, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR10, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
+        }
 
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR11, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR11,
+                                         erp->basic_rates);
 
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL, erp->beacon_int * 4);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL,
+                                   erp->beacon_int * 4);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+        }
 
-        rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
+                rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
+                rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
+        }
 }
 
 static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
@@ -1039,12 +1051,11 @@ static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
+static void rt2500usb_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = (__le32 *) skb->data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        __le32 *txd = (__le32 *) entry->skb->data;
         u32 word;
 
         /*
@@ -1127,7 +1138,7 @@ static void rt2500usb_write_beacon(struct queue_entry *entry,
         /*
          * Write the TX descriptor for the beacon.
          */
-        rt2500usb_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        rt2500usb_write_tx_desc(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -1195,6 +1206,14 @@ static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
         return length;
 }
 
+static void rt2500usb_kill_tx_queue(struct data_queue *queue)
+{
+        if (queue->qid == QID_BEACON)
+                rt2500usb_register_write(queue->rt2x00dev, TXRX_CSR19, 0);
+
+        rt2x00usb_kill_tx_queue(queue);
+}
+
 /*
  * RX control handlers
  */
@@ -1698,19 +1717,23 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
@@ -1789,7 +1812,7 @@ static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
         .write_beacon           = rt2500usb_write_beacon,
         .get_tx_data_len        = rt2500usb_get_tx_data_len,
         .kick_tx_queue          = rt2x00usb_kick_tx_queue,
-        .kill_tx_queue          = rt2x00usb_kill_tx_queue,
+        .kill_tx_queue          = rt2500usb_kill_tx_queue,
         .fill_rxdone            = rt2500usb_fill_rxdone,
         .config_shared_key      = rt2500usb_config_key,
         .config_pairwise_key    = rt2500usb_config_key,
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index ed4ebcdde7c9..2edc7742a7e9 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -639,6 +639,18 @@
 #define LED_CFG_LED_POLAR               FIELD32(0x40000000)
 
 /*
+ * AMPDU_BA_WINSIZE: Force BlockAck window size
+ * FORCE_WINSIZE_ENABLE:
+ *   0: Disable forcing of BlockAck window size
+ *   1: Enable forcing of BlockAck window size, overwrites values BlockAck
+ *      window size values in the TXWI
+ * FORCE_WINSIZE: BlockAck window size
+ */
+#define AMPDU_BA_WINSIZE                0x1040
+#define AMPDU_BA_WINSIZE_FORCE_WINSIZE_ENABLE FIELD32(0x00000020)
+#define AMPDU_BA_WINSIZE_FORCE_WINSIZE  FIELD32(0x0000001f)
+
+/*
  * XIFS_TIME_CFG: MAC timing
  * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
  * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
@@ -1318,7 +1330,25 @@
 #define TX_STA_CNT2_TX_UNDER_FLOW_COUNT FIELD32(0xffff0000)
 
 /*
- * TX_STA_FIFO: TX Result for specific PID status fifo register
+ * TX_STA_FIFO: TX Result for specific PID status fifo register.
+ *
+ * This register is implemented as FIFO with 16 entries in the HW. Each
+ * register read fetches the next tx result. If the FIFO is full because
+ * it wasn't read fast enough after the according interrupt (TX_FIFO_STATUS)
+ * triggered, the hw seems to simply drop further tx results.
+ *
+ * VALID: 1: this tx result is valid
+ *        0: no valid tx result -> driver should stop reading
+ * PID_TYPE: The PID latched from the PID field in the TXWI, can be used
+ *           to match a frame with its tx result (even though the PID is
+ *           only 4 bits wide).
+ * TX_SUCCESS: Indicates tx success (1) or failure (0)
+ * TX_AGGRE: Indicates if the frame was part of an aggregate (1) or not (0)
+ * TX_ACK_REQUIRED: Indicates if the frame needed to get ack'ed (1) or not (0)
+ * WCID: The wireless client ID.
+ * MCS: The tx rate used during the last transmission of this frame, be it
+ *      successful or not.
+ * PHYMODE: The phymode used for the transmission.
  */
 #define TX_STA_FIFO                     0x1718
 #define TX_STA_FIFO_VALID               FIELD32(0x00000001)
@@ -1841,6 +1871,13 @@ struct mac_iveiv_entry {
 #define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
 
 /*
+ * EEPROM Maximum TX power values
+ */
+#define EEPROM_MAX_TX_POWER             0x0027
+#define EEPROM_MAX_TX_POWER_24GHZ       FIELD16(0x00ff)
+#define EEPROM_MAX_TX_POWER_5GHZ        FIELD16(0xff00)
+
+/*
  * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
  *      This is delta in 40MHZ.
  * VALUE: Tx Power dalta value (MAX=4)
@@ -1928,6 +1965,8 @@ struct mac_iveiv_entry {
  * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
  * BW: Channel bandwidth 20MHz or 40 MHz
  * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
+ * AMPDU: 1: this frame is eligible for AMPDU aggregation, the hw will
+ *        aggregate consecutive frames with the same RA and QoS TID.
  */
 #define TXWI_W0_FRAG                    FIELD32(0x00000001)
 #define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
@@ -1945,6 +1984,15 @@ struct mac_iveiv_entry {
 
 /*
  * Word1
+ * ACK: 0: No Ack needed, 1: Ack needed
+ * NSEQ: 0: Don't assign hw sequence number, 1: Assign hw sequence number
+ * BW_WIN_SIZE: BA windows size of the recipient
+ * WIRELESS_CLI_ID: Client ID for WCID table access
+ * MPDU_TOTAL_BYTE_COUNT: Length of 802.11 frame
+ * PACKETID: Will be latched into the TX_STA_FIFO register once the according
+ *           frame was processed. If multiple frames are aggregated together
+ *           (AMPDU==1) the reported tx status will always contain the packet
+ *           id of the first frame. 0: Don't report tx status for this frame.
  */
 #define TXWI_W1_ACK                     FIELD32(0x00000001)
 #define TXWI_W1_NSEQ                    FIELD32(0x00000002)
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b66e0fd8f0fa..3bb67492d754 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1,4 +1,5 @@
 /*
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
         Copyright (C) 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2009 Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
         Copyright (C) 2009 Gertjan van Wingerde <gwingerde@gmail.com>
@@ -254,6 +255,23 @@ void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
 }
 EXPORT_SYMBOL_GPL(rt2800_mcu_request);
 
+int rt2800_wait_csr_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i = 0;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        return 0;
+                msleep(1);
+        }
+
+        ERROR(rt2x00dev, "Unstable hardware.\n");
+        return -EBUSY;
+}
+EXPORT_SYMBOL_GPL(rt2800_wait_csr_ready);
+
 int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
 {
         unsigned int i;
@@ -367,19 +385,16 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
         u32 reg;
 
         /*
-         * Wait for stable hardware.
+         * If driver doesn't wake up firmware here,
+         * rt2800_load_firmware will hang forever when interface is up again.
          */
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
-                if (reg && reg != ~0)
-                        break;
-                msleep(1);
-        }
+        rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0x00000000);
 
-        if (i == REGISTER_BUSY_COUNT) {
-                ERROR(rt2x00dev, "Unstable hardware.\n");
+        /*
+         * Wait for stable hardware.
+         */
+        if (rt2800_wait_csr_ready(rt2x00dev))
                 return -EBUSY;
-        }
 
         if (rt2x00_is_pci(rt2x00dev))
                 rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000002);
@@ -427,8 +442,10 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
 }
 EXPORT_SYMBOL_GPL(rt2800_load_firmware);
 
-void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc)
+void rt2800_write_tx_data(struct queue_entry *entry,
+                          struct txentry_desc *txdesc)
 {
+        __le32 *txwi = rt2800_drv_get_txwi(entry);
         u32 word;
 
         /*
@@ -437,7 +454,8 @@ void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc)
         rt2x00_desc_read(txwi, 0, &word);
         rt2x00_set_field32(&word, TXWI_W0_FRAG,
                            test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
-        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
+        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS,
+                           test_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags));
         rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
         rt2x00_set_field32(&word, TXWI_W0_TS,
                            test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
@@ -465,7 +483,7 @@ void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc)
                            txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
                            txdesc->length);
-        rt2x00_set_field32(&word, TXWI_W1_PACKETID, txdesc->queue + 1);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID, txdesc->qid + 1);
         rt2x00_desc_write(txwi, 1, word);
 
         /*
@@ -478,7 +496,7 @@ void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc)
         _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
         _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
 }
-EXPORT_SYMBOL_GPL(rt2800_write_txwi);
+EXPORT_SYMBOL_GPL(rt2800_write_tx_data);
 
 static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxwi_w2)
 {
@@ -490,7 +508,7 @@ static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxwi_w2)
         u8 offset1;
         u8 offset2;
 
-        if (rt2x00dev->rx_status.band == IEEE80211_BAND_2GHZ) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG, &eeprom);
                 offset0 = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG_OFFSET0);
                 offset1 = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG_OFFSET1);
@@ -569,6 +587,148 @@ void rt2800_process_rxwi(struct queue_entry *entry,
 }
 EXPORT_SYMBOL_GPL(rt2800_process_rxwi);
 
+static bool rt2800_txdone_entry_check(struct queue_entry *entry, u32 reg)
+{
+        __le32 *txwi;
+        u32 word;
+        int wcid, ack, pid;
+        int tx_wcid, tx_ack, tx_pid;
+
+        wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
+        ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
+        pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
+
+        /*
+         * This frames has returned with an IO error,
+         * so the status report is not intended for this
+         * frame.
+         */
+        if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags)) {
+                rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+                return false;
+        }
+
+        /*
+         * Validate if this TX status report is intended for
+         * this entry by comparing the WCID/ACK/PID fields.
+         */
+        txwi = rt2800_drv_get_txwi(entry);
+
+        rt2x00_desc_read(txwi, 1, &word);
+        tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+        tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
+        tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
+
+        if ((wcid != tx_wcid) || (ack != tx_ack) || (pid != tx_pid)) {
+                WARNING(entry->queue->rt2x00dev,
+                        "TX status report missed for queue %d entry %d\n",
+                entry->queue->qid, entry->entry_idx);
+                rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
+                return false;
+        }
+
+        return true;
+}
+
+void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        struct queue_entry *entry;
+        __le32 *txwi;
+        struct txdone_entry_desc txdesc;
+        u32 word;
+        u32 reg;
+        u16 mcs, real_mcs;
+        u8 pid;
+        int i;
+
+        /*
+         * TX_STA_FIFO is a stack of X entries, hence read TX_STA_FIFO
+         * at most X times and also stop processing once the TX_STA_FIFO_VALID
+         * flag is not set anymore.
+         *
+         * The legacy drivers use X=TX_RING_SIZE but state in a comment
+         * that the TX_STA_FIFO stack has a size of 16. We stick to our
+         * tx ring size for now.
+         */
+        for (i = 0; i < TX_ENTRIES; i++) {
+                rt2800_register_read(rt2x00dev, TX_STA_FIFO, &reg);
+                if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
+                        break;
+
+                /*
+                 * Skip this entry when it contains an invalid
+                 * queue identication number.
+                 */
+                pid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE) - 1;
+                if (pid >= QID_RX)
+                        continue;
+
+                queue = rt2x00queue_get_queue(rt2x00dev, pid);
+                if (unlikely(!queue))
+                        continue;
+
+                /*
+                 * Inside each queue, we process each entry in a chronological
+                 * order. We first check that the queue is not empty.
+                 */
+                entry = NULL;
+                txwi = NULL;
+                while (!rt2x00queue_empty(queue)) {
+                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                        if (rt2800_txdone_entry_check(entry, reg))
+                                break;
+                }
+
+                if (!entry || rt2x00queue_empty(queue))
+                        break;
+
+
+                /*
+                 * Obtain the status about this packet.
+                 */
+                txdesc.flags = 0;
+                txwi = rt2800_drv_get_txwi(entry);
+                rt2x00_desc_read(txwi, 0, &word);
+                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
+                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
+
+                /*
+                 * Ralink has a retry mechanism using a global fallback
+                 * table. We setup this fallback table to try the immediate
+                 * lower rate for all rates. In the TX_STA_FIFO, the MCS field
+                 * always contains the MCS used for the last transmission, be
+                 * it successful or not.
+                 */
+                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS)) {
+                        /*
+                         * Transmission succeeded. The number of retries is
+                         * mcs - real_mcs
+                         */
+                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
+                        txdesc.retry = ((mcs > real_mcs) ? mcs - real_mcs : 0);
+                } else {
+                        /*
+                         * Transmission failed. The number of retries is
+                         * always 7 in this case (for a total number of 8
+                         * frames sent).
+                         */
+                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
+                        txdesc.retry = rt2x00dev->long_retry;
+                }
+
+                /*
+                 * the frame was retried at least once
+                 * -> hw used fallback rates
+                 */
+                if (txdesc.retry)
+                        __set_bit(TXDONE_FALLBACK, &txdesc.flags);
+
+                rt2x00lib_txdone(entry, &txdesc);
+        }
+}
+EXPORT_SYMBOL_GPL(rt2800_txdone);
+
 void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
@@ -600,7 +760,7 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
         /*
          * Add the TXWI for the beacon to the skb.
          */
-        rt2800_write_txwi((__le32 *)entry->skb->data, txdesc);
+        rt2800_write_tx_data(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -975,19 +1135,23 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
         }
 
         if (flags & CONFIG_UPDATE_MAC) {
-                reg = le32_to_cpu(conf->mac[1]);
-                rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
-                conf->mac[1] = cpu_to_le32(reg);
+                if (!is_zero_ether_addr((const u8 *)conf->mac)) {
+                        reg = le32_to_cpu(conf->mac[1]);
+                        rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
+                        conf->mac[1] = cpu_to_le32(reg);
+                }
 
                 rt2800_register_multiwrite(rt2x00dev, MAC_ADDR_DW0,
                                               conf->mac, sizeof(conf->mac));
         }
 
         if (flags & CONFIG_UPDATE_BSSID) {
-                reg = le32_to_cpu(conf->bssid[1]);
-                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
-                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
-                conf->bssid[1] = cpu_to_le32(reg);
+                if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
+                        reg = le32_to_cpu(conf->bssid[1]);
+                        rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
+                        rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
+                        conf->bssid[1] = cpu_to_le32(reg);
+                }
 
                 rt2800_register_multiwrite(rt2x00dev, MAC_BSSID_DW0,
                                               conf->bssid, sizeof(conf->bssid));
@@ -995,38 +1159,50 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
 }
 EXPORT_SYMBOL_GPL(rt2800_config_intf);
 
-void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp)
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp,
+                       u32 changed)
 {
         u32 reg;
 
-        rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
-                           !!erp->short_preamble);
-        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2800_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
+                                   !!erp->short_preamble);
+                rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2800_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+        }
 
-        rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
-        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
-                           erp->cts_protection ? 2 : 0);
-        rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+        if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+                rt2800_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+                rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
+                                   erp->cts_protection ? 2 : 0);
+                rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+        }
 
-        rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE,
-                                 erp->basic_rates);
-        rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE,
+                                         erp->basic_rates);
+                rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+        }
 
-        rt2800_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
-        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
-        rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2800_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
+                rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME,
+                                   erp->slot_time);
+                rt2800_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
 
-        rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
-        rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+                rt2800_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
+                rt2800_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+        }
 
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
 }
 EXPORT_SYMBOL_GPL(rt2800_config_erp);
 
@@ -1120,27 +1296,23 @@ static void rt2800_config_channel_rf2xxx(struct rt2x00_dev *rt2x00dev,
                  * double meaning, and we should set a 7DBm boost flag.
                  */
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power1 >= 0));
+                                   (info->default_power1 >= 0));
 
-                if (info->tx_power1 < 0)
-                        info->tx_power1 += 7;
+                if (info->default_power1 < 0)
+                        info->default_power1 += 7;
 
-                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power1));
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A, info->default_power1);
 
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power2 >= 0));
+                                   (info->default_power2 >= 0));
 
-                if (info->tx_power2 < 0)
-                        info->tx_power2 += 7;
+                if (info->default_power2 < 0)
+                        info->default_power2 += 7;
 
-                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power2));
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A, info->default_power2);
         } else {
-                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power1));
-                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power2));
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G, info->default_power1);
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G, info->default_power2);
         }
 
         rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
@@ -1180,13 +1352,11 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
         rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 12, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 13, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power2));
+        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER, info->default_power2);
         rt2800_rfcsr_write(rt2x00dev, 13, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
@@ -1210,10 +1380,19 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         unsigned int tx_pin;
         u8 bbp;
 
+        if (rf->channel <= 14) {
+                info->default_power1 = TXPOWER_G_TO_DEV(info->default_power1);
+                info->default_power2 = TXPOWER_G_TO_DEV(info->default_power2);
+        } else {
+                info->default_power1 = TXPOWER_A_TO_DEV(info->default_power1);
+                info->default_power2 = TXPOWER_A_TO_DEV(info->default_power2);
+        }
+
         if (rt2x00_rf(rt2x00dev, RF2020) ||
             rt2x00_rf(rt2x00dev, RF3020) ||
             rt2x00_rf(rt2x00dev, RF3021) ||
-            rt2x00_rf(rt2x00dev, RF3022))
+            rt2x00_rf(rt2x00dev, RF3022) ||
+            rt2x00_rf(rt2x00dev, RF3052))
                 rt2800_config_channel_rf3xxx(rt2x00dev, conf, rf, info);
         else
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
@@ -1536,7 +1715,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
 /*
  * Initialization functions.
  */
-int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
         u16 eeprom;
@@ -1886,6 +2065,14 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2800_register_write(rt2x00dev, LG_FBK_CFG1, reg);
 
         /*
+         * Do not force the BA window size, we use the TXWI to set it
+         */
+        rt2800_register_read(rt2x00dev, AMPDU_BA_WINSIZE, &reg);
+        rt2x00_set_field32(&reg, AMPDU_BA_WINSIZE_FORCE_WINSIZE_ENABLE, 0);
+        rt2x00_set_field32(&reg, AMPDU_BA_WINSIZE_FORCE_WINSIZE, 0);
+        rt2800_register_write(rt2x00dev, AMPDU_BA_WINSIZE, reg);
+
+        /*
          * We must clear the error counters.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
@@ -1906,7 +2093,6 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(rt2800_init_registers);
 
 static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
 {
@@ -1949,7 +2135,7 @@ static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
         return -EACCES;
 }
 
-int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 {
         unsigned int i;
         u16 eeprom;
@@ -2044,7 +2230,6 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(rt2800_init_bbp);
 
 static u8 rt2800_init_rx_filter(struct rt2x00_dev *rt2x00dev,
                                 bool bw40, u8 rfcsr24, u8 filter_target)
@@ -2106,7 +2291,7 @@ static u8 rt2800_init_rx_filter(struct rt2x00_dev *rt2x00dev,
         return rfcsr24;
 }
 
-int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
 {
         u8 rfcsr;
         u8 bbp;
@@ -2360,7 +2545,100 @@ int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(rt2800_init_rfcsr);
+
+int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 word;
+
+        /*
+         * Initialize all registers.
+         */
+        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800_init_registers(rt2x00dev) ||
+                     rt2800_init_bbp(rt2x00dev) ||
+                     rt2800_init_rfcsr(rt2x00dev)))
+                return -EIO;
+
+        /*
+         * Send signal to firmware during boot time.
+         */
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+
+        if (rt2x00_is_usb(rt2x00dev) &&
+            (rt2x00_rt(rt2x00dev, RT3070) ||
+             rt2x00_rt(rt2x00dev, RT3071) ||
+             rt2x00_rt(rt2x00dev, RT3572))) {
+                udelay(200);
+                rt2800_mcu_request(rt2x00dev, MCU_CURRENT, 0, 0, 0);
+                udelay(10);
+        }
+
+        /*
+         * Enable RX.
+         */
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        udelay(50);
+
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 2);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        /*
+         * Initialize LED control
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
+                           word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
+                           word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
+        rt2800_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
+                           word & 0xff, (word >> 8) & 0xff);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2800_enable_radio);
+
+void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        /* Wait for DMA, ignore error */
+        rt2800_wait_wpdma_ready(rt2x00dev);
+
+        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 0);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
+        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+        rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
+}
+EXPORT_SYMBOL_GPL(rt2800_disable_radio);
 
 int rt2800_efuse_detect(struct rt2x00_dev *rt2x00dev)
 {
@@ -2516,6 +2794,13 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                                    default_lna_gain);
         rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
 
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &word);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_24GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_24GHZ, MAX_G_TXPOWER);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_5GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_5GHZ, MAX_A_TXPOWER);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_MAX_TX_POWER, word);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2800_validate_eeprom);
@@ -2755,9 +3040,10 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
         struct channel_info *info;
-        char *tx_power1;
-        char *tx_power2;
+        char *default_power1;
+        char *default_power2;
         unsigned int i;
+        unsigned short max_power;
         u16 eeprom;
 
         /*
@@ -2865,27 +3151,32 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
-        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
-        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &eeprom);
+        max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_24GHZ);
+        default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
 
         for (i = 0; i < 14; i++) {
-                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
-                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+                info[i].max_power = max_power;
+                info[i].default_power1 = TXPOWER_G_FROM_DEV(default_power1[i]);
+                info[i].default_power2 = TXPOWER_G_FROM_DEV(default_power2[i]);
         }
 
         if (spec->num_channels > 14) {
-                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
-                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+                max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_5GHZ);
+                default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
 
                 for (i = 14; i < spec->num_channels; i++) {
-                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
-                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                        info[i].max_power = max_power;
+                        info[i].default_power1 = TXPOWER_A_FROM_DEV(default_power1[i]);
+                        info[i].default_power2 = TXPOWER_A_FROM_DEV(default_power2[i]);
                 }
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index 091641e3c5e2..600c5eb25c41 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -1,4 +1,6 @@
 /*
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2009 Bartlomiej Zolnierkiewicz
 
         This program is free software; you can redistribute it and/or modify
@@ -44,6 +46,7 @@ struct rt2800_ops {
         int (*drv_write_firmware)(struct rt2x00_dev *rt2x00dev,
                                   const u8 *data, const size_t len);
         int (*drv_init_registers)(struct rt2x00_dev *rt2x00dev);
+        __le32 *(*drv_get_txwi)(struct queue_entry *entry);
 };
 
 static inline void rt2800_register_read(struct rt2x00_dev *rt2x00dev,
@@ -126,18 +129,31 @@ static inline int rt2800_drv_init_registers(struct rt2x00_dev *rt2x00dev)
         return rt2800ops->drv_init_registers(rt2x00dev);
 }
 
+static inline __le32 *rt2800_drv_get_txwi(struct queue_entry *entry)
+{
+        const struct rt2800_ops *rt2800ops = entry->queue->rt2x00dev->ops->drv;
+
+        return rt2800ops->drv_get_txwi(entry);
+}
+
 void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
                         const u8 command, const u8 token,
                         const u8 arg0, const u8 arg1);
 
+int rt2800_wait_csr_ready(struct rt2x00_dev *rt2x00dev);
+int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev);
+
 int rt2800_check_firmware(struct rt2x00_dev *rt2x00dev,
                           const u8 *data, const size_t len);
 int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
                          const u8 *data, const size_t len);
 
-void rt2800_write_txwi(__le32 *txwi, struct txentry_desc *txdesc);
+void rt2800_write_tx_data(struct queue_entry *entry,
+                          struct txentry_desc *txdesc);
 void rt2800_process_rxwi(struct queue_entry *entry, struct rxdone_entry_desc *txdesc);
 
+void rt2800_txdone(struct rt2x00_dev *rt2x00dev);
+
 void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
 
 extern const struct rt2x00debug rt2800_rt2x00debug;
@@ -153,7 +169,8 @@ void rt2800_config_filter(struct rt2x00_dev *rt2x00dev,
                           const unsigned int filter_flags);
 void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
                         struct rt2x00intf_conf *conf, const unsigned int flags);
-void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp);
+void rt2800_config_erp(struct rt2x00_dev *rt2x00dev, struct rt2x00lib_erp *erp,
+                       u32 changed);
 void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant);
 void rt2800_config(struct rt2x00_dev *rt2x00dev,
                    struct rt2x00lib_conf *libconf,
@@ -163,10 +180,8 @@ void rt2800_reset_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual);
 void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
                        const u32 count);
 
-int rt2800_init_registers(struct rt2x00_dev *rt2x00dev);
-int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev);
-int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev);
-int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev);
+int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
 
 int rt2800_efuse_detect(struct rt2x00_dev *rt2x00dev);
 void rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 39b3846fa340..005ee153e0cc 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2009 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2009 Alban Browaeys <prahal@yahoo.com>
         Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
         Copyright (C) 2009 Luis Correia <luis.f.correia@gmail.com>
@@ -196,8 +196,6 @@ static int rt2800pci_write_firmware(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0x00000000);
-
         /*
          * enable Host program ram write selection
          */
@@ -344,24 +342,24 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         }
 
         rt2800_register_read(rt2x00dev, INT_MASK_CSR, &reg);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, 0);
         rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, 0);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, mask);
-        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, 0);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, 0);
         rt2800_register_write(rt2x00dev, INT_MASK_CSR, reg);
 }
 
@@ -399,78 +397,18 @@ static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
 
 static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
 {
-        u32 reg;
-        u16 word;
-
-        /*
-         * Initialize all registers.
-         */
         if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800pci_init_queues(rt2x00dev) ||
-                     rt2800_init_registers(rt2x00dev) ||
-                     rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800_init_bbp(rt2x00dev) ||
-                     rt2800_init_rfcsr(rt2x00dev)))
+                     rt2800pci_init_queues(rt2x00dev)))
                 return -EIO;
 
-        /*
-         * Send signal to firmware during boot time.
-         */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
-
-        /*
-         * Enable RX.
-         */
-        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 2);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
-
-        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        /*
-         * Initialize LED control
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        return 0;
+        return rt2800_enable_radio(rt2x00dev);
 }
 
 static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
-
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
-        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
-        rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
+        rt2800_disable_radio(rt2x00dev);
 
         rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001280);
 
@@ -486,9 +424,6 @@ static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 
         rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
         rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
-
-        /* Wait for DMA, ignore error */
-        rt2800_wait_wpdma_ready(rt2x00dev);
 }
 
 static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
@@ -566,21 +501,16 @@ static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2800pci_write_tx_data(struct queue_entry* entry,
-                                    struct txentry_desc *txdesc)
+static __le32 *rt2800pci_get_txwi(struct queue_entry *entry)
 {
-        __le32 *txwi = (__le32 *) entry->skb->data;
-
-        rt2800_write_txwi(txwi, txdesc);
+        return (__le32 *) entry->skb->data;
 }
 
-
-static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
+static void rt2800pci_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -600,7 +530,7 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_desc_write(txd, 0, word);
 
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_SD_LEN1, skb->len);
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN1, entry->skb->len);
         rt2x00_set_field32(&word, TXD_W1_LAST_SEC1,
                            !test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W1_BURST,
@@ -631,41 +561,35 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 /*
  * TX data initialization
  */
-static void rt2800pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid queue_idx)
+static void rt2800pci_kick_tx_queue(struct data_queue *queue)
 {
-        struct data_queue *queue;
-        unsigned int idx, qidx = 0;
-
-        if (queue_idx > QID_HCCA && queue_idx != QID_MGMT)
-                return;
-
-        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
-        idx = queue->index[Q_INDEX];
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+        struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
+        unsigned int qidx = 0;
 
-        if (queue_idx == QID_MGMT)
+        if (queue->qid == QID_MGMT)
                 qidx = 5;
         else
-                qidx = queue_idx;
+                qidx = queue->qid;
 
-        rt2800_register_write(rt2x00dev, TX_CTX_IDX(qidx), idx);
+        rt2800_register_write(rt2x00dev, TX_CTX_IDX(qidx), entry->entry_idx);
 }
 
-static void rt2800pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    const enum data_queue_qid qid)
+static void rt2800pci_kill_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
-        if (qid == QID_BEACON) {
+        if (queue->qid == QID_BEACON) {
                 rt2800_register_write(rt2x00dev, BCN_TIME_CFG, 0);
                 return;
         }
 
         rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
-        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, (qid == QID_AC_BE));
-        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, (qid == QID_AC_BK));
-        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, (qid == QID_AC_VI));
-        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, (qid == QID_AC_VO));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, (queue->qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, (queue->qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, (queue->qid == QID_AC_VI));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, (queue->qid == QID_AC_VO));
         rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
 }
 
@@ -728,110 +652,6 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
 /*
  * Interrupt functions.
  */
-static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-        struct queue_entry *entry;
-        __le32 *txwi;
-        struct txdone_entry_desc txdesc;
-        u32 word;
-        u32 reg;
-        int wcid, ack, pid, tx_wcid, tx_ack, tx_pid;
-        u16 mcs, real_mcs;
-        int i;
-
-        /*
-         * TX_STA_FIFO is a stack of X entries, hence read TX_STA_FIFO
-         * at most X times and also stop processing once the TX_STA_FIFO_VALID
-         * flag is not set anymore.
-         *
-         * The legacy drivers use X=TX_RING_SIZE but state in a comment
-         * that the TX_STA_FIFO stack has a size of 16. We stick to our
-         * tx ring size for now.
-         */
-        for (i = 0; i < TX_ENTRIES; i++) {
-                rt2800_register_read(rt2x00dev, TX_STA_FIFO, &reg);
-                if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
-                        break;
-
-                wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
-                ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
-                pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
-
-                /*
-                 * Skip this entry when it contains an invalid
-                 * queue identication number.
-                 */
-                if (pid <= 0 || pid > QID_RX)
-                        continue;
-
-                queue = rt2x00queue_get_queue(rt2x00dev, pid - 1);
-                if (unlikely(!queue))
-                        continue;
-
-                /*
-                 * Inside each queue, we process each entry in a chronological
-                 * order. We first check that the queue is not empty.
-                 */
-                if (rt2x00queue_empty(queue))
-                        continue;
-                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-
-                /* Check if we got a match by looking at WCID/ACK/PID
-                 * fields */
-                txwi = (__le32 *) entry->skb->data;
-
-                rt2x00_desc_read(txwi, 1, &word);
-                tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
-                tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
-                tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
-
-                if ((wcid != tx_wcid) || (ack != tx_ack) || (pid != tx_pid))
-                        WARNING(rt2x00dev, "invalid TX_STA_FIFO content\n");
-
-                /*
-                 * Obtain the status about this packet.
-                 */
-                txdesc.flags = 0;
-                rt2x00_desc_read(txwi, 0, &word);
-                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
-                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
-
-                /*
-                 * Ralink has a retry mechanism using a global fallback
-                 * table. We setup this fallback table to try the immediate
-                 * lower rate for all rates. In the TX_STA_FIFO, the MCS field
-                 * always contains the MCS used for the last transmission, be
-                 * it successful or not.
-                 */
-                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS)) {
-                        /*
-                         * Transmission succeeded. The number of retries is
-                         * mcs - real_mcs
-                         */
-                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
-                        txdesc.retry = ((mcs > real_mcs) ? mcs - real_mcs : 0);
-                } else {
-                        /*
-                         * Transmission failed. The number of retries is
-                         * always 7 in this case (for a total number of 8
-                         * frames sent).
-                         */
-                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
-                        txdesc.retry = 7;
-                }
-
-                /*
-                 * the frame was retried at least once
-                 * -> hw used fallback rates
-                 */
-                if (txdesc.retry)
-                        __set_bit(TXDONE_FALLBACK, &txdesc.flags);
-
-                rt2x00lib_txdone(entry, &txdesc);
-        }
-}
-
 static void rt2800pci_wakeup(struct rt2x00_dev *rt2x00dev)
 {
         struct ieee80211_conf conf = { .flags = 0 };
@@ -867,7 +687,7 @@ static irqreturn_t rt2800pci_interrupt_thread(int irq, void *dev_instance)
          * 4 - Tx done interrupt.
          */
         if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
-                rt2800pci_txdone(rt2x00dev);
+                rt2800_txdone(rt2x00dev);
 
         /*
          * 5 - Auto wakeup interrupt.
@@ -1011,6 +831,7 @@ static const struct rt2800_ops rt2800pci_rt2800_ops = {
         .regbusy_read           = rt2x00pci_regbusy_read,
         .drv_write_firmware     = rt2800pci_write_firmware,
         .drv_init_registers     = rt2800pci_init_registers,
+        .drv_get_txwi           = rt2800pci_get_txwi,
 };
 
 static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
@@ -1030,7 +851,7 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .reset_tuner            = rt2800_reset_tuner,
         .link_tuner             = rt2800_link_tuner,
         .write_tx_desc          = rt2800pci_write_tx_desc,
-        .write_tx_data          = rt2800pci_write_tx_data,
+        .write_tx_data          = rt2800_write_tx_data,
         .write_beacon           = rt2800_write_beacon,
         .kick_tx_queue          = rt2800pci_kick_tx_queue,
         .kill_tx_queue          = rt2800pci_kill_tx_queue,
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 5a2dfe87c6b6..3dff56ec195a 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2009 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2009 Mattias Nissler <mattias.nissler@gmx.de>
         Copyright (C) 2009 Felix Fietkau <nbd@openwrt.org>
         Copyright (C) 2009 Xose Vazquez Perez <xose.vazquez@gmail.com>
@@ -100,19 +101,6 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
         msleep(10);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
 
-        /*
-         * Send signal to firmware during boot time.
-         */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
-
-        if (rt2x00_rt(rt2x00dev, RT3070) ||
-            rt2x00_rt(rt2x00dev, RT3071) ||
-            rt2x00_rt(rt2x00dev, RT3572)) {
-                udelay(200);
-                rt2800_mcu_request(rt2x00dev, MCU_CURRENT, 0, 0, 0);
-                udelay(10);
-        }
-
         return 0;
 }
 
@@ -134,26 +122,18 @@ static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
 static int rt2800usb_init_registers(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
-        int i;
 
         /*
          * Wait until BBP and RF are ready.
          */
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2800_register_read(rt2x00dev, MAC_CSR0, &reg);
-                if (reg && reg != ~0)
-                        break;
-                msleep(1);
-        }
-
-        if (i == REGISTER_BUSY_COUNT) {
-                ERROR(rt2x00dev, "Unstable hardware.\n");
+        if (rt2800_wait_csr_ready(rt2x00dev))
                 return -EBUSY;
-        }
 
         rt2800_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
         rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, reg & ~0x00002000);
 
+        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
         rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
@@ -172,30 +152,10 @@ static int rt2800usb_init_registers(struct rt2x00_dev *rt2x00dev)
 static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
-        u16 word;
 
-        /*
-         * Initialize all registers.
-         */
-        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800_init_registers(rt2x00dev) ||
-                     rt2800_init_bbp(rt2x00dev) ||
-                     rt2800_init_rfcsr(rt2x00dev)))
+        if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev)))
                 return -EIO;
 
-        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        udelay(50);
-
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
-
-
         rt2800_register_read(rt2x00dev, USB_DMA_CFG, &reg);
         rt2x00_set_field32(&reg, USB_DMA_CFG_PHY_CLEAR, 0);
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN, 0);
@@ -210,45 +170,12 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, USB_DMA_CFG_TX_BULK_EN, 1);
         rt2800_register_write(rt2x00dev, USB_DMA_CFG, reg);
 
-        rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
-        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
-
-        /*
-         * Initialize LED control
-         */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
-        rt2800_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
-                              word & 0xff, (word >> 8) & 0xff);
-
-        return 0;
+        return rt2800_enable_radio(rt2x00dev);
 }
 
 static void rt2800usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
-        u32 reg;
-
-        rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
-        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
-        rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
-
-        rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
-        rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
-        rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
-
-        /* Wait for DMA, ignore error */
-        rt2800_wait_wpdma_ready(rt2x00dev);
-
+        rt2800_disable_radio(rt2x00dev);
         rt2x00usb_disable_radio(rt2x00dev);
 }
 
@@ -320,21 +247,19 @@ static int rt2800usb_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2800usb_write_tx_data(struct queue_entry* entry,
-                                    struct txentry_desc *txdesc)
+static __le32 *rt2800usb_get_txwi(struct queue_entry *entry)
 {
-        __le32 *txwi = (__le32 *) (entry->skb->data + TXINFO_DESC_SIZE);
-
-        rt2800_write_txwi(txwi, txdesc);
+        if (entry->queue->qid == QID_BEACON)
+                return (__le32 *) (entry->skb->data);
+        else
+                return (__le32 *) (entry->skb->data + TXINFO_DESC_SIZE);
 }
 
-
-static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
+static void rt2800usb_write_tx_desc(struct queue_entry *entry,
                                     struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txi = (__le32 *) skb->data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        __le32 *txi = (__le32 *) entry->skb->data;
         u32 word;
 
         /*
@@ -342,7 +267,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          */
         rt2x00_desc_read(txi, 0, &word);
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-                           skb->len - TXINFO_DESC_SIZE);
+                           entry->skb->len - TXINFO_DESC_SIZE);
         rt2x00_set_field32(&word, TXINFO_W0_WIV,
                            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
         rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
@@ -379,6 +304,46 @@ static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
 }
 
 /*
+ * TX control handlers
+ */
+static void rt2800usb_work_txdone(struct work_struct *work)
+{
+        struct rt2x00_dev *rt2x00dev =
+            container_of(work, struct rt2x00_dev, txdone_work);
+        struct data_queue *queue;
+        struct queue_entry *entry;
+
+        rt2800_txdone(rt2x00dev);
+
+        /*
+         * Process any trailing TX status reports for IO failures,
+         * we loop until we find the first non-IO error entry. This
+         * can either be a frame which is free, is being uploaded,
+         * or has completed the upload but didn't have an entry
+         * in the TX_STAT_FIFO register yet.
+         */
+        tx_queue_for_each(rt2x00dev, queue) {
+                while (!rt2x00queue_empty(queue)) {
+                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+                            !test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+                                break;
+
+                        rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+                }
+        }
+}
+
+static void rt2800usb_kill_tx_queue(struct data_queue *queue)
+{
+        if (queue->qid == QID_BEACON)
+                rt2x00usb_register_write(queue->rt2x00dev, BCN_TIME_CFG, 0);
+
+        rt2x00usb_kill_tx_queue(queue);
+}
+
+/*
  * RX control handlers
  */
 static void rt2800usb_fill_rxdone(struct queue_entry *entry,
@@ -514,6 +479,11 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
          */
         rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
 
+        /*
+         * Overwrite TX done handler
+         */
+        PREPARE_WORK(&rt2x00dev->txdone_work, rt2800usb_work_txdone);
+
         return 0;
 }
 
@@ -549,6 +519,7 @@ static const struct rt2800_ops rt2800usb_rt2800_ops = {
         .regbusy_read           = rt2x00usb_regbusy_read,
         .drv_write_firmware     = rt2800usb_write_firmware,
         .drv_init_registers     = rt2800usb_init_registers,
+        .drv_get_txwi           = rt2800usb_get_txwi,
 };
 
 static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
@@ -566,11 +537,11 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .link_tuner             = rt2800_link_tuner,
         .watchdog               = rt2x00usb_watchdog,
         .write_tx_desc          = rt2800usb_write_tx_desc,
-        .write_tx_data          = rt2800usb_write_tx_data,
+        .write_tx_data          = rt2800_write_tx_data,
         .write_beacon           = rt2800_write_beacon,
         .get_tx_data_len        = rt2800usb_get_tx_data_len,
         .kick_tx_queue          = rt2x00usb_kick_tx_queue,
-        .kill_tx_queue          = rt2x00usb_kill_tx_queue,
+        .kill_tx_queue          = rt2800usb_kill_tx_queue,
         .fill_rxdone            = rt2800usb_fill_rxdone,
         .config_shared_key      = rt2800_config_shared_key,
         .config_pairwise_key    = rt2800_config_pairwise_key,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index c21af38cc5af..7832a5996a8c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
@@ -212,8 +213,9 @@ struct channel_info {
         unsigned int flags;
 #define GEOGRAPHY_ALLOWED       0x00000001
 
-        short tx_power1;
-        short tx_power2;
+        short max_power;
+        short default_power1;
+        short default_power2;
 };
 
 /*
@@ -558,18 +560,15 @@ struct rt2x00lib_ops {
         /*
          * TX control handlers
          */
-        void (*write_tx_desc) (struct rt2x00_dev *rt2x00dev,
-                               struct sk_buff *skb,
+        void (*write_tx_desc) (struct queue_entry *entry,
                                struct txentry_desc *txdesc);
         void (*write_tx_data) (struct queue_entry *entry,
                                struct txentry_desc *txdesc);
         void (*write_beacon) (struct queue_entry *entry,
                               struct txentry_desc *txdesc);
         int (*get_tx_data_len) (struct queue_entry *entry);
-        void (*kick_tx_queue) (struct rt2x00_dev *rt2x00dev,
-                               const enum data_queue_qid queue);
-        void (*kill_tx_queue) (struct rt2x00_dev *rt2x00dev,
-                               const enum data_queue_qid queue);
+        void (*kick_tx_queue) (struct data_queue *queue);
+        void (*kill_tx_queue) (struct data_queue *queue);
 
         /*
          * RX control handlers
@@ -597,7 +596,8 @@ struct rt2x00lib_ops {
 #define CONFIG_UPDATE_BSSID             ( 1 << 3 )
 
         void (*config_erp) (struct rt2x00_dev *rt2x00dev,
-                            struct rt2x00lib_erp *erp);
+                            struct rt2x00lib_erp *erp,
+                            u32 changed);
         void (*config_ant) (struct rt2x00_dev *rt2x00dev,
                             struct antenna_setup *ant);
         void (*config) (struct rt2x00_dev *rt2x00dev,
@@ -698,6 +698,7 @@ struct rt2x00_dev {
         struct ieee80211_hw *hw;
         struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
         enum ieee80211_band curr_band;
+        int curr_freq;
 
         /*
          * If enabled, the debugfs interface structures
@@ -850,11 +851,6 @@ struct rt2x00_dev {
         struct ieee80211_low_level_stats low_level_stats;
 
         /*
-         * RX configuration information.
-         */
-        struct ieee80211_rx_status rx_status;
-
-        /*
          * Scheduled work.
          * NOTE: intf_work will use ieee80211_iterate_active_interfaces()
          * which means it cannot be placed on the hw->workqueue
@@ -862,6 +858,12 @@ struct rt2x00_dev {
          */
         struct work_struct intf_work;
 
+        /**
+         * Scheduled work for TX/RX done handling (USB devices)
+         */
+        struct work_struct rxdone_work;
+        struct work_struct txdone_work;
+
         /*
          * Data queue arrays for RX, TX and Beacon.
          * The Beacon array also contains the Atim queue
@@ -1069,8 +1071,10 @@ static inline void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
  */
 void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev);
 void rt2x00lib_pretbtt(struct rt2x00_dev *rt2x00dev);
+void rt2x00lib_dmadone(struct queue_entry *entry);
 void rt2x00lib_txdone(struct queue_entry *entry,
                       struct txdone_entry_desc *txdesc);
+void rt2x00lib_txdone_noinfo(struct queue_entry *entry, u32 status);
 void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
                       struct queue_entry *entry);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 953dc4f2c6af..4c7ff765a8bf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -81,7 +81,8 @@ void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
 
 void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
                           struct rt2x00_intf *intf,
-                          struct ieee80211_bss_conf *bss_conf)
+                          struct ieee80211_bss_conf *bss_conf,
+                          u32 changed)
 {
         struct rt2x00lib_erp erp;
 
@@ -102,7 +103,7 @@ void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
         /* Update global beacon interval time, this is needed for PS support */
         rt2x00dev->beacon_int = bss_conf->beacon_int;
 
-        rt2x00dev->ops->lib->config_erp(rt2x00dev, &erp);
+        rt2x00dev->ops->lib->config_erp(rt2x00dev, &erp, changed);
 }
 
 static inline
@@ -126,25 +127,17 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          * ANTENNA_SW_DIVERSITY state to the driver.
          * If that happens, fallback to hardware defaults,
          * or our own default.
-         * If diversity handling is active for a particular antenna,
-         * we shouldn't overwrite that antenna.
-         * The calls to rt2x00lib_config_antenna_check()
-         * might have caused that we restore back to the already
-         * active setting. If that has happened we can quit.
          */
         if (!(ant->flags & ANTENNA_RX_DIVERSITY))
                 config.rx = rt2x00lib_config_antenna_check(config.rx, def->rx);
-        else
+        else if(config.rx == ANTENNA_SW_DIVERSITY)
                 config.rx = active->rx;
 
         if (!(ant->flags & ANTENNA_TX_DIVERSITY))
                 config.tx = rt2x00lib_config_antenna_check(config.tx, def->tx);
-        else
+        else if (config.tx == ANTENNA_SW_DIVERSITY)
                 config.tx = active->tx;
 
-        if (config.rx == active->rx && config.tx == active->tx)
-                return;
-
         /*
          * Antenna setup changes require the RX to be disabled,
          * else the changes will be ignored by the device.
@@ -209,10 +202,8 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00link_reset_tuner(rt2x00dev, false);
 
         rt2x00dev->curr_band = conf->channel->band;
+        rt2x00dev->curr_freq = conf->channel->center_freq;
         rt2x00dev->tx_power = conf->power_level;
         rt2x00dev->short_retry = conf->short_frame_max_tx_count;
         rt2x00dev->long_retry = conf->long_frame_max_tx_count;
-
-        rt2x00dev->rx_status.band = conf->channel->band;
-        rt2x00dev->rx_status.freq = conf->channel->center_freq;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index 583dacd8d241..5e9074bf2b8e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -31,15 +31,14 @@
 
 enum cipher rt2x00crypto_key_to_cipher(struct ieee80211_key_conf *key)
 {
-        switch (key->alg) {
-        case ALG_WEP:
-                if (key->keylen == WLAN_KEY_LEN_WEP40)
-                        return CIPHER_WEP64;
-                else
-                        return CIPHER_WEP128;
-        case ALG_TKIP:
+        switch (key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                return CIPHER_WEP64;
+        case WLAN_CIPHER_SUITE_WEP104:
+                return CIPHER_WEP128;
+        case WLAN_CIPHER_SUITE_TKIP:
                 return CIPHER_TKIP;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 return CIPHER_AES;
         default:
                 return CIPHER_NONE;
@@ -95,7 +94,7 @@ unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev,
                 overhead += key->iv_len;
 
         if (!(key->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
-                if (key->alg == ALG_TKIP)
+                if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
                         overhead += 8;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index b0498e7e7aae..c1710b27ba70 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -333,12 +333,12 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
         if (*offset)
                 return 0;
 
-        data = kzalloc(lines * MAX_LINE_LENGTH, GFP_KERNEL);
+        data = kcalloc(lines, MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
         temp = data +
-            sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdone\tcrypto\n");
+            sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdma done\tdone\n");
 
         queue_for_each(intf->rt2x00dev, queue) {
                 spin_lock_irqsave(&queue->lock, irqflags);
@@ -346,8 +346,8 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
                 temp += sprintf(temp, "%d\t%d\t%d\t%d\t%d\t%d\t%d\n", queue->qid,
                                 queue->count, queue->limit, queue->length,
                                 queue->index[Q_INDEX],
-                                queue->index[Q_INDEX_DONE],
-                                queue->index[Q_INDEX_CRYPTO]);
+                                queue->index[Q_INDEX_DMA_DONE],
+                                queue->index[Q_INDEX_DONE]);
 
                 spin_unlock_irqrestore(&queue->lock, irqflags);
         }
@@ -380,7 +380,7 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
                                              loff_t *offset)
 {
         struct rt2x00debug_intf *intf = file->private_data;
-        char *name[] = { "WEP64", "WEP128", "TKIP", "AES" };
+        static const char * const name[] = { "WEP64", "WEP128", "TKIP", "AES" };
         char *data;
         char *temp;
         size_t size;
@@ -481,6 +481,9 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,	\
         if (index >= debug->__name.word_count)                  \
                 return -EINVAL;                                 \
                                                                 \
+        if (length > sizeof(line))                              \
+                return -EINVAL;                                 \
+                                                                \
         if (copy_from_user(line, buf, length))                  \
                 return -EFAULT;                                 \
                                                                 \
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 585e8166f22a..053fdd3bd720 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -250,6 +251,12 @@ void rt2x00lib_pretbtt(struct rt2x00_dev *rt2x00dev)
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_pretbtt);
 
+void rt2x00lib_dmadone(struct queue_entry *entry)
+{
+        rt2x00queue_index_inc(entry->queue, Q_INDEX_DMA_DONE);
+}
+EXPORT_SYMBOL_GPL(rt2x00lib_dmadone);
+
 void rt2x00lib_txdone(struct queue_entry *entry,
                       struct txdone_entry_desc *txdesc)
 {
@@ -383,15 +390,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * send the status report back.
          */
         if (!(skbdesc_flags & SKBDESC_NOT_MAC80211))
-                /*
-                 * Only PCI and SOC devices process the tx status in process
-                 * context. Hence use ieee80211_tx_status for PCI and SOC
-                 * devices and stick to ieee80211_tx_status_irqsafe for USB.
-                 */
-                if (rt2x00_is_usb(rt2x00dev))
-                        ieee80211_tx_status_irqsafe(rt2x00dev->hw, entry->skb);
-                else
-                        ieee80211_tx_status(rt2x00dev->hw, entry->skb);
+                ieee80211_tx_status(rt2x00dev->hw, entry->skb);
         else
                 dev_kfree_skb_any(entry->skb);
 
@@ -403,7 +402,6 @@ void rt2x00lib_txdone(struct queue_entry *entry,
 
         rt2x00dev->ops->lib->clear_entry(entry);
 
-        clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
         rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
 
         /*
@@ -416,6 +414,18 @@ void rt2x00lib_txdone(struct queue_entry *entry,
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
+void rt2x00lib_txdone_noinfo(struct queue_entry *entry, u32 status)
+{
+        struct txdone_entry_desc txdesc;
+
+        txdesc.flags = 0;
+        __set_bit(status, &txdesc.flags);
+        txdesc.retry = 0;
+
+        rt2x00lib_txdone(entry, &txdesc);
+}
+EXPORT_SYMBOL_GPL(rt2x00lib_txdone_noinfo);
+
 static int rt2x00lib_rxdone_read_signal(struct rt2x00_dev *rt2x00dev,
                                         struct rxdone_entry_desc *rxdesc)
 {
@@ -460,9 +470,13 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
 {
         struct rxdone_entry_desc rxdesc;
         struct sk_buff *skb;
-        struct ieee80211_rx_status *rx_status = &rt2x00dev->rx_status;
+        struct ieee80211_rx_status *rx_status;
         unsigned int header_length;
         int rate_idx;
+
+        if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+                goto submit_entry;
+
         /*
          * Allocate a new sk_buffer. If no new buffer available, drop the
          * received frame and reuse the existing buffer.
@@ -527,39 +541,32 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
          */
         rt2x00link_update_stats(rt2x00dev, entry->skb, &rxdesc);
         rt2x00debug_update_crypto(rt2x00dev, &rxdesc);
+        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_RXDONE, entry->skb);
 
+        /*
+         * Initialize RX status information, and send frame
+         * to mac80211.
+         */
+        rx_status = IEEE80211_SKB_RXCB(entry->skb);
         rx_status->mactime = rxdesc.timestamp;
+        rx_status->band = rt2x00dev->curr_band;
+        rx_status->freq = rt2x00dev->curr_freq;
         rx_status->rate_idx = rate_idx;
         rx_status->signal = rxdesc.rssi;
         rx_status->flag = rxdesc.flags;
         rx_status->antenna = rt2x00dev->link.ant.active.rx;
 
-        /*
-         * Send frame to mac80211 & debugfs.
-         * mac80211 will clean up the skb structure.
-         */
-        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_RXDONE, entry->skb);
-        memcpy(IEEE80211_SKB_RXCB(entry->skb), rx_status, sizeof(*rx_status));
-
-        /*
-         * Currently only PCI and SOC devices handle rx interrupts in process
-         * context. Hence, use ieee80211_rx_irqsafe for USB and ieee80211_rx_ni
-         * for PCI and SOC devices.
-         */
-        if (rt2x00_is_usb(rt2x00dev))
-                ieee80211_rx_irqsafe(rt2x00dev->hw, entry->skb);
-        else
-                ieee80211_rx_ni(rt2x00dev->hw, entry->skb);
+        ieee80211_rx_ni(rt2x00dev->hw, entry->skb);
 
         /*
          * Replace the skb with the freshly allocated one.
          */
         entry->skb = skb;
-        entry->flags = 0;
 
+submit_entry:
         rt2x00dev->ops->lib->clear_entry(entry);
-
         rt2x00queue_index_inc(entry->queue, Q_INDEX);
+        rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_rxdone);
 
@@ -710,7 +717,7 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
         for (i = 0; i < spec->num_channels; i++) {
                 rt2x00lib_channel(&channels[i],
                                   spec->channels[i].channel,
-                                  spec->channels_info[i].tx_power1, i);
+                                  spec->channels_info[i].max_power, i);
         }
 
         /*
@@ -1017,6 +1024,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
          * Stop all work.
          */
         cancel_work_sync(&rt2x00dev->intf_work);
+        cancel_work_sync(&rt2x00dev->rxdone_work);
+        cancel_work_sync(&rt2x00dev->txdone_work);
 
         /*
          * Uninitialize device.
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index b818a43c4672..f0e1eb72befc 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -63,6 +63,9 @@ static int rt2x00lib_request_firmware(struct rt2x00_dev *rt2x00dev)
 
         INFO(rt2x00dev, "Firmware detected - version: %d.%d.\n",
              fw->data[fw->size - 4], fw->data[fw->size - 3]);
+        snprintf(rt2x00dev->hw->wiphy->fw_version,
+                        sizeof(rt2x00dev->hw->wiphy->fw_version), "%d.%d",
+                        fw->data[fw->size - 4], fw->data[fw->size - 3]);
 
         retval = rt2x00dev->ops->lib->check_firmware(rt2x00dev, fw->data, fw->size);
         switch (retval) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
index c004cd3a8847..ad3c7ff4837b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00ht.c
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -54,6 +54,16 @@ void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
          */
         if (txrate->flags & IEEE80211_TX_RC_MCS) {
                 txdesc->mcs = txrate->idx;
+
+                /*
+                 * MIMO PS should be set to 1 for STA's using dynamic SM PS
+                 * when using more then one tx stream (>MCS7).
+                 */
+                if (tx_info->control.sta && txdesc->mcs > 7 &&
+                    (tx_info->control.sta->ht_cap.cap &
+                     (WLAN_HT_CAP_SM_PS_DYNAMIC <<
+                      IEEE80211_HT_CAP_SM_PS_SHIFT)))
+                        __set_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags);
         } else {
                 txdesc->mcs = rt2x00_get_rate_mcs(hwrate->mcs);
                 if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index dc5c6574aaf4..70c85ac2e53e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -86,7 +86,8 @@ void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
                            const u8 *mac, const u8 *bssid);
 void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
                           struct rt2x00_intf *intf,
-                          struct ieee80211_bss_conf *conf);
+                          struct ieee80211_bss_conf *conf,
+                          u32 changed);
 void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
                               struct antenna_setup ant);
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 666cef3f8472..4d534e9dc628 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -188,7 +188,6 @@ static void rt2x00lib_antenna_diversity_eval(struct rt2x00_dev *rt2x00dev)
 static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
-        unsigned int flags = ant->flags;
 
         /*
          * Determine if software diversity is enabled for
@@ -196,13 +195,13 @@ static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
          * Always perform this check since within the link
          * tuner interval the configuration might have changed.
          */
-        flags &= ~ANTENNA_RX_DIVERSITY;
-        flags &= ~ANTENNA_TX_DIVERSITY;
+        ant->flags &= ~ANTENNA_RX_DIVERSITY;
+        ant->flags &= ~ANTENNA_TX_DIVERSITY;
 
         if (rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
-                flags |= ANTENNA_RX_DIVERSITY;
+                ant->flags |= ANTENNA_RX_DIVERSITY;
         if (rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
-                flags |= ANTENNA_TX_DIVERSITY;
+                ant->flags |= ANTENNA_TX_DIVERSITY;
 
         if (!(ant->flags & ANTENNA_RX_DIVERSITY) &&
             !(ant->flags & ANTENNA_TX_DIVERSITY)) {
@@ -210,9 +209,6 @@ static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
                 return true;
         }
 
-        /* Update flags */
-        ant->flags = flags;
-
         /*
          * If we have only sampled the data over the last period
          * we should now harvest the data. Otherwise just evaluate
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 235e037e6509..7862a840984a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -669,8 +669,10 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
          * When the erp information has changed, we should perform
          * additional configuration steps. For all other changes we are done.
          */
-        if (changes & ~(BSS_CHANGED_ASSOC | BSS_CHANGED_HT))
-                rt2x00lib_config_erp(rt2x00dev, intf, bss_conf);
+        if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE |
+                       BSS_CHANGED_ERP_SLOT | BSS_CHANGED_BASIC_RATES |
+                       BSS_CHANGED_BEACON_INT))
+                rt2x00lib_config_erp(rt2x00dev, intf, bss_conf, changes);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_bss_info_changed);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index a3401d301058..eede99939db9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
@@ -311,7 +312,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         /*
          * Initialize information from queue
          */
-        txdesc->queue = entry->queue->qid;
+        txdesc->qid = entry->queue->qid;
         txdesc->cw_min = entry->queue->cw_min;
         txdesc->cw_max = entry->queue->cw_max;
         txdesc->aifs = entry->queue->aifs;
@@ -448,15 +449,14 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
                                             struct txentry_desc *txdesc)
 {
         struct data_queue *queue = entry->queue;
-        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
 
-        rt2x00dev->ops->lib->write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        queue->rt2x00dev->ops->lib->write_tx_desc(entry, txdesc);
 
         /*
          * All processing on the frame has been completed, this means
          * it is now ready to be dumped to userspace through debugfs.
          */
-        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_TX, entry->skb);
+        rt2x00debug_dump_frame(queue->rt2x00dev, DUMP_FRAME_TX, entry->skb);
 }
 
 static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
@@ -476,7 +476,7 @@ static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
          */
         if (rt2x00queue_threshold(queue) ||
             !test_bit(ENTRY_TXD_BURST, &txdesc->flags))
-                rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, queue->qid);
+                rt2x00dev->ops->lib->kick_tx_queue(queue);
 }
 
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
@@ -590,7 +590,7 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         intf->beacon->skb = NULL;
 
         if (!enable_beacon) {
-                rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);
+                rt2x00dev->ops->lib->kill_tx_queue(intf->beacon->queue);
                 mutex_unlock(&intf->beacon_skb_mutex);
                 return 0;
         }
@@ -625,6 +625,51 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         return 0;
 }
 
+void rt2x00queue_for_each_entry(struct data_queue *queue,
+                                enum queue_index start,
+                                enum queue_index end,
+                                void (*fn)(struct queue_entry *entry))
+{
+        unsigned long irqflags;
+        unsigned int index_start;
+        unsigned int index_end;
+        unsigned int i;
+
+        if (unlikely(start >= Q_INDEX_MAX || end >= Q_INDEX_MAX)) {
+                ERROR(queue->rt2x00dev,
+                      "Entry requested from invalid index range (%d - %d)\n",
+                      start, end);
+                return;
+        }
+
+        /*
+         * Only protect the range we are going to loop over,
+         * if during our loop a extra entry is set to pending
+         * it should not be kicked during this run, since it
+         * is part of another TX operation.
+         */
+        spin_lock_irqsave(&queue->lock, irqflags);
+        index_start = queue->index[start];
+        index_end = queue->index[end];
+        spin_unlock_irqrestore(&queue->lock, irqflags);
+
+        /*
+         * Start from the TX done pointer, this guarentees that we will
+         * send out all frames in the correct order.
+         */
+        if (index_start < index_end) {
+                for (i = index_start; i < index_end; i++)
+                        fn(&queue->entries[i]);
+        } else {
+                for (i = index_start; i < queue->limit; i++)
+                        fn(&queue->entries[i]);
+
+                for (i = 0; i < index_end; i++)
+                        fn(&queue->entries[i]);
+        }
+}
+EXPORT_SYMBOL_GPL(rt2x00queue_for_each_entry);
+
 struct data_queue *rt2x00queue_get_queue(struct rt2x00_dev *rt2x00dev,
                                          const enum data_queue_qid queue)
 {
@@ -686,13 +731,13 @@ void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index)
         if (queue->index[index] >= queue->limit)
                 queue->index[index] = 0;
 
+        queue->last_action[index] = jiffies;
+
         if (index == Q_INDEX) {
                 queue->length++;
-                queue->last_index = jiffies;
         } else if (index == Q_INDEX_DONE) {
                 queue->length--;
                 queue->count++;
-                queue->last_index_done = jiffies;
         }
 
         spin_unlock_irqrestore(&queue->lock, irqflags);
@@ -701,14 +746,17 @@ void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index)
 static void rt2x00queue_reset(struct data_queue *queue)
 {
         unsigned long irqflags;
+        unsigned int i;
 
         spin_lock_irqsave(&queue->lock, irqflags);
 
         queue->count = 0;
         queue->length = 0;
-        queue->last_index = jiffies;
-        queue->last_index_done = jiffies;
-        memset(queue->index, 0, sizeof(queue->index));
+
+        for (i = 0; i < Q_INDEX_MAX; i++) {
+                queue->index[i] = 0;
+                queue->last_action[i] = jiffies;
+        }
 
         spin_unlock_irqrestore(&queue->lock, irqflags);
 }
@@ -718,7 +766,7 @@ void rt2x00queue_stop_queues(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
 
         txall_queue_for_each(rt2x00dev, queue)
-                rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, queue->qid);
+                rt2x00dev->ops->lib->kill_tx_queue(queue);
 }
 
 void rt2x00queue_init_queues(struct rt2x00_dev *rt2x00dev)
@@ -730,9 +778,9 @@ void rt2x00queue_init_queues(struct rt2x00_dev *rt2x00dev)
                 rt2x00queue_reset(queue);
 
                 for (i = 0; i < queue->limit; i++) {
-                        queue->entries[i].flags = 0;
-
                         rt2x00dev->ops->lib->clear_entry(&queue->entries[i]);
+                        if (queue->qid == QID_RX)
+                                rt2x00queue_index_inc(queue, Q_INDEX);
                 }
         }
 }
@@ -755,7 +803,7 @@ static int rt2x00queue_alloc_entries(struct data_queue *queue,
          * Allocate all queue entries.
          */
         entry_size = sizeof(*entries) + qdesc->priv_size;
-        entries = kzalloc(queue->limit * entry_size, GFP_KERNEL);
+        entries = kcalloc(queue->limit, entry_size, GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
 
@@ -891,7 +939,7 @@ int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
          */
         rt2x00dev->data_queues = 2 + rt2x00dev->ops->tx_queues + req_atim;
 
-        queue = kzalloc(rt2x00dev->data_queues * sizeof(*queue), GFP_KERNEL);
+        queue = kcalloc(rt2x00dev->data_queues, sizeof(*queue), GFP_KERNEL);
         if (!queue) {
                 ERROR(rt2x00dev, "Queue allocation failed.\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 191e7775a9c0..d81d85f34866 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -268,6 +268,7 @@ struct txdone_entry_desc {
  * @ENTRY_TXD_HT_AMPDU: This frame is part of an AMPDU.
  * @ENTRY_TXD_HT_BW_40: Use 40MHz Bandwidth.
  * @ENTRY_TXD_HT_SHORT_GI: Use short GI.
+ * @ENTRY_TXD_HT_MIMO_PS: The receiving STA is in dynamic SM PS mode.
  */
 enum txentry_desc_flags {
         ENTRY_TXD_RTS_FRAME,
@@ -286,6 +287,7 @@ enum txentry_desc_flags {
         ENTRY_TXD_HT_AMPDU,
         ENTRY_TXD_HT_BW_40,
         ENTRY_TXD_HT_SHORT_GI,
+        ENTRY_TXD_HT_MIMO_PS,
 };
 
 /**
@@ -294,7 +296,7 @@ enum txentry_desc_flags {
  * Summary of information for the frame descriptor before sending a TX frame.
  *
  * @flags: Descriptor flags (See &enum queue_entry_flags).
- * @queue: Queue identification (See &enum data_queue_qid).
+ * @qid: Queue identification (See &enum data_queue_qid).
  * @length: Length of the entire frame.
  * @header_length: Length of 802.11 header.
  * @length_high: PLCP length high word.
@@ -320,7 +322,7 @@ enum txentry_desc_flags {
 struct txentry_desc {
         unsigned long flags;
 
-        enum data_queue_qid queue;
+        enum data_queue_qid qid;
 
         u16 length;
         u16 header_length;
@@ -358,17 +360,17 @@ struct txentry_desc {
  * @ENTRY_OWNER_DEVICE_DATA: This entry is owned by the device for data
  *      transfer (either TX or RX depending on the queue). The entry should
  *      only be touched after the device has signaled it is done with it.
- * @ENTRY_OWNER_DEVICE_CRYPTO: This entry is owned by the device for data
- *      encryption or decryption. The entry should only be touched after
- *      the device has signaled it is done with it.
  * @ENTRY_DATA_PENDING: This entry contains a valid frame and is waiting
  *      for the signal to start sending.
+ * @ENTRY_DATA_IO_FAILED: Hardware indicated that an IO error occured
+ *      while transfering the data to the hardware. No TX status report will
+ *      be expected from the hardware.
  */
 enum queue_entry_flags {
         ENTRY_BCN_ASSIGNED,
         ENTRY_OWNER_DEVICE_DATA,
-        ENTRY_OWNER_DEVICE_CRYPTO,
         ENTRY_DATA_PENDING,
+        ENTRY_DATA_IO_FAILED
 };
 
 /**
@@ -399,18 +401,18 @@ struct queue_entry {
  *
  * @Q_INDEX: Index pointer to the current entry in the queue, if this entry is
  *      owned by the hardware then the queue is considered to be full.
+ * @Q_INDEX_DMA_DONE: Index pointer for the next entry which will have been
+ *      transfered to the hardware.
  * @Q_INDEX_DONE: Index pointer to the next entry which will be completed by
  *      the hardware and for which we need to run the txdone handler. If this
  *      entry is not owned by the hardware the queue is considered to be empty.
- * @Q_INDEX_CRYPTO: Index pointer to the next entry which encryption/decription
- *      will be completed by the hardware next.
  * @Q_INDEX_MAX: Keep last, used in &struct data_queue to determine the size
  *      of the index array.
  */
 enum queue_index {
         Q_INDEX,
+        Q_INDEX_DMA_DONE,
         Q_INDEX_DONE,
-        Q_INDEX_CRYPTO,
         Q_INDEX_MAX,
 };
 
@@ -446,13 +448,12 @@ struct data_queue {
         enum data_queue_qid qid;
 
         spinlock_t lock;
-        unsigned long last_index;
-        unsigned long last_index_done;
         unsigned int count;
         unsigned short limit;
         unsigned short threshold;
         unsigned short length;
         unsigned short index[Q_INDEX_MAX];
+        unsigned long last_action[Q_INDEX_MAX];
 
         unsigned short txop;
         unsigned short aifs;
@@ -565,6 +566,22 @@ struct data_queue_desc {
         queue_loop(__entry, (__dev)->tx, queue_end(__dev))
 
 /**
+ * rt2x00queue_for_each_entry - Loop through all entries in the queue
+ * @queue: Pointer to @data_queue
+ * @start: &enum queue_index Pointer to start index
+ * @end: &enum queue_index Pointer to end index
+ * @fn: The function to call for each &struct queue_entry
+ *
+ * This will walk through all entries in the queue, in chronological
+ * order. This means it will start at the current @start pointer
+ * and will walk through the queue until it reaches the @end pointer.
+ */
+void rt2x00queue_for_each_entry(struct data_queue *queue,
+                                enum queue_index start,
+                                enum queue_index end,
+                                void (*fn)(struct queue_entry *entry));
+
+/**
  * rt2x00queue_empty - Check if the queue is empty.
  * @queue: Queue to check if empty.
  */
@@ -601,12 +618,23 @@ static inline int rt2x00queue_threshold(struct data_queue *queue)
 }
 
 /**
- * rt2x00queue_timeout - Check if a timeout occured for this queue
+ * rt2x00queue_timeout - Check if a timeout occured for STATUS reorts
  * @queue: Queue to check.
  */
 static inline int rt2x00queue_timeout(struct data_queue *queue)
 {
-        return time_after(queue->last_index, queue->last_index_done + (HZ / 10));
+        return time_after(queue->last_action[Q_INDEX_DMA_DONE],
+                          queue->last_action[Q_INDEX_DONE] + (HZ / 10));
+}
+
+/**
+ * rt2x00queue_timeout - Check if a timeout occured for DMA transfers
+ * @queue: Queue to check.
+ */
+static inline int rt2x00queue_dma_timeout(struct data_queue *queue)
+{
+        return time_after(queue->last_action[Q_INDEX],
+                          queue->last_action[Q_INDEX_DMA_DONE] + (HZ / 10));
 }
 
 /**
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index ff3a36622d1b..4c5ae3d45625 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -1,5 +1,6 @@
 /*
-        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
+        Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -167,137 +168,142 @@ EXPORT_SYMBOL_GPL(rt2x00usb_regbusy_read);
 /*
  * TX data handlers.
  */
-static void rt2x00usb_interrupt_txdone(struct urb *urb)
+static void rt2x00usb_work_txdone_entry(struct queue_entry *entry)
 {
-        struct queue_entry *entry = (struct queue_entry *)urb->context;
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct txdone_entry_desc txdesc;
-
-        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags) ||
-            !test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
-                return;
-
         /*
-         * Obtain the status about this packet.
-         * Note that when the status is 0 it does not mean the
+         * If the transfer to hardware succeeded, it does not mean the
          * frame was send out correctly. It only means the frame
          * was succesfully pushed to the hardware, we have no
          * way to determine the transmission status right now.
          * (Only indirectly by looking at the failed TX counters
          * in the register).
          */
-        txdesc.flags = 0;
-        if (!urb->status)
-                __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
+        if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+                rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
         else
-                __set_bit(TXDONE_FAILURE, &txdesc.flags);
-        txdesc.retry = 0;
-
-        rt2x00lib_txdone(entry, &txdesc);
+                rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
 }
 
-static inline void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
+static void rt2x00usb_work_txdone(struct work_struct *work)
 {
-        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
-        struct queue_entry_priv_usb *entry_priv = entry->priv_data;
-        u32 length;
+        struct rt2x00_dev *rt2x00dev =
+            container_of(work, struct rt2x00_dev, txdone_work);
+        struct data_queue *queue;
+        struct queue_entry *entry;
 
-        if (test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags)) {
-                /*
-                 * USB devices cannot blindly pass the skb->len as the
-                 * length of the data to usb_fill_bulk_urb. Pass the skb
-                 * to the driver to determine what the length should be.
-                 */
-                length = rt2x00dev->ops->lib->get_tx_data_len(entry);
+        tx_queue_for_each(rt2x00dev, queue) {
+                while (!rt2x00queue_empty(queue)) {
+                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 
-                usb_fill_bulk_urb(entry_priv->urb, usb_dev,
-                                  usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint),
-                                  entry->skb->data, length,
-                                  rt2x00usb_interrupt_txdone, entry);
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                                break;
 
-                usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+                        rt2x00usb_work_txdone_entry(entry);
+                }
         }
 }
 
-void rt2x00usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                             const enum data_queue_qid qid)
+static void rt2x00usb_interrupt_txdone(struct urb *urb)
 {
-        struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, qid);
-        unsigned long irqflags;
-        unsigned int index;
-        unsigned int index_done;
-        unsigned int i;
+        struct queue_entry *entry = (struct queue_entry *)urb->context;
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+
+        if (!__test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                return;
 
         /*
-         * Only protect the range we are going to loop over,
-         * if during our loop a extra entry is set to pending
-         * it should not be kicked during this run, since it
-         * is part of another TX operation.
+         * Report the frame as DMA done
          */
-        spin_lock_irqsave(&queue->lock, irqflags);
-        index = queue->index[Q_INDEX];
-        index_done = queue->index[Q_INDEX_DONE];
-        spin_unlock_irqrestore(&queue->lock, irqflags);
+        rt2x00lib_dmadone(entry);
 
         /*
-         * Start from the TX done pointer, this guarentees that we will
-         * send out all frames in the correct order.
+         * Check if the frame was correctly uploaded
          */
-        if (index_done < index) {
-                for (i = index_done; i < index; i++)
-                        rt2x00usb_kick_tx_entry(&queue->entries[i]);
-        } else {
-                for (i = index_done; i < queue->limit; i++)
-                        rt2x00usb_kick_tx_entry(&queue->entries[i]);
+        if (urb->status)
+                __set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
 
-                for (i = 0; i < index; i++)
-                        rt2x00usb_kick_tx_entry(&queue->entries[i]);
-        }
+        /*
+         * Schedule the delayed work for reading the TX status
+         * from the device.
+         */
+        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
+            test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+                ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work);
+}
+
+static void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
+        struct queue_entry_priv_usb *entry_priv = entry->priv_data;
+        u32 length;
+
+        if (!test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags))
+                return;
+
+        /*
+         * USB devices cannot blindly pass the skb->len as the
+         * length of the data to usb_fill_bulk_urb. Pass the skb
+         * to the driver to determine what the length should be.
+         */
+        length = rt2x00dev->ops->lib->get_tx_data_len(entry);
+
+        usb_fill_bulk_urb(entry_priv->urb, usb_dev,
+                          usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint),
+                          entry->skb->data, length,
+                          rt2x00usb_interrupt_txdone, entry);
+
+        usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+}
+
+void rt2x00usb_kick_tx_queue(struct data_queue *queue)
+{
+        rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                                   rt2x00usb_kick_tx_entry);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_kick_tx_queue);
 
-void rt2x00usb_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                             const enum data_queue_qid qid)
+static void rt2x00usb_kill_tx_entry(struct queue_entry *entry)
 {
-        struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, qid);
-        struct queue_entry_priv_usb *entry_priv;
-        struct queue_entry_priv_usb_bcn *bcn_priv;
-        unsigned int i;
-        bool kill_guard;
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct queue_entry_priv_usb *entry_priv = entry->priv_data;
+        struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;
+
+        if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                return;
+
+        usb_kill_urb(entry_priv->urb);
 
         /*
-         * When killing the beacon queue, we must also kill
-         * the beacon guard byte.
+         * Kill guardian urb (if required by driver).
          */
-        kill_guard =
-            (qid == QID_BEACON) &&
-            (test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags));
+        if ((entry->queue->qid == QID_BEACON) &&
+            (test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags)))
+                usb_kill_urb(bcn_priv->guardian_urb);
 
         /*
-         * Cancel all entries.
+         * We need a short delay here to wait for
+         * the URB to be canceled
          */
-        for (i = 0; i < queue->limit; i++) {
-                entry_priv = queue->entries[i].priv_data;
-                usb_kill_urb(entry_priv->urb);
+        do {
+                udelay(100);
+        } while (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags));
+}
 
-                /*
-                 * Kill guardian urb (if required by driver).
-                 */
-                if (kill_guard) {
-                        bcn_priv = queue->entries[i].priv_data;
-                        usb_kill_urb(bcn_priv->guardian_urb);
-                }
-        }
+void rt2x00usb_kill_tx_queue(struct data_queue *queue)
+{
+        rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                                   rt2x00usb_kill_tx_entry);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_kill_tx_queue);
 
-static void rt2x00usb_watchdog_reset_tx(struct data_queue *queue)
+static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
 {
-        struct queue_entry_priv_usb *entry_priv;
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         unsigned short threshold = queue->threshold;
 
-        WARNING(queue->rt2x00dev, "TX queue %d timed out, invoke reset", queue->qid);
+        WARNING(queue->rt2x00dev, "TX queue %d DMA timed out,"
+                " invoke forced forced reset", queue->qid);
 
         /*
          * Temporarily disable the TX queue, this will force mac80211
@@ -307,20 +313,33 @@ static void rt2x00usb_watchdog_reset_tx(struct data_queue *queue)
          * queue from being enabled during the txdone handler.
          */
         queue->threshold = queue->limit;
-        ieee80211_stop_queue(queue->rt2x00dev->hw, queue->qid);
+        ieee80211_stop_queue(rt2x00dev->hw, queue->qid);
 
         /*
-         * Reset all currently uploaded TX frames.
+         * Kill all entries in the queue, afterwards we need to
+         * wait a bit for all URBs to be cancelled.
          */
-        while (!rt2x00queue_empty(queue)) {
-                entry_priv = rt2x00queue_get_entry(queue, Q_INDEX_DONE)->priv_data;
-                usb_kill_urb(entry_priv->urb);
+        rt2x00usb_kill_tx_queue(queue);
 
-                /*
-                 * We need a short delay here to wait for
-                 * the URB to be canceled and invoked the tx_done handler.
-                 */
-                udelay(200);
+        /*
+         * In case that a driver has overriden the txdone_work
+         * function, we invoke the TX done through there.
+         */
+        rt2x00dev->txdone_work.func(&rt2x00dev->txdone_work);
+
+        /*
+         * Security measure: if the driver did override the
+         * txdone_work function, and the hardware did arrive
+         * in a state which causes it to malfunction, it is
+         * possible that the driver couldn't handle the txdone
+         * event correctly. So after giving the driver the
+         * chance to cleanup, we now force a cleanup of any
+         * leftovers.
+         */
+        if (!rt2x00queue_empty(queue)) {
+                WARNING(queue->rt2x00dev, "TX queue %d DMA timed out,"
+                        " status handling failed, invoke hard reset", queue->qid);
+                rt2x00usb_work_txdone(&rt2x00dev->txdone_work);
         }
 
         /*
@@ -328,7 +347,15 @@ static void rt2x00usb_watchdog_reset_tx(struct data_queue *queue)
          * queue again.
          */
         queue->threshold = threshold;
-        ieee80211_wake_queue(queue->rt2x00dev->hw, queue->qid);
+        ieee80211_wake_queue(rt2x00dev->hw, queue->qid);
+}
+
+static void rt2x00usb_watchdog_tx_status(struct data_queue *queue)
+{
+        WARNING(queue->rt2x00dev, "TX queue %d status timed out,"
+                " invoke forced tx handler", queue->qid);
+
+        ieee80211_queue_work(queue->rt2x00dev->hw, &queue->rt2x00dev->txdone_work);
 }
 
 void rt2x00usb_watchdog(struct rt2x00_dev *rt2x00dev)
@@ -336,8 +363,10 @@ void rt2x00usb_watchdog(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
 
         tx_queue_for_each(rt2x00dev, queue) {
+                if (rt2x00queue_dma_timeout(queue))
+                        rt2x00usb_watchdog_tx_dma(queue);
                 if (rt2x00queue_timeout(queue))
-                        rt2x00usb_watchdog_reset_tx(queue);
+                        rt2x00usb_watchdog_tx_status(queue);
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_watchdog);
@@ -345,38 +374,62 @@ EXPORT_SYMBOL_GPL(rt2x00usb_watchdog);
 /*
  * RX data handlers.
  */
+static void rt2x00usb_work_rxdone(struct work_struct *work)
+{
+        struct rt2x00_dev *rt2x00dev =
+            container_of(work, struct rt2x00_dev, rxdone_work);
+        struct queue_entry *entry;
+        struct skb_frame_desc *skbdesc;
+        u8 rxd[32];
+
+        while (!rt2x00queue_empty(rt2x00dev->rx)) {
+                entry = rt2x00queue_get_entry(rt2x00dev->rx, Q_INDEX_DONE);
+
+                if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                        break;
+
+                /*
+                 * Fill in desc fields of the skb descriptor
+                 */
+                skbdesc = get_skb_frame_desc(entry->skb);
+                skbdesc->desc = rxd;
+                skbdesc->desc_len = entry->queue->desc_size;
+
+                /*
+                 * Send the frame to rt2x00lib for further processing.
+                 */
+                rt2x00lib_rxdone(rt2x00dev, entry);
+        }
+}
+
 static void rt2x00usb_interrupt_rxdone(struct urb *urb)
 {
         struct queue_entry *entry = (struct queue_entry *)urb->context;
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
-        u8 rxd[32];
 
-        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags) ||
-            !test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!__test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         /*
-         * Check if the received data is simply too small
-         * to be actually valid, or if the urb is signaling
-         * a problem.
+         * Report the frame as DMA done
          */
-        if (urb->actual_length < entry->queue->desc_size || urb->status) {
-                set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
-                usb_submit_urb(urb, GFP_ATOMIC);
-                return;
-        }
+        rt2x00lib_dmadone(entry);
 
         /*
-         * Fill in desc fields of the skb descriptor
+         * Check if the received data is simply too small
+         * to be actually valid, or if the urb is signaling
+         * a problem.
          */
-        skbdesc->desc = rxd;
-        skbdesc->desc_len = entry->queue->desc_size;
+        if (urb->actual_length < entry->queue->desc_size || urb->status)
+                __set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
 
         /*
-         * Send the frame to rt2x00lib for further processing.
+         * Schedule the delayed work for reading the RX status
+         * from the device.
          */
-        rt2x00lib_rxdone(rt2x00dev, entry);
+        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
+            test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+                ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work);
 }
 
 /*
@@ -391,7 +444,7 @@ void rt2x00usb_disable_radio(struct rt2x00_dev *rt2x00dev)
          * The USB version of kill_tx_queue also works
          * on the RX queue.
          */
-        rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_RX);
+        rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev->rx);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_disable_radio);
 
@@ -405,6 +458,8 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
         struct queue_entry_priv_usb *entry_priv = entry->priv_data;
         int pipe;
 
+        entry->flags = 0;
+
         if (entry->queue->qid == QID_RX) {
                 pipe = usb_rcvbulkpipe(usb_dev, entry->queue->usb_endpoint);
                 usb_fill_bulk_urb(entry_priv->urb, usb_dev, pipe,
@@ -413,8 +468,6 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
 
                 set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
                 usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
-        } else {
-                entry->flags = 0;
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_clear_entry);
@@ -659,6 +712,9 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
 
         rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 
+        INIT_WORK(&rt2x00dev->rxdone_work, rt2x00usb_work_rxdone);
+        INIT_WORK(&rt2x00dev->txdone_work, rt2x00usb_work_txdone);
+
         retval = rt2x00usb_alloc_reg(rt2x00dev);
         if (retval)
                 goto exit_free_device;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index d3d3ddc40875..c2d997f67b3e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -379,25 +379,21 @@ struct queue_entry_priv_usb_bcn {
 
 /**
  * rt2x00usb_kick_tx_queue - Kick data queue
- * @rt2x00dev: Pointer to &struct rt2x00_dev
- * @qid: Data queue to kick
+ * @queue: Data queue to kick
  *
  * This will walk through all entries of the queue and push all pending
  * frames to the hardware as a single burst.
  */
-void rt2x00usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                             const enum data_queue_qid qid);
+void rt2x00usb_kick_tx_queue(struct data_queue *queue);
 
 /**
  * rt2x00usb_kill_tx_queue - Kill data queue
- * @rt2x00dev: Pointer to &struct rt2x00_dev
- * @qid: Data queue to kill
+ * @queue: Data queue to kill
  *
  * This will walk through all entries of the queue and kill all
  * previously kicked frames before they can be send.
  */
-void rt2x00usb_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                              const enum data_queue_qid qid);
+void rt2x00usb_kill_tx_queue(struct data_queue *queue);
 
 /**
  * rt2x00usb_watchdog - Watchdog for USB communication
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e539c6cb636f..97b3935f615b 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -594,7 +594,8 @@ static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
-                               struct rt2x00lib_erp *erp)
+                               struct rt2x00lib_erp *erp,
+                               u32 changed)
 {
         u32 reg;
 
@@ -603,28 +604,36 @@ static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2x00pci_register_read(rt2x00dev, TXRX_CSR4, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+        }
 
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR5, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR5,
+                                         erp->basic_rates);
 
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR9, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
+                rt2x00pci_register_write(rt2x00dev, MAC_CSR9, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR8, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
-        rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR8, reg);
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR8, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
+                rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
+                rt2x00pci_register_write(rt2x00dev, MAC_CSR8, reg);
+        }
 }
 
 static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
@@ -1050,7 +1059,7 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev,
         /*
          * Determine r17 bounds.
          */
-        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
                 if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags)) {
@@ -1645,6 +1654,7 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
         rt2x00_set_field32(&reg, INT_MASK_CSR_TXDONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_RXDONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_BEACON_DONE, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_ENABLE_MITIGATION, mask);
         rt2x00_set_field32(&reg, INT_MASK_CSR_MITIGATION_PERIOD, 0xff);
         rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
@@ -1658,6 +1668,7 @@ static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_5, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_6, mask);
         rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_7, mask);
+        rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_TWAKEUP, mask);
         rt2x00pci_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
 }
 
@@ -1766,12 +1777,11 @@ static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                  struct sk_buff *skb,
+static void rt61pci_write_tx_desc(struct queue_entry *entry,
                                   struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
 
@@ -1779,7 +1789,7 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          * Start writing the descriptor words.
          */
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->queue);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->qid);
         rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
         rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
         rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
@@ -1802,15 +1812,15 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         }
 
         rt2x00_desc_read(txd, 5, &word);
-        rt2x00_set_field32(&word, TXD_W5_PID_TYPE, skbdesc->entry->queue->qid);
+        rt2x00_set_field32(&word, TXD_W5_PID_TYPE, entry->queue->qid);
         rt2x00_set_field32(&word, TXD_W5_PID_SUBTYPE,
                            skbdesc->entry->entry_idx);
         rt2x00_set_field32(&word, TXD_W5_TX_POWER,
-                           TXPOWER_TO_DEV(rt2x00dev->tx_power));
+                           TXPOWER_TO_DEV(entry->queue->rt2x00dev->tx_power));
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
-        if (txdesc->queue != QID_BEACON) {
+        if (txdesc->qid != QID_BEACON) {
                 rt2x00_desc_read(txd, 6, &word);
                 rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
                                    skbdesc->skb_dma);
@@ -1857,7 +1867,7 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          */
         skbdesc->desc = txd;
         skbdesc->desc_len =
-                (txdesc->queue == QID_BEACON) ?  TXINFO_SIZE : TXD_DESC_SIZE;
+                (txdesc->qid == QID_BEACON) ?  TXINFO_SIZE : TXD_DESC_SIZE;
 }
 
 /*
@@ -1882,7 +1892,7 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
         /*
          * Write the TX descriptor for the beacon.
          */
-        rt61pci_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        rt61pci_write_tx_desc(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -1918,34 +1928,34 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
         entry->skb = NULL;
 }
 
-static void rt61pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                  const enum data_queue_qid queue)
+static void rt61pci_kick_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC0, (queue == QID_AC_BE));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC1, (queue == QID_AC_BK));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC2, (queue == QID_AC_VI));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC3, (queue == QID_AC_VO));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC0, (queue->qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC1, (queue->qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC2, (queue->qid == QID_AC_VI));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC3, (queue->qid == QID_AC_VO));
         rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
 }
 
-static void rt61pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                  const enum data_queue_qid qid)
+static void rt61pci_kill_tx_queue(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         u32 reg;
 
-        if (qid == QID_BEACON) {
+        if (queue->qid == QID_BEACON) {
                 rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, 0);
                 return;
         }
 
         rt2x00pci_register_read(rt2x00dev, TX_CNTL_CSR, &reg);
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC0, (qid == QID_AC_BE));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC1, (qid == QID_AC_BK));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC2, (qid == QID_AC_VI));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC3, (qid == QID_AC_VO));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC0, (queue->qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC1, (queue->qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC2, (queue->qid == QID_AC_VI));
+        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC3, (queue->qid == QID_AC_VO));
         rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
 }
 
@@ -1972,7 +1982,7 @@ static int rt61pci_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
                 return 0;
         }
 
-        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 if (lna == 3 || lna == 2)
                         offset += 10;
         }
@@ -2107,11 +2117,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                                 "TX status report missed for entry %d\n",
                                 entry_done->entry_idx);
 
-                        txdesc.flags = 0;
-                        __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
-                        txdesc.retry = 0;
-
-                        rt2x00lib_txdone(entry_done, &txdesc);
+                        rt2x00lib_txdone_noinfo(entry_done, TXDONE_UNKNOWN);
                         entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                 }
 
@@ -2654,20 +2660,24 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index aa9de18fd410..e22f01c1818e 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -545,7 +545,8 @@ static void rt73usb_config_intf(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt73usb_config_erp(struct rt2x00_dev *rt2x00dev,
-                               struct rt2x00lib_erp *erp)
+                               struct rt2x00lib_erp *erp,
+                               u32 changed)
 {
         u32 reg;
 
@@ -554,28 +555,36 @@ static void rt73usb_config_erp(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR0, reg);
 
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR4, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
-                           !!erp->short_preamble);
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR4, reg);
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2x00usb_register_read(rt2x00dev, TXRX_CSR4, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
+                                   !!erp->short_preamble);
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR4, reg);
+        }
 
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR5, erp->basic_rates);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR5,
+                                         erp->basic_rates);
 
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
-                           erp->beacon_int * 16);
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
+                                   erp->beacon_int * 16);
+                rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-        rt2x00usb_register_read(rt2x00dev, MAC_CSR9, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
-        rt2x00usb_register_write(rt2x00dev, MAC_CSR9, reg);
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR9, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
+                rt2x00usb_register_write(rt2x00dev, MAC_CSR9, reg);
 
-        rt2x00usb_register_read(rt2x00dev, MAC_CSR8, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
-        rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
-        rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
-        rt2x00usb_register_write(rt2x00dev, MAC_CSR8, reg);
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR8, &reg);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
+                rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
+                rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
+                rt2x00usb_register_write(rt2x00dev, MAC_CSR8, reg);
+        }
 }
 
 static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
@@ -929,7 +938,7 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev,
         /*
          * Determine r17 bounds.
          */
-        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
 
@@ -1426,12 +1435,11 @@ static int rt73usb_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                  struct sk_buff *skb,
+static void rt73usb_write_tx_desc(struct queue_entry *entry,
                                   struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = (__le32 *) skb->data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        __le32 *txd = (__le32 *) entry->skb->data;
         u32 word;
 
         /*
@@ -1464,7 +1472,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_desc_write(txd, 0, word);
 
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->queue);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->qid);
         rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
         rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
         rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
@@ -1487,7 +1495,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 
         rt2x00_desc_read(txd, 5, &word);
         rt2x00_set_field32(&word, TXD_W5_TX_POWER,
-                           TXPOWER_TO_DEV(rt2x00dev->tx_power));
+                           TXPOWER_TO_DEV(entry->queue->rt2x00dev->tx_power));
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
@@ -1526,7 +1534,7 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
         /*
          * Write the TX descriptor for the beacon.
          */
-        rt73usb_write_tx_desc(rt2x00dev, entry->skb, txdesc);
+        rt73usb_write_tx_desc(entry, txdesc);
 
         /*
          * Dump beacon to userspace through debugfs.
@@ -1574,6 +1582,14 @@ static int rt73usb_get_tx_data_len(struct queue_entry *entry)
         return length;
 }
 
+static void rt73usb_kill_tx_queue(struct data_queue *queue)
+{
+        if (queue->qid == QID_BEACON)
+                rt2x00usb_register_write(queue->rt2x00dev, TXRX_CSR9, 0);
+
+        rt2x00usb_kill_tx_queue(queue);
+}
+
 /*
  * RX control handlers
  */
@@ -1597,7 +1613,7 @@ static int rt73usb_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
                 return 0;
         }
 
-        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags)) {
                         if (lna == 3 || lna == 2)
                                 offset += 10;
@@ -2084,20 +2100,24 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Create channel information array
          */
-        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
@@ -2259,7 +2279,7 @@ static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
         .write_beacon           = rt73usb_write_beacon,
         .get_tx_data_len        = rt73usb_get_tx_data_len,
         .kick_tx_queue          = rt2x00usb_kick_tx_queue,
-        .kill_tx_queue          = rt2x00usb_kill_tx_queue,
+        .kill_tx_queue          = rt73usb_kill_tx_queue,
         .fill_rxdone            = rt73usb_fill_rxdone,
         .config_shared_key      = rt73usb_config_shared_key,
         .config_pairwise_key    = rt73usb_config_pairwise_key,
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 30107ce78dfb..05c6badbe201 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -99,19 +99,66 @@ void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
         }
 }
 
-static void rtl8180_handle_rx(struct ieee80211_hw *dev)
+static void rtl8180_handle_tx(struct ieee80211_hw *dev)
 {
         struct rtl8180_priv *priv = dev->priv;
-        unsigned int count = 32;
+        struct rtl8180_tx_ring *ring;
+        int prio;
+
+        spin_lock(&priv->lock);
+
+        for (prio = 3; prio >= 0; prio--) {
+                ring = &priv->tx_ring[prio];
+
+                while (skb_queue_len(&ring->queue)) {
+                        struct rtl8180_tx_desc *entry = &ring->desc[ring->idx];
+                        struct sk_buff *skb;
+                        struct ieee80211_tx_info *info;
+                        u32 flags = le32_to_cpu(entry->flags);
+
+                        if (flags & RTL818X_TX_DESC_FLAG_OWN)
+                                break;
+
+                        ring->idx = (ring->idx + 1) % ring->entries;
+                        skb = __skb_dequeue(&ring->queue);
+                        pci_unmap_single(priv->pdev, le32_to_cpu(entry->tx_buf),
+                                         skb->len, PCI_DMA_TODEVICE);
+
+                        info = IEEE80211_SKB_CB(skb);
+                        ieee80211_tx_info_clear_status(info);
+
+                        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
+                            (flags & RTL818X_TX_DESC_FLAG_TX_OK))
+                                info->flags |= IEEE80211_TX_STAT_ACK;
+
+                        info->status.rates[0].count = (flags & 0xFF) + 1;
+                        info->status.rates[1].idx = -1;
+
+                        ieee80211_tx_status(dev, skb);
+                        if (ring->entries - skb_queue_len(&ring->queue) == 2)
+                                ieee80211_wake_queue(dev, prio);
+                }
+        }
+
+        spin_unlock(&priv->lock);
+}
+
+static int rtl8180_poll(struct ieee80211_hw *dev, int budget)
+{
+        struct rtl8180_priv *priv = dev->priv;
+        unsigned int count = 0;
         u8 signal, agc, sq;
 
-        while (count--) {
+        /* handle pending Tx queue cleanup */
+        rtl8180_handle_tx(dev);
+
+        while (count++ < budget) {
                 struct rtl8180_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
                 struct sk_buff *skb = priv->rx_buf[priv->rx_idx];
                 u32 flags = le32_to_cpu(entry->flags);
 
                 if (flags & RTL818X_RX_DESC_FLAG_OWN)
-                        return;
+                        break;
 
                 if (unlikely(flags & (RTL818X_RX_DESC_FLAG_DMA_FAIL |
                                       RTL818X_RX_DESC_FLAG_FOF |
@@ -151,7 +198,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
 
                         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
-                        ieee80211_rx_irqsafe(dev, skb);
+                        ieee80211_rx(dev, skb);
 
                         skb = new_skb;
                         priv->rx_buf[priv->rx_idx] = skb;
@@ -168,41 +215,16 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         entry->flags |= cpu_to_le32(RTL818X_RX_DESC_FLAG_EOR);
                 priv->rx_idx = (priv->rx_idx + 1) % 32;
         }
-}
 
-static void rtl8180_handle_tx(struct ieee80211_hw *dev, unsigned int prio)
-{
-        struct rtl8180_priv *priv = dev->priv;
-        struct rtl8180_tx_ring *ring = &priv->tx_ring[prio];
+        if (count < budget) {
+                /* disable polling */
+                ieee80211_napi_complete(dev);
 
-        while (skb_queue_len(&ring->queue)) {
-                struct rtl8180_tx_desc *entry = &ring->desc[ring->idx];
-                struct sk_buff *skb;
-                struct ieee80211_tx_info *info;
-                u32 flags = le32_to_cpu(entry->flags);
-
-                if (flags & RTL818X_TX_DESC_FLAG_OWN)
-                        return;
-
-                ring->idx = (ring->idx + 1) % ring->entries;
-                skb = __skb_dequeue(&ring->queue);
-                pci_unmap_single(priv->pdev, le32_to_cpu(entry->tx_buf),
-                                 skb->len, PCI_DMA_TODEVICE);
-
-                info = IEEE80211_SKB_CB(skb);
-                ieee80211_tx_info_clear_status(info);
-
-                if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
-                    (flags & RTL818X_TX_DESC_FLAG_TX_OK))
-                        info->flags |= IEEE80211_TX_STAT_ACK;
-
-                info->status.rates[0].count = (flags & 0xFF) + 1;
-                info->status.rates[1].idx = -1;
-
-                ieee80211_tx_status_irqsafe(dev, skb);
-                if (ring->entries - skb_queue_len(&ring->queue) == 2)
-                        ieee80211_wake_queue(dev, prio);
+                /* enable interrupts */
+                rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0xFFFF);
         }
+
+        return count;
 }
 
 static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
@@ -211,31 +233,17 @@ static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
         struct rtl8180_priv *priv = dev->priv;
         u16 reg;
 
-        spin_lock(&priv->lock);
         reg = rtl818x_ioread16(priv, &priv->map->INT_STATUS);
-        if (unlikely(reg == 0xFFFF)) {
-                spin_unlock(&priv->lock);
+        if (unlikely(reg == 0xFFFF))
                 return IRQ_HANDLED;
-        }
 
         rtl818x_iowrite16(priv, &priv->map->INT_STATUS, reg);
 
-        if (reg & (RTL818X_INT_TXB_OK | RTL818X_INT_TXB_ERR))
-                rtl8180_handle_tx(dev, 3);
-
-        if (reg & (RTL818X_INT_TXH_OK | RTL818X_INT_TXH_ERR))
-                rtl8180_handle_tx(dev, 2);
-
-        if (reg & (RTL818X_INT_TXN_OK | RTL818X_INT_TXN_ERR))
-                rtl8180_handle_tx(dev, 1);
-
-        if (reg & (RTL818X_INT_TXL_OK | RTL818X_INT_TXL_ERR))
-                rtl8180_handle_tx(dev, 0);
-
-        if (reg & (RTL818X_INT_RX_OK | RTL818X_INT_RX_ERR))
-                rtl8180_handle_rx(dev);
+        /* disable interrupts */
+        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
 
-        spin_unlock(&priv->lock);
+        /* enable polling */
+        ieee80211_napi_schedule(dev);
 
         return IRQ_HANDLED;
 }
@@ -247,7 +255,6 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct rtl8180_priv *priv = dev->priv;
         struct rtl8180_tx_ring *ring;
         struct rtl8180_tx_desc *entry;
-        unsigned long flags;
         unsigned int idx, prio;
         dma_addr_t mapping;
         u32 tx_flags;
@@ -294,7 +301,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
                         plcp_len |= 1 << 15;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock(&priv->lock);
 
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
@@ -318,7 +325,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         if (ring->entries - skb_queue_len(&ring->queue) < 2)
                 ieee80211_stop_queue(dev, prio);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->lock);
 
         rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING, (1 << (prio + 4)));
 
@@ -783,6 +790,7 @@ static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
         struct rtl8180_priv *priv = dev->priv;
         struct rtl8180_vif *vif_priv;
         int i;
+        u8 reg;
 
         vif_priv = (struct rtl8180_vif *)&vif->drv_priv;
 
@@ -791,12 +799,14 @@ static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
                         rtl818x_iowrite8(priv, &priv->map->BSSID[i],
                                          info->bssid[i]);
 
-                if (is_valid_ether_addr(info->bssid))
-                        rtl818x_iowrite8(priv, &priv->map->MSR,
-                                         RTL818X_MSR_INFRA);
-                else
-                        rtl818x_iowrite8(priv, &priv->map->MSR,
-                                         RTL818X_MSR_NO_LINK);
+                if (is_valid_ether_addr(info->bssid)) {
+                        if (vif->type == NL80211_IFTYPE_ADHOC)
+                                reg = RTL818X_MSR_ADHOC;
+                        else
+                                reg = RTL818X_MSR_INFRA;
+                } else
+                        reg = RTL818X_MSR_NO_LINK;
+                rtl818x_iowrite8(priv, &priv->map->MSR, reg);
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT && priv->rf->conf_erp)
@@ -861,6 +871,7 @@ static const struct ieee80211_ops rtl8180_ops = {
         .prepare_multicast      = rtl8180_prepare_multicast,
         .configure_filter       = rtl8180_configure_filter,
         .get_tsf                = rtl8180_get_tsf,
+        .napi_poll              = rtl8180_poll,
 };
 
 static void rtl8180_eeprom_register_read(struct eeprom_93cx6 *eeprom)
@@ -992,6 +1003,8 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         dev->queues = 1;
         dev->max_signal = 65;
 
+        dev->napi_weight = 64;
+
         reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
         reg &= RTL818X_TX_CONF_HWVER_MASK;
         switch (reg) {
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 98e0351c1dd6..38fa8244cc96 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1176,13 +1176,12 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                 else
                         reg = 0;
 
-                if (is_valid_ether_addr(info->bssid)) {
+                if (is_valid_ether_addr(info->bssid))
                         reg |= RTL818X_MSR_INFRA;
-                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
-                } else {
+                else
                         reg |= RTL818X_MSR_NO_LINK;
-                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
-                }
+
+                rtl818x_iowrite8(priv, &priv->map->MSR, reg);
 
                 mutex_unlock(&priv->conf_mutex);
         }
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 2f98058be451..4a8bb25c1739 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -74,4 +74,7 @@ config WL1271_SDIO
           If you choose to build a module, it'll be called
           wl1271_sdio. Say N if unsure.
 
-
+config WL12XX_PLATFORM_DATA
+        bool
+        depends on WL1271_SDIO != n
+        default y
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 6b942a28e6a5..e113d4c1fb35 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008-2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -274,6 +272,8 @@ struct wl1251 {
         int irq;
         bool use_eeprom;
 
+        spinlock_t wl_lock;
+
         enum wl1251_state state;
         struct mutex mutex;
 
@@ -401,7 +401,8 @@ void wl1251_disable_interrupts(struct wl1251 *wl);
 
 #define WL1251_DEFAULT_POWER_LEVEL 20
 
-#define WL1251_TX_QUEUE_MAX_LENGTH 20
+#define WL1251_TX_QUEUE_LOW_WATERMARK  10
+#define WL1251_TX_QUEUE_HIGH_WATERMARK 25
 
 #define WL1251_DEFAULT_BEACON_INT 100
 #define WL1251_DEFAULT_DTIM_PERIOD 1
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.c b/drivers/net/wireless/wl12xx/wl1251_acx.c
index 91891f928070..2f8a2ba744dc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.c
@@ -380,7 +380,7 @@ int wl1251_acx_pd_threshold(struct wl1251 *wl)
 
 out:
         kfree(pd);
-        return 0;
+        return ret;
 }
 
 int wl1251_acx_slot(struct wl1251 *wl, enum acx_slot_type slot_time)
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.h b/drivers/net/wireless/wl12xx/wl1251_acx.h
index 842df310d92a..c7cc5c1e8a75 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -37,7 +35,7 @@ struct acx_header {
 
         /* payload length (not including headers */
         u16 len;
-};
+} __packed;
 
 struct acx_error_counter {
         struct acx_header header;
@@ -459,8 +457,8 @@ struct acx_beacon_filter_ie_table {
         struct acx_header header;
 
         u8 num_ie;
-        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
         u8 pad[3];
+        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
 } __packed;
 
 #define SYNCH_FAIL_DEFAULT_THRESHOLD    10     /* number of beacons */
@@ -471,7 +469,7 @@ struct acx_conn_monit_params {
 
         u32 synch_fail_thold; /* number of beacons missed */
         u32 bss_lose_timeout; /* number of TU's from synch fail */
-};
+} __packed;
 
 enum {
         SG_ENABLE = 0,
@@ -1056,7 +1054,7 @@ struct acx_rate_class {
         u8 long_retry_limit;
         u8 aflags;
         u8 reserved;
-};
+} __packed;
 
 struct acx_rate_policy {
         struct acx_header header;
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index 65e0416be5b6..468b47b0328a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -302,7 +300,7 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 ROAMING_TRIGGER_LOW_RSSI_EVENT_ID |
                 ROAMING_TRIGGER_REGAINED_RSSI_EVENT_ID |
                 REGAINED_BSS_EVENT_ID | BT_PTA_SENSE_EVENT_ID |
-                BT_PTA_PREDICTION_EVENT_ID;
+                BT_PTA_PREDICTION_EVENT_ID | JOIN_EVENT_COMPLETE_ID;
 
         ret = wl1251_event_unmask(wl);
         if (ret < 0) {
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.h b/drivers/net/wireless/wl12xx/wl1251_boot.h
index 90063697e8f2..7661bc5e4662 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.h
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.c b/drivers/net/wireless/wl12xx/wl1251_cmd.c
index ce3722f4c3e3..15fb68c6b542 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.c
@@ -200,7 +200,7 @@ int wl1251_cmd_vbm(struct wl1251 *wl, u8 identity,
 
 out:
         kfree(vbm);
-        return 0;
+        return ret;
 }
 
 int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.h b/drivers/net/wireless/wl12xx/wl1251_cmd.h
index a9e4991369be..e5c74c631374 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -111,7 +109,7 @@ struct wl1251_cmd_header {
 struct  wl1251_command {
         struct wl1251_cmd_header header;
         u8  parameters[MAX_CMD_PARAMS];
-};
+} __packed;
 
 enum {
         CMD_MAILBOX_IDLE                        =  0,
@@ -164,7 +162,7 @@ struct cmd_read_write_memory {
            of this field is the Host in WRITE command or the Wilink in READ
            command. */
         u8 value[MAX_READ_SIZE];
-};
+} __packed;
 
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
@@ -339,7 +337,7 @@ struct wl1251_cmd_trigger_scan_to {
         struct wl1251_cmd_header header;
 
         u32 timeout;
-};
+} __packed;
 
 /* HW encryption keys */
 #define NUM_ACCESS_CATEGORIES_COPY 4
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index 5e4465ac08fa..6ffe4cd58561 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.h b/drivers/net/wireless/wl12xx/wl1251_debugfs.h
index 6dc3d080853c..b3417c02a218 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.h
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.h
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.c b/drivers/net/wireless/wl12xx/wl1251_event.c
index 020d764f9c13..54223556b308 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.c
+++ b/drivers/net/wireless/wl12xx/wl1251_event.c
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -36,9 +34,7 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
                      mbox->scheduled_scan_channels);
 
         if (wl->scanning) {
-                mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, false);
-                mutex_lock(&wl->mutex);
                 wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan completed");
                 wl->scanning = false;
         }
@@ -97,6 +93,35 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
         return 0;
 }
 
+/*
+ * Poll the mailbox event field until any of the bits in the mask is set or a
+ * timeout occurs (WL1251_EVENT_TIMEOUT in msecs)
+ */
+int wl1251_event_wait(struct wl1251 *wl, u32 mask, int timeout_ms)
+{
+        u32 events_vector, event;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(timeout_ms);
+
+        do {
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+
+                msleep(1);
+
+                /* read from both event fields */
+                wl1251_mem_read(wl, wl->mbox_ptr[0], &events_vector,
+                                sizeof(events_vector));
+                event = events_vector & mask;
+                wl1251_mem_read(wl, wl->mbox_ptr[1], &events_vector,
+                                sizeof(events_vector));
+                event |= events_vector & mask;
+        } while (!event);
+
+        return 0;
+}
+
 int wl1251_event_unmask(struct wl1251 *wl)
 {
         int ret;
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.h b/drivers/net/wireless/wl12xx/wl1251_event.h
index f48a2b66bc5a..30eb5d150bf7 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.h
+++ b/drivers/net/wireless/wl12xx/wl1251_event.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -117,5 +115,6 @@ struct event_mailbox {
 int wl1251_event_unmask(struct wl1251 *wl);
 void wl1251_event_mbox_config(struct wl1251 *wl);
 int wl1251_event_handle(struct wl1251 *wl, u8 mbox);
+int wl1251_event_wait(struct wl1251 *wl, u32 mask, int timeout_ms);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.c b/drivers/net/wireless/wl12xx/wl1251_init.c
index b538bdd7b320..c5daec05d9ee 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.c
+++ b/drivers/net/wireless/wl12xx/wl1251_init.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.h b/drivers/net/wireless/wl12xx/wl1251_init.h
index 269cefb3e7d4..543f17582ead 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.h
+++ b/drivers/net/wireless/wl12xx/wl1251_init.h
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.c b/drivers/net/wireless/wl12xx/wl1251_io.c
index f1c232e0887f..ad6ca68b303f 100644
--- a/drivers/net/wireless/wl12xx/wl1251_io.c
+++ b/drivers/net/wireless/wl12xx/wl1251_io.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 861a5f33761e..faf221ca3f41 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008-2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -293,14 +291,14 @@ static void wl1251_irq_work(struct work_struct *work)
                         wl1251_tx_complete(wl);
                 }
 
-                if (intr & (WL1251_ACX_INTR_EVENT_A |
-                            WL1251_ACX_INTR_EVENT_B)) {
-                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)",
-                                     intr);
-                        if (intr & WL1251_ACX_INTR_EVENT_A)
-                                wl1251_event_handle(wl, 0);
-                        else
-                                wl1251_event_handle(wl, 1);
+                if (intr & WL1251_ACX_INTR_EVENT_A) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT_A");
+                        wl1251_event_handle(wl, 0);
+                }
+
+                if (intr & WL1251_ACX_INTR_EVENT_B) {
+                        wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT_B");
+                        wl1251_event_handle(wl, 1);
                 }
 
                 if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
@@ -339,11 +337,9 @@ static int wl1251_join(struct wl1251 *wl, u8 bss_type, u8 channel,
         if (ret < 0)
                 goto out;
 
-        /*
-         * FIXME: we should wait for JOIN_EVENT_COMPLETE_ID but to simplify
-         * locking we just sleep instead, for now
-         */
-        msleep(10);
+        ret = wl1251_event_wait(wl, JOIN_EVENT_COMPLETE_ID, 100);
+        if (ret < 0)
+                wl1251_warning("join timeout");
 
 out:
         return ret;
@@ -379,6 +375,7 @@ out:
 static int wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct wl1251 *wl = hw->priv;
+        unsigned long flags;
 
         skb_queue_tail(&wl->tx_queue, skb);
 
@@ -393,16 +390,13 @@ static int wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * The workqueue is slow to process the tx_queue and we need stop
          * the queue here, otherwise the queue will get too long.
          */
-        if (skb_queue_len(&wl->tx_queue) >= WL1251_TX_QUEUE_MAX_LENGTH) {
+        if (skb_queue_len(&wl->tx_queue) >= WL1251_TX_QUEUE_HIGH_WATERMARK) {
                 wl1251_debug(DEBUG_TX, "op_tx: tx_queue full, stop queues");
-                ieee80211_stop_queues(wl->hw);
 
-                /*
-                 * FIXME: this is racy, the variable is not properly
-                 * protected. Maybe fix this by removing the stupid
-                 * variable altogether and checking the real queue state?
-                 */
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_stop_queues(wl->hw);
                 wl->tx_queue_stopped = true;
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
         return NETDEV_TX_OK;
@@ -471,9 +465,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         WARN_ON(wl->state != WL1251_STATE_ON);
 
         if (wl->scanning) {
-                mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, true);
-                mutex_lock(&wl->mutex);
                 wl->scanning = false;
         }
 
@@ -725,8 +717,9 @@ static int wl1251_set_key_type(struct wl1251 *wl,
                                struct ieee80211_key_conf *mac80211_key,
                                const u8 *addr)
 {
-        switch (mac80211_key->alg) {
-        case ALG_WEP:
+        switch (mac80211_key->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 if (is_broadcast_ether_addr(addr))
                         key->key_type = KEY_WEP_DEFAULT;
                 else
@@ -734,7 +727,7 @@ static int wl1251_set_key_type(struct wl1251 *wl,
 
                 mac80211_key->hw_key_idx = mac80211_key->keyidx;
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 if (is_broadcast_ether_addr(addr))
                         key->key_type = KEY_TKIP_MIC_GROUP;
                 else
@@ -742,7 +735,7 @@ static int wl1251_set_key_type(struct wl1251 *wl,
 
                 mac80211_key->hw_key_idx = mac80211_key->keyidx;
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 if (is_broadcast_ether_addr(addr))
                         key->key_type = KEY_AES_GROUP;
                 else
@@ -750,7 +743,7 @@ static int wl1251_set_key_type(struct wl1251 *wl,
                 mac80211_key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                 break;
         default:
-                wl1251_error("Unknown key algo 0x%x", mac80211_key->alg);
+                wl1251_error("Unknown key cipher 0x%x", mac80211_key->cipher);
                 return -EOPNOTSUPP;
         }
 
@@ -783,7 +776,7 @@ static int wl1251_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         wl1251_debug(DEBUG_CRYPT, "CMD: 0x%x", cmd);
         wl1251_dump(DEBUG_CRYPT, "ADDR: ", addr, ETH_ALEN);
         wl1251_debug(DEBUG_CRYPT, "Key: algo:0x%x, id:%d, len:%d flags 0x%x",
-                     key->alg, key->keyidx, key->keylen, key->flags);
+                     key->cipher, key->keyidx, key->keylen, key->flags);
         wl1251_dump(DEBUG_CRYPT, "KEY: ", key->key, key->keylen);
 
         if (is_zero_ether_addr(addr)) {
@@ -1438,5 +1431,5 @@ EXPORT_SYMBOL_GPL(wl1251_free_hw);
 
 MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
+MODULE_AUTHOR("Kalle Valo <kvalo@adurom.com>");
 MODULE_FIRMWARE(WL1251_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index b55cb2bd459a..0b997bdfec09 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.h b/drivers/net/wireless/wl12xx/wl1251_ps.h
index c688ac57aee4..e5db81fc1dfc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.h
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.h
@@ -1,14 +1,9 @@
-#ifndef __WL1251_PS_H__
-#define __WL1251_PS_H__
-
 /*
  * This file is part of wl1251
  *
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -25,6 +20,9 @@
  *
  */
 
+#ifndef __WL1251_PS_H__
+#define __WL1251_PS_H__
+
 #include "wl1251.h"
 #include "wl1251_acx.h"
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl12xx/wl1251_reg.h
index d16edd9bf06c..a5809019c5c1 100644
--- a/drivers/net/wireless/wl12xx/wl1251_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1251_reg.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 1b6294b3b996..25764592a596 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.h b/drivers/net/wireless/wl12xx/wl1251_rx.h
index da4e53406a0e..4448f635a4d8 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index b901b6135654..74ba9ced5393 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -24,7 +24,7 @@
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 #include <linux/platform_device.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/irq.h>
 
 #include "wl1251.h"
@@ -339,4 +339,4 @@ module_init(wl1251_sdio_init);
 module_exit(wl1251_sdio_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
+MODULE_AUTHOR("Kalle Valo <kvalo@adurom.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index 27fdfaaeb074..320de79667a6 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -26,7 +24,7 @@
 #include <linux/slab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 
 #include "wl1251.h"
 #include "wl1251_reg.h"
@@ -344,5 +342,5 @@ module_init(wl1251_spi_init);
 module_exit(wl1251_spi_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
+MODULE_AUTHOR("Kalle Valo <kvalo@adurom.com>");
 MODULE_ALIAS("spi:wl1251");
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.h b/drivers/net/wireless/wl12xx/wl1251_spi.h
index 2e273a97e7f3..7dcf3cf7ae40 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.h
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.c b/drivers/net/wireless/wl12xx/wl1251_tx.c
index a38ec199187a..388492a7f41f 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.c
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
@@ -189,7 +187,7 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
         tx_hdr = (struct tx_double_buffer_desc *) skb->data;
 
         if (control->control.hw_key &&
-            control->control.hw_key->alg == ALG_TKIP) {
+            control->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 int hdrlen;
                 __le16 fc;
                 u16 length;
@@ -322,11 +320,6 @@ void wl1251_tx_work(struct work_struct *work)
 
                 ret = wl1251_tx_frame(wl, skb);
                 if (ret == -EBUSY) {
-                        /* firmware buffer is full, stop queues */
-                        wl1251_debug(DEBUG_TX, "tx_work: fw buffer full, "
-                                     "stop queues");
-                        ieee80211_stop_queues(wl->hw);
-                        wl->tx_queue_stopped = true;
                         skb_queue_head(&wl->tx_queue, skb);
                         goto out;
                 } else if (ret < 0) {
@@ -399,7 +392,7 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,
          */
         frame = skb_pull(skb, sizeof(struct tx_double_buffer_desc));
         if (info->control.hw_key &&
-            info->control.hw_key->alg == ALG_TKIP) {
+            info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 hdrlen = ieee80211_get_hdrlen_from_skb(skb);
                 memmove(frame + WL1251_TKIP_IV_SPACE, frame, hdrlen);
                 skb_pull(skb, WL1251_TKIP_IV_SPACE);
@@ -449,6 +442,7 @@ void wl1251_tx_complete(struct wl1251 *wl)
 {
         int i, result_index, num_complete = 0;
         struct tx_result result[FW_TX_CMPLT_BLOCK_SIZE], *result_ptr;
+        unsigned long flags;
 
         if (unlikely(wl->state != WL1251_STATE_ON))
                 return;
@@ -477,6 +471,20 @@ void wl1251_tx_complete(struct wl1251 *wl)
                 }
         }
 
+        if (wl->tx_queue_stopped
+            &&
+            skb_queue_len(&wl->tx_queue) <= WL1251_TX_QUEUE_LOW_WATERMARK){
+
+                /* firmware buffer has space, restart queues */
+                wl1251_debug(DEBUG_TX, "tx_complete: waking queues");
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_wake_queues(wl->hw);
+                wl->tx_queue_stopped = false;
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
+
+        }
+
         /* Every completed frame needs to be acknowledged */
         if (num_complete) {
                 /*
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.h b/drivers/net/wireless/wl12xx/wl1251_tx.h
index f40eeb37f5aa..96011e78cd5a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.h
@@ -4,8 +4,6 @@
  * Copyright (c) 1998-2007 Texas Instruments Incorporated
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * version 2 as published by the Free Software Foundation.
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index dd3cee6ea5bb..4134f4495b95 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -313,7 +313,7 @@ struct wl1271_if_operations {
                      bool fixed);
         void (*reset)(struct wl1271 *wl);
         void (*init)(struct wl1271 *wl);
-        void (*power)(struct wl1271 *wl, bool enable);
+        int (*power)(struct wl1271 *wl, bool enable);
         struct device* (*dev)(struct wl1271 *wl);
         void (*enable_irq)(struct wl1271 *wl);
         void (*disable_irq)(struct wl1271 *wl);
@@ -330,6 +330,7 @@ struct wl1271 {
 
         void (*set_power)(bool enable);
         int irq;
+        int ref_clock;
 
         spinlock_t wl_lock;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index bb245f05af49..f03ad088db8b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -269,7 +269,7 @@ int wl1271_acx_pd_threshold(struct wl1271 *wl)
 
 out:
         kfree(pd);
-        return 0;
+        return ret;
 }
 
 int wl1271_acx_slot(struct wl1271 *wl, enum acx_slot_type slot_time)
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index f36430b0336d..fc21db810812 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -457,17 +457,20 @@ int wl1271_boot(struct wl1271 *wl)
 {
         int ret = 0;
         u32 tmp, clk, pause;
+        int ref_clock = wl->ref_clock;
 
         wl1271_boot_hw_version(wl);
 
-        if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
+        if (ref_clock == 0 || ref_clock == 2 || ref_clock == 4)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
-        else if (REF_CLOCK == 1 || REF_CLOCK == 3)
+        else if (ref_clock == 1 || ref_clock == 3)
                 /* ref clk: 26/52 */
                 clk = 0x5;
+        else
+                return -EINVAL;
 
-        if (REF_CLOCK != 0) {
+        if (ref_clock != 0) {
                 u16 val;
                 /* Set clock type (open drain) */
                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
@@ -516,7 +519,7 @@ int wl1271_boot(struct wl1271 *wl)
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
         /* 2 */
-        clk |= (REF_CLOCK << 1) << 4;
+        clk |= (ref_clock << 1) << 4;
         wl1271_write32(wl, DRPW_SCRATCH_START, clk);
 
         wl1271_set_partition(wl, &part_table[PART_WORK]);
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index f829699d597e..f73b0b15a280 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -46,7 +46,6 @@ struct wl1271_static_data {
 /* delay between retries */
 #define INIT_LOOP_DELAY 50
 
-#define REF_CLOCK            2
 #define WU_COUNTER_PAUSE_VAL 0x3FF
 #define WELP_ARM_COMMAND_VAL 0x4
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
index bc806c74c63a..c1f92e65ded0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -144,10 +144,13 @@ static inline void wl1271_power_off(struct wl1271 *wl)
         clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
-static inline void wl1271_power_on(struct wl1271 *wl)
+static inline int wl1271_power_on(struct wl1271 *wl)
 {
-        wl->if_ops->power(wl, true);
-        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+        int ret = wl->if_ops->power(wl, true);
+        if (ret == 0)
+                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+
+        return ret;
 }
 
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 9d68f0012f05..776cd7c41148 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -621,7 +621,9 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
         int ret = 0;
 
         msleep(WL1271_PRE_POWER_ON_SLEEP);
-        wl1271_power_on(wl);
+        ret = wl1271_power_on(wl);
+        if (ret < 0)
+                goto out;
         msleep(WL1271_POWER_ON_SLEEP);
         wl1271_io_reset(wl);
         wl1271_io_init(wl);
@@ -948,9 +950,7 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
                 ieee80211_enable_dyn_ps(wl->vif);
 
         if (wl->scan.state != WL1271_SCAN_STATE_IDLE) {
-                mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, true);
-                mutex_lock(&wl->mutex);
                 wl->scan.state = WL1271_SCAN_STATE_IDLE;
                 kfree(wl->scan.scanned_ch);
                 wl->scan.scanned_ch = NULL;
@@ -1439,7 +1439,7 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         wl1271_debug(DEBUG_CRYPT, "CMD: 0x%x", cmd);
         wl1271_dump(DEBUG_CRYPT, "ADDR: ", addr, ETH_ALEN);
         wl1271_debug(DEBUG_CRYPT, "Key: algo:0x%x, id:%d, len:%d flags 0x%x",
-                     key_conf->alg, key_conf->keyidx,
+                     key_conf->cipher, key_conf->keyidx,
                      key_conf->keylen, key_conf->flags);
         wl1271_dump(DEBUG_CRYPT, "KEY: ", key_conf->key, key_conf->keylen);
 
@@ -1455,20 +1455,21 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (ret < 0)
                 goto out_unlock;
 
-        switch (key_conf->alg) {
-        case ALG_WEP:
+        switch (key_conf->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 key_type = KEY_WEP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 key_type = KEY_TKIP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
                 tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
                 tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 key_type = KEY_AES;
 
                 key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
@@ -1476,7 +1477,7 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
         default:
-                wl1271_error("Unknown key algo 0x%x", key_conf->alg);
+                wl1271_error("Unknown key algo 0x%x", key_conf->cipher);
 
                 ret = -EOPNOTSUPP;
                 goto out_sleep;
@@ -1633,7 +1634,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        if ((changed && BSS_CHANGED_BEACON_INT) &&
+        if ((changed & BSS_CHANGED_BEACON_INT) &&
             (wl->bss_type == BSS_TYPE_IBSS)) {
                 wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon interval updated: %d",
                         bss_conf->beacon_int);
@@ -1642,7 +1643,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 do_join = true;
         }
 
-        if ((changed && BSS_CHANGED_BEACON) &&
+        if ((changed & BSS_CHANGED_BEACON) &&
             (wl->bss_type == BSS_TYPE_IBSS)) {
                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index 019aa79cd9df..94da5dd7723c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -76,7 +76,6 @@ static void wl1271_rx_status(struct wl1271 *wl,
 
 static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
 {
-        struct ieee80211_rx_status rx_status;
         struct wl1271_rx_descriptor *desc;
         struct sk_buff *skb;
         u16 *fc;
@@ -109,14 +108,13 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         if ((*fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
                 beacon = 1;
 
-        wl1271_rx_status(wl, desc, &rx_status, beacon);
+        wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
 
         wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
                      beacon ? "beacon" : "");
 
         skb_trim(skb, skb->len - desc->pad_len);
 
-        memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
         ieee80211_rx_ni(wl->hw, skb);
 }
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_scan.c b/drivers/net/wireless/wl12xx/wl1271_scan.c
index fec43eed8c55..e4950c8e396e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_scan.c
+++ b/drivers/net/wireless/wl12xx/wl1271_scan.c
@@ -215,9 +215,7 @@ void wl1271_scan_stm(struct wl1271 *wl)
                 break;
 
         case WL1271_SCAN_STATE_DONE:
-                mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, false);
-                mutex_lock(&wl->mutex);
 
                 kfree(wl->scan.scanned_ch);
                 wl->scan.scanned_ch = NULL;
@@ -248,7 +246,7 @@ int wl1271_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
 
         wl->scan.req = req;
 
-        wl->scan.scanned_ch = kzalloc(req->n_channels *
+        wl->scan.scanned_ch = kcalloc(req->n_channels,
                                       sizeof(*wl->scan.scanned_ch),
                                       GFP_KERNEL);
         wl1271_scan_stm(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/wl1271_sdio.c
index 7059b5cccf0f..f2f04663627c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1271_sdio.c
@@ -29,14 +29,12 @@
 #include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/card.h>
 #include <linux/gpio.h>
+#include <linux/wl12xx.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_io.h"
 
-
-#define RX71_WL1271_IRQ_GPIO            42
-
 #ifndef SDIO_VENDOR_ID_TI
 #define SDIO_VENDOR_ID_TI               0x0097
 #endif
@@ -107,6 +105,8 @@ static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
         int ret;
         struct sdio_func *func = wl_to_func(wl);
 
+        sdio_claim_host(func);
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
                 ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
                 wl1271_debug(DEBUG_SDIO, "sdio read 52 addr 0x%x, byte 0x%02x",
@@ -122,9 +122,10 @@ static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
                 wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
         }
 
+        sdio_release_host(func);
+
         if (ret)
                 wl1271_error("sdio read failed (%d)", ret);
-
 }
 
 static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
@@ -133,6 +134,8 @@ static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
         int ret;
         struct sdio_func *func = wl_to_func(wl);
 
+        sdio_claim_host(func);
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
                 sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
                 wl1271_debug(DEBUG_SDIO, "sdio write 52 addr 0x%x, byte 0x%02x",
@@ -147,26 +150,45 @@ static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
                 else
                         ret = sdio_memcpy_toio(func, addr, buf, len);
         }
+
+        sdio_release_host(func);
+
         if (ret)
                 wl1271_error("sdio write failed (%d)", ret);
+}
+
+static int wl1271_sdio_power_on(struct wl1271 *wl)
+{
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        sdio_enable_func(func);
+        sdio_release_host(func);
 
+        return 0;
 }
 
-static void wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+static int wl1271_sdio_power_off(struct wl1271 *wl)
 {
         struct sdio_func *func = wl_to_func(wl);
 
+        sdio_claim_host(func);
+        sdio_disable_func(func);
+        sdio_release_host(func);
+
+        return 0;
+}
+
+static int wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+{
         /* Let the SDIO stack handle wlan_enable control, so we
          * keep host claimed while wlan is in use to keep wl1271
          * alive.
          */
-        if (enable) {
-                sdio_claim_host(func);
-                sdio_enable_func(func);
-        } else {
-                sdio_disable_func(func);
-                sdio_release_host(func);
-        }
+        if (enable)
+                return wl1271_sdio_power_on(wl);
+        else
+                return wl1271_sdio_power_off(wl);
 }
 
 static struct wl1271_if_operations sdio_ops = {
@@ -184,6 +206,7 @@ static int __devinit wl1271_probe(struct sdio_func *func,
                                   const struct sdio_device_id *id)
 {
         struct ieee80211_hw *hw;
+        const struct wl12xx_platform_data *wlan_data;
         struct wl1271 *wl;
         int ret;
 
@@ -203,13 +226,16 @@ static int __devinit wl1271_probe(struct sdio_func *func,
         /* Grab access to FN0 for ELP reg. */
         func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
 
-        wl->irq = gpio_to_irq(RX71_WL1271_IRQ_GPIO);
-        if (wl->irq < 0) {
-                ret = wl->irq;
-                wl1271_error("could not get irq!");
+        wlan_data = wl12xx_get_platform_data();
+        if (IS_ERR(wlan_data)) {
+                ret = PTR_ERR(wlan_data);
+                wl1271_error("missing wlan platform data: %d", ret);
                 goto out_free;
         }
 
+        wl->irq = wlan_data->irq;
+        wl->ref_clock = wlan_data->board_ref_clock;
+
         ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
         if (ret < 0) {
                 wl1271_error("request_irq() failed: %d", ret);
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 4cb99c541e2a..ced0a9e2c7e1 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -25,7 +25,7 @@
 #include <linux/module.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/wl12xx.h>
+#include <linux/wl12xx.h>
 #include <linux/slab.h>
 
 #include "wl1271.h"
@@ -312,10 +312,12 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
         return IRQ_HANDLED;
 }
 
-static void wl1271_spi_set_power(struct wl1271 *wl, bool enable)
+static int wl1271_spi_set_power(struct wl1271 *wl, bool enable)
 {
         if (wl->set_power)
                 wl->set_power(enable);
+
+        return 0;
 }
 
 static struct wl1271_if_operations spi_ops = {
@@ -370,6 +372,8 @@ static int __devinit wl1271_probe(struct spi_device *spi)
                 goto out_free;
         }
 
+        wl->ref_clock = pdata->board_ref_clock;
+
         wl->irq = spi->irq;
         if (wl->irq < 0) {
                 wl1271_error("irq missing in platform data");
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index c592cc2e9fe8..dc0b46c93c4b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -193,7 +193,7 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
         info = IEEE80211_SKB_CB(skb);
 
         if (info->control.hw_key &&
-            info->control.hw_key->alg == ALG_TKIP)
+            info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP)
                 extra = WL1271_TKIP_IV_SPACE;
 
         if (info->control.hw_key) {
@@ -347,7 +347,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 
         /* remove TKIP header space if present */
         if (info->control.hw_key &&
-            info->control.hw_key->alg == ALG_TKIP) {
+            info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
                 memmove(skb->data + WL1271_TKIP_IV_SPACE, skb->data, hdrlen);
                 skb_pull(skb, WL1271_TKIP_IV_SPACE);
diff --git a/drivers/net/wireless/wl12xx/wl12xx_platform_data.c b/drivers/net/wireless/wl12xx/wl12xx_platform_data.c
new file mode 100644
index 000000000000..973b11060a8f
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl12xx_platform_data.c
@@ -0,0 +1,28 @@
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/wl12xx.h>
+
+static const struct wl12xx_platform_data *platform_data;
+
+int __init wl12xx_set_platform_data(const struct wl12xx_platform_data *data)
+{
+        if (platform_data)
+                return -EBUSY;
+        if (!data)
+                return -EINVAL;
+
+        platform_data = kmemdup(data, sizeof(*data), GFP_KERNEL);
+        if (!platform_data)
+                return -ENOMEM;
+
+        return 0;
+}
+
+const struct wl12xx_platform_data *wl12xx_get_platform_data(void)
+{
+        if (!platform_data)
+                return ERR_PTR(-ENODEV);
+
+        return platform_data;
+}
+EXPORT_SYMBOL(wl12xx_get_platform_data);
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index a1cc2d498a1c..420e9e986a18 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -29,7 +29,6 @@
 
 #include <linux/delay.h>
 #include <linux/types.h>
-#include <linux/ethtool.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/in.h>
@@ -1411,15 +1410,6 @@ static struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
         return wstats;
 }
 
-static void wl3501_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
-{
-        strlcpy(info->driver, "wl3501_cs", sizeof(info->driver));
-}
-
-static const struct ethtool_ops ops = {
-        .get_drvinfo = wl3501_get_drvinfo
-};
-
 /**
  * wl3501_detach - deletes a driver "instance"
  * @link - FILL_IN
@@ -1905,7 +1895,6 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
         this->p_dev = p_dev;
         dev->wireless_data      = &this->wireless_data;
         dev->wireless_handlers  = &wl3501_handler_def;
-        SET_ETHTOOL_OPS(dev, &ops);
         netif_stop_queue(dev);
         p_dev->priv = dev;
 
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index b2af3c549bb3..87a95bcfee57 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -973,6 +973,7 @@ static void dump_fw_registers(struct zd_chip *chip)
 
 static int print_fw_version(struct zd_chip *chip)
 {
+        struct wiphy *wiphy = zd_chip_to_mac(chip)->hw->wiphy;
         int r;
         u16 version;
 
@@ -982,6 +983,10 @@ static int print_fw_version(struct zd_chip *chip)
                 return r;
 
         dev_info(zd_chip_dev(chip),"firmware version %04hx\n", version);
+
+        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version),
+                        "%04hx", version);
+
         return 0;
 }
 
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index b50fedcef8ac..630fb8664768 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -135,7 +135,7 @@ static void skb_entry_set_link(union skb_entry *list, unsigned short id)
 static int skb_entry_is_link(const union skb_entry *list)
 {
         BUILD_BUG_ON(sizeof(list->skb) != sizeof(list->link));
-        return ((unsigned long)list->skb < PAGE_OFFSET);
+        return (unsigned long)list->skb < PAGE_OFFSET;
 }
 
 /*
@@ -203,8 +203,8 @@ static void rx_refill_timeout(unsigned long data)
 
 static int netfront_tx_slot_available(struct netfront_info *np)
 {
-        return ((np->tx.req_prod_pvt - np->tx.rsp_cons) <
-                (TX_MAX_TARGET - MAX_SKB_FRAGS - 2));
+        return (np->tx.req_prod_pvt - np->tx.rsp_cons) <
+                (TX_MAX_TARGET - MAX_SKB_FRAGS - 2);
 }
 
 static void xennet_maybe_wake_tx(struct net_device *dev)
@@ -1395,7 +1395,7 @@ static int setup_netfront(struct xenbus_device *dev, struct netfront_info *info)
 }
 
 /* Common code used when first setting up, and when resuming. */
-static int talk_to_backend(struct xenbus_device *dev,
+static int talk_to_netback(struct xenbus_device *dev,
                            struct netfront_info *info)
 {
         const char *message;
@@ -1545,7 +1545,7 @@ static int xennet_connect(struct net_device *dev)
                 return -ENODEV;
         }
 
-        err = talk_to_backend(np->xbdev, np);
+        err = talk_to_netback(np->xbdev, np);
         if (err)
                 return err;
 
@@ -1599,7 +1599,7 @@ static int xennet_connect(struct net_device *dev)
 /**
  * Callback received when the backend's state changes.
  */
-static void backend_changed(struct xenbus_device *dev,
+static void netback_changed(struct xenbus_device *dev,
                             enum xenbus_state backend_state)
 {
         struct netfront_info *np = dev_get_drvdata(&dev->dev);
@@ -1801,7 +1801,7 @@ static struct xenbus_driver netfront_driver = {
         .probe = netfront_probe,
         .remove = __devexit_p(xennet_remove),
         .resume = netfront_resume,
-        .otherend_changed = backend_changed,
+        .otherend_changed = netback_changed,
 };
 
 static int __init netif_init(void)
diff --git a/drivers/net/xilinx_emaclite.c b/drivers/net/xilinx_emaclite.c
index ecbbb688eba0..f3f8be5a35fa 100644
--- a/drivers/net/xilinx_emaclite.c
+++ b/drivers/net/xilinx_emaclite.c
@@ -641,7 +641,7 @@ static void xemaclite_rx_handler(struct net_device *dev)
         skb_put(skb, len);      /* Tell the skb how much data we got */
 
         skb->protocol = eth_type_trans(skb, dev);
-        skb->ip_summed = CHECKSUM_NONE;
+        skb_checksum_none_assert(skb);
 
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += len;
@@ -1269,6 +1269,16 @@ static int __devexit xemaclite_of_remove(struct platform_device *of_dev)
         return 0;
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void
+xemaclite_poll_controller(struct net_device *ndev)
+{
+        disable_irq(ndev->irq);
+        xemaclite_interrupt(ndev->irq, ndev);
+        enable_irq(ndev->irq);
+}
+#endif
+
 static struct net_device_ops xemaclite_netdev_ops = {
         .ndo_open               = xemaclite_open,
         .ndo_stop               = xemaclite_close,
@@ -1276,6 +1286,9 @@ static struct net_device_ops xemaclite_netdev_ops = {
         .ndo_set_mac_address    = xemaclite_set_mac_address,
         .ndo_tx_timeout         = xemaclite_tx_timeout,
         .ndo_get_stats          = xemaclite_get_stats,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = xemaclite_poll_controller,
+#endif
 };
 
 /* Match table for OF platform binding */
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index 4eb67aed68dd..cd1b3dcd61db 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -646,7 +646,7 @@ static int yellowfin_open(struct net_device *dev)
         init_timer(&yp->timer);
         yp->timer.expires = jiffies + 3*HZ;
         yp->timer.data = (unsigned long)dev;
-        yp->timer.function = &yellowfin_timer;                          /* timer handler */
+        yp->timer.function = yellowfin_timer;                           /* timer handler */
         add_timer(&yp->timer);
 
         return 0;
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index f0037eefd44e..0f4ef8769a3d 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -208,6 +208,7 @@ struct qdio_dev_perf_stat {
         unsigned int eqbs_partial;
         unsigned int sqbs;
         unsigned int sqbs_partial;
+        unsigned int int_discarded;
 } ____cacheline_aligned;
 
 struct qdio_queue_perf_stat {
@@ -222,6 +223,10 @@ struct qdio_queue_perf_stat {
         unsigned int nr_sbal_total;
 };
 
+enum qdio_queue_irq_states {
+        QDIO_QUEUE_IRQS_DISABLED,
+};
+
 struct qdio_input_q {
         /* input buffer acknowledgement flag */
         int polling;
@@ -231,6 +236,10 @@ struct qdio_input_q {
         int ack_count;
         /* last time of noticing incoming data */
         u64 timestamp;
+        /* upper-layer polling flag */
+        unsigned long queue_irq_state;
+        /* callback to start upper-layer polling */
+        void (*queue_start_poll) (struct ccw_device *, int, unsigned long);
 };
 
 struct qdio_output_q {
@@ -399,6 +408,26 @@ static inline int multicast_outbound(struct qdio_q *q)
 #define sub_buf(bufnr, dec) \
         ((bufnr - dec) & QDIO_MAX_BUFFERS_MASK)
 
+#define queue_irqs_enabled(q)                   \
+        (test_bit(QDIO_QUEUE_IRQS_DISABLED, &q->u.in.queue_irq_state) == 0)
+#define queue_irqs_disabled(q)                  \
+        (test_bit(QDIO_QUEUE_IRQS_DISABLED, &q->u.in.queue_irq_state) != 0)
+
+#define TIQDIO_SHARED_IND               63
+
+/* device state change indicators */
+struct indicator_t {
+        u32 ind;        /* u32 because of compare-and-swap performance */
+        atomic_t count; /* use count, 0 or 1 for non-shared indicators */
+};
+
+extern struct indicator_t *q_indicators;
+
+static inline int shared_ind(struct qdio_irq *irq_ptr)
+{
+        return irq_ptr->dsci == &q_indicators[TIQDIO_SHARED_IND].ind;
+}
+
 /* prototypes for thin interrupt */
 void qdio_setup_thinint(struct qdio_irq *irq_ptr);
 int qdio_establish_thinint(struct qdio_irq *irq_ptr);
diff --git a/drivers/s390/cio/qdio_debug.c b/drivers/s390/cio/qdio_debug.c
index 6ce83f56d537..28868e7471a5 100644
--- a/drivers/s390/cio/qdio_debug.c
+++ b/drivers/s390/cio/qdio_debug.c
@@ -56,9 +56,16 @@ static int qstat_show(struct seq_file *m, void *v)
 
         seq_printf(m, "DSCI: %d   nr_used: %d\n",
                    *(u32 *)q->irq_ptr->dsci, atomic_read(&q->nr_buf_used));
-        seq_printf(m, "ftc: %d  last_move: %d\n", q->first_to_check, q->last_move);
-        seq_printf(m, "polling: %d  ack start: %d  ack count: %d\n",
-                   q->u.in.polling, q->u.in.ack_start, q->u.in.ack_count);
+        seq_printf(m, "ftc: %d  last_move: %d\n",
+                   q->first_to_check, q->last_move);
+        if (q->is_input_q) {
+                seq_printf(m, "polling: %d  ack start: %d  ack count: %d\n",
+                           q->u.in.polling, q->u.in.ack_start,
+                           q->u.in.ack_count);
+                seq_printf(m, "IRQs disabled: %u\n",
+                           test_bit(QDIO_QUEUE_IRQS_DISABLED,
+                           &q->u.in.queue_irq_state));
+        }
         seq_printf(m, "SBAL states:\n");
         seq_printf(m, "|0      |8      |16     |24     |32     |40     |48     |56  63|\n");
 
@@ -113,22 +120,6 @@ static int qstat_show(struct seq_file *m, void *v)
         return 0;
 }
 
-static ssize_t qstat_seq_write(struct file *file, const char __user *buf,
-                               size_t count, loff_t *off)
-{
-        struct seq_file *seq = file->private_data;
-        struct qdio_q *q = seq->private;
-
-        if (!q)
-                return 0;
-        if (q->is_input_q)
-                xchg(q->irq_ptr->dsci, 1);
-        local_bh_disable();
-        tasklet_schedule(&q->tasklet);
-        local_bh_enable();
-        return count;
-}
-
 static int qstat_seq_open(struct inode *inode, struct file *filp)
 {
         return single_open(filp, qstat_show,
@@ -139,7 +130,6 @@ static const struct file_operations debugfs_fops = {
         .owner   = THIS_MODULE,
         .open    = qstat_seq_open,
         .read    = seq_read,
-        .write   = qstat_seq_write,
         .llseek  = seq_lseek,
         .release = single_release,
 };
@@ -166,7 +156,8 @@ static char *qperf_names[] = {
         "QEBSM eqbs",
         "QEBSM eqbs partial",
         "QEBSM sqbs",
-        "QEBSM sqbs partial"
+        "QEBSM sqbs partial",
+        "Discarded interrupts"
 };
 
 static int qperf_show(struct seq_file *m, void *v)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 00520f9a7a8e..5fcfa7f9e9ef 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -884,8 +884,19 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
         if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
                 return;
 
-        for_each_input_queue(irq_ptr, q, i)
-                tasklet_schedule(&q->tasklet);
+        for_each_input_queue(irq_ptr, q, i) {
+                if (q->u.in.queue_start_poll) {
+                        /* skip if polling is enabled or already in work */
+                        if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+                                     &q->u.in.queue_irq_state)) {
+                                qperf_inc(q, int_discarded);
+                                continue;
+                        }
+                        q->u.in.queue_start_poll(q->irq_ptr->cdev, q->nr,
+                                                 q->irq_ptr->int_parm);
+                } else
+                        tasklet_schedule(&q->tasklet);
+        }
 
         if (!(irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED))
                 return;
@@ -1519,6 +1530,129 @@ int do_QDIO(struct ccw_device *cdev, unsigned int callflags,
 }
 EXPORT_SYMBOL_GPL(do_QDIO);
 
+/**
+ * qdio_start_irq - process input buffers
+ * @cdev: associated ccw_device for the qdio subchannel
+ * @nr: input queue number
+ *
+ * Return codes
+ *   0 - success
+ *   1 - irqs not started since new data is available
+ */
+int qdio_start_irq(struct ccw_device *cdev, int nr)
+{
+        struct qdio_q *q;
+        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+
+        if (!irq_ptr)
+                return -ENODEV;
+        q = irq_ptr->input_qs[nr];
+
+        WARN_ON(queue_irqs_enabled(q));
+
+        if (!shared_ind(q->irq_ptr))
+                xchg(q->irq_ptr->dsci, 0);
+
+        qdio_stop_polling(q);
+        clear_bit(QDIO_QUEUE_IRQS_DISABLED, &q->u.in.queue_irq_state);
+
+        /*
+         * We need to check again to not lose initiative after
+         * resetting the ACK state.
+         */
+        if (!shared_ind(q->irq_ptr) && *q->irq_ptr->dsci)
+                goto rescan;
+        if (!qdio_inbound_q_done(q))
+                goto rescan;
+        return 0;
+
+rescan:
+        if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+                             &q->u.in.queue_irq_state))
+                return 0;
+        else
+                return 1;
+
+}
+EXPORT_SYMBOL(qdio_start_irq);
+
+/**
+ * qdio_get_next_buffers - process input buffers
+ * @cdev: associated ccw_device for the qdio subchannel
+ * @nr: input queue number
+ * @bufnr: first filled buffer number
+ * @error: buffers are in error state
+ *
+ * Return codes
+ *   < 0 - error
+ *   = 0 - no new buffers found
+ *   > 0 - number of processed buffers
+ */
+int qdio_get_next_buffers(struct ccw_device *cdev, int nr, int *bufnr,
+                          int *error)
+{
+        struct qdio_q *q;
+        int start, end;
+        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+
+        if (!irq_ptr)
+                return -ENODEV;
+        q = irq_ptr->input_qs[nr];
+        WARN_ON(queue_irqs_enabled(q));
+
+        qdio_sync_after_thinint(q);
+
+        /*
+         * The interrupt could be caused by a PCI request. Check the
+         * PCI capable outbound queues.
+         */
+        qdio_check_outbound_after_thinint(q);
+
+        if (!qdio_inbound_q_moved(q))
+                return 0;
+
+        /* Note: upper-layer MUST stop processing immediately here ... */
+        if (unlikely(q->irq_ptr->state != QDIO_IRQ_STATE_ACTIVE))
+                return -EIO;
+
+        start = q->first_to_kick;
+        end = q->first_to_check;
+        *bufnr = start;
+        *error = q->qdio_error;
+
+        /* for the next time */
+        q->first_to_kick = end;
+        q->qdio_error = 0;
+        return sub_buf(end, start);
+}
+EXPORT_SYMBOL(qdio_get_next_buffers);
+
+/**
+ * qdio_stop_irq - disable interrupt processing for the device
+ * @cdev: associated ccw_device for the qdio subchannel
+ * @nr: input queue number
+ *
+ * Return codes
+ *   0 - interrupts were already disabled
+ *   1 - interrupts successfully disabled
+ */
+int qdio_stop_irq(struct ccw_device *cdev, int nr)
+{
+        struct qdio_q *q;
+        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+
+        if (!irq_ptr)
+                return -ENODEV;
+        q = irq_ptr->input_qs[nr];
+
+        if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+                             &q->u.in.queue_irq_state))
+                return 0;
+        else
+                return 1;
+}
+EXPORT_SYMBOL(qdio_stop_irq);
+
 static int __init init_QDIO(void)
 {
         int rc;
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 34c7e4046df4..a13cf7ec64b2 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -161,6 +161,7 @@ static void setup_queues(struct qdio_irq *irq_ptr,
                 setup_queues_misc(q, irq_ptr, qdio_init->input_handler, i);
 
                 q->is_input_q = 1;
+                q->u.in.queue_start_poll = qdio_init->queue_start_poll;
                 setup_storage_lists(q, irq_ptr, input_sbal_array, i);
                 input_sbal_array += QDIO_MAX_BUFFERS_PER_Q;
 
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 8daf1b99f153..752dbee06af5 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -25,24 +25,20 @@
  */
 #define TIQDIO_NR_NONSHARED_IND         63
 #define TIQDIO_NR_INDICATORS            (TIQDIO_NR_NONSHARED_IND + 1)
-#define TIQDIO_SHARED_IND               63
 
 /* list of thin interrupt input queues */
 static LIST_HEAD(tiq_list);
 DEFINE_MUTEX(tiq_list_lock);
 
 /* adapter local summary indicator */
-static unsigned char *tiqdio_alsi;
+static u8 *tiqdio_alsi;
 
-/* device state change indicators */
-struct indicator_t {
-        u32 ind;        /* u32 because of compare-and-swap performance */
-        atomic_t count; /* use count, 0 or 1 for non-shared indicators */
-};
-static struct indicator_t *q_indicators;
+struct indicator_t *q_indicators;
 
 static int css_qdio_omit_svs;
 
+static u64 last_ai_time;
+
 static inline unsigned long do_clear_global_summary(void)
 {
         register unsigned long __fn asm("1") = 3;
@@ -116,59 +112,73 @@ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
         }
 }
 
-static inline int shared_ind(struct qdio_irq *irq_ptr)
+static inline int shared_ind_used(void)
 {
-        return irq_ptr->dsci == &q_indicators[TIQDIO_SHARED_IND].ind;
+        return atomic_read(&q_indicators[TIQDIO_SHARED_IND].count);
 }
 
 /**
  * tiqdio_thinint_handler - thin interrupt handler for qdio
- * @ind: pointer to adapter local summary indicator
- * @drv_data: NULL
+ * @alsi: pointer to adapter local summary indicator
+ * @data: NULL
  */
-static void tiqdio_thinint_handler(void *ind, void *drv_data)
+static void tiqdio_thinint_handler(void *alsi, void *data)
 {
         struct qdio_q *q;
 
+        last_ai_time = S390_lowcore.int_clock;
+
         /*
          * SVS only when needed: issue SVS to benefit from iqdio interrupt
-         * avoidance (SVS clears adapter interrupt suppression overwrite)
+         * avoidance (SVS clears adapter interrupt suppression overwrite).
          */
         if (!css_qdio_omit_svs)
                 do_clear_global_summary();
 
-        /*
-         * reset local summary indicator (tiqdio_alsi) to stop adapter
-         * interrupts for now
-         */
-        xchg((u8 *)ind, 0);
+        /* reset local summary indicator */
+        if (shared_ind_used())
+                xchg(tiqdio_alsi, 0);
 
         /* protect tiq_list entries, only changed in activate or shutdown */
         rcu_read_lock();
 
         /* check for work on all inbound thinint queues */
-        list_for_each_entry_rcu(q, &tiq_list, entry)
+        list_for_each_entry_rcu(q, &tiq_list, entry) {
+
                 /* only process queues from changed sets */
-                if (*q->irq_ptr->dsci) {
-                        qperf_inc(q, adapter_int);
+                if (!*q->irq_ptr->dsci)
+                        continue;
 
+                if (q->u.in.queue_start_poll) {
+                        /* skip if polling is enabled or already in work */
+                        if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+                                             &q->u.in.queue_irq_state)) {
+                                qperf_inc(q, int_discarded);
+                                continue;
+                        }
+
+                        /* avoid dsci clear here, done after processing */
+                        q->u.in.queue_start_poll(q->irq_ptr->cdev, q->nr,
+                                                 q->irq_ptr->int_parm);
+                } else {
                         /* only clear it if the indicator is non-shared */
                         if (!shared_ind(q->irq_ptr))
                                 xchg(q->irq_ptr->dsci, 0);
                         /*
-                         * don't call inbound processing directly since
-                         * that could starve other thinint queues
+                         * Call inbound processing but not directly
+                         * since that could starve other thinint queues.
                          */
                         tasklet_schedule(&q->tasklet);
                 }
-
+                qperf_inc(q, adapter_int);
+        }
         rcu_read_unlock();
 
         /*
-         * if we used the shared indicator clear it now after all queues
-         * were processed
+         * If the shared indicator was used clear it now after all queues
+         * were processed.
          */
-        if (atomic_read(&q_indicators[TIQDIO_SHARED_IND].count)) {
+        if (shared_ind_used()) {
                 xchg(&q_indicators[TIQDIO_SHARED_IND].ind, 0);
 
                 /* prevent racing */
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 977bb4d4ed15..456b18743397 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -100,6 +100,6 @@ config QETH_IPV6
 
 config CCWGROUP
         tristate
-        default (LCS || CTCM || QETH)
+        default (LCS || CTCM || QETH || CLAW)
 
 endmenu
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index d1257768be90..6be43eb126b4 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -676,6 +676,7 @@ enum qeth_discipline_id {
 };
 
 struct qeth_discipline {
+        void (*start_poll)(struct ccw_device *, int, unsigned long);
         qdio_handler_t *input_handler;
         qdio_handler_t *output_handler;
         int (*recover)(void *ptr);
@@ -702,6 +703,16 @@ struct qeth_skb_data {
 #define QETH_SKB_MAGIC 0x71657468
 #define QETH_SIGA_CC2_RETRIES 3
 
+struct qeth_rx {
+        int b_count;
+        int b_index;
+        struct qdio_buffer_element *b_element;
+        int e_offset;
+        int qdio_err;
+};
+
+#define QETH_NAPI_WEIGHT 128
+
 struct qeth_card {
         struct list_head list;
         enum qeth_card_states state;
@@ -749,6 +760,8 @@ struct qeth_card {
         debug_info_t *debug;
         struct mutex conf_mutex;
         struct mutex discipline_mutex;
+        struct napi_struct napi;
+        struct qeth_rx rx;
 };
 
 struct qeth_card_list_struct {
@@ -831,6 +844,10 @@ struct sk_buff *qeth_core_get_next_skb(struct qeth_card *,
                 struct qdio_buffer *, struct qdio_buffer_element **, int *,
                 struct qeth_hdr **);
 void qeth_schedule_recovery(struct qeth_card *);
+void qeth_qdio_start_poll(struct ccw_device *, int, unsigned long);
+void qeth_qdio_input_handler(struct ccw_device *,
+                unsigned int, unsigned int, int,
+                int, unsigned long);
 void qeth_qdio_output_handler(struct ccw_device *, unsigned int,
                         int, int, int, unsigned long);
 void qeth_clear_ipacmd_list(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 3a5a18a0fc28..764267062601 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2911,6 +2911,27 @@ static void qeth_check_outbound_queue(struct qeth_qdio_out_q *queue)
         }
 }
 
+void qeth_qdio_start_poll(struct ccw_device *ccwdev, int queue,
+                unsigned long card_ptr)
+{
+        struct qeth_card *card = (struct qeth_card *)card_ptr;
+
+        if (card->dev)
+                napi_schedule(&card->napi);
+}
+EXPORT_SYMBOL_GPL(qeth_qdio_start_poll);
+
+void qeth_qdio_input_handler(struct ccw_device *ccwdev, unsigned int qdio_err,
+                unsigned int queue, int first_element, int count,
+                unsigned long card_ptr)
+{
+        struct qeth_card *card = (struct qeth_card *)card_ptr;
+
+        if (qdio_err)
+                qeth_schedule_recovery(card);
+}
+EXPORT_SYMBOL_GPL(qeth_qdio_input_handler);
+
 void qeth_qdio_output_handler(struct ccw_device *ccwdev,
                 unsigned int qdio_error, int __queue, int first_element,
                 int count, unsigned long card_ptr)
@@ -3843,6 +3864,7 @@ static int qeth_qdio_establish(struct qeth_card *card)
         init_data.no_output_qs           = card->qdio.no_out_queues;
         init_data.input_handler          = card->discipline.input_handler;
         init_data.output_handler         = card->discipline.output_handler;
+        init_data.queue_start_poll       = card->discipline.start_poll;
         init_data.int_parm               = (unsigned long) card;
         init_data.input_sbal_addr_array  = (void **) in_sbal_ptrs;
         init_data.output_sbal_addr_array = (void **) out_sbal_ptrs;
@@ -4513,8 +4535,8 @@ static struct {
 /* 20 */{"queue 1 buffer usage"},
         {"queue 2 buffer usage"},
         {"queue 3 buffer usage"},
-        {"rx handler time"},
-        {"rx handler count"},
+        {"rx poll time"},
+        {"rx poll count"},
         {"rx do_QDIO time"},
         {"rx do_QDIO count"},
         {"tx handler time"},
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 830d63524d61..01c3c1f77879 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -407,29 +407,25 @@ static int qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
         return rc;
 }
 
-static void qeth_l2_process_inbound_buffer(struct qeth_card *card,
-                            struct qeth_qdio_buffer *buf, int index)
+static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
+                                int budget, int *done)
 {
-        struct qdio_buffer_element *element;
+        int work_done = 0;
         struct sk_buff *skb;
         struct qeth_hdr *hdr;
-        int offset;
         unsigned int len;
 
-        /* get first element of current buffer */
-        element = (struct qdio_buffer_element *)&buf->buffer->element[0];
-        offset = 0;
-        if (card->options.performance_stats)
-                card->perf_stats.bufs_rec++;
-        while ((skb = qeth_core_get_next_skb(card, buf->buffer, &element,
-                                       &offset, &hdr))) {
-                skb->dev = card->dev;
-                /* is device UP ? */
-                if (!(card->dev->flags & IFF_UP)) {
-                        dev_kfree_skb_any(skb);
-                        continue;
+        *done = 0;
+        BUG_ON(!budget);
+        while (budget) {
+                skb = qeth_core_get_next_skb(card,
+                        card->qdio.in_q->bufs[card->rx.b_index].buffer,
+                        &card->rx.b_element, &card->rx.e_offset, &hdr);
+                if (!skb) {
+                        *done = 1;
+                        break;
                 }
-
+                skb->dev = card->dev;
                 switch (hdr->hdr.l2.id) {
                 case QETH_HEADER_TYPE_LAYER2:
                         skb->pkt_type = PACKET_HOST;
@@ -441,7 +437,7 @@ static void qeth_l2_process_inbound_buffer(struct qeth_card *card,
                         if (skb->protocol == htons(ETH_P_802_2))
                                 *((__u32 *)skb->cb) = ++card->seqno.pkt_seqno;
                         len = skb->len;
-                        netif_rx(skb);
+                        netif_receive_skb(skb);
                         break;
                 case QETH_HEADER_TYPE_OSN:
                         if (card->info.type == QETH_CARD_TYPE_OSN) {
@@ -459,9 +455,87 @@ static void qeth_l2_process_inbound_buffer(struct qeth_card *card,
                         QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
                         continue;
                 }
+                work_done++;
+                budget--;
                 card->stats.rx_packets++;
                 card->stats.rx_bytes += len;
         }
+        return work_done;
+}
+
+static int qeth_l2_poll(struct napi_struct *napi, int budget)
+{
+        struct qeth_card *card = container_of(napi, struct qeth_card, napi);
+        int work_done = 0;
+        struct qeth_qdio_buffer *buffer;
+        int done;
+        int new_budget = budget;
+
+        if (card->options.performance_stats) {
+                card->perf_stats.inbound_cnt++;
+                card->perf_stats.inbound_start_time = qeth_get_micros();
+        }
+
+        while (1) {
+                if (!card->rx.b_count) {
+                        card->rx.qdio_err = 0;
+                        card->rx.b_count = qdio_get_next_buffers(
+                                card->data.ccwdev, 0, &card->rx.b_index,
+                                &card->rx.qdio_err);
+                        if (card->rx.b_count <= 0) {
+                                card->rx.b_count = 0;
+                                break;
+                        }
+                        card->rx.b_element =
+                                &card->qdio.in_q->bufs[card->rx.b_index]
+                                .buffer->element[0];
+                        card->rx.e_offset = 0;
+                }
+
+                while (card->rx.b_count) {
+                        buffer = &card->qdio.in_q->bufs[card->rx.b_index];
+                        if (!(card->rx.qdio_err &&
+                            qeth_check_qdio_errors(card, buffer->buffer,
+                            card->rx.qdio_err, "qinerr")))
+                                work_done += qeth_l2_process_inbound_buffer(
+                                        card, new_budget, &done);
+                        else
+                                done = 1;
+
+                        if (done) {
+                                if (card->options.performance_stats)
+                                        card->perf_stats.bufs_rec++;
+                                qeth_put_buffer_pool_entry(card,
+                                        buffer->pool_entry);
+                                qeth_queue_input_buffer(card, card->rx.b_index);
+                                card->rx.b_count--;
+                                if (card->rx.b_count) {
+                                        card->rx.b_index =
+                                                (card->rx.b_index + 1) %
+                                                QDIO_MAX_BUFFERS_PER_Q;
+                                        card->rx.b_element =
+                                                &card->qdio.in_q
+                                                ->bufs[card->rx.b_index]
+                                                .buffer->element[0];
+                                        card->rx.e_offset = 0;
+                                }
+                        }
+
+                        if (work_done >= budget)
+                                goto out;
+                        else
+                                new_budget = budget - work_done;
+                }
+        }
+
+        napi_complete(napi);
+        if (qdio_start_irq(card->data.ccwdev, 0))
+                napi_schedule(&card->napi);
+out:
+        if (card->options.performance_stats)
+                card->perf_stats.inbound_time += qeth_get_micros() -
+                        card->perf_stats.inbound_start_time;
+        return work_done;
 }
 
 static int qeth_l2_send_setdelmac(struct qeth_card *card, __u8 *mac,
@@ -755,49 +829,10 @@ tx_drop:
         return NETDEV_TX_OK;
 }
 
-static void qeth_l2_qdio_input_handler(struct ccw_device *ccwdev,
-                        unsigned int qdio_err, unsigned int queue,
-                        int first_element, int count, unsigned long card_ptr)
-{
-        struct net_device *net_dev;
-        struct qeth_card *card;
-        struct qeth_qdio_buffer *buffer;
-        int index;
-        int i;
-
-        card = (struct qeth_card *) card_ptr;
-        net_dev = card->dev;
-        if (card->options.performance_stats) {
-                card->perf_stats.inbound_cnt++;
-                card->perf_stats.inbound_start_time = qeth_get_micros();
-        }
-        if (qdio_err & QDIO_ERROR_ACTIVATE_CHECK_CONDITION) {
-                QETH_CARD_TEXT(card, 1, "qdinchk");
-                QETH_CARD_TEXT_(card, 1, "%04X%04X", first_element,
-                                count);
-                QETH_CARD_TEXT_(card, 1, "%04X", queue);
-                qeth_schedule_recovery(card);
-                return;
-        }
-        for (i = first_element; i < (first_element + count); ++i) {
-                index = i % QDIO_MAX_BUFFERS_PER_Q;
-                buffer = &card->qdio.in_q->bufs[index];
-                if (!(qdio_err &&
-                      qeth_check_qdio_errors(card, buffer->buffer, qdio_err,
-                                             "qinerr")))
-                        qeth_l2_process_inbound_buffer(card, buffer, index);
-                /* clear buffer and give back to hardware */
-                qeth_put_buffer_pool_entry(card, buffer->pool_entry);
-                qeth_queue_input_buffer(card, index);
-        }
-        if (card->options.performance_stats)
-                card->perf_stats.inbound_time += qeth_get_micros() -
-                        card->perf_stats.inbound_start_time;
-}
-
 static int qeth_l2_open(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
+        int rc = 0;
 
         QETH_CARD_TEXT(card, 4, "qethopen");
         if (card->state != CARD_STATE_SOFTSETUP)
@@ -814,18 +849,24 @@ static int qeth_l2_open(struct net_device *dev)
 
         if (!card->lan_online && netif_carrier_ok(dev))
                 netif_carrier_off(dev);
-        return 0;
+        if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+                napi_enable(&card->napi);
+                napi_schedule(&card->napi);
+        } else
+                rc = -EIO;
+        return rc;
 }
 
-
 static int qeth_l2_stop(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
 
         QETH_CARD_TEXT(card, 4, "qethstop");
         netif_tx_disable(dev);
-        if (card->state == CARD_STATE_UP)
+        if (card->state == CARD_STATE_UP) {
                 card->state = CARD_STATE_SOFTSETUP;
+                napi_disable(&card->napi);
+        }
         return 0;
 }
 
@@ -836,8 +877,9 @@ static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
         INIT_LIST_HEAD(&card->vid_list);
         INIT_LIST_HEAD(&card->mc_list);
         card->options.layer2 = 1;
+        card->discipline.start_poll = qeth_qdio_start_poll;
         card->discipline.input_handler = (qdio_handler_t *)
-                qeth_l2_qdio_input_handler;
+                qeth_qdio_input_handler;
         card->discipline.output_handler = (qdio_handler_t *)
                 qeth_qdio_output_handler;
         card->discipline.recover = qeth_l2_recover;
@@ -923,6 +965,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         card->info.broadcast_capable = 1;
         qeth_l2_request_initial_mac(card);
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
+        netif_napi_add(card->dev, &card->napi, qeth_l2_poll, QETH_NAPI_WEIGHT);
         return register_netdev(card->dev);
 }
 
@@ -955,6 +998,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 qeth_l2_send_setmac(card, &card->dev->dev_addr[0]);
 
         card->state = CARD_STATE_HARDSETUP;
+        memset(&card->rx, 0, sizeof(struct qeth_rx));
         qeth_print_status_message(card);
 
         /* softsetup */
@@ -1086,9 +1130,6 @@ static int qeth_l2_recover(void *ptr)
         card->use_hard_stop = 1;
         __qeth_l2_set_offline(card->gdev, 1);
         rc = __qeth_l2_set_online(card->gdev, 1);
-        /* don't run another scheduled recovery */
-        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
-        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         if (!rc)
                 dev_info(&card->gdev->dev,
                         "Device successfully recovered!\n");
@@ -1099,6 +1140,8 @@ static int qeth_l2_recover(void *ptr)
                 dev_warn(&card->gdev->dev, "The qeth device driver "
                         "failed to recover an error on the device\n");
         }
+        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
+        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         return 0;
 }
 
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index e22ae248f613..5b79f573bd93 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -103,12 +103,7 @@ int qeth_l3_string_to_ipaddr4(const char *buf, __u8 *addr)
 
 void qeth_l3_ipaddr6_to_string(const __u8 *addr, char *buf)
 {
-        sprintf(buf, "%02x%02x:%02x%02x:%02x%02x:%02x%02x"
-                     ":%02x%02x:%02x%02x:%02x%02x:%02x%02x",
-                     addr[0], addr[1], addr[2], addr[3],
-                     addr[4], addr[5], addr[6], addr[7],
-                     addr[8], addr[9], addr[10], addr[11],
-                     addr[12], addr[13], addr[14], addr[15]);
+        sprintf(buf, "%pI6", addr);
 }
 
 int qeth_l3_string_to_ipaddr6(const char *buf, __u8 *addr)
@@ -2112,51 +2107,44 @@ static inline __u16 qeth_l3_rebuild_skb(struct qeth_card *card,
         return vlan_id;
 }
 
-static void qeth_l3_process_inbound_buffer(struct qeth_card *card,
-                            struct qeth_qdio_buffer *buf, int index)
+static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
+                                int budget, int *done)
 {
-        struct qdio_buffer_element *element;
+        int work_done = 0;
         struct sk_buff *skb;
         struct qeth_hdr *hdr;
-        int offset;
         __u16 vlan_tag = 0;
         unsigned int len;
-        /* get first element of current buffer */
-        element = (struct qdio_buffer_element *)&buf->buffer->element[0];
-        offset = 0;
-        if (card->options.performance_stats)
-                card->perf_stats.bufs_rec++;
-        while ((skb = qeth_core_get_next_skb(card, buf->buffer, &element,
-                                       &offset, &hdr))) {
-                skb->dev = card->dev;
-                /* is device UP ? */
-                if (!(card->dev->flags & IFF_UP)) {
-                        dev_kfree_skb_any(skb);
-                        continue;
-                }
 
+        *done = 0;
+        BUG_ON(!budget);
+        while (budget) {
+                skb = qeth_core_get_next_skb(card,
+                        card->qdio.in_q->bufs[card->rx.b_index].buffer,
+                        &card->rx.b_element, &card->rx.e_offset, &hdr);
+                if (!skb) {
+                        *done = 1;
+                        break;
+                }
+                skb->dev = card->dev;
                 switch (hdr->hdr.l3.id) {
                 case QETH_HEADER_TYPE_LAYER3:
                         vlan_tag = qeth_l3_rebuild_skb(card, skb, hdr);
                         len = skb->len;
                         if (vlan_tag && !card->options.sniffer)
                                 if (card->vlangrp)
-                                        vlan_hwaccel_rx(skb, card->vlangrp,
-                                                vlan_tag);
+                                        vlan_gro_receive(&card->napi,
+                                                card->vlangrp, vlan_tag, skb);
                                 else {
                                         dev_kfree_skb_any(skb);
                                         continue;
                                 }
                         else
-                                netif_rx(skb);
+                                napi_gro_receive(&card->napi, skb);
                         break;
                 case QETH_HEADER_TYPE_LAYER2: /* for HiperSockets sniffer */
                         skb->pkt_type = PACKET_HOST;
                         skb->protocol = eth_type_trans(skb, skb->dev);
-                        if (card->options.checksum_type == NO_CHECKSUMMING)
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        else
-                                skb->ip_summed = CHECKSUM_NONE;
                         len = skb->len;
                         netif_receive_skb(skb);
                         break;
@@ -2166,10 +2154,87 @@ static void qeth_l3_process_inbound_buffer(struct qeth_card *card,
                         QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
                         continue;
                 }
-
+                work_done++;
+                budget--;
                 card->stats.rx_packets++;
                 card->stats.rx_bytes += len;
         }
+        return work_done;
+}
+
+static int qeth_l3_poll(struct napi_struct *napi, int budget)
+{
+        struct qeth_card *card = container_of(napi, struct qeth_card, napi);
+        int work_done = 0;
+        struct qeth_qdio_buffer *buffer;
+        int done;
+        int new_budget = budget;
+
+        if (card->options.performance_stats) {
+                card->perf_stats.inbound_cnt++;
+                card->perf_stats.inbound_start_time = qeth_get_micros();
+        }
+
+        while (1) {
+                if (!card->rx.b_count) {
+                        card->rx.qdio_err = 0;
+                        card->rx.b_count = qdio_get_next_buffers(
+                                card->data.ccwdev, 0, &card->rx.b_index,
+                                &card->rx.qdio_err);
+                        if (card->rx.b_count <= 0) {
+                                card->rx.b_count = 0;
+                                break;
+                        }
+                        card->rx.b_element =
+                                &card->qdio.in_q->bufs[card->rx.b_index]
+                                .buffer->element[0];
+                        card->rx.e_offset = 0;
+                }
+
+                while (card->rx.b_count) {
+                        buffer = &card->qdio.in_q->bufs[card->rx.b_index];
+                        if (!(card->rx.qdio_err &&
+                            qeth_check_qdio_errors(card, buffer->buffer,
+                            card->rx.qdio_err, "qinerr")))
+                                work_done += qeth_l3_process_inbound_buffer(
+                                        card, new_budget, &done);
+                        else
+                                done = 1;
+
+                        if (done) {
+                                if (card->options.performance_stats)
+                                        card->perf_stats.bufs_rec++;
+                                qeth_put_buffer_pool_entry(card,
+                                        buffer->pool_entry);
+                                qeth_queue_input_buffer(card, card->rx.b_index);
+                                card->rx.b_count--;
+                                if (card->rx.b_count) {
+                                        card->rx.b_index =
+                                                (card->rx.b_index + 1) %
+                                                QDIO_MAX_BUFFERS_PER_Q;
+                                        card->rx.b_element =
+                                                &card->qdio.in_q
+                                                ->bufs[card->rx.b_index]
+                                                .buffer->element[0];
+                                        card->rx.e_offset = 0;
+                                }
+                        }
+
+                        if (work_done >= budget)
+                                goto out;
+                        else
+                                new_budget = budget - work_done;
+                }
+        }
+
+        napi_complete(napi);
+        if (qdio_start_irq(card->data.ccwdev, 0))
+                napi_schedule(&card->napi);
+out:
+        if (card->options.performance_stats)
+                card->perf_stats.inbound_time += qeth_get_micros() -
+                        card->perf_stats.inbound_start_time;
+        return work_done;
 }
 
 static int qeth_l3_verify_vlan_dev(struct net_device *dev,
@@ -3103,6 +3168,7 @@ tx_drop:
 static int qeth_l3_open(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
+        int rc = 0;
 
         QETH_CARD_TEXT(card, 4, "qethopen");
         if (card->state != CARD_STATE_SOFTSETUP)
@@ -3113,7 +3179,12 @@ static int qeth_l3_open(struct net_device *dev)
 
         if (!card->lan_online && netif_carrier_ok(dev))
                 netif_carrier_off(dev);
-        return 0;
+        if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+                napi_enable(&card->napi);
+                napi_schedule(&card->napi);
+        } else
+                rc = -EIO;
+        return rc;
 }
 
 static int qeth_l3_stop(struct net_device *dev)
@@ -3122,8 +3193,10 @@ static int qeth_l3_stop(struct net_device *dev)
 
         QETH_CARD_TEXT(card, 4, "qethstop");
         netif_tx_disable(dev);
-        if (card->state == CARD_STATE_UP)
+        if (card->state == CARD_STATE_UP) {
                 card->state = CARD_STATE_SOFTSETUP;
+                napi_disable(&card->napi);
+        }
         return 0;
 }
 
@@ -3293,57 +3366,19 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
         card->dev->gso_max_size = 15 * PAGE_SIZE;
 
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
+        netif_napi_add(card->dev, &card->napi, qeth_l3_poll, QETH_NAPI_WEIGHT);
         return register_netdev(card->dev);
 }
 
-static void qeth_l3_qdio_input_handler(struct ccw_device *ccwdev,
-                unsigned int qdio_err, unsigned int queue, int first_element,
-                int count, unsigned long card_ptr)
-{
-        struct net_device *net_dev;
-        struct qeth_card *card;
-        struct qeth_qdio_buffer *buffer;
-        int index;
-        int i;
-
-        card = (struct qeth_card *) card_ptr;
-        net_dev = card->dev;
-        if (card->options.performance_stats) {
-                card->perf_stats.inbound_cnt++;
-                card->perf_stats.inbound_start_time = qeth_get_micros();
-        }
-        if (qdio_err & QDIO_ERROR_ACTIVATE_CHECK_CONDITION) {
-                QETH_CARD_TEXT(card, 1, "qdinchk");
-                QETH_CARD_TEXT_(card, 1, "%04X%04X",
-                                first_element, count);
-                QETH_CARD_TEXT_(card, 1, "%04X", queue);
-                qeth_schedule_recovery(card);
-                return;
-        }
-        for (i = first_element; i < (first_element + count); ++i) {
-                index = i % QDIO_MAX_BUFFERS_PER_Q;
-                buffer = &card->qdio.in_q->bufs[index];
-                if (!(qdio_err &&
-                      qeth_check_qdio_errors(card, buffer->buffer,
-                                             qdio_err, "qinerr")))
-                        qeth_l3_process_inbound_buffer(card, buffer, index);
-                /* clear buffer and give back to hardware */
-                qeth_put_buffer_pool_entry(card, buffer->pool_entry);
-                qeth_queue_input_buffer(card, index);
-        }
-        if (card->options.performance_stats)
-                card->perf_stats.inbound_time += qeth_get_micros() -
-                        card->perf_stats.inbound_start_time;
-}
-
 static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
 
         qeth_l3_create_device_attributes(&gdev->dev);
         card->options.layer2 = 0;
+        card->discipline.start_poll = qeth_qdio_start_poll;
         card->discipline.input_handler = (qdio_handler_t *)
-                qeth_l3_qdio_input_handler;
+                qeth_qdio_input_handler;
         card->discipline.output_handler = (qdio_handler_t *)
                 qeth_qdio_output_handler;
         card->discipline.recover = qeth_l3_recover;
@@ -3402,6 +3437,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         }
 
         card->state = CARD_STATE_HARDSETUP;
+        memset(&card->rx, 0, sizeof(struct qeth_rx));
         qeth_print_status_message(card);
 
         /* softsetup */
@@ -3538,9 +3574,6 @@ static int qeth_l3_recover(void *ptr)
         card->use_hard_stop = 1;
         __qeth_l3_set_offline(card->gdev, 1);
         rc = __qeth_l3_set_online(card->gdev, 1);
-        /* don't run another scheduled recovery */
-        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
-        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         if (!rc)
                 dev_info(&card->gdev->dev,
                         "Device successfully recovered!\n");
@@ -3551,6 +3584,8 @@ static int qeth_l3_recover(void *ptr)
                 dev_warn(&card->gdev->dev, "The qeth device driver "
                         "failed to recover an error on the device\n");
         }
+        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
+        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index b2635759721c..da54a28a1b87 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -277,16 +277,12 @@ int zfcp_qdio_send(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req)
 static void zfcp_qdio_setup_init_data(struct qdio_initialize *id,
                                       struct zfcp_qdio *qdio)
 {
-
+        memset(id, 0, sizeof(*id));
         id->cdev = qdio->adapter->ccw_device;
         id->q_format = QDIO_ZFCP_QFMT;
         memcpy(id->adapter_name, dev_name(&id->cdev->dev), 8);
         ASCEBC(id->adapter_name, 8);
         id->qib_rflags = QIB_RFLAGS_ENABLE_DATA_DIV;
-        id->qib_param_field_format = 0;
-        id->qib_param_field = NULL;
-        id->input_slib_elements = NULL;
-        id->output_slib_elements = NULL;
         id->no_input_qs = 1;
         id->no_output_qs = 1;
         id->input_handler = zfcp_qdio_int_resp;
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 5af23cc5ea9f..f383cb42b1d7 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -1344,8 +1344,24 @@ static struct usbatm_driver cxacru_driver = {
         .tx_padding     = 11,
 };
 
-static int cxacru_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+static int cxacru_usb_probe(struct usb_interface *intf,
+                const struct usb_device_id *id)
 {
+        struct usb_device *usb_dev = interface_to_usbdev(intf);
+        char buf[15];
+
+        /* Avoid ADSL routers (cx82310_eth).
+         * Abort if bDeviceClass is 0xff and iProduct is "USB NET CARD".
+         */
+        if (usb_dev->descriptor.bDeviceClass == USB_CLASS_VENDOR_SPEC
+                        && usb_string(usb_dev, usb_dev->descriptor.iProduct,
+                                buf, sizeof(buf)) > 0) {
+                if (!strcmp(buf, "USB NET CARD")) {
+                        dev_info(&intf->dev, "ignoring cx82310_eth device\n");
+                        return -ENODEV;
+                }
+        }
+
         return usbatm_usb_probe(intf, id, &cxacru_driver);
 }
 
diff --git a/drivers/uwb/address.c b/drivers/uwb/address.c
index 973321327c44..8739c4f4d015 100644
--- a/drivers/uwb/address.c
+++ b/drivers/uwb/address.c
@@ -363,10 +363,7 @@ size_t __uwb_addr_print(char *buf, size_t buf_size, const unsigned char *addr,
 {
         size_t result;
         if (type)
-                result = scnprintf(buf, buf_size,
-                                  "%02x:%02x:%02x:%02x:%02x:%02x",
-                                  addr[0], addr[1], addr[2],
-                                  addr[3], addr[4], addr[5]);
+                result = scnprintf(buf, buf_size, "%pM", addr);
         else
                 result = scnprintf(buf, buf_size, "%02x:%02x",
                                   addr[1], addr[0]);
diff --git a/drivers/uwb/wlp/wss-lc.c b/drivers/uwb/wlp/wss-lc.c
index a005d2a03b5d..67872c83b679 100644
--- a/drivers/uwb/wlp/wss-lc.c
+++ b/drivers/uwb/wlp/wss-lc.c
@@ -791,11 +791,8 @@ int wlp_wss_prep_hdr(struct wlp *wlp, struct wlp_eda_node *eda_entry,
         } else {
                 if (printk_ratelimit())
                         dev_err(dev, "WLP: Destination neighbor (Ethernet: "
-                                "%02x:%02x:%02x:%02x:%02x:%02x, Dev: "
-                                "%02x:%02x) is not connected. \n", eth_addr[0],
-                                eth_addr[1], eth_addr[2], eth_addr[3],
-                                eth_addr[4], eth_addr[5], dev_addr->data[1],
-                                dev_addr->data[0]);
+                                "%pM, Dev: %02x:%02x) is not connected.\n",
+                                eth_addr, dev_addr->data[1], dev_addr->data[0]);
                 result = -EINVAL;
         }
         return result;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 626b629429ff..c7fbf298ad68 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -302,6 +302,7 @@ header-y += quota.h
 header-y += radeonfb.h
 header-y += random.h
 header-y += raw.h
+header-y += rds.h
 header-y += reboot.h
 header-y += reiserfs_fs.h
 header-y += reiserfs_xattr.h
diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index f6481daf6e52..a8e4e832cdbb 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -449,7 +449,7 @@ void vcc_insert_socket(struct sock *sk);
 
 static inline int atm_guess_pdu2truesize(int size)
 {
-        return (SKB_DATA_ALIGN(size) + sizeof(struct skb_shared_info));
+        return SKB_DATA_ALIGN(size) + sizeof(struct skb_shared_info);
 }
 
 
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 7434a8353e23..7187bd8a75f6 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -165,8 +165,10 @@ enum {
         DCCPO_TIMESTAMP_ECHO = 42,
         DCCPO_ELAPSED_TIME = 43,
         DCCPO_MAX = 45,
-        DCCPO_MIN_CCID_SPECIFIC = 128,
-        DCCPO_MAX_CCID_SPECIFIC = 255,
+        DCCPO_MIN_RX_CCID_SPECIFIC = 128,       /* from sender to receiver */
+        DCCPO_MAX_RX_CCID_SPECIFIC = 191,
+        DCCPO_MIN_TX_CCID_SPECIFIC = 192,       /* from receiver to sender */
+        DCCPO_MAX_TX_CCID_SPECIFIC = 255,
 };
 /* maximum size of a single TLV-encoded DCCP option (sans type/len bytes) */
 #define DCCP_SINGLE_OPT_MAXLEN  253
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 2308fbb4523a..f16a01081e15 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -71,7 +71,7 @@ static inline int is_zero_ether_addr(const u8 *addr)
  */
 static inline int is_multicast_ether_addr(const u8 *addr)
 {
-        return (0x01 & addr[0]);
+        return 0x01 & addr[0];
 }
 
 /**
@@ -82,7 +82,7 @@ static inline int is_multicast_ether_addr(const u8 *addr)
  */
 static inline int is_local_ether_addr(const u8 *addr)
 {
-        return (0x02 & addr[0]);
+        return 0x02 & addr[0];
 }
 
 /**
@@ -237,13 +237,29 @@ static inline bool is_etherdev_addr(const struct net_device *dev,
  * entry points.
  */
 
-static inline int compare_ether_header(const void *a, const void *b)
+static inline unsigned long compare_ether_header(const void *a, const void *b)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        unsigned long fold;
+
+        /*
+         * We want to compare 14 bytes:
+         *  [a0 ... a13] ^ [b0 ... b13]
+         * Use two long XOR, ORed together, with an overlap of two bytes.
+         *  [a0  a1  a2  a3  a4  a5  a6  a7 ] ^ [b0  b1  b2  b3  b4  b5  b6  b7 ] |
+         *  [a6  a7  a8  a9  a10 a11 a12 a13] ^ [b6  b7  b8  b9  b10 b11 b12 b13]
+         * This means the [a6 a7] ^ [b6 b7] part is done two times.
+        */
+        fold = *(unsigned long *)a ^ *(unsigned long *)b;
+        fold |= *(unsigned long *)(a + 6) ^ *(unsigned long *)(b + 6);
+        return fold;
+#else
         u32 *a32 = (u32 *)((u8 *)a + 2);
         u32 *b32 = (u32 *)((u8 *)b + 2);
 
         return (*(u16 *)a ^ *(u16 *)b) | (a32[0] ^ b32[0]) |
                (a32[1] ^ b32[1]) | (a32[2] ^ b32[2]);
+#endif
 }
 
 #endif  /* _LINUX_ETHERDEVICE_H */
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 991269e5b152..8a3338ceb438 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -14,6 +14,7 @@
 #define _LINUX_ETHTOOL_H
 
 #include <linux/types.h>
+#include <linux/if_ether.h>
 
 /* This should work for both 32 and 64 bit userland. */
 struct ethtool_cmd {
@@ -314,9 +315,20 @@ enum ethtool_flags {
 };
 
 /* The following structures are for supporting RX network flow
- * classification configuration. Note, all multibyte fields, e.g.,
- * ip4src, ip4dst, psrc, pdst, spi, etc. are expected to be in network
- * byte order.
+ * classification and RX n-tuple configuration. Note, all multibyte
+ * fields, e.g., ip4src, ip4dst, psrc, pdst, spi, etc. are expected to
+ * be in network byte order.
+ */
+
+/**
+ * struct ethtool_tcpip4_spec - flow specification for TCP/IPv4 etc.
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @psrc: Source port
+ * @pdst: Destination port
+ * @tos: Type-of-service
+ *
+ * This can be used to specify a TCP/IPv4, UDP/IPv4 or SCTP/IPv4 flow.
  */
 struct ethtool_tcpip4_spec {
         __be32  ip4src;
@@ -326,6 +338,15 @@ struct ethtool_tcpip4_spec {
         __u8    tos;
 };
 
+/**
+ * struct ethtool_ah_espip4_spec - flow specification for IPsec/IPv4
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @spi: Security parameters index
+ * @tos: Type-of-service
+ *
+ * This can be used to specify an IPsec transport or tunnel over IPv4.
+ */
 struct ethtool_ah_espip4_spec {
         __be32  ip4src;
         __be32  ip4dst;
@@ -333,21 +354,17 @@ struct ethtool_ah_espip4_spec {
         __u8    tos;
 };
 
-struct ethtool_rawip4_spec {
-        __be32  ip4src;
-        __be32  ip4dst;
-        __u8    hdata[64];
-};
-
-struct ethtool_ether_spec {
-        __be16  ether_type;
-        __u8    frame_size;
-        __u8    eframe[16];
-};
-
 #define ETH_RX_NFC_IP4  1
-#define ETH_RX_NFC_IP6  2
 
+/**
+ * struct ethtool_usrip4_spec - general flow specification for IPv4
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @l4_4_bytes: First 4 bytes of transport (layer 4) header
+ * @tos: Type-of-service
+ * @ip_ver: Value must be %ETH_RX_NFC_IP4; mask must be 0
+ * @proto: Transport protocol number; mask must be 0
+ */
 struct ethtool_usrip4_spec {
         __be32  ip4src;
         __be32  ip4dst;
@@ -357,6 +374,15 @@ struct ethtool_usrip4_spec {
         __u8    proto;
 };
 
+/**
+ * struct ethtool_rx_flow_spec - specification for RX flow filter
+ * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
+ * @h_u: Flow fields to match (dependent on @flow_type)
+ * @m_u: Masks for flow field bits to be ignored
+ * @ring_cookie: RX ring/queue index to deliver to, or %RX_CLS_FLOW_DISC
+ *      if packets should be discarded
+ * @location: Index of filter in hardware table
+ */
 struct ethtool_rx_flow_spec {
         __u32           flow_type;
         union {
@@ -365,36 +391,91 @@ struct ethtool_rx_flow_spec {
                 struct ethtool_tcpip4_spec              sctp_ip4_spec;
                 struct ethtool_ah_espip4_spec           ah_ip4_spec;
                 struct ethtool_ah_espip4_spec           esp_ip4_spec;
-                struct ethtool_rawip4_spec              raw_ip4_spec;
-                struct ethtool_ether_spec               ether_spec;
                 struct ethtool_usrip4_spec              usr_ip4_spec;
-                __u8                                    hdata[64];
-        } h_u, m_u; /* entry, mask */
+                struct ethhdr                           ether_spec;
+                __u8                                    hdata[72];
+        } h_u, m_u;
         __u64           ring_cookie;
         __u32           location;
 };
 
+/**
+ * struct ethtool_rxnfc - command to get or set RX flow classification rules
+ * @cmd: Specific command number - %ETHTOOL_GRXFH, %ETHTOOL_SRXFH,
+ *      %ETHTOOL_GRXRINGS, %ETHTOOL_GRXCLSRLCNT, %ETHTOOL_GRXCLSRULE,
+ *      %ETHTOOL_GRXCLSRLALL, %ETHTOOL_SRXCLSRLDEL or %ETHTOOL_SRXCLSRLINS
+ * @flow_type: Type of flow to be affected, e.g. %TCP_V4_FLOW
+ * @data: Command-dependent value
+ * @fs: Flow filter specification
+ * @rule_cnt: Number of rules to be affected
+ * @rule_locs: Array of valid rule indices
+ *
+ * For %ETHTOOL_GRXFH and %ETHTOOL_SRXFH, @data is a bitmask indicating
+ * the fields included in the flow hash, e.g. %RXH_IP_SRC.  The following
+ * structure fields must not be used.
+ *
+ * For %ETHTOOL_GRXRINGS, @data is set to the number of RX rings/queues
+ * on return.
+ *
+ * For %ETHTOOL_GRXCLSRLCNT, @rule_cnt is set to the number of defined
+ * rules on return.
+ *
+ * For %ETHTOOL_GRXCLSRULE, @fs.@location specifies the index of an
+ * existing filter rule on entry and @fs contains the rule on return.
+ *
+ * For %ETHTOOL_GRXCLSRLALL, @rule_cnt specifies the array size of the
+ * user buffer for @rule_locs on entry.  On return, @data is the size
+ * of the filter table and @rule_locs contains the indices of the
+ * defined rules.
+ *
+ * For %ETHTOOL_SRXCLSRLINS, @fs specifies the filter rule to add or
+ * update.  @fs.@location specifies the index to use and must not be
+ * ignored.
+ *
+ * For %ETHTOOL_SRXCLSRLDEL, @fs.@location specifies the index of an
+ * existing filter rule on entry.
+ *
+ * Implementation of indexed classification rules generally requires a
+ * TCAM.
+ */
 struct ethtool_rxnfc {
         __u32                           cmd;
         __u32                           flow_type;
-        /* The rx flow hash value or the rule DB size */
         __u64                           data;
-        /* The following fields are not valid and must not be used for
-         * the ETHTOOL_{G,X}RXFH commands. */
         struct ethtool_rx_flow_spec     fs;
         __u32                           rule_cnt;
         __u32                           rule_locs[0];
 };
 
+/**
+ * struct ethtool_rxfh_indir - command to get or set RX flow hash indirection
+ * @cmd: Specific command number - %ETHTOOL_GRXFHINDIR or %ETHTOOL_SRXFHINDIR
+ * @size: On entry, the array size of the user buffer.  On return from
+ *      %ETHTOOL_GRXFHINDIR, the array size of the hardware indirection table.
+ * @ring_index: RX ring/queue index for each hash value
+ */
 struct ethtool_rxfh_indir {
         __u32   cmd;
-        /* On entry, this is the array size of the user buffer.  On
-         * return from ETHTOOL_GRXFHINDIR, this is the array size of
-         * the hardware indirection table. */
         __u32   size;
-        __u32   ring_index[0];  /* ring/queue index for each hash value */
+        __u32   ring_index[0];
 };
 
+/**
+ * struct ethtool_rx_ntuple_flow_spec - specification for RX flow filter
+ * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
+ * @h_u: Flow field values to match (dependent on @flow_type)
+ * @m_u: Masks for flow field value bits to be ignored
+ * @vlan_tag: VLAN tag to match
+ * @vlan_tag_mask: Mask for VLAN tag bits to be ignored
+ * @data: Driver-dependent data to match
+ * @data_mask: Mask for driver-dependent data bits to be ignored
+ * @action: RX ring/queue index to deliver to (non-negative) or other action
+ *      (negative, e.g. %ETHTOOL_RXNTUPLE_ACTION_DROP)
+ *
+ * For flow types %TCP_V4_FLOW, %UDP_V4_FLOW and %SCTP_V4_FLOW, where
+ * a field value and mask are both zero this is treated as if all mask
+ * bits are set i.e. the field is ignored.
+ */
 struct ethtool_rx_ntuple_flow_spec {
         __u32            flow_type;
         union {
@@ -403,22 +484,26 @@ struct ethtool_rx_ntuple_flow_spec {
                 struct ethtool_tcpip4_spec              sctp_ip4_spec;
                 struct ethtool_ah_espip4_spec           ah_ip4_spec;
                 struct ethtool_ah_espip4_spec           esp_ip4_spec;
-                struct ethtool_rawip4_spec              raw_ip4_spec;
-                struct ethtool_ether_spec               ether_spec;
                 struct ethtool_usrip4_spec              usr_ip4_spec;
-                __u8                                    hdata[64];
-        } h_u, m_u; /* entry, mask */
+                struct ethhdr                           ether_spec;
+                __u8                                    hdata[72];
+        } h_u, m_u;
 
         __u16           vlan_tag;
         __u16           vlan_tag_mask;
-        __u64           data;      /* user-defined flow spec data */
-        __u64           data_mask; /* user-defined flow spec mask */
+        __u64           data;
+        __u64           data_mask;
 
-        /* signed to distinguish between queue and actions (DROP) */
         __s32           action;
-#define ETHTOOL_RXNTUPLE_ACTION_DROP -1
+#define ETHTOOL_RXNTUPLE_ACTION_DROP    (-1)    /* drop packet */
+#define ETHTOOL_RXNTUPLE_ACTION_CLEAR   (-2)    /* clear filter */
 };
 
+/**
+ * struct ethtool_rx_ntuple - command to set or clear RX flow filter
+ * @cmd: Command number - %ETHTOOL_SRXNTUPLE
+ * @fs: Flow filter specification
+ */
 struct ethtool_rx_ntuple {
         __u32                                   cmd;
         struct ethtool_rx_ntuple_flow_spec      fs;
@@ -759,22 +844,23 @@ struct ethtool_ops {
 #define WAKE_MAGIC              (1 << 5)
 #define WAKE_MAGICSECURE        (1 << 6) /* only meaningful if WAKE_MAGIC */
 
-/* L3-L4 network traffic flow types */
-#define TCP_V4_FLOW     0x01
-#define UDP_V4_FLOW     0x02
-#define SCTP_V4_FLOW    0x03
-#define AH_ESP_V4_FLOW  0x04
-#define TCP_V6_FLOW     0x05
-#define UDP_V6_FLOW     0x06
-#define SCTP_V6_FLOW    0x07
-#define AH_ESP_V6_FLOW  0x08
-#define AH_V4_FLOW      0x09
-#define ESP_V4_FLOW     0x0a
-#define AH_V6_FLOW      0x0b
-#define ESP_V6_FLOW     0x0c
-#define IP_USER_FLOW    0x0d
-#define IPV4_FLOW       0x10
-#define IPV6_FLOW       0x11
+/* L2-L4 network traffic flow types */
+#define TCP_V4_FLOW     0x01    /* hash or spec (tcp_ip4_spec) */
+#define UDP_V4_FLOW     0x02    /* hash or spec (udp_ip4_spec) */
+#define SCTP_V4_FLOW    0x03    /* hash or spec (sctp_ip4_spec) */
+#define AH_ESP_V4_FLOW  0x04    /* hash only */
+#define TCP_V6_FLOW     0x05    /* hash only */
+#define UDP_V6_FLOW     0x06    /* hash only */
+#define SCTP_V6_FLOW    0x07    /* hash only */
+#define AH_ESP_V6_FLOW  0x08    /* hash only */
+#define AH_V4_FLOW      0x09    /* hash or spec (ah_ip4_spec) */
+#define ESP_V4_FLOW     0x0a    /* hash or spec (esp_ip4_spec) */
+#define AH_V6_FLOW      0x0b    /* hash only */
+#define ESP_V6_FLOW     0x0c    /* hash only */
+#define IP_USER_FLOW    0x0d    /* spec only (usr_ip4_spec) */
+#define IPV4_FLOW       0x10    /* hash only */
+#define IPV6_FLOW       0x11    /* hash only */
+#define ETHER_FLOW      0x12    /* spec only (ether_spec) */
 
 /* L3-L4 network traffic flow hash options */
 #define RXH_L2DA        (1 << 1)
diff --git a/include/linux/if.h b/include/linux/if.h
index 53558ec59e1b..123959927745 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -75,6 +75,8 @@
 #define IFF_DISABLE_NETPOLL     0x2000  /* disable netpoll at run-time */
 #define IFF_MACVLAN_PORT        0x4000  /* device used as macvlan port */
 #define IFF_BRIDGE_PORT 0x8000          /* device used as bridge port */
+#define IFF_OVS_DATAPATH        0x10000 /* device used as Open vSwitch
+                                         * datapath port */
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index bed7a4682b90..f9c3df03db0f 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -137,8 +137,6 @@ extern struct ctl_table ether_table[];
 
 extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len);
 
-#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
-
 #endif
 
 #endif  /* _LINUX_IF_ETHER_H */
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 35280b302290..8a2fd66a8b5f 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -40,6 +40,12 @@ struct macvlan_rx_stats {
         unsigned long           rx_errors;
 };
 
+/*
+ * Maximum times a macvtap device can be opened. This can be used to
+ * configure the number of receive queue, e.g. for multiqueue virtio.
+ */
+#define MAX_MACVTAP_QUEUES      (NR_CPUS < 16 ? NR_CPUS : 16)
+
 struct macvlan_dev {
         struct net_device       *dev;
         struct list_head        list;
@@ -50,7 +56,8 @@ struct macvlan_dev {
         enum macvlan_mode       mode;
         int (*receive)(struct sk_buff *skb);
         int (*forward)(struct net_device *dev, struct sk_buff *skb);
-        struct macvtap_queue    *tap;
+        struct macvtap_queue    *taps[MAX_MACVTAP_QUEUES];
+        int                     numvtaps;
 };
 
 static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 27741e05446f..397921b09ef9 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -40,25 +40,35 @@
  * PPPoE addressing definition 
  */ 
 typedef __be16 sid_t;
-struct pppoe_addr{ 
-       sid_t           sid;                    /* Session identifier */ 
-       unsigned char   remote[ETH_ALEN];       /* Remote address */ 
-       char            dev[IFNAMSIZ];          /* Local device to use */ 
+struct pppoe_addr {
+        sid_t         sid;                    /* Session identifier */
+        unsigned char remote[ETH_ALEN];       /* Remote address */
+        char          dev[IFNAMSIZ];          /* Local device to use */
 }; 
  
 /************************************************************************ 
- * Protocols supported by AF_PPPOX 
- */ 
+ * PPTP addressing definition
+ */
+struct pptp_addr {
+        __be16          call_id;
+        struct in_addr  sin_addr;
+};
+
+/************************************************************************
+ * Protocols supported by AF_PPPOX
+ */
 #define PX_PROTO_OE    0 /* Currently just PPPoE */
 #define PX_PROTO_OL2TP 1 /* Now L2TP also */
-#define PX_MAX_PROTO   2
-
-struct sockaddr_pppox { 
-       sa_family_t     sa_family;            /* address family, AF_PPPOX */ 
-       unsigned int    sa_protocol;          /* protocol identifier */ 
-       union{ 
-               struct pppoe_addr       pppoe; 
-       }sa_addr; 
+#define PX_PROTO_PPTP  2
+#define PX_MAX_PROTO   3
+
+struct sockaddr_pppox {
+        sa_family_t     sa_family;            /* address family, AF_PPPOX */
+        unsigned int    sa_protocol;          /* protocol identifier */
+        union {
+                struct pppoe_addr  pppoe;
+                struct pptp_addr   pptp;
+        } sa_addr;
 } __attribute__((packed));
 
 /* The use of the above union isn't viable because the size of this
@@ -150,15 +160,23 @@ struct pppoe_opt {
                                              relayed to (PPPoE relaying) */
 };
 
+struct pptp_opt {
+        struct pptp_addr src_addr;
+        struct pptp_addr dst_addr;
+        u32 ack_sent, ack_recv;
+        u32 seq_sent, seq_recv;
+        int ppp_flags;
+};
 #include <net/sock.h>
 
 struct pppox_sock {
         /* struct sock must be the first member of pppox_sock */
-        struct sock             sk;
-        struct ppp_channel      chan;
+        struct sock sk;
+        struct ppp_channel chan;
         struct pppox_sock       *next;    /* for hash table */
         union {
                 struct pppoe_opt pppoe;
+                struct pptp_opt  pptp;
         } proto;
         __be16                  num;
 };
@@ -186,7 +204,7 @@ struct pppox_proto {
         struct module   *owner;
 };
 
-extern int register_pppox_proto(int proto_num, struct pppox_proto *pp);
+extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
 extern void unregister_pppox_proto(int proto_num);
 extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */
 extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 3d870fda8c4f..a52320751bfc 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -119,7 +119,7 @@ extern u16 vlan_dev_vlan_id(const struct net_device *dev);
 
 extern int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                              u16 vlan_tci, int polling);
-extern int vlan_hwaccel_do_receive(struct sk_buff *skb);
+extern void vlan_hwaccel_do_receive(struct sk_buff *skb);
 extern gro_result_t
 vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
                  unsigned int vlan_tci, struct sk_buff *skb);
@@ -147,9 +147,8 @@ static inline int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         return NET_XMIT_SUCCESS;
 }
 
-static inline int vlan_hwaccel_do_receive(struct sk_buff *skb)
+static inline void vlan_hwaccel_do_receive(struct sk_buff *skb)
 {
-        return 0;
 }
 
 static inline gro_result_t
diff --git a/include/linux/in.h b/include/linux/in.h
index 41d88a4689af..beeb6dee2b49 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -250,6 +250,25 @@ struct sockaddr_in {
 
 #ifdef __KERNEL__
 
+#include <linux/errno.h>
+
+static inline int proto_ports_offset(int proto)
+{
+        switch (proto) {
+        case IPPROTO_TCP:
+        case IPPROTO_UDP:
+        case IPPROTO_DCCP:
+        case IPPROTO_ESP:       /* SPI */
+        case IPPROTO_SCTP:
+        case IPPROTO_UDPLITE:
+                return 0;
+        case IPPROTO_AH:        /* SPI */
+                return 4;
+        default:
+                return -EINVAL;
+        }
+}
+
 static inline bool ipv4_is_loopback(__be32 addr)
 {
         return (addr & htonl(0xff000000)) == htonl(0x7f000000);
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 2be1a1a2beb9..1ec09bb4a3ab 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -9,6 +9,7 @@
 #include <linux/rcupdate.h>
 #include <linux/timer.h>
 #include <linux/sysctl.h>
+#include <linux/rtnetlink.h>
 
 enum
 {
@@ -198,14 +199,10 @@ static __inline__ int bad_mask(__be32 mask, __be32 addr)
 
 static inline struct in_device *__in_dev_get_rcu(const struct net_device *dev)
 {
-        struct in_device *in_dev = dev->ip_ptr;
-        if (in_dev)
-                in_dev = rcu_dereference(in_dev);
-        return in_dev;
+        return rcu_dereference(dev->ip_ptr);
 }
 
-static __inline__ struct in_device *
-in_dev_get(const struct net_device *dev)
+static inline struct in_device *in_dev_get(const struct net_device *dev)
 {
         struct in_device *in_dev;
 
@@ -217,10 +214,9 @@ in_dev_get(const struct net_device *dev)
         return in_dev;
 }
 
-static __inline__ struct in_device *
-__in_dev_get_rtnl(const struct net_device *dev)
+static inline struct in_device *__in_dev_get_rtnl(const struct net_device *dev)
 {
-        return (struct in_device*)dev->ip_ptr;
+        return rcu_dereference_check(dev->ip_ptr, lockdep_rtnl_is_held());
 }
 
 extern void in_dev_finish_destroy(struct in_device *idev);
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 0f82293a82ed..78a1b9671752 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -56,6 +56,7 @@ enum {
         MLX4_CMD_QUERY_HCA       = 0xb,
         MLX4_CMD_QUERY_PORT      = 0x43,
         MLX4_CMD_SENSE_PORT      = 0x4d,
+        MLX4_CMD_HW_HEALTH_CHECK = 0x50,
         MLX4_CMD_SET_PORT        = 0xc,
         MLX4_CMD_ACCESS_DDR      = 0x2e,
         MLX4_CMD_MAP_ICM         = 0xffa,
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 7a7f9c1e679a..7338654c02b4 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -186,6 +186,10 @@ struct mlx4_caps {
         int                     eth_mtu_cap[MLX4_MAX_PORTS + 1];
         int                     gid_table_len[MLX4_MAX_PORTS + 1];
         int                     pkey_table_len[MLX4_MAX_PORTS + 1];
+        int                     trans_type[MLX4_MAX_PORTS + 1];
+        int                     vendor_oui[MLX4_MAX_PORTS + 1];
+        int                     wavelength[MLX4_MAX_PORTS + 1];
+        u64                     trans_code[MLX4_MAX_PORTS + 1];
         int                     local_ca_ack_delay;
         int                     num_uars;
         int                     bf_reg_size;
@@ -229,6 +233,8 @@ struct mlx4_caps {
         u32                     bmme_flags;
         u32                     reserved_lkey;
         u16                     stat_rate_support;
+        int                     udp_rss;
+        int                     loopback_support;
         u8                      port_width_cap[MLX4_MAX_PORTS + 1];
         int                     max_gso_sz;
         int                     reserved_qps_cnt[MLX4_NUM_QP_REGION];
@@ -480,5 +486,6 @@ void mlx4_fmr_unmap(struct mlx4_dev *dev, struct mlx4_fmr *fmr,
                     u32 *lkey, u32 *rkey);
 int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr);
 int mlx4_SYNC_TPT(struct mlx4_dev *dev);
+int mlx4_test_interrupts(struct mlx4_dev *dev);
 
 #endif /* MLX4_DEVICE_H */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 46c36ffe20ee..01bd4c82d982 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -228,9 +228,9 @@ struct netdev_hw_addr {
 #define NETDEV_HW_ADDR_T_SLAVE          3
 #define NETDEV_HW_ADDR_T_UNICAST        4
 #define NETDEV_HW_ADDR_T_MULTICAST      5
-        int                     refcount;
         bool                    synced;
         bool                    global_use;
+        int                     refcount;
         struct rcu_head         rcu_head;
 };
 
@@ -901,7 +901,7 @@ struct net_device {
 
         unsigned int            flags;  /* interface flags (a la BSD)   */
         unsigned short          gflags;
-        unsigned short          priv_flags; /* Like 'flags' but invisible to userspace. */
+        unsigned int            priv_flags; /* Like 'flags' but invisible to userspace. */
         unsigned short          padded; /* How much padding added by alloc_netdev() */
 
         unsigned char           operstate; /* RFC2863 operstate */
@@ -918,10 +918,6 @@ struct net_device {
         unsigned short          needed_headroom;
         unsigned short          needed_tailroom;
 
-        struct net_device       *master; /* Pointer to master device of a group,
-                                          * which this device is member of.
-                                          */
-
         /* Interface address info. */
         unsigned char           perm_addr[MAX_ADDR_LEN]; /* permanent hw address */
         unsigned char           addr_assign_type; /* hw address assignment type */
@@ -942,7 +938,7 @@ struct net_device {
         void                    *dsa_ptr;       /* dsa specific data */
 #endif
         void                    *atalk_ptr;     /* AppleTalk link       */
-        void                    *ip_ptr;        /* IPv4 specific data   */
+        struct in_device __rcu  *ip_ptr;        /* IPv4 specific data   */
         void                    *dn_ptr;        /* DECnet specific data */
         void                    *ip6_ptr;       /* IPv6 specific data */
         void                    *ec_ptr;        /* Econet specific data */
@@ -951,9 +947,20 @@ struct net_device {
                                                    assign before registering */
 
 /*
- * Cache line mostly used on receive path (including eth_type_trans())
+ * Cache lines mostly used on receive path (including eth_type_trans())
  */
-        unsigned long           last_rx;        /* Time of last Rx      */
+        unsigned long           last_rx;        /* Time of last Rx
+                                                 * This should not be set in
+                                                 * drivers, unless really needed,
+                                                 * because network stack (bonding)
+                                                 * use it if/when necessary, to
+                                                 * avoid dirtying this cache line.
+                                                 */
+
+        struct net_device       *master; /* Pointer to master device of a group,
+                                          * which this device is member of.
+                                          */
+
         /* Interface address info used in eth_type_trans() */
         unsigned char           *dev_addr;      /* hw address, (before bcast
                                                    because most packets are
@@ -973,10 +980,14 @@ struct net_device {
         unsigned int            num_rx_queues;
 #endif
 
-        struct netdev_queue     rx_queue;
         rx_handler_func_t       *rx_handler;
         void                    *rx_handler_data;
 
+        struct netdev_queue     rx_queue; /* use two cache lines */
+
+/*
+ * Cache lines mostly used on transmit path
+ */
         struct netdev_queue     *_tx ____cacheline_aligned_in_smp;
 
         /* Number of TX queues allocated at alloc_netdev_mq() time  */
@@ -990,9 +1001,7 @@ struct net_device {
 
         unsigned long           tx_queue_len;   /* Max frames per queue allowed */
         spinlock_t              tx_global_lock;
-/*
- * One part is mostly used on xmit path (device)
- */
+
         /* These may be needed for future network-power-down code. */
 
         /*
@@ -1041,8 +1050,10 @@ struct net_device {
 #endif
 
         /* mid-layer private */
-        void                    *ml_priv;
-
+        union {
+                void                            *ml_priv;
+                struct pcpu_lstats __percpu     *lstats; /* loopback stats */
+        };
         /* GARP */
         struct garp_port        *garp_port;
 
@@ -1667,7 +1678,7 @@ static inline void netif_wake_subqueue(struct net_device *dev, u16 queue_index)
  */
 static inline int netif_is_multiqueue(const struct net_device *dev)
 {
-        return (dev->num_tx_queues > 1);
+        return dev->num_tx_queues > 1;
 }
 
 extern void netif_set_real_num_tx_queues(struct net_device *dev,
@@ -1695,6 +1706,7 @@ extern gro_result_t	dev_gro_receive(struct napi_struct *napi,
 extern gro_result_t     napi_skb_finish(gro_result_t ret, struct sk_buff *skb);
 extern gro_result_t     napi_gro_receive(struct napi_struct *napi,
                                          struct sk_buff *skb);
+extern void             napi_gro_flush(struct napi_struct *napi);
 extern void             napi_reuse_skb(struct napi_struct *napi,
                                        struct sk_buff *skb);
 extern struct sk_buff * napi_get_frags(struct napi_struct *napi);
@@ -2171,6 +2183,8 @@ extern void dev_seq_stop(struct seq_file *seq, void *v);
 extern int netdev_class_create_file(struct class_attribute *class_attr);
 extern void netdev_class_remove_file(struct class_attribute *class_attr);
 
+extern struct kobj_ns_type_operations net_ns_type_operations;
+
 extern char *netdev_drivername(const struct net_device *dev, char *buffer, int len);
 
 extern void linkwatch_run_queue(void);
@@ -2191,7 +2205,7 @@ static inline int net_gso_ok(int features, int gso_type)
 static inline int skb_gso_ok(struct sk_buff *skb, int features)
 {
         return net_gso_ok(features, skb_shinfo(skb)->gso_type) &&
-               (!skb_has_frags(skb) || (features & NETIF_F_FRAGLIST));
+               (!skb_has_frag_list(skb) || (features & NETIF_F_FRAGLIST));
 }
 
 static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2c8701687336..f0518b0278a9 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -40,6 +40,43 @@
  */
 
 /**
+ * DOC: Frame transmission/registration support
+ *
+ * Frame transmission and registration support exists to allow userspace
+ * management entities such as wpa_supplicant react to management frames
+ * that are not being handled by the kernel. This includes, for example,
+ * certain classes of action frames that cannot be handled in the kernel
+ * for various reasons.
+ *
+ * Frame registration is done on a per-interface basis and registrations
+ * cannot be removed other than by closing the socket. It is possible to
+ * specify a registration filter to register, for example, only for a
+ * certain type of action frame. In particular with action frames, those
+ * that userspace registers for will not be returned as unhandled by the
+ * driver, so that the registered application has to take responsibility
+ * for doing that.
+ *
+ * The type of frame that can be registered for is also dependent on the
+ * driver and interface type. The frame types are advertised in wiphy
+ * attributes so applications know what to expect.
+ *
+ * NOTE: When an interface changes type while registrations are active,
+ *       these registrations are ignored until the interface type is
+ *       changed again. This means that changing the interface type can
+ *       lead to a situation that couldn't otherwise be produced, but
+ *       any such registrations will be dormant in the sense that they
+ *       will not be serviced, i.e. they will not receive any frames.
+ *
+ * Frame transmission allows userspace to send for example the required
+ * responses to action frames. It is subject to some sanity checking,
+ * but many frames can be transmitted. When a frame was transmitted, its
+ * status is indicated to the sending socket.
+ *
+ * For more technical details, see the corresponding command descriptions
+ * below.
+ */
+
+/**
  * enum nl80211_commands - supported nl80211 commands
  *
  * @NL80211_CMD_UNSPEC: unspecified command to catch errors
@@ -258,7 +295,9 @@
  *      auth and assoc steps. For this, you need to specify the SSID in a
  *      %NL80211_ATTR_SSID attribute, and can optionally specify the association
  *      IEs in %NL80211_ATTR_IE, %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_MAC,
- *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_CONTROL_PORT.
+ *      %NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
+ *      %NL80211_ATTR_CONTROL_PORT_ETHERTYPE and
+ *      %NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT.
  *      It is also sent as an event, with the BSSID and response IEs when the
  *      connection is established or failed to be established. This can be
  *      determined by the STATUS_CODE attribute.
@@ -301,16 +340,20 @@
  *      rate selection. %NL80211_ATTR_IFINDEX is used to specify the interface
  *      and @NL80211_ATTR_TX_RATES the set of allowed rates.
  *
- * @NL80211_CMD_REGISTER_ACTION: Register for receiving certain action frames
- *      (via @NL80211_CMD_ACTION) for processing in userspace. This command
- *      requires an interface index and a match attribute containing the first
- *      few bytes of the frame that should match, e.g. a single byte for only
- *      a category match or four bytes for vendor frames including the OUI.
- *      The registration cannot be dropped, but is removed automatically
- *      when the netlink socket is closed. Multiple registrations can be made.
- * @NL80211_CMD_ACTION: Action frame TX request and RX notification. This
- *      command is used both as a request to transmit an Action frame and as an
- *      event indicating reception of an Action frame that was not processed in
+ * @NL80211_CMD_REGISTER_FRAME: Register for receiving certain mgmt frames
+ *      (via @NL80211_CMD_FRAME) for processing in userspace. This command
+ *      requires an interface index, a frame type attribute (optional for
+ *      backward compatibility reasons, if not given assumes action frames)
+ *      and a match attribute containing the first few bytes of the frame
+ *      that should match, e.g. a single byte for only a category match or
+ *      four bytes for vendor frames including the OUI. The registration
+ *      cannot be dropped, but is removed automatically when the netlink
+ *      socket is closed. Multiple registrations can be made.
+ * @NL80211_CMD_REGISTER_ACTION: Alias for @NL80211_CMD_REGISTER_FRAME for
+ *      backward compatibility
+ * @NL80211_CMD_FRAME: Management frame TX request and RX notification. This
+ *      command is used both as a request to transmit a management frame and
+ *      as an event indicating reception of a frame that was not processed in
  *      kernel code, but is for us (i.e., which may need to be processed in a
  *      user space application). %NL80211_ATTR_FRAME is used to specify the
  *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ (and
@@ -320,11 +363,14 @@
  *      operational channel). When called, this operation returns a cookie
  *      (%NL80211_ATTR_COOKIE) that will be included with the TX status event
  *      pertaining to the TX request.
- * @NL80211_CMD_ACTION_TX_STATUS: Report TX status of an Action frame
- *      transmitted with %NL80211_CMD_ACTION. %NL80211_ATTR_COOKIE identifies
+ * @NL80211_CMD_ACTION: Alias for @NL80211_CMD_FRAME for backward compatibility.
+ * @NL80211_CMD_FRAME_TX_STATUS: Report TX status of a management frame
+ *      transmitted with %NL80211_CMD_FRAME. %NL80211_ATTR_COOKIE identifies
  *      the TX command and %NL80211_ATTR_FRAME includes the contents of the
  *      frame. %NL80211_ATTR_ACK flag is included if the recipient acknowledged
  *      the frame.
+ * @NL80211_CMD_ACTION_TX_STATUS: Alias for @NL80211_CMD_FRAME_TX_STATUS for
+ *      backward compatibility.
  * @NL80211_CMD_SET_CQM: Connection quality monitor configuration. This command
  *      is used to configure connection quality monitoring notification trigger
  *      levels.
@@ -429,9 +475,12 @@ enum nl80211_commands {
 
         NL80211_CMD_SET_TX_BITRATE_MASK,
 
-        NL80211_CMD_REGISTER_ACTION,
-        NL80211_CMD_ACTION,
-        NL80211_CMD_ACTION_TX_STATUS,
+        NL80211_CMD_REGISTER_FRAME,
+        NL80211_CMD_REGISTER_ACTION = NL80211_CMD_REGISTER_FRAME,
+        NL80211_CMD_FRAME,
+        NL80211_CMD_ACTION = NL80211_CMD_FRAME,
+        NL80211_CMD_FRAME_TX_STATUS,
+        NL80211_CMD_ACTION_TX_STATUS = NL80211_CMD_FRAME_TX_STATUS,
 
         NL80211_CMD_SET_POWER_SAVE,
         NL80211_CMD_GET_POWER_SAVE,
@@ -639,6 +688,15 @@ enum nl80211_commands {
  *      request, the driver will assume that the port is unauthorized until
  *      authorized by user space. Otherwise, port is marked authorized by
  *      default in station mode.
+ * @NL80211_ATTR_CONTROL_PORT_ETHERTYPE: A 16-bit value indicating the
+ *      ethertype that will be used for key negotiation. It can be
+ *      specified with the associate and connect commands. If it is not
+ *      specified, the value defaults to 0x888E (PAE, 802.1X). This
+ *      attribute is also used as a flag in the wiphy information to
+ *      indicate that protocols other than PAE are supported.
+ * @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT: When included along with
+ *      %NL80211_ATTR_CONTROL_PORT_ETHERTYPE, indicates that the custom
+ *      ethertype frames used for key negotiation must not be encrypted.
  *
  * @NL80211_ATTR_TESTDATA: Testmode data blob, passed through to the driver.
  *      We recommend using nested, driver-specific attributes within this.
@@ -708,7 +766,16 @@ enum nl80211_commands {
  *      is used with %NL80211_CMD_SET_TX_BITRATE_MASK.
  *
  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
- *      at least one byte, currently used with @NL80211_CMD_REGISTER_ACTION.
+ *      at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
+ * @NL80211_ATTR_FRAME_TYPE: A u16 indicating the frame type/subtype for the
+ *      @NL80211_CMD_REGISTER_FRAME command.
+ * @NL80211_ATTR_TX_FRAME_TYPES: wiphy capability attribute, which is a
+ *      nested attribute of %NL80211_ATTR_FRAME_TYPE attributes, containing
+ *      information about which frame types can be transmitted with
+ *      %NL80211_CMD_FRAME.
+ * @NL80211_ATTR_RX_FRAME_TYPES: wiphy capability attribute, which is a
+ *      nested attribute of %NL80211_ATTR_FRAME_TYPE attributes, containing
+ *      information about which frame types can be registered for RX.
  *
  * @NL80211_ATTR_ACK: Flag attribute indicating that the frame was
  *      acknowledged by the recipient.
@@ -891,6 +958,13 @@ enum nl80211_attrs {
         NL80211_ATTR_WIPHY_TX_POWER_SETTING,
         NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
 
+        NL80211_ATTR_TX_FRAME_TYPES,
+        NL80211_ATTR_RX_FRAME_TYPES,
+        NL80211_ATTR_FRAME_TYPE,
+
+        NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
+        NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -946,8 +1020,10 @@ enum nl80211_attrs {
  * @NL80211_IFTYPE_WDS: wireless distribution interface
  * @NL80211_IFTYPE_MONITOR: monitor interface receiving all frames
  * @NL80211_IFTYPE_MESH_POINT: mesh point
+ * @NL80211_IFTYPE_P2P_CLIENT: P2P client
+ * @NL80211_IFTYPE_P2P_GO: P2P group owner
  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
- * @__NL80211_IFTYPE_AFTER_LAST: internal use
+ * @NUM_NL80211_IFTYPES: number of defined interface types
  *
  * These values are used with the %NL80211_ATTR_IFTYPE
  * to set the type of an interface.
@@ -962,10 +1038,12 @@ enum nl80211_iftype {
         NL80211_IFTYPE_WDS,
         NL80211_IFTYPE_MONITOR,
         NL80211_IFTYPE_MESH_POINT,
+        NL80211_IFTYPE_P2P_CLIENT,
+        NL80211_IFTYPE_P2P_GO,
 
         /* keep last */
-        __NL80211_IFTYPE_AFTER_LAST,
-        NL80211_IFTYPE_MAX = __NL80211_IFTYPE_AFTER_LAST - 1
+        NUM_NL80211_IFTYPES,
+        NL80211_IFTYPE_MAX = NUM_NL80211_IFTYPES - 1
 };
 
 /**
@@ -974,11 +1052,14 @@ enum nl80211_iftype {
  * Station flags. When a station is added to an AP interface, it is
  * assumed to be already associated (and hence authenticated.)
  *
+ * @__NL80211_STA_FLAG_INVALID: attribute number 0 is reserved
  * @NL80211_STA_FLAG_AUTHORIZED: station is authorized (802.1X)
  * @NL80211_STA_FLAG_SHORT_PREAMBLE: station is capable of receiving frames
  *      with short barker preamble
  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
  * @NL80211_STA_FLAG_MFP: station uses management frame protection
+ * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
+ * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
 enum nl80211_sta_flags {
         __NL80211_STA_FLAG_INVALID,
@@ -1091,14 +1172,17 @@ enum nl80211_mpath_flags {
  * information about a mesh path.
  *
  * @__NL80211_MPATH_INFO_INVALID: attribute number 0 is reserved
- * @NL80211_ATTR_MPATH_FRAME_QLEN: number of queued frames for this destination
- * @NL80211_ATTR_MPATH_SN: destination sequence number
- * @NL80211_ATTR_MPATH_METRIC: metric (cost) of this mesh path
- * @NL80211_ATTR_MPATH_EXPTIME: expiration time for the path, in msec from now
- * @NL80211_ATTR_MPATH_FLAGS: mesh path flags, enumerated in
+ * @NL80211_MPATH_INFO_FRAME_QLEN: number of queued frames for this destination
+ * @NL80211_MPATH_INFO_SN: destination sequence number
+ * @NL80211_MPATH_INFO_METRIC: metric (cost) of this mesh path
+ * @NL80211_MPATH_INFO_EXPTIME: expiration time for the path, in msec from now
+ * @NL80211_MPATH_INFO_FLAGS: mesh path flags, enumerated in
  *      &enum nl80211_mpath_flags;
- * @NL80211_ATTR_MPATH_DISCOVERY_TIMEOUT: total path discovery timeout, in msec
- * @NL80211_ATTR_MPATH_DISCOVERY_RETRIES: mesh path discovery retries
+ * @NL80211_MPATH_INFO_DISCOVERY_TIMEOUT: total path discovery timeout, in msec
+ * @NL80211_MPATH_INFO_DISCOVERY_RETRIES: mesh path discovery retries
+ * @NL80211_MPATH_INFO_MAX: highest mesh path information attribute number
+ *      currently defind
+ * @__NL80211_MPATH_INFO_AFTER_LAST: internal use
  */
 enum nl80211_mpath_info {
         __NL80211_MPATH_INFO_INVALID,
@@ -1127,6 +1211,8 @@ enum nl80211_mpath_info {
  * @NL80211_BAND_ATTR_HT_CAPA: HT capabilities, as in the HT information IE
  * @NL80211_BAND_ATTR_HT_AMPDU_FACTOR: A-MPDU factor, as in 11n
  * @NL80211_BAND_ATTR_HT_AMPDU_DENSITY: A-MPDU density, as in 11n
+ * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
+ * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_band_attr {
         __NL80211_BAND_ATTR_INVALID,
@@ -1147,6 +1233,7 @@ enum nl80211_band_attr {
 
 /**
  * enum nl80211_frequency_attr - frequency attributes
+ * @__NL80211_FREQUENCY_ATTR_INVALID: attribute number 0 is reserved
  * @NL80211_FREQUENCY_ATTR_FREQ: Frequency in MHz
  * @NL80211_FREQUENCY_ATTR_DISABLED: Channel is disabled in current
  *      regulatory domain.
@@ -1158,6 +1245,9 @@ enum nl80211_band_attr {
  *      on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_MAX_TX_POWER: Maximum transmission power in mBm
  *      (100 * dBm).
+ * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
+ *      currently defined
+ * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_frequency_attr {
         __NL80211_FREQUENCY_ATTR_INVALID,
@@ -1177,9 +1267,13 @@ enum nl80211_frequency_attr {
 
 /**
  * enum nl80211_bitrate_attr - bitrate attributes
+ * @__NL80211_BITRATE_ATTR_INVALID: attribute number 0 is reserved
  * @NL80211_BITRATE_ATTR_RATE: Bitrate in units of 100 kbps
  * @NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE: Short preamble supported
  *      in 2.4 GHz band.
+ * @NL80211_BITRATE_ATTR_MAX: highest bitrate attribute number
+ *      currently defined
+ * @__NL80211_BITRATE_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_bitrate_attr {
         __NL80211_BITRATE_ATTR_INVALID,
@@ -1235,6 +1329,7 @@ enum nl80211_reg_type {
 
 /**
  * enum nl80211_reg_rule_attr - regulatory rule attributes
+ * @__NL80211_REG_RULE_ATTR_INVALID: attribute number 0 is reserved
  * @NL80211_ATTR_REG_RULE_FLAGS: a set of flags which specify additional
  *      considerations for a given frequency range. These are the
  *      &enum nl80211_reg_rule_flags.
@@ -1251,6 +1346,9 @@ enum nl80211_reg_type {
  *      If you don't have one then don't send this.
  * @NL80211_ATTR_POWER_RULE_MAX_EIRP: the maximum allowed EIRP for
  *      a given frequency range. The value is in mBm (100 * dBm).
+ * @NL80211_REG_RULE_ATTR_MAX: highest regulatory rule attribute number
+ *      currently defined
+ * @__NL80211_REG_RULE_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_reg_rule_attr {
         __NL80211_REG_RULE_ATTR_INVALID,
@@ -1302,6 +1400,9 @@ enum nl80211_reg_rule_flags {
  * @__NL80211_SURVEY_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_SURVEY_INFO_FREQUENCY: center frequency of channel
  * @NL80211_SURVEY_INFO_NOISE: noise level of channel (u8, dBm)
+ * @NL80211_SURVEY_INFO_MAX: highest survey info attribute number
+ *      currently defined
+ * @__NL80211_SURVEY_INFO_AFTER_LAST: internal use
  */
 enum nl80211_survey_info {
         __NL80211_SURVEY_INFO_INVALID,
@@ -1466,6 +1567,7 @@ enum nl80211_channel_type {
  * enum nl80211_bss - netlink attributes for a BSS
  *
  * @__NL80211_BSS_INVALID: invalid
+ * @NL80211_BSS_BSSID: BSSID of the BSS (6 octets)
  * @NL80211_BSS_FREQUENCY: frequency in MHz (u32)
  * @NL80211_BSS_TSF: TSF of the received probe response/beacon (u64)
  * @NL80211_BSS_BEACON_INTERVAL: beacon interval of the (I)BSS (u16)
@@ -1509,6 +1611,12 @@ enum nl80211_bss {
 
 /**
  * enum nl80211_bss_status - BSS "status"
+ * @NL80211_BSS_STATUS_AUTHENTICATED: Authenticated with this BSS.
+ * @NL80211_BSS_STATUS_ASSOCIATED: Associated with this BSS.
+ * @NL80211_BSS_STATUS_IBSS_JOINED: Joined to this IBSS.
+ *
+ * The BSS status is a BSS attribute in scan dumps, which
+ * indicates the status the interface has wrt. this BSS.
  */
 enum nl80211_bss_status {
         NL80211_BSS_STATUS_AUTHENTICATED,
@@ -1619,8 +1727,8 @@ enum nl80211_tx_rate_attributes {
 
 /**
  * enum nl80211_band - Frequency band
- * @NL80211_BAND_2GHZ - 2.4 GHz ISM band
- * @NL80211_BAND_5GHZ - around 5 GHz band (4.9 - 5.7 GHz)
+ * @NL80211_BAND_2GHZ: 2.4 GHz ISM band
+ * @NL80211_BAND_5GHZ: around 5 GHz band (4.9 - 5.7 GHz)
  */
 enum nl80211_band {
         NL80211_BAND_2GHZ,
@@ -1658,9 +1766,9 @@ enum nl80211_attr_cqm {
 
 /**
  * enum nl80211_cqm_rssi_threshold_event - RSSI threshold event
- * @NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW - The RSSI level is lower than the
+ * @NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW: The RSSI level is lower than the
  *      configured threshold
- * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH - The RSSI is higher than the
+ * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
  *      configured threshold
  */
 enum nl80211_cqm_rssi_threshold_event {
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 10d33309e9a6..9438660b46ea 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2189,6 +2189,9 @@
 #define PCI_VENDOR_ID_ARIMA             0x161f
 
 #define PCI_VENDOR_ID_BROCADE           0x1657
+#define PCI_DEVICE_ID_BROCADE_CT        0x0014
+#define PCI_DEVICE_ID_BROCADE_FC_8G1P   0x0017
+#define PCI_DEVICE_ID_BROCADE_CT_FC     0x0021
 
 #define PCI_VENDOR_ID_SIBYTE            0x166d
 #define PCI_DEVICE_ID_BCM1250_PCI       0x0001
diff --git a/include/linux/phonet.h b/include/linux/phonet.h
index 76edadf046d3..85e14a83283b 100644
--- a/include/linux/phonet.h
+++ b/include/linux/phonet.h
@@ -47,6 +47,8 @@
 
 /* ioctls */
 #define SIOCPNGETOBJECT         (SIOCPROTOPRIVATE + 0)
+#define SIOCPNADDRESOURCE       (SIOCPROTOPRIVATE + 14)
+#define SIOCPNDELRESOURCE       (SIOCPROTOPRIVATE + 15)
 
 /* Phonet protocol header */
 struct phonethdr {
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 6b0a782c6224..a6e047a04f79 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -116,7 +116,7 @@ struct mii_bus {
         /* list of all PHYs on bus */
         struct phy_device *phy_map[PHY_MAX_ADDR];
 
-        /* Phy addresses to be ignored when probing */
+        /* PHY addresses to be ignored when probing */
         u32 phy_mask;
 
         /*
@@ -283,7 +283,7 @@ struct phy_device {
 
         phy_interface_t interface;
 
-        /* Bus address of the PHY (0-32) */
+        /* Bus address of the PHY (0-31) */
         int addr;
 
         /*
diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h
index 7f6ba8658abe..defbde203d07 100644
--- a/include/linux/pkt_cls.h
+++ b/include/linux/pkt_cls.h
@@ -332,6 +332,7 @@ enum {
         FLOW_KEY_SKUID,
         FLOW_KEY_SKGID,
         FLOW_KEY_VLAN_TAG,
+        FLOW_KEY_RXHASH,
         __FLOW_KEY_MAX,
 };
 
diff --git a/include/linux/rds.h b/include/linux/rds.h
index 24bce3ded9ea..91950950aa59 100644
--- a/include/linux/rds.h
+++ b/include/linux/rds.h
@@ -36,15 +36,6 @@
 
 #include <linux/types.h>
 
-/* These sparse annotated types shouldn't be in any user
- * visible header file. We should clean this up rather
- * than kludging around them. */
-#ifndef __KERNEL__
-#define __be16  u_int16_t
-#define __be32  u_int32_t
-#define __be64  u_int64_t
-#endif
-
 #define RDS_IB_ABI_VERSION              0x301
 
 /*
@@ -82,6 +73,10 @@
 #define RDS_CMSG_RDMA_MAP               3
 #define RDS_CMSG_RDMA_STATUS            4
 #define RDS_CMSG_CONG_UPDATE            5
+#define RDS_CMSG_ATOMIC_FADD            6
+#define RDS_CMSG_ATOMIC_CSWP            7
+#define RDS_CMSG_MASKED_ATOMIC_FADD     8
+#define RDS_CMSG_MASKED_ATOMIC_CSWP     9
 
 #define RDS_INFO_FIRST                  10000
 #define RDS_INFO_COUNTERS               10000
@@ -98,9 +93,9 @@
 #define RDS_INFO_LAST                   10010
 
 struct rds_info_counter {
-        u_int8_t        name[32];
-        u_int64_t       value;
-} __packed;
+        uint8_t name[32];
+        uint64_t        value;
+} __attribute__((packed));
 
 #define RDS_INFO_CONNECTION_FLAG_SENDING        0x01
 #define RDS_INFO_CONNECTION_FLAG_CONNECTING     0x02
@@ -109,56 +104,48 @@ struct rds_info_counter {
 #define TRANSNAMSIZ     16
 
 struct rds_info_connection {
-        u_int64_t       next_tx_seq;
-        u_int64_t       next_rx_seq;
-        __be32          laddr;
-        __be32          faddr;
-        u_int8_t        transport[TRANSNAMSIZ];         /* null term ascii */
-        u_int8_t        flags;
-} __packed;
-
-struct rds_info_flow {
+        uint64_t        next_tx_seq;
+        uint64_t        next_rx_seq;
         __be32          laddr;
         __be32          faddr;
-        u_int32_t       bytes;
-        __be16          lport;
-        __be16          fport;
-} __packed;
+        uint8_t transport[TRANSNAMSIZ];         /* null term ascii */
+        uint8_t flags;
+} __attribute__((packed));
 
 #define RDS_INFO_MESSAGE_FLAG_ACK               0x01
 #define RDS_INFO_MESSAGE_FLAG_FAST_ACK          0x02
 
 struct rds_info_message {
-        u_int64_t       seq;
-        u_int32_t       len;
+        uint64_t        seq;
+        uint32_t        len;
         __be32          laddr;
         __be32          faddr;
         __be16          lport;
         __be16          fport;
-        u_int8_t        flags;
-} __packed;
+        uint8_t flags;
+} __attribute__((packed));
 
 struct rds_info_socket {
-        u_int32_t       sndbuf;
+        uint32_t        sndbuf;
         __be32          bound_addr;
         __be32          connected_addr;
         __be16          bound_port;
         __be16          connected_port;
-        u_int32_t       rcvbuf;
-        u_int64_t       inum;
-} __packed;
+        uint32_t        rcvbuf;
+        uint64_t        inum;
+} __attribute__((packed));
 
 struct rds_info_tcp_socket {
         __be32          local_addr;
         __be16          local_port;
         __be32          peer_addr;
         __be16          peer_port;
-        u_int64_t       hdr_rem;
-        u_int64_t       data_rem;
-        u_int32_t       last_sent_nxt;
-        u_int32_t       last_expected_una;
-        u_int32_t       last_seen_una;
-} __packed;
+        uint64_t       hdr_rem;
+        uint64_t       data_rem;
+        uint32_t       last_sent_nxt;
+        uint32_t       last_expected_una;
+        uint32_t       last_seen_una;
+} __attribute__((packed));
 
 #define RDS_IB_GID_LEN  16
 struct rds_info_rdma_connection {
@@ -212,42 +199,69 @@ struct rds_info_rdma_connection {
  * (so that the application does not have to worry about
  * alignment).
  */
-typedef u_int64_t       rds_rdma_cookie_t;
+typedef uint64_t        rds_rdma_cookie_t;
 
 struct rds_iovec {
-        u_int64_t       addr;
-        u_int64_t       bytes;
+        uint64_t        addr;
+        uint64_t        bytes;
 };
 
 struct rds_get_mr_args {
         struct rds_iovec vec;
-        u_int64_t       cookie_addr;
+        uint64_t        cookie_addr;
         uint64_t        flags;
 };
 
 struct rds_get_mr_for_dest_args {
         struct sockaddr_storage dest_addr;
         struct rds_iovec        vec;
-        u_int64_t               cookie_addr;
+        uint64_t                cookie_addr;
         uint64_t                flags;
 };
 
 struct rds_free_mr_args {
         rds_rdma_cookie_t cookie;
-        u_int64_t       flags;
+        uint64_t        flags;
 };
 
 struct rds_rdma_args {
         rds_rdma_cookie_t cookie;
         struct rds_iovec remote_vec;
-        u_int64_t       local_vec_addr;
-        u_int64_t       nr_local;
-        u_int64_t       flags;
-        u_int64_t       user_token;
+        uint64_t        local_vec_addr;
+        uint64_t        nr_local;
+        uint64_t        flags;
+        uint64_t        user_token;
+};
+
+struct rds_atomic_args {
+        rds_rdma_cookie_t cookie;
+        uint64_t        local_addr;
+        uint64_t        remote_addr;
+        union {
+                struct {
+                        uint64_t        compare;
+                        uint64_t        swap;
+                } cswp;
+                struct {
+                        uint64_t        add;
+                } fadd;
+                struct {
+                        uint64_t        compare;
+                        uint64_t        swap;
+                        uint64_t        compare_mask;
+                        uint64_t        swap_mask;
+                } m_cswp;
+                struct {
+                        uint64_t        add;
+                        uint64_t        nocarry_mask;
+                } m_fadd;
+        };
+        uint64_t        flags;
+        uint64_t        user_token;
 };
 
 struct rds_rdma_notify {
-        u_int64_t       user_token;
+        uint64_t        user_token;
         int32_t         status;
 };
 
@@ -266,5 +280,6 @@ struct rds_rdma_notify {
 #define RDS_RDMA_USE_ONCE       0x0008  /* free MR after use */
 #define RDS_RDMA_DONTWAIT       0x0010  /* Don't wait in SET_BARRIER */
 #define RDS_RDMA_NOTIFY_ME      0x0020  /* Notify when operation completes */
+#define RDS_RDMA_SILENT         0x0040  /* Do not interrupt remote */
 
 #endif /* IB_RDS_H */
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 58d44491880f..68c436bddc88 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -749,6 +749,26 @@ extern int rtnl_is_locked(void);
 extern int lockdep_rtnl_is_held(void);
 #endif /* #ifdef CONFIG_PROVE_LOCKING */
 
+/**
+ * rcu_dereference_rtnl - rcu_dereference with debug checking
+ * @p: The pointer to read, prior to dereferencing
+ *
+ * Do an rcu_dereference(p), but check caller either holds rcu_read_lock()
+ * or RTNL
+ */
+#define rcu_dereference_rtnl(p)                                 \
+        rcu_dereference_check(p, rcu_read_lock_held() ||        \
+                                 lockdep_rtnl_is_held())
+
+/**
+ * rtnl_dereference - rcu_dereference with debug checking
+ * @p: The pointer to read, prior to dereferencing
+ *
+ * Do an rcu_dereference(p), but check caller holds RTNL
+ */
+#define rtnl_dereference(p)                                     \
+        rcu_dereference_check(p, lockdep_rtnl_is_held())
+
 extern void rtnetlink_init(void);
 extern void __rtnl_unlock(void);
 
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 77eb60d2b496..0b53c43ac92e 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -129,8 +129,13 @@ typedef struct skb_frag_struct skb_frag_t;
 
 struct skb_frag_struct {
         struct page *page;
+#if (BITS_PER_LONG > 32) || (PAGE_SIZE >= 65536)
         __u32 page_offset;
         __u32 size;
+#else
+        __u16 page_offset;
+        __u16 size;
+#endif
 };
 
 #define HAVE_HW_TIME_STAMP
@@ -163,26 +168,19 @@ struct skb_shared_hwtstamps {
         ktime_t syststamp;
 };
 
-/**
- * struct skb_shared_tx - instructions for time stamping of outgoing packets
- * @hardware:           generate hardware time stamp
- * @software:           generate software time stamp
- * @in_progress:        device driver is going to provide
- *                      hardware time stamp
- * @prevent_sk_orphan:  make sk reference available on driver level
- * @flags:              all shared_tx flags
- *
- * These flags are attached to packets as part of the
- * &skb_shared_info. Use skb_tx() to get a pointer.
- */
-union skb_shared_tx {
-        struct {
-                __u8    hardware:1,
-                        software:1,
-                        in_progress:1,
-                        prevent_sk_orphan:1;
-        };
-        __u8 flags;
+/* Definitions for tx_flags in struct skb_shared_info */
+enum {
+        /* generate hardware time stamp */
+        SKBTX_HW_TSTAMP = 1 << 0,
+
+        /* generate software time stamp */
+        SKBTX_SW_TSTAMP = 1 << 1,
+
+        /* device driver is going to provide hardware time stamp */
+        SKBTX_IN_PROGRESS = 1 << 2,
+
+        /* ensure the originating sk reference is available on driver level */
+        SKBTX_DRV_NEEDS_SK_REF = 1 << 3,
 };
 
 /* This data is invariant across clones and lives at
@@ -195,7 +193,7 @@ struct skb_shared_info {
         unsigned short  gso_segs;
         unsigned short  gso_type;
         __be32          ip6_frag_id;
-        union skb_shared_tx tx_flags;
+        __u8            tx_flags;
         struct sk_buff  *frag_list;
         struct skb_shared_hwtstamps hwtstamps;
 
@@ -558,6 +556,15 @@ extern unsigned int   skb_find_text(struct sk_buff *skb, unsigned int from,
                                     unsigned int to, struct ts_config *config,
                                     struct ts_state *state);
 
+extern __u32 __skb_get_rxhash(struct sk_buff *skb);
+static inline __u32 skb_get_rxhash(struct sk_buff *skb)
+{
+        if (!skb->rxhash)
+                skb->rxhash = __skb_get_rxhash(skb);
+
+        return skb->rxhash;
+}
+
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
@@ -578,11 +585,6 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
         return &skb_shinfo(skb)->hwtstamps;
 }
 
-static inline union skb_shared_tx *skb_tx(struct sk_buff *skb)
-{
-        return &skb_shinfo(skb)->tx_flags;
-}
-
 /**
  *      skb_queue_empty - check if a queue is empty
  *      @list: queue head
@@ -604,7 +606,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
                                      const struct sk_buff *skb)
 {
-        return (skb->next == (struct sk_buff *) list);
+        return skb->next == (struct sk_buff *)list;
 }
 
 /**
@@ -617,7 +619,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
                                       const struct sk_buff *skb)
 {
-        return (skb->prev == (struct sk_buff *) list);
+        return skb->prev == (struct sk_buff *)list;
 }
 
 /**
@@ -1123,7 +1125,7 @@ extern void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page,
                             int off, int size);
 
 #define SKB_PAGE_ASSERT(skb)    BUG_ON(skb_shinfo(skb)->nr_frags)
-#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_has_frags(skb))
+#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_has_frag_list(skb))
 #define SKB_LINEAR_ASSERT(skb)  BUG_ON(skb_is_nonlinear(skb))
 
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
@@ -1787,7 +1789,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
                      skb = skb->prev)
 
 
-static inline bool skb_has_frags(const struct sk_buff *skb)
+static inline bool skb_has_frag_list(const struct sk_buff *skb)
 {
         return skb_shinfo(skb)->frag_list != NULL;
 }
@@ -1987,8 +1989,8 @@ extern void skb_tstamp_tx(struct sk_buff *orig_skb,
 
 static inline void sw_tx_timestamp(struct sk_buff *skb)
 {
-        union skb_shared_tx *shtx = skb_tx(skb);
-        if (shtx->software && !shtx->in_progress)
+        if (skb_shinfo(skb)->tx_flags & SKBTX_SW_TSTAMP &&
+            !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
                 skb_tstamp_tx(skb, NULL);
 }
 
@@ -2159,7 +2161,7 @@ static inline u16 skb_get_rx_queue(const struct sk_buff *skb)
 
 static inline bool skb_rx_queue_recorded(const struct sk_buff *skb)
 {
-        return (skb->queue_mapping != 0);
+        return skb->queue_mapping != 0;
 }
 
 extern u16 skb_tx_hash(const struct net_device *dev,
@@ -2209,6 +2211,21 @@ static inline void skb_forward_csum(struct sk_buff *skb)
                 skb->ip_summed = CHECKSUM_NONE;
 }
 
+/**
+ * skb_checksum_none_assert - make sure skb ip_summed is CHECKSUM_NONE
+ * @skb: skb to check
+ *
+ * fresh skbs have their ip_summed set to CHECKSUM_NONE.
+ * Instead of forcing ip_summed to CHECKSUM_NONE, we can
+ * use this helper, to document places where we make this assertion.
+ */
+static inline void skb_checksum_none_assert(struct sk_buff *skb)
+{
+#ifdef DEBUG
+        BUG_ON(skb->ip_summed != CHECKSUM_NONE);
+#endif
+}
+
 bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off);
 #endif  /* __KERNEL__ */
 #endif  /* _LINUX_SKBUFF_H */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index a6d5225b9275..11daf9c140e7 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -97,6 +97,7 @@
 #define  SSB_TMSLOW_RESET       0x00000001 /* Reset */
 #define  SSB_TMSLOW_REJECT_22   0x00000002 /* Reject (Backplane rev 2.2) */
 #define  SSB_TMSLOW_REJECT_23   0x00000004 /* Reject (Backplane rev 2.3) */
+#define  SSB_TMSLOW_PHYCLK      0x00000010 /* MAC PHY Clock Control Enable */
 #define  SSB_TMSLOW_CLOCK       0x00010000 /* Clock Enable */
 #define  SSB_TMSLOW_FGC         0x00020000 /* Force Gated Clocks On */
 #define  SSB_TMSLOW_PE          0x40000000 /* Power Management Enable */
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 632ff7c03280..d66c61774d95 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -32,10 +32,14 @@
 struct plat_stmmacenet_data {
         int bus_id;
         int pbl;
+        int clk_csr;
         int has_gmac;
         int enh_desc;
+        int tx_coe;
+        int bugged_jumbo;
+        int pmt;
         void (*fix_mac_speed)(void *priv, unsigned int speed);
-        void (*bus_setup)(unsigned long ioaddr);
+        void (*bus_setup)(void __iomem *ioaddr);
 #ifdef CONFIG_STM_DRIVERS
         struct stm_pad_config *pad_config;
 #endif
diff --git a/include/linux/tc_act/Kbuild b/include/linux/tc_act/Kbuild
index 76990937f4c9..67b501c302b2 100644
--- a/include/linux/tc_act/Kbuild
+++ b/include/linux/tc_act/Kbuild
@@ -4,3 +4,4 @@ header-y += tc_mirred.h
 header-y += tc_pedit.h
 header-y += tc_nat.h
 header-y += tc_skbedit.h
+header-y += tc_csum.h
diff --git a/include/linux/tc_act/tc_csum.h b/include/linux/tc_act/tc_csum.h
new file mode 100644
index 000000000000..a047c49a3153
--- /dev/null
+++ b/include/linux/tc_act/tc_csum.h
@@ -0,0 +1,32 @@
+#ifndef __LINUX_TC_CSUM_H
+#define __LINUX_TC_CSUM_H
+
+#include <linux/types.h>
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_CSUM 16
+
+enum {
+        TCA_CSUM_UNSPEC,
+        TCA_CSUM_PARMS,
+        TCA_CSUM_TM,
+        __TCA_CSUM_MAX
+};
+#define TCA_CSUM_MAX (__TCA_CSUM_MAX - 1)
+
+enum {
+        TCA_CSUM_UPDATE_FLAG_IPV4HDR = 1,
+        TCA_CSUM_UPDATE_FLAG_ICMP    = 2,
+        TCA_CSUM_UPDATE_FLAG_IGMP    = 4,
+        TCA_CSUM_UPDATE_FLAG_TCP     = 8,
+        TCA_CSUM_UPDATE_FLAG_UDP     = 16,
+        TCA_CSUM_UPDATE_FLAG_UDPLITE = 32
+};
+
+struct tc_csum {
+        tc_gen;
+
+        __u32 update_flags;
+};
+
+#endif /* __LINUX_TC_CSUM_H */
diff --git a/include/linux/tc_ematch/tc_em_meta.h b/include/linux/tc_ematch/tc_em_meta.h
index 0864206ec1a3..7138962664f8 100644
--- a/include/linux/tc_ematch/tc_em_meta.h
+++ b/include/linux/tc_ematch/tc_em_meta.h
@@ -79,6 +79,7 @@ enum {
         TCF_META_ID_SK_SENDMSG_OFF,
         TCF_META_ID_SK_WRITE_PENDING,
         TCF_META_ID_VLAN_TAG,
+        TCF_META_ID_RXHASH,
         __TCF_META_ID_MAX
 };
 #define TCF_META_ID_MAX (__TCF_META_ID_MAX - 1)
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index a778ee024590..e64f4c67d0ef 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -105,6 +105,7 @@ enum {
 #define TCP_COOKIE_TRANSACTIONS 15      /* TCP Cookie Transactions */
 #define TCP_THIN_LINEAR_TIMEOUTS 16      /* Use linear timeouts for thin streams*/
 #define TCP_THIN_DUPACK         17      /* Fast retrans. after 1 dupack */
+#define TCP_USER_TIMEOUT        18      /* How long for loss retry before timeout */
 
 /* for TCP_INFO socket option */
 #define TCPI_OPT_TIMESTAMPS     1
diff --git a/include/linux/spi/wl12xx.h b/include/linux/wl12xx.h
index a223ecbc71ef..95deae3968f4 100644
--- a/include/linux/spi/wl12xx.h
+++ b/include/linux/wl12xx.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -21,14 +21,18 @@
  *
  */
 
-#ifndef _LINUX_SPI_WL12XX_H
-#define _LINUX_SPI_WL12XX_H
+#ifndef _LINUX_WL12XX_H
+#define _LINUX_WL12XX_H
 
 struct wl12xx_platform_data {
         void (*set_power)(bool enable);
         /* SDIO only: IRQ number if WLAN_IRQ line is used, 0 for SDIO IRQs */
         int irq;
         bool use_eeprom;
+        int board_ref_clock;
 };
 
+int wl12xx_set_platform_data(const struct wl12xx_platform_data *data);
+const struct wl12xx_platform_data *wl12xx_get_platform_data(void);
+
 #endif
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 4d40c4d0230b..958d2749b7a9 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -175,20 +175,32 @@ extern int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
 extern int register_inet6addr_notifier(struct notifier_block *nb);
 extern int unregister_inet6addr_notifier(struct notifier_block *nb);
 
-static inline struct inet6_dev *
-__in6_dev_get(struct net_device *dev)
+/**
+ * __in6_dev_get - get inet6_dev pointer from netdevice
+ * @dev: network device
+ *
+ * Caller must hold rcu_read_lock or RTNL, because this function
+ * does not take a reference on the inet6_dev.
+ */
+static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
 {
-        return rcu_dereference_check(dev->ip6_ptr,
-                                     rcu_read_lock_held() ||
-                                     lockdep_rtnl_is_held());
+        return rcu_dereference_rtnl(dev->ip6_ptr);
 }
 
-static inline struct inet6_dev *
-in6_dev_get(struct net_device *dev)
+/**
+ * in6_dev_get - get inet6_dev pointer from netdevice
+ * @dev: network device
+ *
+ * This version can be used in any context, and takes a reference
+ * on the inet6_dev. Callers must use in6_dev_put() later to
+ * release this reference.
+ */
+static inline struct inet6_dev *in6_dev_get(const struct net_device *dev)
 {
-        struct inet6_dev *idev = NULL;
+        struct inet6_dev *idev;
+
         rcu_read_lock();
-        idev = __in6_dev_get(dev);
+        idev = rcu_dereference(dev->ip6_ptr);
         if (idev)
                 atomic_inc(&idev->refcnt);
         rcu_read_unlock();
@@ -197,16 +209,21 @@ in6_dev_get(struct net_device *dev)
 
 extern void in6_dev_finish_destroy(struct inet6_dev *idev);
 
-static inline void
-in6_dev_put(struct inet6_dev *idev)
+static inline void in6_dev_put(struct inet6_dev *idev)
 {
         if (atomic_dec_and_test(&idev->refcnt))
                 in6_dev_finish_destroy(idev);
 }
 
-#define __in6_dev_put(idev)  atomic_dec(&(idev)->refcnt)
-#define in6_dev_hold(idev)   atomic_inc(&(idev)->refcnt)
+static inline void __in6_dev_put(struct inet6_dev *idev)
+{
+        atomic_dec(&idev->refcnt);
+}
 
+static inline void in6_dev_hold(struct inet6_dev *idev)
+{
+        atomic_inc(&idev->refcnt);
+}
 
 extern void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp);
 
@@ -216,9 +233,15 @@ static inline void in6_ifa_put(struct inet6_ifaddr *ifp)
                 inet6_ifa_finish_destroy(ifp);
 }
 
-#define __in6_ifa_put(ifp)      atomic_dec(&(ifp)->refcnt)
-#define in6_ifa_hold(ifp)       atomic_inc(&(ifp)->refcnt)
+static inline void __in6_ifa_put(struct inet6_ifaddr *ifp)
+{
+        atomic_dec(&ifp->refcnt);
+}
 
+static inline void in6_ifa_hold(struct inet6_ifaddr *ifp)
+{
+        atomic_inc(&ifp->refcnt);
+}
 
 
 /*
@@ -241,23 +264,23 @@ static inline int ipv6_addr_is_multicast(const struct in6_addr *addr)
 
 static inline int ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 {
-        return (((addr->s6_addr32[0] ^ htonl(0xff020000)) |
+        return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
                 addr->s6_addr32[1] | addr->s6_addr32[2] |
-                (addr->s6_addr32[3] ^ htonl(0x00000001))) == 0);
+                (addr->s6_addr32[3] ^ htonl(0x00000001))) == 0;
 }
 
 static inline int ipv6_addr_is_ll_all_routers(const struct in6_addr *addr)
 {
-        return (((addr->s6_addr32[0] ^ htonl(0xff020000)) |
+        return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
                 addr->s6_addr32[1] | addr->s6_addr32[2] |
-                (addr->s6_addr32[3] ^ htonl(0x00000002))) == 0);
+                (addr->s6_addr32[3] ^ htonl(0x00000002))) == 0;
 }
 
 extern int __ipv6_isatap_ifid(u8 *eui, __be32 addr);
 
 static inline int ipv6_addr_is_isatap(const struct in6_addr *addr)
 {
-        return ((addr->s6_addr32[2] | htonl(0x02000000)) == htonl(0x02005EFE));
+        return (addr->s6_addr32[2] | htonl(0x02000000)) == htonl(0x02005EFE);
 }
 
 #ifdef CONFIG_PROC_FS
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 4568b938ca35..ebec8c9a929d 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -233,7 +233,7 @@ static inline void inquiry_cache_init(struct hci_dev *hdev)
 static inline int inquiry_cache_empty(struct hci_dev *hdev)
 {
         struct inquiry_cache *c = &hdev->inq_cache;
-        return (c->list == NULL);
+        return c->list == NULL;
 }
 
 static inline long inquiry_cache_age(struct hci_dev *hdev)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 6c241444f902..c819c8bf9b68 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -414,7 +414,7 @@ static inline int l2cap_tx_window_full(struct sock *sk)
         if (sub < 0)
                 sub += 64;
 
-        return (sub == pi->remote_tx_win);
+        return sub == pi->remote_tx_win;
 }
 
 #define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2fd06c60ffbb..a0613ff62c97 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -25,6 +25,43 @@
 #include <linux/wireless.h>
 
 
+/**
+ * DOC: Introduction
+ *
+ * cfg80211 is the configuration API for 802.11 devices in Linux. It bridges
+ * userspace and drivers, and offers some utility functionality associated
+ * with 802.11. cfg80211 must, directly or indirectly via mac80211, be used
+ * by all modern wireless drivers in Linux, so that they offer a consistent
+ * API through nl80211. For backward compatibility, cfg80211 also offers
+ * wireless extensions to userspace, but hides them from drivers completely.
+ *
+ * Additionally, cfg80211 contains code to help enforce regulatory spectrum
+ * use restrictions.
+ */
+
+
+/**
+ * DOC: Device registration
+ *
+ * In order for a driver to use cfg80211, it must register the hardware device
+ * with cfg80211. This happens through a number of hardware capability structs
+ * described below.
+ *
+ * The fundamental structure for each device is the 'wiphy', of which each
+ * instance describes a physical wireless device connected to the system. Each
+ * such wiphy can have zero, one, or many virtual interfaces associated with
+ * it, which need to be identified as such by pointing the network interface's
+ * @ieee80211_ptr pointer to a &struct wireless_dev which further describes
+ * the wireless part of the interface, normally this struct is embedded in the
+ * network interface's private data area. Drivers can optionally allow creating
+ * or destroying virtual interfaces on the fly, but without at least one or the
+ * ability to create some the wireless device isn't useful.
+ *
+ * Each wiphy structure contains device capability information, and also has
+ * a pointer to the various operations the driver offers. The definitions and
+ * structures here describe these capabilities in detail.
+ */
+
 /*
  * wireless hardware capability structures
  */
@@ -205,6 +242,21 @@ struct ieee80211_supported_band {
  */
 
 /**
+ * DOC: Actions and configuration
+ *
+ * Each wireless device and each virtual interface offer a set of configuration
+ * operations and other actions that are invoked by userspace. Each of these
+ * actions is described in the operations structure, and the parameters these
+ * operations use are described separately.
+ *
+ * Additionally, some operations are asynchronous and expect to get status
+ * information via some functions that drivers need to call.
+ *
+ * Scanning and BSS list handling with its associated functionality is described
+ * in a separate chapter.
+ */
+
+/**
  * struct vif_params - describes virtual interface parameters
  * @mesh_id: mesh ID to use
  * @mesh_id_len: length of the mesh ID
@@ -570,8 +622,28 @@ struct ieee80211_txq_params {
 /* from net/wireless.h */
 struct wiphy;
 
-/* from net/ieee80211.h */
-struct ieee80211_channel;
+/**
+ * DOC: Scanning and BSS list handling
+ *
+ * The scanning process itself is fairly simple, but cfg80211 offers quite
+ * a bit of helper functionality. To start a scan, the scan operation will
+ * be invoked with a scan definition. This scan definition contains the
+ * channels to scan, and the SSIDs to send probe requests for (including the
+ * wildcard, if desired). A passive scan is indicated by having no SSIDs to
+ * probe. Additionally, a scan request may contain extra information elements
+ * that should be added to the probe request. The IEs are guaranteed to be
+ * well-formed, and will not exceed the maximum length the driver advertised
+ * in the wiphy structure.
+ *
+ * When scanning finds a BSS, cfg80211 needs to be notified of that, because
+ * it is responsible for maintaining the BSS list; the driver should not
+ * maintain a list itself. For this notification, various functions exist.
+ *
+ * Since drivers do not maintain a BSS list, there are also a number of
+ * functions to search for a BSS and obtain information about it from the
+ * BSS structure cfg80211 maintains. The BSS list is also made available
+ * to userspace.
+ */
 
 /**
  * struct cfg80211_ssid - SSID description
@@ -691,6 +763,10 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
  *      required to assume that the port is unauthorized until authorized by
  *      user space. Otherwise, port is marked authorized by default.
+ * @control_port_ethertype: the control port protocol that should be
+ *      allowed through even on unauthorized ports
+ * @control_port_no_encrypt: TRUE to prevent encryption of control port
+ *      protocol frames.
  */
 struct cfg80211_crypto_settings {
         u32 wpa_versions;
@@ -700,6 +776,8 @@ struct cfg80211_crypto_settings {
         int n_akm_suites;
         u32 akm_suites[NL80211_MAX_NR_AKM_SUITES];
         bool control_port;
+        __be16 control_port_ethertype;
+        bool control_port_no_encrypt;
 };
 
 /**
@@ -1020,7 +1098,7 @@ struct cfg80211_pmksa {
  * @cancel_remain_on_channel: Cancel an on-going remain-on-channel operation.
  *      This allows the operation to be terminated prior to timeout based on
  *      the duration value.
- * @action: Transmit an action frame
+ * @mgmt_tx: Transmit a management frame
  *
  * @testmode_cmd: run a test mode command
  *
@@ -1172,7 +1250,7 @@ struct cfg80211_ops {
                                             struct net_device *dev,
                                             u64 cookie);
 
-        int     (*action)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
                           struct ieee80211_channel *chan,
                           enum nl80211_channel_type channel_type,
                           bool channel_type_valid,
@@ -1221,21 +1299,29 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_4ADDR_AP: supports 4addr mode even on AP (with a single station
  *      on a VLAN interface)
  * @WIPHY_FLAG_4ADDR_STATION: supports 4addr mode even as a station
+ * @WIPHY_FLAG_CONTROL_PORT_PROTOCOL: This device supports setting the
+ *      control port protocol ethertype. The device also honours the
+ *      control_port_no_encrypt flag.
  */
 enum wiphy_flags {
-        WIPHY_FLAG_CUSTOM_REGULATORY    = BIT(0),
-        WIPHY_FLAG_STRICT_REGULATORY    = BIT(1),
-        WIPHY_FLAG_DISABLE_BEACON_HINTS = BIT(2),
-        WIPHY_FLAG_NETNS_OK             = BIT(3),
-        WIPHY_FLAG_PS_ON_BY_DEFAULT     = BIT(4),
-        WIPHY_FLAG_4ADDR_AP             = BIT(5),
-        WIPHY_FLAG_4ADDR_STATION        = BIT(6),
+        WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
+        WIPHY_FLAG_STRICT_REGULATORY            = BIT(1),
+        WIPHY_FLAG_DISABLE_BEACON_HINTS         = BIT(2),
+        WIPHY_FLAG_NETNS_OK                     = BIT(3),
+        WIPHY_FLAG_PS_ON_BY_DEFAULT             = BIT(4),
+        WIPHY_FLAG_4ADDR_AP                     = BIT(5),
+        WIPHY_FLAG_4ADDR_STATION                = BIT(6),
+        WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
 };
 
 struct mac_address {
         u8 addr[ETH_ALEN];
 };
 
+struct ieee80211_txrx_stypes {
+        u16 tx, rx;
+};
+
 /**
  * struct wiphy - wireless hardware description
  * @reg_notifier: the driver's regulatory notification callback
@@ -1286,6 +1372,10 @@ struct mac_address {
  * @privid: a pointer that drivers can use to identify if an arbitrary
  *      wiphy is theirs, e.g. in global notifiers
  * @bands: information about bands/channels supported by this device
+ *
+ * @mgmt_stypes: bitmasks of frame subtypes that can be subscribed to or
+ *      transmitted through nl80211, points to an array indexed by interface
+ *      type
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1294,9 +1384,12 @@ struct wiphy {
         u8 perm_addr[ETH_ALEN];
         u8 addr_mask[ETH_ALEN];
 
-        u16 n_addresses;
         struct mac_address *addresses;
 
+        const struct ieee80211_txrx_stypes *mgmt_stypes;
+
+        u16 n_addresses;
+
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
         u16 interface_modes;
 
@@ -1492,8 +1585,8 @@ struct cfg80211_cached_keys;
  *      set by driver (if supported) on add_interface BEFORE registering the
  *      netdev and may otherwise be used by driver read-only, will be update
  *      by cfg80211 on change_interface
- * @action_registrations: list of registrations for action frames
- * @action_registrations_lock: lock for the list
+ * @mgmt_registrations: list of registrations for management frames
+ * @mgmt_registrations_lock: lock for the list
  * @mtx: mutex used to lock data in this struct
  * @cleanup_work: work struct used for cleanup that can't be done directly
  */
@@ -1505,8 +1598,8 @@ struct wireless_dev {
         struct list_head list;
         struct net_device *netdev;
 
-        struct list_head action_registrations;
-        spinlock_t action_registrations_lock;
+        struct list_head mgmt_registrations;
+        spinlock_t mgmt_registrations_lock;
 
         struct mutex mtx;
 
@@ -1563,8 +1656,10 @@ static inline void *wdev_priv(struct wireless_dev *wdev)
         return wiphy_priv(wdev->wiphy);
 }
 
-/*
- * Utility functions
+/**
+ * DOC: Utility functions
+ *
+ * cfg80211 offers a number of utility functions that can be useful.
  */
 
 /**
@@ -1715,7 +1810,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
  * ieee80211_hdrlen - get header length in bytes from frame control
  * @fc: frame control field in little-endian format
  */
-unsigned int ieee80211_hdrlen(__le16 fc);
+unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
+
+/**
+ * DOC: Data path helpers
+ *
+ * In addition to generic utilities, cfg80211 also offers
+ * functions that help implement the data path for devices
+ * that do not do the 802.11/802.3 conversion on the device.
+ */
 
 /**
  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
@@ -1777,8 +1880,10 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb);
  */
 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
 
-/*
- * Regulatory helper functions for wiphys
+/**
+ * DOC: Regulatory enforcement infrastructure
+ *
+ * TODO
  */
 
 /**
@@ -2181,6 +2286,20 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
 /**
+ * DOC: RFkill integration
+ *
+ * RFkill integration in cfg80211 is almost invisible to drivers,
+ * as cfg80211 automatically registers an rfkill instance for each
+ * wireless device it knows about. Soft kill is also translated
+ * into disconnecting and turning all interfaces off, drivers are
+ * expected to turn off the device when all interfaces are down.
+ *
+ * However, devices may have a hard RFkill line, in which case they
+ * also need to interact with the rfkill subsystem, via cfg80211.
+ * They can do this with a few helper functions documented here.
+ */
+
+/**
  * wiphy_rfkill_set_hw_state - notify cfg80211 about hw block state
  * @wiphy: the wiphy
  * @blocked: block status
@@ -2201,6 +2320,17 @@ void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
 
 #ifdef CONFIG_NL80211_TESTMODE
 /**
+ * DOC: Test mode
+ *
+ * Test mode is a set of utility functions to allow drivers to
+ * interact with driver-specific tools to aid, for instance,
+ * factory programming.
+ *
+ * This chapter describes how drivers interact with it, for more
+ * information see the nl80211 book's chapter on it.
+ */
+
+/**
  * cfg80211_testmode_alloc_reply_skb - allocate testmode reply
  * @wiphy: the wiphy
  * @approxlen: an upper bound of the length of the data that will
@@ -2373,38 +2503,39 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
- * cfg80211_rx_action - notification of received, unprocessed Action frame
+ * cfg80211_rx_mgmt - notification of received, unprocessed management frame
  * @dev: network device
  * @freq: Frequency on which the frame was received in MHz
- * @buf: Action frame (header + body)
+ * @buf: Management frame (header + body)
  * @len: length of the frame data
  * @gfp: context flags
- * Returns %true if a user space application is responsible for rejecting the
- *      unrecognized Action frame; %false if no such application is registered
- *      (i.e., the driver is responsible for rejecting the unrecognized Action
- *      frame)
+ *
+ * Returns %true if a user space application has registered for this frame.
+ * For action frames, that makes it responsible for rejecting unrecognized
+ * action frames; %false otherwise, in which case for action frames the
+ * driver is responsible for rejecting the frame.
  *
  * This function is called whenever an Action frame is received for a station
  * mode interface, but is not processed in kernel.
  */
-bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
-                        size_t len, gfp_t gfp);
+bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
+                      size_t len, gfp_t gfp);
 
 /**
- * cfg80211_action_tx_status - notification of TX status for Action frame
+ * cfg80211_mgmt_tx_status - notification of TX status for management frame
  * @dev: network device
- * @cookie: Cookie returned by cfg80211_ops::action()
- * @buf: Action frame (header + body)
+ * @cookie: Cookie returned by cfg80211_ops::mgmt_tx()
+ * @buf: Management frame (header + body)
  * @len: length of the frame data
  * @ack: Whether frame was acknowledged
  * @gfp: context flags
  *
- * This function is called whenever an Action frame was requested to be
- * transmitted with cfg80211_ops::action() to report the TX status of the
+ * This function is called whenever a management frame was requested to be
+ * transmitted with cfg80211_ops::mgmt_tx() to report the TX status of the
  * transmission attempt.
  */
-void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
-                               const u8 *buf, size_t len, bool ack, gfp_t gfp);
+void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+                             const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
 
 /**
@@ -2427,49 +2558,36 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 /* wiphy_printk helpers, similar to dev_printk */
 
 #define wiphy_printk(level, wiphy, format, args...)             \
-        printk(level "%s: " format, wiphy_name(wiphy), ##args)
+        dev_printk(level, &(wiphy)->dev, format, ##args)
 #define wiphy_emerg(wiphy, format, args...)                     \
-        wiphy_printk(KERN_EMERG, wiphy, format, ##args)
+        dev_emerg(&(wiphy)->dev, format, ##args)
 #define wiphy_alert(wiphy, format, args...)                     \
-        wiphy_printk(KERN_ALERT, wiphy, format, ##args)
+        dev_alert(&(wiphy)->dev, format, ##args)
 #define wiphy_crit(wiphy, format, args...)                      \
-        wiphy_printk(KERN_CRIT, wiphy, format, ##args)
+        dev_crit(&(wiphy)->dev, format, ##args)
 #define wiphy_err(wiphy, format, args...)                       \
-        wiphy_printk(KERN_ERR, wiphy, format, ##args)
+        dev_err(&(wiphy)->dev, format, ##args)
 #define wiphy_warn(wiphy, format, args...)                      \
-        wiphy_printk(KERN_WARNING, wiphy, format, ##args)
+        dev_warn(&(wiphy)->dev, format, ##args)
 #define wiphy_notice(wiphy, format, args...)                    \
-        wiphy_printk(KERN_NOTICE, wiphy, format, ##args)
+        dev_notice(&(wiphy)->dev, format, ##args)
 #define wiphy_info(wiphy, format, args...)                      \
-        wiphy_printk(KERN_INFO, wiphy, format, ##args)
-
-int wiphy_debug(const struct wiphy *wiphy, const char *format, ...)
-        __attribute__ ((format (printf, 2, 3)));
+        dev_info(&(wiphy)->dev, format, ##args)
 
-#if defined(DEBUG)
-#define wiphy_dbg(wiphy, format, args...)                       \
+#define wiphy_debug(wiphy, format, args...)                     \
         wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
-#elif defined(CONFIG_DYNAMIC_DEBUG)
+
 #define wiphy_dbg(wiphy, format, args...)                       \
-        dynamic_pr_debug("%s: " format, wiphy_name(wiphy), ##args)
-#else
-#define wiphy_dbg(wiphy, format, args...)                               \
-({                                                                      \
-        if (0)                                                          \
-                wiphy_printk(KERN_DEBUG, wiphy, format, ##args);        \
-        0;                                                              \
-})
-#endif
+        dev_dbg(&(wiphy)->dev, format, ##args)
 
 #if defined(VERBOSE_DEBUG)
 #define wiphy_vdbg      wiphy_dbg
 #else
-
 #define wiphy_vdbg(wiphy, format, args...)                              \
 ({                                                                      \
         if (0)                                                          \
                 wiphy_printk(KERN_DEBUG, wiphy, format, ##args);        \
-                0;                                                      \
+        0;                                                              \
 })
 #endif
 
diff --git a/include/net/gre.h b/include/net/gre.h
new file mode 100644
index 000000000000..82665474bcb7
--- /dev/null
+++ b/include/net/gre.h
@@ -0,0 +1,18 @@
+#ifndef __LINUX_GRE_H
+#define __LINUX_GRE_H
+
+#include <linux/skbuff.h>
+
+#define GREPROTO_CISCO          0
+#define GREPROTO_PPTP           1
+#define GREPROTO_MAX            2
+
+struct gre_protocol {
+        int  (*handler)(struct sk_buff *skb);
+        void (*err_handler)(struct sk_buff *skb, u32 info);
+};
+
+int gre_add_protocol(const struct gre_protocol *proto, u8 version);
+int gre_del_protocol(const struct gre_protocol *proto, u8 version);
+
+#endif
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index b6d3b55da19b..e4f494b42e06 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -125,6 +125,7 @@ struct inet_connection_sock {
                 int               probe_size;
         } icsk_mtup;
         u32                       icsk_ca_priv[16];
+        u32                       icsk_user_timeout;
 #define ICSK_CA_PRIV_SIZE       (16 * sizeof(u32))
 };
 
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 9b5d08f4f6e8..88bdd010d65d 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -27,7 +27,7 @@ static inline int INET_ECN_is_not_ect(__u8 dsfield)
 
 static inline int INET_ECN_is_capable(__u8 dsfield)
 {
-        return (dsfield & INET_ECN_ECT_0);
+        return dsfield & INET_ECN_ECT_0;
 }
 
 static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
diff --git a/include/net/ip.h b/include/net/ip.h
index 890f9725d681..dbee3fe260e1 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -53,7 +53,7 @@ struct ipcm_cookie {
         __be32                  addr;
         int                     oif;
         struct ip_options       *opt;
-        union skb_shared_tx     shtx;
+        __u8                    tx_flags;
 };
 
 #define IPCB(skb) ((struct inet_skb_parm*)((skb)->cb))
@@ -238,9 +238,9 @@ int ip_decrease_ttl(struct iphdr *iph)
 static inline
 int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 {
-        return (inet_sk(sk)->pmtudisc == IP_PMTUDISC_DO ||
+        return  inet_sk(sk)->pmtudisc == IP_PMTUDISC_DO ||
                 (inet_sk(sk)->pmtudisc == IP_PMTUDISC_WANT &&
-                 !(dst_metric_locked(dst, RTAX_MTU))));
+                 !(dst_metric_locked(dst, RTAX_MTU)));
 }
 
 extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 1f8412410998..4a3cd2cd2f5e 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -262,7 +262,7 @@ static inline int ipv6_addr_scope(const struct in6_addr *addr)
 
 static inline int __ipv6_addr_src_scope(int type)
 {
-        return (type == IPV6_ADDR_ANY ? __IPV6_ADDR_SCOPE_INVALID : (type >> 16));
+        return (type == IPV6_ADDR_ANY) ? __IPV6_ADDR_SCOPE_INVALID : (type >> 16);
 }
 
 static inline int ipv6_addr_src_scope(const struct in6_addr *addr)
@@ -279,10 +279,10 @@ static inline int
 ipv6_masked_addr_cmp(const struct in6_addr *a1, const struct in6_addr *m,
                      const struct in6_addr *a2)
 {
-        return (!!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
-                   ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
-                   ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
-                   ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3])));
+        return !!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
+                  ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
+                  ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
+                  ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3]));
 }
 
 static inline void ipv6_addr_copy(struct in6_addr *a1, const struct in6_addr *a2)
@@ -317,10 +317,10 @@ static inline void ipv6_addr_set(struct in6_addr *addr,
 static inline int ipv6_addr_equal(const struct in6_addr *a1,
                                   const struct in6_addr *a2)
 {
-        return (((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
-                 (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
-                 (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
-                 (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0);
+        return ((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
+                (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
+                (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
+                (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0;
 }
 
 static inline int __ipv6_prefix_equal(const __be32 *a1, const __be32 *a2,
@@ -373,20 +373,20 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a);
 
 static inline int ipv6_addr_any(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] | 
-                 a->s6_addr32[2] | a->s6_addr32[3] ) == 0); 
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                a->s6_addr32[2] | a->s6_addr32[3]) == 0;
 }
 
 static inline int ipv6_addr_loopback(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] |
-                 a->s6_addr32[2] | (a->s6_addr32[3] ^ htonl(1))) == 0);
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                a->s6_addr32[2] | (a->s6_addr32[3] ^ htonl(1))) == 0;
 }
 
 static inline int ipv6_addr_v4mapped(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] |
-                 (a->s6_addr32[2] ^ htonl(0x0000ffff))) == 0);
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                 (a->s6_addr32[2] ^ htonl(0x0000ffff))) == 0;
 }
 
 /*
@@ -395,8 +395,7 @@ static inline int ipv6_addr_v4mapped(const struct in6_addr *a)
  */
 static inline int ipv6_addr_orchid(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] & htonl(0xfffffff0))
-                == htonl(0x20010010));
+        return (a->s6_addr32[0] & htonl(0xfffffff0)) == htonl(0x20010010);
 }
 
 static inline void ipv6_addr_set_v4mapped(const __be32 addr,
@@ -441,7 +440,7 @@ static inline int __ipv6_addr_diff(const void *token1, const void *token2, int a
          *      if returned value is greater than prefix length.
          *                                      --ANK (980803)
          */
-        return (addrlen << 5);
+        return addrlen << 5;
 }
 
 static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_addr *a2)
diff --git a/include/net/irda/irlan_common.h b/include/net/irda/irlan_common.h
index 73cacb3ac16c..0af8b8dfbc22 100644
--- a/include/net/irda/irlan_common.h
+++ b/include/net/irda/irlan_common.h
@@ -171,7 +171,6 @@ struct irlan_cb {
         int    magic;
         struct list_head  dev_list;
         struct net_device *dev;        /* Ethernet device structure*/
-        struct net_device_stats stats;
 
         __u32 saddr;               /* Source device address */
         __u32 daddr;               /* Destination device address */
diff --git a/include/net/irda/irlan_event.h b/include/net/irda/irlan_event.h
index 6d9539f05806..018b5a77e610 100644
--- a/include/net/irda/irlan_event.h
+++ b/include/net/irda/irlan_event.h
@@ -67,7 +67,7 @@ typedef enum {
         IRLAN_WATCHDOG_TIMEOUT,
 } IRLAN_EVENT;
 
-extern char *irlan_state[];
+extern const char * const irlan_state[];
 
 void irlan_do_client_event(struct irlan_cb *self, IRLAN_EVENT event, 
                            struct sk_buff *skb);
diff --git a/include/net/irda/irlap.h b/include/net/irda/irlap.h
index 9d0c78ea92f5..17fcd964f9d9 100644
--- a/include/net/irda/irlap.h
+++ b/include/net/irda/irlap.h
@@ -282,7 +282,7 @@ static inline int irlap_is_primary(struct irlap_cb *self)
         default:
                 ret = -1;
         }
-        return(ret);
+        return ret;
 }
 
 /* Clear a pending IrLAP disconnect. - Jean II */
diff --git a/include/net/irda/irlmp.h b/include/net/irda/irlmp.h
index 3ffc1d0f93d6..fff11b7fe8a4 100644
--- a/include/net/irda/irlmp.h
+++ b/include/net/irda/irlmp.h
@@ -274,7 +274,7 @@ static inline int irlmp_lap_tx_queue_full(struct lsap_cb *self)
         if (self->lap->irlap == NULL)
                 return 0;
 
-        return(IRLAP_GET_TX_QUEUE_LEN(self->lap->irlap) >= LAP_HIGH_THRESHOLD);
+        return IRLAP_GET_TX_QUEUE_LEN(self->lap->irlap) >= LAP_HIGH_THRESHOLD;
 }
 
 /* After doing a irlmp_dup(), this get one of the two socket back into
diff --git a/include/net/irda/irttp.h b/include/net/irda/irttp.h
index 11aee7a2972a..af4b87721d13 100644
--- a/include/net/irda/irttp.h
+++ b/include/net/irda/irttp.h
@@ -204,7 +204,7 @@ static inline int irttp_is_primary(struct tsap_cb *self)
             (self->lsap->lap == NULL) ||
             (self->lsap->lap->irlap == NULL))
                 return -2;
-        return(irlap_is_primary(self->lsap->lap->irlap));
+        return irlap_is_primary(self->lsap->lap->irlap);
 }
 
 #endif /* IRTTP_H */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b0787a1dea90..12a49f0ba32c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -149,6 +149,7 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_ARP_FILTER: Hardware ARP filter address list or state changed.
  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
  *      that it is only ever disabled for station mode.
+ * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -165,6 +166,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_IBSS                = 1<<11,
         BSS_CHANGED_ARP_FILTER          = 1<<12,
         BSS_CHANGED_QOS                 = 1<<13,
+        BSS_CHANGED_IDLE                = 1<<14,
 
         /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -223,6 +225,9 @@ enum ieee80211_bss_change {
  *      hardware must not perform any ARP filtering. Note, that the filter will
  *      be enabled also in promiscuous mode.
  * @qos: This is a QoS-enabled BSS.
+ * @idle: This interface is idle. There's also a global idle flag in the
+ *      hardware config which may be more appropriate depending on what
+ *      your driver/device needs to do.
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
@@ -247,6 +252,7 @@ struct ieee80211_bss_conf {
         u8 arp_addr_cnt;
         bool arp_filter_enabled;
         bool qos;
+        bool idle;
 };
 
 /**
@@ -763,6 +769,8 @@ struct ieee80211_channel_switch {
  * @bss_conf: BSS configuration for this interface, either our own
  *      or the BSS we're associated to
  * @addr: address of this interface
+ * @p2p: indicates whether this AP or STA interface is a p2p
+ *      interface, i.e. a GO or p2p-sta respectively
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -770,6 +778,7 @@ struct ieee80211_vif {
         enum nl80211_iftype type;
         struct ieee80211_bss_conf bss_conf;
         u8 addr[ETH_ALEN];
+        bool p2p;
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -783,20 +792,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 }
 
 /**
- * enum ieee80211_key_alg - key algorithm
- * @ALG_WEP: WEP40 or WEP104
- * @ALG_TKIP: TKIP
- * @ALG_CCMP: CCMP (AES)
- * @ALG_AES_CMAC: AES-128-CMAC
- */
-enum ieee80211_key_alg {
-        ALG_WEP,
-        ALG_TKIP,
-        ALG_CCMP,
-        ALG_AES_CMAC,
-};
-
-/**
  * enum ieee80211_key_flags - key flags
  *
  * These flags are used for communication about keys between the driver
@@ -833,7 +828,7 @@ enum ieee80211_key_flags {
  * @hw_key_idx: To be set by the driver, this is the key index the driver
  *      wants to be given when a frame is transmitted and needs to be
  *      encrypted in hardware.
- * @alg: The key algorithm.
+ * @cipher: The key's cipher suite selector.
  * @flags: key flags, see &enum ieee80211_key_flags.
  * @keyidx: the key index (0-3)
  * @keylen: key material length
@@ -846,7 +841,7 @@ enum ieee80211_key_flags {
  * @iv_len: The IV length for this key type
  */
 struct ieee80211_key_conf {
-        enum ieee80211_key_alg alg;
+        u32 cipher;
         u8 icv_len;
         u8 iv_len;
         u8 hw_key_idx;
@@ -1102,6 +1097,10 @@ enum ieee80211_hw_flags {
  *
  * @max_rates: maximum number of alternate rate retry stages
  * @max_rate_tries: maximum number of tries for each stage
+ *
+ * @napi_weight: weight used for NAPI polling.  You must specify an
+ *      appropriate value here if a napi_poll operation is provided
+ *      by your driver.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1113,6 +1112,7 @@ struct ieee80211_hw {
         int channel_change_time;
         int vif_data_size;
         int sta_data_size;
+        int napi_weight;
         u16 queues;
         u16 max_listen_interval;
         s8 max_signal;
@@ -1245,8 +1245,8 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * %IEEE80211_CONF_PS flag enabled means that the powersave mode defined in
  * IEEE 802.11-2007 section 11.2 is enabled. This is not to be confused
  * with hardware wakeup and sleep states. Driver is responsible for waking
- * up the hardware before issueing commands to the hardware and putting it
- * back to sleep at approriate times.
+ * up the hardware before issuing commands to the hardware and putting it
+ * back to sleep at appropriate times.
  *
  * When PS is enabled, hardware needs to wakeup for beacons and receive the
  * buffered multicast/broadcast frames after the beacon. Also it must be
@@ -1267,7 +1267,7 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * there's data traffic and still saving significantly power in idle
  * periods.
  *
- * Dynamic powersave is supported by simply mac80211 enabling and disabling
+ * Dynamic powersave is simply supported by mac80211 enabling and disabling
  * PS based on traffic. Driver needs to only set %IEEE80211_HW_SUPPORTS_PS
  * flag and mac80211 will handle everything automatically. Additionally,
  * hardware having support for the dynamic PS feature may set the
@@ -1540,6 +1540,12 @@ enum ieee80211_ampdu_mlme_action {
  *      negative error code (which will be seen in userspace.)
  *      Must be implemented and can sleep.
  *
+ * @change_interface: Called when a netdevice changes type. This callback
+ *      is optional, but only if it is supported can interface types be
+ *      switched while the interface is UP. The callback may sleep.
+ *      Note that while an interface is being switched, it will not be
+ *      found by the interface iteration callbacks.
+ *
  * @remove_interface: Notifies a driver that an interface is going down.
  *      The @stop callback is called after this if it is the last interface
  *      and no monitor interfaces are present.
@@ -1687,6 +1693,8 @@ enum ieee80211_ampdu_mlme_action {
  *      switch operation for CSAs received from the AP may implement this
  *      callback. They must then call ieee80211_chswitch_done() to indicate
  *      completion of the channel switch.
+ *
+ * @napi_poll: Poll Rx queue for incoming data frames.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1694,6 +1702,9 @@ struct ieee80211_ops {
         void (*stop)(struct ieee80211_hw *hw);
         int (*add_interface)(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
+        int (*change_interface)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                enum nl80211_iftype new_type, bool p2p);
         void (*remove_interface)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif);
         int (*config)(struct ieee80211_hw *hw, u32 changed);
@@ -1752,6 +1763,7 @@ struct ieee80211_ops {
         void (*flush)(struct ieee80211_hw *hw, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
+        int (*napi_poll)(struct ieee80211_hw *hw, int budget);
 };
 
 /**
@@ -1897,6 +1909,22 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
+/** ieee80211_napi_schedule - schedule NAPI poll
+ *
+ * Use this function to schedule NAPI polling on a device.
+ *
+ * @hw: the hardware to start polling
+ */
+void ieee80211_napi_schedule(struct ieee80211_hw *hw);
+
+/** ieee80211_napi_complete - complete NAPI polling
+ *
+ * Use this function to finish NAPI polling on a device.
+ *
+ * @hw: the hardware to stop polling
+ */
+void ieee80211_napi_complete(struct ieee80211_hw *hw);
+
 /**
  * ieee80211_rx - receive frame
  *
@@ -2252,7 +2280,8 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw);
  *
  * When hardware scan offload is used (i.e. the hw_scan() callback is
  * assigned) this function needs to be called by the driver to notify
- * mac80211 that the scan finished.
+ * mac80211 that the scan finished. This function can be called from
+ * any context, including hardirq context.
  *
  * @hw: the hardware that finished the scan
  * @aborted: set to true if scan was aborted
@@ -2267,6 +2296,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted);
  * This function allows the iterator function to sleep, when the iterator
  * function is atomic @ieee80211_iterate_active_interfaces_atomic can
  * be used.
+ * Does not iterate over a new interface during add_interface()
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call
@@ -2284,6 +2314,7 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
  * hardware that are currently active and calls the callback for them.
  * This function requires the iterator callback function to be atomic,
  * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
+ * Does not iterate over a new interface during add_interface()
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call, cannot sleep
@@ -2442,7 +2473,7 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING and
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER and
  * %IEEE80211_CONF_PS is set, the driver needs to inform whenever the
  * hardware is not receiving beacons with this function.
  */
@@ -2453,7 +2484,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING, and
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER, and
  * %IEEE80211_CONF_PS and %IEEE80211_HW_CONNECTION_MONITOR are set, the driver
  * needs to inform if the connection to the AP has been lost.
  *
@@ -2518,6 +2549,18 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
  */
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success);
 
+/**
+ * ieee80211_request_smps - request SM PS transition
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @smps_mode: new SM PS mode
+ *
+ * This allows the driver to request an SM PS transition in managed
+ * mode. This is useful when the driver has more information than
+ * the stack about possible interference, for example by bluetooth.
+ */
+void ieee80211_request_smps(struct ieee80211_vif *vif,
+                            enum ieee80211_smps_mode smps_mode);
+
 /* Rate control API */
 
 /**
@@ -2681,4 +2724,26 @@ conf_is_ht(struct ieee80211_conf *conf)
         return conf->channel_type != NL80211_CHAN_NO_HT;
 }
 
+static inline enum nl80211_iftype
+ieee80211_iftype_p2p(enum nl80211_iftype type, bool p2p)
+{
+        if (p2p) {
+                switch (type) {
+                case NL80211_IFTYPE_STATION:
+                        return NL80211_IFTYPE_P2P_CLIENT;
+                case NL80211_IFTYPE_AP:
+                        return NL80211_IFTYPE_P2P_GO;
+                default:
+                        break;
+                }
+        }
+        return type;
+}
+
+static inline enum nl80211_iftype
+ieee80211_vif_type_p2p(struct ieee80211_vif *vif)
+{
+        return ieee80211_iftype_p2p(vif->type, vif->p2p);
+}
+
 #endif /* MAC80211_H */
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
index 35672b1cf44a..37f23dc05de8 100644
--- a/include/net/phonet/pep.h
+++ b/include/net/phonet/pep.h
@@ -77,6 +77,11 @@ static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
 #define MAX_PNPIPE_HEADER (MAX_PHONET_HEADER + 4)
 
 enum {
+        PNS_PIPE_CREATE_REQ = 0x00,
+        PNS_PIPE_CREATE_RESP,
+        PNS_PIPE_REMOVE_REQ,
+        PNS_PIPE_REMOVE_RESP,
+
         PNS_PIPE_DATA = 0x20,
         PNS_PIPE_ALIGNED_DATA,
 
diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h
index 7b114079a51b..d5df797f9540 100644
--- a/include/net/phonet/phonet.h
+++ b/include/net/phonet/phonet.h
@@ -54,6 +54,11 @@ void pn_sock_hash(struct sock *sk);
 void pn_sock_unhash(struct sock *sk);
 int pn_sock_get_port(struct sock *sk, unsigned short sport);
 
+struct sock *pn_find_sock_by_res(struct net *net, u8 res);
+int pn_sock_bind_res(struct sock *sock, u8 res);
+int pn_sock_unbind_res(struct sock *sk, u8 res);
+void pn_sock_unbind_all_res(struct sock *sk);
+
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target);
 
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
index 2d16783d5e20..13649eb57413 100644
--- a/include/net/phonet/pn_dev.h
+++ b/include/net/phonet/pn_dev.h
@@ -57,5 +57,6 @@ struct net_device *phonet_route_output(struct net *net, u8 daddr);
 #define PN_NO_ADDR      0xff
 
 extern const struct file_operations pn_sock_seq_fops;
+extern const struct file_operations pn_res_seq_fops;
 
 #endif
diff --git a/include/net/raw.h b/include/net/raw.h
index 43c57502659b..42ce6fe7a2d5 100644
--- a/include/net/raw.h
+++ b/include/net/raw.h
@@ -45,7 +45,10 @@ struct raw_iter_state {
         struct raw_hashinfo *h;
 };
 
-#define raw_seq_private(seq) ((struct raw_iter_state *)(seq)->private)
+static inline struct raw_iter_state *raw_seq_private(struct seq_file *seq)
+{
+        return seq->private;
+}
 void *raw_seq_start(struct seq_file *seq, loff_t *pos);
 void *raw_seq_next(struct seq_file *seq, void *v, loff_t *pos);
 void raw_seq_stop(struct seq_file *seq, void *v);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 3c8728aaab4e..eda8808fdacd 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -601,7 +601,7 @@ static inline u32 qdisc_l2t(struct qdisc_rate_table* rtab, unsigned int pktlen)
                 slot = 0;
         slot >>= rtab->rate.cell_log;
         if (slot > 255)
-                return (rtab->data[255]*(slot >> 8) + rtab->data[slot & 0xFF]);
+                return rtab->data[255]*(slot >> 8) + rtab->data[slot & 0xFF];
         return rtab->data[slot];
 }
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 65946bc43d00..505845ddb0be 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -275,24 +275,35 @@ struct sctp_mib {
 /* Print debugging messages.  */
 #if SCTP_DEBUG
 extern int sctp_debug_flag;
-#define SCTP_DEBUG_PRINTK(whatever...) \
-        ((void) (sctp_debug_flag && printk(KERN_DEBUG whatever)))
-#define SCTP_DEBUG_PRINTK_IPADDR(lead, trail, leadparm, saddr, otherparms...) \
-        if (sctp_debug_flag) { \
-                if (saddr->sa.sa_family == AF_INET6) { \
-                        printk(KERN_DEBUG \
-                               lead "%pI6" trail, \
-                               leadparm, \
-                               &saddr->v6.sin6_addr, \
-                               otherparms); \
-                } else { \
-                        printk(KERN_DEBUG \
-                               lead "%pI4" trail, \
-                               leadparm, \
-                               &saddr->v4.sin_addr.s_addr, \
-                               otherparms); \
-                } \
-        }
+#define SCTP_DEBUG_PRINTK(fmt, args...)                 \
+do {                                                    \
+        if (sctp_debug_flag)                            \
+                printk(KERN_DEBUG pr_fmt(fmt), ##args); \
+} while (0)
+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)            \
+do {                                                    \
+        if (sctp_debug_flag)                            \
+                pr_cont(fmt, ##args);                   \
+} while (0)
+#define SCTP_DEBUG_PRINTK_IPADDR(fmt_lead, fmt_trail,                   \
+                                 args_lead, saddr, args_trail...)       \
+do {                                                                    \
+        if (sctp_debug_flag) {                                          \
+                if (saddr->sa.sa_family == AF_INET6) {                  \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt(fmt_lead "%pI6" fmt_trail),       \
+                               args_lead,                               \
+                               &saddr->v6.sin6_addr,                    \
+                               args_trail);                             \
+                } else {                                                \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt(fmt_lead "%pI4" fmt_trail),       \
+                               args_lead,                               \
+                               &saddr->v4.sin_addr.s_addr,              \
+                               args_trail);                             \
+                }                                                       \
+        }                                                               \
+} while (0)
 #define SCTP_ENABLE_DEBUG { sctp_debug_flag = 1; }
 #define SCTP_DISABLE_DEBUG { sctp_debug_flag = 0; }
 
@@ -306,6 +317,7 @@ extern int sctp_debug_flag;
 #else   /* SCTP_DEBUG */
 
 #define SCTP_DEBUG_PRINTK(whatever...)
+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
 #define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
 #define SCTP_ENABLE_DEBUG
 #define SCTP_DISABLE_DEBUG
@@ -393,7 +405,7 @@ static inline void sctp_v6_del_protocol(void) { return; }
 /* Map an association to an assoc_id. */
 static inline sctp_assoc_t sctp_assoc2id(const struct sctp_association *asoc)
 {
-        return (asoc?asoc->assoc_id:0);
+        return asoc ? asoc->assoc_id : 0;
 }
 
 /* Look up the association by its id.  */
@@ -461,7 +473,7 @@ static inline void sctp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 /* Tests if the list has one and only one entry. */
 static inline int sctp_list_single_entry(struct list_head *head)
 {
-        return ((head->next != head) && (head->next == head->prev));
+        return (head->next != head) && (head->next == head->prev);
 }
 
 /* Generate a random jitter in the range of -50% ~ +50% of input RTO. */
@@ -619,13 +631,13 @@ static inline int sctp_sanity_check(void)
 /* This is the hash function for the SCTP port hash table. */
 static inline int sctp_phashfn(__u16 lport)
 {
-        return (lport & (sctp_port_hashsize - 1));
+        return lport & (sctp_port_hashsize - 1);
 }
 
 /* This is the hash function for the endpoint hash table. */
 static inline int sctp_ep_hashfn(__u16 lport)
 {
-        return (lport & (sctp_ep_hashsize - 1));
+        return lport & (sctp_ep_hashsize - 1);
 }
 
 /* This is the hash function for the association hash table. */
@@ -633,7 +645,7 @@ static inline int sctp_assoc_hashfn(__u16 lport, __u16 rport)
 {
         int h = (lport << 16) + rport;
         h ^= h>>8;
-        return (h & (sctp_assoc_hashsize - 1));
+        return h & (sctp_assoc_hashsize - 1);
 }
 
 /* This is the hash function for the association hash table.  This is
@@ -644,7 +656,7 @@ static inline int sctp_vtag_hashfn(__u16 lport, __u16 rport, __u32 vtag)
 {
         int h = (lport << 16) + rport;
         h ^= vtag;
-        return (h & (sctp_assoc_hashsize-1));
+        return h & (sctp_assoc_hashsize - 1);
 }
 
 #define sctp_for_each_hentry(epb, node, head) \
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 4088c89a9055..9352d12f02de 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -345,12 +345,12 @@ enum {
 
 static inline int TSN_lt(__u32 s, __u32 t)
 {
-        return (((s) - (t)) & TSN_SIGN_BIT);
+        return ((s) - (t)) & TSN_SIGN_BIT;
 }
 
 static inline int TSN_lte(__u32 s, __u32 t)
 {
-        return (((s) == (t)) || (((s) - (t)) & TSN_SIGN_BIT));
+        return ((s) == (t)) || (((s) - (t)) & TSN_SIGN_BIT);
 }
 
 /* Compare two SSNs */
@@ -369,12 +369,12 @@ enum {
 
 static inline int SSN_lt(__u16 s, __u16 t)
 {
-        return (((s) - (t)) & SSN_SIGN_BIT);
+        return ((s) - (t)) & SSN_SIGN_BIT;
 }
 
 static inline int SSN_lte(__u16 s, __u16 t)
 {
-        return (((s) == (t)) || (((s) - (t)) & SSN_SIGN_BIT));
+        return ((s) == (t)) || (((s) - (t)) & SSN_SIGN_BIT);
 }
 
 /*
@@ -388,7 +388,7 @@ enum {
 
 static inline int ADDIP_SERIAL_gte(__u16 s, __u16 t)
 {
-        return (((s) == (t)) || (((t) - (s)) & ADDIP_SERIAL_SIGN_BIT));
+        return ((s) == (t)) || (((t) - (s)) & ADDIP_SERIAL_SIGN_BIT);
 }
 
 /* Check VTAG of the packet matches the sender's own tag. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index f9e7473613bd..69fef4fb79c0 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -847,7 +847,7 @@ void sctp_packet_free(struct sctp_packet *);
 
 static inline int sctp_packet_empty(struct sctp_packet *packet)
 {
-        return (packet->size == packet->overhead);
+        return packet->size == packet->overhead;
 }
 
 /* This represents a remote transport address.
diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
index 4aabc5a96cf6..e7728bc14ccf 100644
--- a/include/net/sctp/tsnmap.h
+++ b/include/net/sctp/tsnmap.h
@@ -157,7 +157,7 @@ __u16 sctp_tsnmap_pending(struct sctp_tsnmap *map);
 /* Is there a gap in the TSN map?  */
 static inline int sctp_tsnmap_has_gap(const struct sctp_tsnmap *map)
 {
-        return (map->cumulative_tsn_ack_point != map->max_tsn_seen);
+        return map->cumulative_tsn_ack_point != map->max_tsn_seen;
 }
 
 /* Mark a duplicate TSN.  Note:  limit the storage of duplicate TSN
diff --git a/include/net/sock.h b/include/net/sock.h
index adab9dc58183..73a4f9702a65 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1558,7 +1558,11 @@ static inline void sk_wake_async(struct sock *sk, int how, int band)
 }
 
 #define SOCK_MIN_SNDBUF 2048
-#define SOCK_MIN_RCVBUF 256
+/*
+ * Since sk_rmem_alloc sums skb->truesize, even a small frame might need
+ * sizeof(sk_buff) + MTU + padding, unless net driver perform copybreak
+ */
+#define SOCK_MIN_RCVBUF (2048 + sizeof(struct sk_buff))
 
 static inline void sk_stream_moderate_sndbuf(struct sock *sk)
 {
@@ -1670,17 +1674,13 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
 
 /**
  * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
- * @msg:        outgoing packet
  * @sk:         socket sending this packet
- * @shtx:       filled with instructions for time stamping
+ * @tx_flags:   filled with instructions for time stamping
  *
  * Currently only depends on SOCK_TIMESTAMPING* flags. Returns error code if
  * parameters are invalid.
  */
-extern int sock_tx_timestamp(struct msghdr *msg,
-                             struct sock *sk,
-                             union skb_shared_tx *shtx);
-
+extern int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
new file mode 100644
index 000000000000..9e8710be7a04
--- /dev/null
+++ b/include/net/tc_act/tc_csum.h
@@ -0,0 +1,15 @@
+#ifndef __NET_TC_CSUM_H
+#define __NET_TC_CSUM_H
+
+#include <linux/types.h>
+#include <net/act_api.h>
+
+struct tcf_csum {
+        struct tcf_common common;
+
+        u32 update_flags;
+};
+#define to_tcf_csum(pc) \
+        container_of(pc,struct tcf_csum,common)
+
+#endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 3e4b33e36602..914a60c7ad62 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -803,6 +803,15 @@ static inline __u32 tcp_current_ssthresh(const struct sock *sk)
 /* Use define here intentionally to get WARN_ON location shown at the caller */
 #define tcp_verify_left_out(tp) WARN_ON(tcp_left_out(tp) > tp->packets_out)
 
+/*
+ * Convert RFC 3390 larger initial window into an equivalent number of packets.
+ * This is based on the numbers specified in RFC 5681, 3.1.
+ */
+static inline u32 rfc3390_bytes_to_packets(const u32 smss)
+{
+        return smss <= 1095 ? 4 : (smss > 2190 ? 2 : 3);
+}
+
 extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
 extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
 
diff --git a/include/net/tipc/tipc_msg.h b/include/net/tipc/tipc_msg.h
index 2e159a812f83..ffe50b4e7b93 100644
--- a/include/net/tipc/tipc_msg.h
+++ b/include/net/tipc/tipc_msg.h
@@ -107,7 +107,7 @@ static inline u32 msg_hdr_sz(struct tipc_msg *m)
 
 static inline int msg_short(struct tipc_msg *m)
 {
-        return (msg_hdr_sz(m) == 24);
+        return msg_hdr_sz(m) == 24;
 }
 
 static inline u32 msg_size(struct tipc_msg *m)
@@ -117,7 +117,7 @@ static inline u32 msg_size(struct tipc_msg *m)
 
 static inline u32 msg_data_sz(struct tipc_msg *m)
 {
-        return (msg_size(m) - msg_hdr_sz(m));
+        return msg_size(m) - msg_hdr_sz(m);
 }
 
 static inline unchar *msg_data(struct tipc_msg *m)
@@ -132,17 +132,17 @@ static inline u32 msg_type(struct tipc_msg *m)
 
 static inline u32 msg_named(struct tipc_msg *m)
 {
-        return (msg_type(m) == TIPC_NAMED_MSG);
+        return msg_type(m) == TIPC_NAMED_MSG;
 }
 
 static inline u32 msg_mcast(struct tipc_msg *m)
 {
-        return (msg_type(m) == TIPC_MCAST_MSG);
+        return msg_type(m) == TIPC_MCAST_MSG;
 }
 
 static inline u32 msg_connected(struct tipc_msg *m)
 {
-        return (msg_type(m) == TIPC_CONN_MSG);
+        return msg_type(m) == TIPC_CONN_MSG;
 }
 
 static inline u32 msg_errcode(struct tipc_msg *m)
diff --git a/net/802/fc.c b/net/802/fc.c
index 34cf1ee014b8..1e49f2d4ea96 100644
--- a/net/802/fc.c
+++ b/net/802/fc.c
@@ -70,7 +70,7 @@ static int fc_header(struct sk_buff *skb, struct net_device *dev,
         if(daddr)
         {
                 memcpy(fch->daddr,daddr,dev->addr_len);
-                return(hdr_len);
+                return hdr_len;
         }
         return -hdr_len;
 }
diff --git a/net/802/fddi.c b/net/802/fddi.c
index 3ef0ab0a543a..94b3ad08f39a 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -82,10 +82,10 @@ static int fddi_header(struct sk_buff *skb, struct net_device *dev,
         if (daddr != NULL)
         {
                 memcpy(fddi->daddr, daddr, dev->addr_len);
-                return(hl);
+                return hl;
         }
 
-        return(-hl);
+        return -hl;
 }
 
 
@@ -108,7 +108,7 @@ static int fddi_rebuild_header(struct sk_buff	*skb)
         {
                 printk("%s: Don't know how to resolve type %04X addresses.\n",
                        skb->dev->name, ntohs(fddi->hdr.llc_snap.ethertype));
-                return(0);
+                return 0;
         }
 }
 
@@ -162,7 +162,7 @@ __be16 fddi_type_trans(struct sk_buff *skb, struct net_device *dev)
 
         /* Assume 802.2 SNAP frames, for now */
 
-        return(type);
+        return type;
 }
 
 EXPORT_SYMBOL(fddi_type_trans);
@@ -170,9 +170,9 @@ EXPORT_SYMBOL(fddi_type_trans);
 int fddi_change_mtu(struct net_device *dev, int new_mtu)
 {
         if ((new_mtu < FDDI_K_SNAP_HLEN) || (new_mtu > FDDI_K_SNAP_DLEN))
-                return(-EINVAL);
+                return -EINVAL;
         dev->mtu = new_mtu;
-        return(0);
+        return 0;
 }
 EXPORT_SYMBOL(fddi_change_mtu);
 
diff --git a/net/802/hippi.c b/net/802/hippi.c
index cd3e8e929529..91aca8780fd0 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -152,7 +152,7 @@ int hippi_change_mtu(struct net_device *dev, int new_mtu)
         if ((new_mtu < 68) || (new_mtu > 65280))
                 return -EINVAL;
         dev->mtu = new_mtu;
-        return(0);
+        return 0;
 }
 EXPORT_SYMBOL(hippi_change_mtu);
 
diff --git a/net/802/tr.c b/net/802/tr.c
index 1c6e596074df..5e20cf8a074b 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -145,7 +145,7 @@ static int tr_header(struct sk_buff *skb, struct net_device *dev,
         {
                 memcpy(trh->daddr,daddr,dev->addr_len);
                 tr_source_route(skb, trh, dev);
-                return(hdr_len);
+                return hdr_len;
         }
 
         return -hdr_len;
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index a2ad15250575..2c6c2bd6e4a9 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -525,6 +525,10 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 break;
 
         case NETDEV_UNREGISTER:
+                /* twiddle thumbs on netns device moves */
+                if (dev->reg_state != NETREG_UNREGISTERING)
+                        break;
+
                 /* Delete all VLANs for this dev. */
                 grp->killall = 1;
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 8d9503ad01da..b26ce343072c 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -25,6 +25,7 @@ struct vlan_priority_tci_mapping {
  *      @rx_multicast: number of received multicast packets
  *      @syncp: synchronization point for 64bit counters
  *      @rx_errors: number of errors
+ *      @rx_dropped: number of dropped packets
  */
 struct vlan_rx_stats {
         u64                     rx_packets;
@@ -32,6 +33,7 @@ struct vlan_rx_stats {
         u64                     rx_multicast;
         struct u64_stats_sync   syncp;
         unsigned long           rx_errors;
+        unsigned long           rx_dropped;
 };
 
 /**
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 01ddb0472f86..0eb486d342dc 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -27,7 +27,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         else if (vlan_id)
                 goto drop;
 
-        return (polling ? netif_receive_skb(skb) : netif_rx(skb));
+        return polling ? netif_receive_skb(skb) : netif_rx(skb);
 
 drop:
         dev_kfree_skb_any(skb);
@@ -35,12 +35,12 @@ drop:
 }
 EXPORT_SYMBOL(__vlan_hwaccel_rx);
 
-int vlan_hwaccel_do_receive(struct sk_buff *skb)
+void vlan_hwaccel_do_receive(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct vlan_rx_stats     *rx_stats;
 
-        skb->dev = vlan_dev_info(dev)->real_dev;
+        skb->dev = vlan_dev_real_dev(dev);
         netif_nit_deliver(skb);
 
         skb->dev = dev;
@@ -69,7 +69,6 @@ int vlan_hwaccel_do_receive(struct sk_buff *skb)
                 break;
         }
         u64_stats_update_end(&rx_stats->syncp);
-        return 0;
 }
 
 struct net_device *vlan_dev_real_dev(const struct net_device *dev)
@@ -106,9 +105,12 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
                 goto drop;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow =
-                        p->dev == skb->dev && !compare_ether_header(
-                                skb_mac_header(p), skb_gro_mac_header(skb));
+                unsigned long diffs;
+
+                diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
+                diffs |= compare_ether_header(skb_mac_header(p),
+                                              skb_gro_mac_header(skb));
+                NAPI_GRO_CB(p)->same_flow = !diffs;
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 3bccdd12a264..94a1feddeb49 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -225,7 +225,10 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                 }
         }
 
-        netif_rx(skb);
+        if (unlikely(netif_rx(skb) == NET_RX_DROP)) {
+                if (rx_stats)
+                        rx_stats->rx_dropped++;
+        }
         rcu_read_unlock();
         return NET_RX_SUCCESS;
 
@@ -843,13 +846,15 @@ static struct rtnl_link_stats64 *vlan_dev_get_stats64(struct net_device *dev, st
                         accum.rx_packets += rxpackets;
                         accum.rx_bytes   += rxbytes;
                         accum.rx_multicast += rxmulticast;
-                        /* rx_errors is an ulong, not protected by syncp */
+                        /* rx_errors, rx_dropped are ulong, not protected by syncp */
                         accum.rx_errors  += p->rx_errors;
+                        accum.rx_dropped += p->rx_dropped;
                 }
                 stats->rx_packets = accum.rx_packets;
                 stats->rx_bytes   = accum.rx_bytes;
                 stats->rx_errors  = accum.rx_errors;
                 stats->multicast  = accum.rx_multicast;
+                stats->rx_dropped = accum.rx_dropped;
         }
         return stats;
 }
diff --git a/net/9p/client.c b/net/9p/client.c
index dc6f2f26d023..f34b9f510818 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -61,13 +61,13 @@ static const match_table_t tokens = {
 
 inline int p9_is_proto_dotl(struct p9_client *clnt)
 {
-        return (clnt->proto_version == p9_proto_2000L);
+        return clnt->proto_version == p9_proto_2000L;
 }
 EXPORT_SYMBOL(p9_is_proto_dotl);
 
 inline int p9_is_proto_dotu(struct p9_client *clnt)
 {
-        return (clnt->proto_version == p9_proto_2000u);
+        return clnt->proto_version == p9_proto_2000u;
 }
 EXPORT_SYMBOL(p9_is_proto_dotu);
 
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index c85109d809ca..078eb162d9bf 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -222,7 +222,7 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
         }
 }
 
-static unsigned int
+static int
 p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt)
 {
         int ret, n;
diff --git a/net/atm/common.c b/net/atm/common.c
index 940404a73b3d..1b9c52a02cd3 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -792,7 +792,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
         default:
                 if (level == SOL_SOCKET)
                         return -EINVAL;
-                        break;
+                break;
         }
         if (!vcc->dev || !vcc->dev->ops->getsockopt)
                 return -EINVAL;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index d98bde1a0ac8..181d70c73d70 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -220,7 +220,6 @@ static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
 static int lec_open(struct net_device *dev)
 {
         netif_start_queue(dev);
-        memset(&dev->stats, 0, sizeof(struct net_device_stats));
 
         return 0;
 }
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index cfdfd7e2a172..26eaebf4aaa9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1103,7 +1103,7 @@ done:
 out:
         release_sock(sk);
 
-        return 0;
+        return err;
 }
 
 /*
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 7805945a5fd6..a1690845dc6e 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -412,7 +412,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 {
         ax25_uid_assoc *user;
         ax25_route *ax25_rt;
-        int err;
+        int err = 0;
 
         if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
                 return -EHOSTUNREACH;
@@ -453,7 +453,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 put:
         ax25_put_route(ax25_rt);
 
-        return 0;
+        return err;
 }
 
 struct sk_buff *ax25_rt_build_path(struct sk_buff *skb, ax25_address *src,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 421c45bd1b95..ed0f22f57668 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -297,13 +297,12 @@ unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *w
                 mask |= POLLERR;
 
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
 
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-                        (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         if (sk->sk_state == BT_CLOSED)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 7dca91bb8c57..15ea84ba344e 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -179,13 +179,13 @@ static unsigned char rfcomm_crc_table[256] = {
 /* FCS on 2 bytes */
 static inline u8 __fcs(u8 *data)
 {
-        return (0xff - __crc(data));
+        return 0xff - __crc(data);
 }
 
 /* FCS on 3 bytes */
 static inline u8 __fcs2(u8 *data)
 {
-        return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
+        return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 }
 
 /* Check FCS */
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c03d2c3ff03e..89ad25a76202 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -61,30 +61,27 @@ static int port_cost(struct net_device *dev)
 }
 
 
-/*
- * Check for port carrier transistions.
- * Called from work queue to allow for calling functions that
- * might sleep (such as speed check), and to debounce.
- */
+/* Check for port carrier transistions. */
 void br_port_carrier_check(struct net_bridge_port *p)
 {
         struct net_device *dev = p->dev;
         struct net_bridge *br = p->br;
 
-        if (netif_carrier_ok(dev))
+        if (netif_running(dev) && netif_carrier_ok(dev))
                 p->path_cost = port_cost(dev);
 
-        if (netif_running(br->dev)) {
-                spin_lock_bh(&br->lock);
-                if (netif_carrier_ok(dev)) {
-                        if (p->state == BR_STATE_DISABLED)
-                                br_stp_enable_port(p);
-                } else {
-                        if (p->state != BR_STATE_DISABLED)
-                                br_stp_disable_port(p);
-                }
-                spin_unlock_bh(&br->lock);
+        if (!netif_running(br->dev))
+                return;
+
+        spin_lock_bh(&br->lock);
+        if (netif_running(dev) && netif_carrier_ok(dev)) {
+                if (p->state == BR_STATE_DISABLED)
+                        br_stp_enable_port(p);
+        } else {
+                if (p->state != BR_STATE_DISABLED)
+                        br_stp_disable_port(p);
         }
+        spin_unlock_bh(&br->lock);
 }
 
 static void release_nbp(struct kobject *kobj)
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 826cd5221536..6d04cfdf4541 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -141,7 +141,7 @@ struct sk_buff *br_handle_frame(struct sk_buff *skb)
         const unsigned char *dest = eth_hdr(skb)->h_dest;
         int (*rhook)(struct sk_buff *skb);
 
-        if (skb->pkt_type == PACKET_LOOPBACK)
+        if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
                 return skb;
 
         if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 137f23259a93..77f7b5fda45a 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -209,6 +209,72 @@ static inline void nf_bridge_update_protocol(struct sk_buff *skb)
                 skb->protocol = htons(ETH_P_PPP_SES);
 }
 
+/* When handing a packet over to the IP layer
+ * check whether we have a skb that is in the
+ * expected format
+ */
+
+int br_parse_ip_options(struct sk_buff *skb)
+{
+        struct ip_options *opt;
+        struct iphdr *iph;
+        struct net_device *dev = skb->dev;
+        u32 len;
+
+        iph = ip_hdr(skb);
+        opt = &(IPCB(skb)->opt);
+
+        /* Basic sanity checks */
+        if (iph->ihl < 5 || iph->version != 4)
+                goto inhdr_error;
+
+        if (!pskb_may_pull(skb, iph->ihl*4))
+                goto inhdr_error;
+
+        iph = ip_hdr(skb);
+        if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
+                goto inhdr_error;
+
+        len = ntohs(iph->tot_len);
+        if (skb->len < len) {
+                IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INTRUNCATEDPKTS);
+                goto drop;
+        } else if (len < (iph->ihl*4))
+                goto inhdr_error;
+
+        if (pskb_trim_rcsum(skb, len)) {
+                IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
+                goto drop;
+        }
+
+        /* Zero out the CB buffer if no options present */
+        if (iph->ihl == 5) {
+                memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+                return 0;
+        }
+
+        opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
+        if (ip_options_compile(dev_net(dev), opt, skb))
+                goto inhdr_error;
+
+        /* Check correct handling of SRR option */
+        if (unlikely(opt->srr)) {
+                struct in_device *in_dev = __in_dev_get_rcu(dev);
+                if (in_dev && !IN_DEV_SOURCE_ROUTE(in_dev))
+                        goto drop;
+
+                if (ip_options_rcv_srr(skb))
+                        goto drop;
+        }
+
+        return 0;
+
+inhdr_error:
+        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
+drop:
+        return -1;
+}
+
 /* Fill in the header for fragmented IP packets handled by
  * the IPv4 connection tracking code.
  */
@@ -549,7 +615,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 {
         struct net_bridge_port *p;
         struct net_bridge *br;
-        struct iphdr *iph;
         __u32 len = nf_bridge_encap_header_len(skb);
 
         if (unlikely(!pskb_may_pull(skb, len)))
@@ -578,28 +643,9 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
         nf_bridge_pull_encap_header_rcsum(skb);
 
-        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-                goto inhdr_error;
-
-        iph = ip_hdr(skb);
-        if (iph->ihl < 5 || iph->version != 4)
-                goto inhdr_error;
-
-        if (!pskb_may_pull(skb, 4 * iph->ihl))
-                goto inhdr_error;
-
-        iph = ip_hdr(skb);
-        if (ip_fast_csum((__u8 *) iph, iph->ihl) != 0)
-                goto inhdr_error;
-
-        len = ntohs(iph->tot_len);
-        if (skb->len < len || len < 4 * iph->ihl)
-                goto inhdr_error;
-
-        pskb_trim_rcsum(skb, len);
-
-        /* BUG: Should really parse the IP options here. */
-        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+        if (br_parse_ip_options(skb))
+                /* Drop invalid packet */
+                goto out;
 
         nf_bridge_put(skb->nf_bridge);
         if (!nf_bridge_alloc(skb))
@@ -614,8 +660,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
         return NF_STOLEN;
 
-inhdr_error:
-//      IP_INC_STATS_BH(IpInHdrErrors);
 out:
         return NF_DROP;
 }
@@ -759,14 +803,19 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
 #if defined(CONFIG_NF_CONNTRACK_IPV4) || defined(CONFIG_NF_CONNTRACK_IPV4_MODULE)
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
+        int ret;
+
         if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
             skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
             !skb_is_gso(skb)) {
-                /* BUG: Should really parse the IP options here. */
-                memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-                return ip_fragment(skb, br_dev_queue_push_xmit);
+                if (br_parse_ip_options(skb))
+                        /* Drop invalid packet */
+                        return NF_DROP;
+                ret = ip_fragment(skb, br_dev_queue_push_xmit);
         } else
-                return br_dev_queue_push_xmit(skb);
+                ret = br_dev_queue_push_xmit(skb);
+
+        return ret;
 }
 #else
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 0b586e9d1378..b99369a055d1 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -9,6 +9,8 @@
  *  and Sakari Ailus <sakari.ailus@nokia.com>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -171,7 +173,7 @@ static int receive(struct sk_buff *skb, struct net_device *dev,
         net = dev_net(dev);
         pkt = cfpkt_fromnative(CAIF_DIR_IN, skb);
         caifd = caif_get(dev);
-        if (!caifd || !caifd->layer.up || !caifd->layer.up->ctrlcmd)
+        if (!caifd || !caifd->layer.up || !caifd->layer.up->receive)
                 return NET_RX_DROP;
 
         if (caifd->layer.up->receive(caifd->layer.up, pkt))
@@ -214,7 +216,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
         switch (what) {
         case NETDEV_REGISTER:
-                pr_info("CAIF: %s():register %s\n", __func__, dev->name);
+                netdev_info(dev, "register\n");
                 caifd = caif_device_alloc(dev);
                 if (caifd == NULL)
                         break;
@@ -225,14 +227,13 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                 break;
 
         case NETDEV_UP:
-                pr_info("CAIF: %s(): up %s\n", __func__, dev->name);
+                netdev_info(dev, "up\n");
                 caifd = caif_get(dev);
                 if (caifd == NULL)
                         break;
                 caifdev = netdev_priv(dev);
                 if (atomic_read(&caifd->state) == NETDEV_UP) {
-                        pr_info("CAIF: %s():%s already up\n",
-                                __func__, dev->name);
+                        netdev_info(dev, "already up\n");
                         break;
                 }
                 atomic_set(&caifd->state, what);
@@ -273,7 +274,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                 caifd = caif_get(dev);
                 if (caifd == NULL)
                         break;
-                pr_info("CAIF: %s():going down %s\n", __func__, dev->name);
+                netdev_info(dev, "going down\n");
 
                 if (atomic_read(&caifd->state) == NETDEV_GOING_DOWN ||
                         atomic_read(&caifd->state) == NETDEV_DOWN)
@@ -295,11 +296,10 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                 caifd = caif_get(dev);
                 if (caifd == NULL)
                         break;
-                pr_info("CAIF: %s(): down %s\n", __func__, dev->name);
+                netdev_info(dev, "down\n");
                 if (atomic_read(&caifd->in_use))
-                        pr_warning("CAIF: %s(): "
-                                   "Unregistering an active CAIF device: %s\n",
-                                   __func__, dev->name);
+                        netdev_warn(dev,
+                                    "Unregistering an active CAIF device\n");
                 cfcnfg_del_phy_layer(get_caif_conf(), &caifd->layer);
                 dev_put(dev);
                 atomic_set(&caifd->state, what);
@@ -307,7 +307,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
         case NETDEV_UNREGISTER:
                 caifd = caif_get(dev);
-                pr_info("CAIF: %s(): unregister %s\n", __func__, dev->name);
+                netdev_info(dev, "unregister\n");
                 atomic_set(&caifd->state, what);
                 caif_device_destroy(dev);
                 break;
@@ -391,7 +391,7 @@ static int __init caif_device_init(void)
         int result;
         cfg = cfcnfg_create();
         if (!cfg) {
-                pr_warning("CAIF: %s(): can't create cfcnfg.\n", __func__);
+                pr_warn("can't create cfcnfg\n");
                 goto err_cfcnfg_create_failed;
         }
         result = register_pernet_device(&caif_net_ops);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 8ce904786116..4d918f8f4e67 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -28,9 +30,6 @@
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_NETPROTO(AF_CAIF);
 
-#define CAIF_DEF_SNDBUF (4096*10)
-#define CAIF_DEF_RCVBUF (4096*100)
-
 /*
  * CAIF state is re-using the TCP socket states.
  * caif_states stored in sk_state reflect the state as reported by
@@ -157,9 +156,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
                 (unsigned)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
-                trace_printk("CAIF: %s():"
-                        " sending flow OFF (queue len = %d %d)\n",
-                        __func__,
+                pr_debug("sending flow OFF (queue len = %d %d)\n",
                         atomic_read(&cf_sk->sk.sk_rmem_alloc),
                         sk_rcvbuf_lowwater(cf_sk));
                 set_rx_flow_off(cf_sk);
@@ -172,9 +169,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return err;
         if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
                 set_rx_flow_off(cf_sk);
-                trace_printk("CAIF: %s():"
-                        " sending flow OFF due to rmem_schedule\n",
-                        __func__);
+                pr_debug("sending flow OFF due to rmem_schedule\n");
                 dbfs_atomic_inc(&cnt.num_rx_flow_off);
                 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
         }
@@ -275,8 +270,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
                 break;
 
         default:
-                pr_debug("CAIF: %s(): Unexpected flow command %d\n",
-                                __func__, flow);
+                pr_debug("Unexpected flow command %d\n", flow);
         }
 }
 
@@ -536,8 +530,7 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
 
                 /* Slight paranoia, probably not needed. */
                 if (unlikely(loopcnt++ > 1000)) {
-                        pr_warning("CAIF: %s(): transmit retries failed,"
-                                " error = %d\n", __func__, ret);
+                        pr_warn("transmit retries failed, error = %d\n", ret);
                         break;
                 }
 
@@ -902,8 +895,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         cf_sk->maxframe = dev->mtu - (headroom + tailroom);
         dev_put(dev);
         if (cf_sk->maxframe < 1) {
-                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%d)\n",
-                        __func__, dev->mtu);
+                pr_warn("CAIF Interface MTU too small (%d)\n", dev->mtu);
                 err = -ENODEV;
                 goto out;
         }
@@ -1123,10 +1115,6 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         /* Store the protocol */
         sk->sk_protocol = (unsigned char) protocol;
 
-        /* Sendbuf dictates the amount of outbound packets not yet sent */
-        sk->sk_sndbuf = CAIF_DEF_SNDBUF;
-        sk->sk_rcvbuf = CAIF_DEF_RCVBUF;
-
         /*
          * Lock in order to try to stop someone from opening the socket
          * too early.
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 1c29189b344d..41adafd18914 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -3,6 +3,9 @@
  * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/stddef.h>
 #include <linux/slab.h>
@@ -78,7 +81,7 @@ struct cfcnfg *cfcnfg_create(void)
         /* Initiate this layer */
         this = kzalloc(sizeof(struct cfcnfg), GFP_ATOMIC);
         if (!this) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         this->mux = cfmuxl_create();
@@ -106,7 +109,7 @@ struct cfcnfg *cfcnfg_create(void)
         layer_set_up(this->ctrl, this);
         return this;
 out_of_mem:
-        pr_warning("CAIF: %s(): Out of memory\n", __func__);
+        pr_warn("Out of memory\n");
         kfree(this->mux);
         kfree(this->ctrl);
         kfree(this);
@@ -194,7 +197,7 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
         caif_assert(adap_layer != NULL);
         channel_id = adap_layer->id;
         if (adap_layer->dn == NULL || channel_id == 0) {
-                pr_err("CAIF: %s():adap_layer->id is 0\n", __func__);
+                pr_err("adap_layer->dn == NULL or adap_layer->id is 0\n");
                 ret = -ENOTCONN;
                 goto end;
         }
@@ -204,9 +207,8 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
         layer_set_up(servl, NULL);
         ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
         if (servl == NULL) {
-                pr_err("CAIF: %s(): PROTOCOL ERROR "
-                       "- Error removing service_layer Channel_Id(%d)",
-                        __func__, channel_id);
+                pr_err("PROTOCOL ERROR - Error removing service_layer Channel_Id(%d)",
+                       channel_id);
                 ret = -EINVAL;
                 goto end;
         }
@@ -216,18 +218,14 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
 
                 phyinfo = cfcnfg_get_phyinfo(cnfg, phyid);
                 if (phyinfo == NULL) {
-                        pr_warning("CAIF: %s(): "
-                                "No interface to send disconnect to\n",
-                                __func__);
+                        pr_warn("No interface to send disconnect to\n");
                         ret = -ENODEV;
                         goto end;
                 }
                 if (phyinfo->id != phyid ||
                         phyinfo->phy_layer->id != phyid ||
                         phyinfo->frm_layer->id != phyid) {
-                        pr_err("CAIF: %s(): "
-                                "Inconsistency in phy registration\n",
-                                __func__);
+                        pr_err("Inconsistency in phy registration\n");
                         ret = -EINVAL;
                         goto end;
                 }
@@ -276,21 +274,20 @@ int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
 {
         struct cflayer *frml;
         if (adap_layer == NULL) {
-                pr_err("CAIF: %s(): adap_layer is zero", __func__);
+                pr_err("adap_layer is zero\n");
                 return -EINVAL;
         }
         if (adap_layer->receive == NULL) {
-                pr_err("CAIF: %s(): adap_layer->receive is NULL", __func__);
+                pr_err("adap_layer->receive is NULL\n");
                 return -EINVAL;
         }
         if (adap_layer->ctrlcmd == NULL) {
-                pr_err("CAIF: %s(): adap_layer->ctrlcmd == NULL", __func__);
+                pr_err("adap_layer->ctrlcmd == NULL\n");
                 return -EINVAL;
         }
         frml = cnfg->phy_layers[param->phyid].frm_layer;
         if (frml == NULL) {
-                pr_err("CAIF: %s(): Specified PHY type does not exist!",
-                        __func__);
+                pr_err("Specified PHY type does not exist!\n");
                 return -ENODEV;
         }
         caif_assert(param->phyid == cnfg->phy_layers[param->phyid].id);
@@ -330,9 +327,7 @@ cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id, enum cfctrl_srv serv,
         struct net_device *netdev;
 
         if (adapt_layer == NULL) {
-                pr_debug("CAIF: %s(): link setup response "
-                                "but no client exist, send linkdown back\n",
-                                __func__);
+                pr_debug("link setup response but no client exist, send linkdown back\n");
                 cfctrl_linkdown_req(cnfg->ctrl, channel_id, NULL);
                 return;
         }
@@ -374,13 +369,11 @@ cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id, enum cfctrl_srv serv,
                 servicel = cfdbgl_create(channel_id, &phyinfo->dev_info);
                 break;
         default:
-                pr_err("CAIF: %s(): Protocol error. "
-                        "Link setup response - unknown channel type\n",
-                        __func__);
+                pr_err("Protocol error. Link setup response - unknown channel type\n");
                 return;
         }
         if (!servicel) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         layer_set_dn(servicel, cnfg->mux);
@@ -418,7 +411,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
                 }
         }
         if (*phyid == 0) {
-                pr_err("CAIF: %s(): No Available PHY ID\n", __func__);
+                pr_err("No Available PHY ID\n");
                 return;
         }
 
@@ -427,7 +420,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
                 phy_driver =
                     cfserl_create(CFPHYTYPE_FRAG, *phyid, stx);
                 if (!phy_driver) {
-                        pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                        pr_warn("Out of memory\n");
                         return;
                 }
 
@@ -436,7 +429,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
                 phy_driver = NULL;
                 break;
         default:
-                pr_err("CAIF: %s(): %d", __func__, phy_type);
+                pr_err("%d\n", phy_type);
                 return;
                 break;
         }
@@ -455,7 +448,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
         phy_layer->type = phy_type;
         frml = cffrml_create(*phyid, fcs);
         if (!frml) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         cnfg->phy_layers[*phyid].frm_layer = frml;
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 563145fdc4c3..08f267a109aa 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -36,7 +38,7 @@ struct cflayer *cfctrl_create(void)
         struct cfctrl *this =
                 kmalloc(sizeof(struct cfctrl), GFP_ATOMIC);
         if (!this) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
@@ -132,9 +134,7 @@ struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
         list_for_each_entry_safe(p, tmp, &ctrl->list, list) {
                 if (cfctrl_req_eq(req, p)) {
                         if (p != first)
-                                pr_warning("CAIF: %s(): Requests are not "
-                                        "received in order\n",
-                                        __func__);
+                                pr_warn("Requests are not received in order\n");
 
                         atomic_set(&ctrl->rsp_seq_no,
                                          p->sequence_no);
@@ -177,7 +177,7 @@ void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
         int ret;
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
@@ -189,8 +189,7 @@ void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
         ret =
             cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
         if (ret < 0) {
-                pr_err("CAIF: %s(): Could not transmit enum message\n",
-                        __func__);
+                pr_err("Could not transmit enum message\n");
                 cfpkt_destroy(pkt);
         }
 }
@@ -208,7 +207,7 @@ int cfctrl_linkup_request(struct cflayer *layer,
         char utility_name[16];
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return -ENOMEM;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_SETUP);
@@ -253,13 +252,13 @@ int cfctrl_linkup_request(struct cflayer *layer,
                                param->u.utility.paramlen);
                 break;
         default:
-                pr_warning("CAIF: %s():Request setup of bad link type = %d\n",
-                           __func__, param->linktype);
+                pr_warn("Request setup of bad link type = %d\n",
+                        param->linktype);
                 return -EINVAL;
         }
         req = kzalloc(sizeof(*req), GFP_KERNEL);
         if (!req) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return -ENOMEM;
         }
         req->client_layer = user_layer;
@@ -276,8 +275,7 @@ int cfctrl_linkup_request(struct cflayer *layer,
         ret =
             cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
         if (ret < 0) {
-                pr_err("CAIF: %s(): Could not transmit linksetup request\n",
-                        __func__);
+                pr_err("Could not transmit linksetup request\n");
                 cfpkt_destroy(pkt);
                 return -ENODEV;
         }
@@ -291,7 +289,7 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
         struct cfctrl *cfctrl = container_obj(layer);
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return -ENOMEM;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
@@ -300,8 +298,7 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
         ret =
             cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
         if (ret < 0) {
-                pr_err("CAIF: %s(): Could not transmit link-down request\n",
-                        __func__);
+                pr_err("Could not transmit link-down request\n");
                 cfpkt_destroy(pkt);
         }
         return ret;
@@ -313,7 +310,7 @@ void cfctrl_sleep_req(struct cflayer *layer)
         struct cfctrl *cfctrl = container_obj(layer);
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_SLEEP);
@@ -330,7 +327,7 @@ void cfctrl_wake_req(struct cflayer *layer)
         struct cfctrl *cfctrl = container_obj(layer);
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_WAKE);
@@ -347,7 +344,7 @@ void cfctrl_getstartreason_req(struct cflayer *layer)
         struct cfctrl *cfctrl = container_obj(layer);
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_START_REASON);
@@ -364,12 +361,11 @@ void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)
         struct cfctrl_request_info *p, *tmp;
         struct cfctrl *ctrl = container_obj(layr);
         spin_lock(&ctrl->info_list_lock);
-        pr_warning("CAIF: %s(): enter\n", __func__);
+        pr_warn("enter\n");
 
         list_for_each_entry_safe(p, tmp, &ctrl->list, list) {
                 if (p->client_layer == adap_layer) {
-                        pr_warning("CAIF: %s(): cancel req :%d\n", __func__,
-                                        p->sequence_no);
+                        pr_warn("cancel req :%d\n", p->sequence_no);
                         list_del(&p->list);
                         kfree(p);
                 }
@@ -520,9 +516,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                                 cfpkt_extr_head(pkt, &param, len);
                                 break;
                         default:
-                                pr_warning("CAIF: %s(): Request setup "
-                                           "- invalid link type (%d)",
-                                           __func__, serv);
+                                pr_warn("Request setup - invalid link type (%d)\n",
+                                        serv);
                                 goto error;
                         }
 
@@ -532,9 +527,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
 
                         if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) ||
                                 cfpkt_erroneous(pkt)) {
-                                pr_err("CAIF: %s(): Invalid O/E bit or parse "
-                                       "error on CAIF control channel",
-                                        __func__);
+                                pr_err("Invalid O/E bit or parse error on CAIF control channel\n");
                                 cfctrl->res.reject_rsp(cfctrl->serv.layer.up,
                                                        0,
                                                        req ? req->client_layer
@@ -556,8 +549,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                 cfctrl->res.linkdestroy_rsp(cfctrl->serv.layer.up, linkid);
                 break;
         case CFCTRL_CMD_LINK_ERR:
-                pr_err("CAIF: %s(): Frame Error Indication received\n",
-                        __func__);
+                pr_err("Frame Error Indication received\n");
                 cfctrl->res.linkerror_ind();
                 break;
         case CFCTRL_CMD_ENUM:
@@ -576,7 +568,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                 cfctrl->res.radioset_rsp();
                 break;
         default:
-                pr_err("CAIF: %s(): Unrecognized Control Frame\n", __func__);
+                pr_err("Unrecognized Control Frame\n");
                 goto error;
                 break;
         }
@@ -595,8 +587,7 @@ static void cfctrl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
         case CAIF_CTRLCMD_FLOW_OFF_IND:
                 spin_lock(&this->info_list_lock);
                 if (!list_empty(&this->list)) {
-                        pr_debug("CAIF: %s(): Received flow off in "
-                                   "control layer", __func__);
+                        pr_debug("Received flow off in control layer\n");
                 }
                 spin_unlock(&this->info_list_lock);
                 break;
@@ -620,7 +611,7 @@ static int handle_loop(struct cfctrl *ctrl, int cmd, struct cfpkt *pkt)
                         if (!ctrl->loop_linkused[linkid])
                                 goto found;
                 spin_unlock(&ctrl->loop_linkid_lock);
-                pr_err("CAIF: %s(): Out of link-ids\n", __func__);
+                pr_err("Out of link-ids\n");
                 return -EINVAL;
 found:
                 if (!ctrl->loop_linkused[linkid])
diff --git a/net/caif/cfdbgl.c b/net/caif/cfdbgl.c
index 676648cac8dd..496fda9ac66f 100644
--- a/net/caif/cfdbgl.c
+++ b/net/caif/cfdbgl.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/slab.h>
 #include <net/caif/caif_layer.h>
@@ -17,7 +19,7 @@ struct cflayer *cfdbgl_create(u8 channel_id, struct dev_info *dev_info)
 {
         struct cfsrvl *dbg = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
         if (!dbg) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfsrvl, layer) == 0);
diff --git a/net/caif/cfdgml.c b/net/caif/cfdgml.c
index ed9d53aff280..d3ed264ad6c4 100644
--- a/net/caif/cfdgml.c
+++ b/net/caif/cfdgml.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -26,7 +28,7 @@ struct cflayer *cfdgml_create(u8 channel_id, struct dev_info *dev_info)
 {
         struct cfsrvl *dgm = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
         if (!dgm) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfsrvl, layer) == 0);
@@ -49,14 +51,14 @@ static int cfdgml_receive(struct cflayer *layr, struct cfpkt *pkt)
         caif_assert(layr->ctrlcmd != NULL);
 
         if (cfpkt_extr_head(pkt, &cmd, 1) < 0) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
 
         if ((cmd & DGM_CMD_BIT) == 0) {
                 if (cfpkt_extr_head(pkt, &dgmhdr, 3) < 0) {
-                        pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                        pr_err("Packet is erroneous!\n");
                         cfpkt_destroy(pkt);
                         return -EPROTO;
                 }
@@ -75,8 +77,7 @@ static int cfdgml_receive(struct cflayer *layr, struct cfpkt *pkt)
                 return 0;
         default:
                 cfpkt_destroy(pkt);
-                pr_info("CAIF: %s(): Unknown datagram control %d (0x%x)\n",
-                        __func__, cmd, cmd);
+                pr_info("Unknown datagram control %d (0x%x)\n", cmd, cmd);
                 return -EPROTO;
         }
 }
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index e86a4ca3b217..a445043931ae 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -6,6 +6,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -32,7 +34,7 @@ struct cflayer *cffrml_create(u16 phyid, bool use_fcs)
 {
         struct cffrml *this = kmalloc(sizeof(struct cffrml), GFP_ATOMIC);
         if (!this) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cffrml, layer) == 0);
@@ -83,7 +85,7 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
 
         if (cfpkt_setlen(pkt, len) < 0) {
                 ++cffrml_rcv_error;
-                pr_err("CAIF: %s():Framing length error (%d)\n", __func__, len);
+                pr_err("Framing length error (%d)\n", len);
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -99,14 +101,14 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
                         cfpkt_add_trail(pkt, &tmp, 2);
                         ++cffrml_rcv_error;
                         ++cffrml_rcv_checsum_error;
-                        pr_info("CAIF: %s(): Frame checksum error "
-                                "(0x%x != 0x%x)\n", __func__, hdrchks, pktchks);
+                        pr_info("Frame checksum error (0x%x != 0x%x)\n",
+                                hdrchks, pktchks);
                         return -EILSEQ;
                 }
         }
         if (cfpkt_erroneous(pkt)) {
                 ++cffrml_rcv_error;
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -132,7 +134,7 @@ static int cffrml_transmit(struct cflayer *layr, struct cfpkt *pkt)
         cfpkt_add_head(pkt, &tmp, 2);
         cfpkt_info(pkt)->hdr_len += 2;
         if (cfpkt_erroneous(pkt)) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 return -EPROTO;
         }
         ret = layr->dn->transmit(layr->dn, pkt);
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 80c8d332b258..46f34b2e0478 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -3,6 +3,9 @@
  * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -190,7 +193,7 @@ static int cfmuxl_receive(struct cflayer *layr, struct cfpkt *pkt)
         u8 id;
         struct cflayer *up;
         if (cfpkt_extr_head(pkt, &id, 1) < 0) {
-                pr_err("CAIF: %s(): erroneous Caif Packet\n", __func__);
+                pr_err("erroneous Caif Packet\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -199,8 +202,8 @@ static int cfmuxl_receive(struct cflayer *layr, struct cfpkt *pkt)
         up = get_up(muxl, id);
         spin_unlock(&muxl->receive_lock);
         if (up == NULL) {
-                pr_info("CAIF: %s():Received data on unknown link ID = %d "
-                        "(0x%x)  up == NULL", __func__, id, id);
+                pr_info("Received data on unknown link ID = %d (0x%x) up == NULL",
+                        id, id);
                 cfpkt_destroy(pkt);
                 /*
                  * Don't return ERROR, since modem misbehaves and sends out
@@ -223,9 +226,8 @@ static int cfmuxl_transmit(struct cflayer *layr, struct cfpkt *pkt)
         struct caif_payload_info *info = cfpkt_info(pkt);
         dn = get_dn(muxl, cfpkt_info(pkt)->dev_info);
         if (dn == NULL) {
-                pr_warning("CAIF: %s(): Send data on unknown phy "
-                           "ID = %d (0x%x)\n",
-                           __func__, info->dev_info->id, info->dev_info->id);
+                pr_warn("Send data on unknown phy ID = %d (0x%x)\n",
+                        info->dev_info->id, info->dev_info->id);
                 return -ENOTCONN;
         }
         info->hdr_len += 1;
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index c49a6695793a..d7e865e2ff65 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/string.h>
 #include <linux/skbuff.h>
 #include <linux/hardirq.h>
@@ -12,11 +14,12 @@
 #define PKT_PREFIX  48
 #define PKT_POSTFIX 2
 #define PKT_LEN_WHEN_EXTENDING 128
-#define PKT_ERROR(pkt, errmsg) do {        \
-    cfpkt_priv(pkt)->erronous = true;      \
-    skb_reset_tail_pointer(&pkt->skb);     \
-    pr_warning("CAIF: " errmsg);\
-  } while (0)
+#define PKT_ERROR(pkt, errmsg)             \
+do {                                       \
+        cfpkt_priv(pkt)->erronous = true;  \
+        skb_reset_tail_pointer(&pkt->skb); \
+        pr_warn(errmsg);                   \
+} while (0)
 
 struct cfpktq {
         struct sk_buff_head head;
@@ -130,13 +133,13 @@ int cfpkt_extr_head(struct cfpkt *pkt, void *data, u16 len)
                 return -EPROTO;
 
         if (unlikely(len > skb->len)) {
-                PKT_ERROR(pkt, "cfpkt_extr_head read beyond end of packet\n");
+                PKT_ERROR(pkt, "read beyond end of packet\n");
                 return -EPROTO;
         }
 
         if (unlikely(len > skb_headlen(skb))) {
                 if (unlikely(skb_linearize(skb) != 0)) {
-                        PKT_ERROR(pkt, "cfpkt_extr_head linearize failed\n");
+                        PKT_ERROR(pkt, "linearize failed\n");
                         return -EPROTO;
                 }
         }
@@ -156,11 +159,11 @@ int cfpkt_extr_trail(struct cfpkt *pkt, void *dta, u16 len)
                 return -EPROTO;
 
         if (unlikely(skb_linearize(skb) != 0)) {
-                PKT_ERROR(pkt, "cfpkt_extr_trail linearize failed\n");
+                PKT_ERROR(pkt, "linearize failed\n");
                 return -EPROTO;
         }
         if (unlikely(skb->data + len > skb_tail_pointer(skb))) {
-                PKT_ERROR(pkt, "cfpkt_extr_trail read beyond end of packet\n");
+                PKT_ERROR(pkt, "read beyond end of packet\n");
                 return -EPROTO;
         }
         from = skb_tail_pointer(skb) - len;
@@ -202,7 +205,7 @@ int cfpkt_add_body(struct cfpkt *pkt, const void *data, u16 len)
 
                 /* Make sure data is writable */
                 if (unlikely(skb_cow_data(skb, addlen, &lastskb) < 0)) {
-                        PKT_ERROR(pkt, "cfpkt_add_body: cow failed\n");
+                        PKT_ERROR(pkt, "cow failed\n");
                         return -EPROTO;
                 }
                 /*
@@ -211,8 +214,7 @@ int cfpkt_add_body(struct cfpkt *pkt, const void *data, u16 len)
                  * lengths of the top SKB.
                  */
                 if (lastskb != skb) {
-                        pr_warning("CAIF: %s(): Packet is non-linear\n",
-                                   __func__);
+                        pr_warn("Packet is non-linear\n");
                         skb->len += len;
                         skb->data_len += len;
                 }
@@ -242,14 +244,14 @@ int cfpkt_add_head(struct cfpkt *pkt, const void *data2, u16 len)
         if (unlikely(is_erronous(pkt)))
                 return -EPROTO;
         if (unlikely(skb_headroom(skb) < len)) {
-                PKT_ERROR(pkt, "cfpkt_add_head: no headroom\n");
+                PKT_ERROR(pkt, "no headroom\n");
                 return -EPROTO;
         }
 
         /* Make sure data is writable */
         ret = skb_cow_data(skb, 0, &lastskb);
         if (unlikely(ret < 0)) {
-                PKT_ERROR(pkt, "cfpkt_add_head: cow failed\n");
+                PKT_ERROR(pkt, "cow failed\n");
                 return ret;
         }
 
@@ -283,7 +285,7 @@ inline u16 cfpkt_iterate(struct cfpkt *pkt,
         if (unlikely(is_erronous(pkt)))
                 return -EPROTO;
         if (unlikely(skb_linearize(&pkt->skb) != 0)) {
-                PKT_ERROR(pkt, "cfpkt_iterate: linearize failed\n");
+                PKT_ERROR(pkt, "linearize failed\n");
                 return -EPROTO;
         }
         return iter_func(data, pkt->skb.data, cfpkt_getlen(pkt));
@@ -309,7 +311,7 @@ int cfpkt_setlen(struct cfpkt *pkt, u16 len)
 
         /* Need to expand SKB */
         if (unlikely(!cfpkt_pad_trail(pkt, len - skb->len)))
-                PKT_ERROR(pkt, "cfpkt_setlen: skb_pad_trail failed\n");
+                PKT_ERROR(pkt, "skb_pad_trail failed\n");
 
         return cfpkt_getlen(pkt);
 }
@@ -380,8 +382,7 @@ struct cfpkt *cfpkt_split(struct cfpkt *pkt, u16 pos)
                 return NULL;
 
         if (skb->data + pos > skb_tail_pointer(skb)) {
-                PKT_ERROR(pkt,
-                          "cfpkt_split: trying to split beyond end of packet");
+                PKT_ERROR(pkt, "trying to split beyond end of packet\n");
                 return NULL;
         }
 
@@ -455,17 +456,17 @@ int cfpkt_raw_append(struct cfpkt *pkt, void **buf, unsigned int buflen)
                 return -EPROTO;
         /* Make sure SKB is writable */
         if (unlikely(skb_cow_data(skb, 0, &lastskb) < 0)) {
-                PKT_ERROR(pkt, "cfpkt_raw_append: skb_cow_data failed\n");
+                PKT_ERROR(pkt, "skb_cow_data failed\n");
                 return -EPROTO;
         }
 
         if (unlikely(skb_linearize(skb) != 0)) {
-                PKT_ERROR(pkt, "cfpkt_raw_append: linearize failed\n");
+                PKT_ERROR(pkt, "linearize failed\n");
                 return -EPROTO;
         }
 
         if (unlikely(skb_tailroom(skb) < buflen)) {
-                PKT_ERROR(pkt, "cfpkt_raw_append: buffer too short - failed\n");
+                PKT_ERROR(pkt, "buffer too short - failed\n");
                 return -EPROTO;
         }
 
@@ -483,14 +484,13 @@ int cfpkt_raw_extract(struct cfpkt *pkt, void **buf, unsigned int buflen)
                 return -EPROTO;
 
         if (unlikely(buflen > skb->len)) {
-                PKT_ERROR(pkt, "cfpkt_raw_extract: buflen too large "
-                                "- failed\n");
+                PKT_ERROR(pkt, "buflen too large - failed\n");
                 return -EPROTO;
         }
 
         if (unlikely(buflen > skb_headlen(skb))) {
                 if (unlikely(skb_linearize(skb) != 0)) {
-                        PKT_ERROR(pkt, "cfpkt_raw_extract: linearize failed\n");
+                        PKT_ERROR(pkt, "linearize failed\n");
                         return -EPROTO;
                 }
         }
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index 9a699242d104..bde8481e8d25 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -48,7 +50,7 @@ struct cflayer *cfrfml_create(u8 channel_id, struct dev_info *dev_info,
                 kzalloc(sizeof(struct cfrfml), GFP_ATOMIC);
 
         if (!this) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
 
@@ -178,9 +180,7 @@ out:
                         cfpkt_destroy(rfml->incomplete_frm);
                 rfml->incomplete_frm = NULL;
 
-                pr_info("CAIF: %s(): "
-                                "Connection error %d triggered on RFM link\n",
-                                __func__, err);
+                pr_info("Connection error %d triggered on RFM link\n", err);
 
                 /* Trigger connection error upon failure.*/
                 layr->up->ctrlcmd(layr->up, CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND,
@@ -280,9 +280,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 out:
 
         if (err != 0) {
-                pr_info("CAIF: %s(): "
-                                "Connection error %d triggered on RFM link\n",
-                                __func__, err);
+                pr_info("Connection error %d triggered on RFM link\n", err);
                 /* Trigger connection error upon failure.*/
 
                 layr->up->ctrlcmd(layr->up, CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND,
diff --git a/net/caif/cfserl.c b/net/caif/cfserl.c
index a11fbd68a13d..9297f7dea9d8 100644
--- a/net/caif/cfserl.c
+++ b/net/caif/cfserl.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -34,7 +36,7 @@ struct cflayer *cfserl_create(int type, int instance, bool use_stx)
 {
         struct cfserl *this = kmalloc(sizeof(struct cfserl), GFP_ATOMIC);
         if (!this) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfserl, layer) == 0);
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index f40939a91211..ab5e542526bf 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/errno.h>
@@ -79,8 +81,7 @@ static void cfservl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                 layr->up->ctrlcmd(layr->up, ctrl, phyid);
                 break;
         default:
-                pr_warning("CAIF: %s(): "
-                           "Unexpected ctrl in cfsrvl (%d)\n", __func__, ctrl);
+                pr_warn("Unexpected ctrl in cfsrvl (%d)\n", ctrl);
                 /* We have both modem and phy flow on, send flow on */
                 layr->up->ctrlcmd(layr->up, ctrl, phyid);
                 service->phy_flow_on = true;
@@ -107,14 +108,12 @@ static int cfservl_modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
                         u8 flow_on = SRVL_FLOW_ON;
                         pkt = cfpkt_create(SRVL_CTRL_PKT_SIZE);
                         if (!pkt) {
-                                pr_warning("CAIF: %s(): Out of memory\n",
-                                        __func__);
+                                pr_warn("Out of memory\n");
                                 return -ENOMEM;
                         }
 
                         if (cfpkt_add_head(pkt, &flow_on, 1) < 0) {
-                                pr_err("CAIF: %s(): Packet is erroneous!\n",
-                                        __func__);
+                                pr_err("Packet is erroneous!\n");
                                 cfpkt_destroy(pkt);
                                 return -EPROTO;
                         }
@@ -131,14 +130,12 @@ static int cfservl_modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
                         u8 flow_off = SRVL_FLOW_OFF;
                         pkt = cfpkt_create(SRVL_CTRL_PKT_SIZE);
                         if (!pkt) {
-                                pr_warning("CAIF: %s(): Out of memory\n",
-                                        __func__);
+                                pr_warn("Out of memory\n");
                                 return -ENOMEM;
                         }
 
                         if (cfpkt_add_head(pkt, &flow_off, 1) < 0) {
-                                pr_err("CAIF: %s(): Packet is erroneous!\n",
-                                        __func__);
+                                pr_err("Packet is erroneous!\n");
                                 cfpkt_destroy(pkt);
                                 return -EPROTO;
                         }
diff --git a/net/caif/cfutill.c b/net/caif/cfutill.c
index 02795aff57a4..efad410e4c82 100644
--- a/net/caif/cfutill.c
+++ b/net/caif/cfutill.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/slab.h>
@@ -26,7 +28,7 @@ struct cflayer *cfutill_create(u8 channel_id, struct dev_info *dev_info)
 {
         struct cfsrvl *util = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
         if (!util) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfsrvl, layer) == 0);
@@ -47,7 +49,7 @@ static int cfutill_receive(struct cflayer *layr, struct cfpkt *pkt)
         caif_assert(layr->up->receive != NULL);
         caif_assert(layr->up->ctrlcmd != NULL);
         if (cfpkt_extr_head(pkt, &cmd, 1) < 0) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -64,16 +66,14 @@ static int cfutill_receive(struct cflayer *layr, struct cfpkt *pkt)
                 cfpkt_destroy(pkt);
                 return 0;
         case UTIL_REMOTE_SHUTDOWN:      /* Remote Shutdown Request */
-                pr_err("CAIF: %s(): REMOTE SHUTDOWN REQUEST RECEIVED\n",
-                        __func__);
+                pr_err("REMOTE SHUTDOWN REQUEST RECEIVED\n");
                 layr->ctrlcmd(layr, CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND, 0);
                 service->open = false;
                 cfpkt_destroy(pkt);
                 return 0;
         default:
                 cfpkt_destroy(pkt);
-                pr_warning("CAIF: %s(): Unknown service control %d (0x%x)\n",
-                           __func__, cmd, cmd);
+                pr_warn("Unknown service control %d (0x%x)\n", cmd, cmd);
                 return -EPROTO;
         }
 }
diff --git a/net/caif/cfveil.c b/net/caif/cfveil.c
index 77cc09faac9a..3b425b189a99 100644
--- a/net/caif/cfveil.c
+++ b/net/caif/cfveil.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/stddef.h>
 #include <linux/slab.h>
 #include <net/caif/caif_layer.h>
@@ -25,7 +27,7 @@ struct cflayer *cfvei_create(u8 channel_id, struct dev_info *dev_info)
 {
         struct cfsrvl *vei = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
         if (!vei) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfsrvl, layer) == 0);
@@ -47,7 +49,7 @@ static int cfvei_receive(struct cflayer *layr, struct cfpkt *pkt)
 
 
         if (cfpkt_extr_head(pkt, &cmd, 1) < 0) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -67,8 +69,7 @@ static int cfvei_receive(struct cflayer *layr, struct cfpkt *pkt)
                 cfpkt_destroy(pkt);
                 return 0;
         default:                /* SET RS232 PIN */
-                pr_warning("CAIF: %s():Unknown VEI control packet %d (0x%x)!\n",
-                           __func__, cmd, cmd);
+                pr_warn("Unknown VEI control packet %d (0x%x)!\n", cmd, cmd);
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
@@ -86,7 +87,7 @@ static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
         caif_assert(layr->dn->transmit != NULL);
 
         if (cfpkt_add_head(pkt, &tmp, 1) < 0) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 return -EPROTO;
         }
 
diff --git a/net/caif/cfvidl.c b/net/caif/cfvidl.c
index ada6ee2d48f5..bf6fef2a0eff 100644
--- a/net/caif/cfvidl.c
+++ b/net/caif/cfvidl.c
@@ -4,6 +4,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/slab.h>
@@ -21,7 +23,7 @@ struct cflayer *cfvidl_create(u8 channel_id, struct dev_info *dev_info)
 {
         struct cfsrvl *vid = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
         if (!vid) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
+                pr_warn("Out of memory\n");
                 return NULL;
         }
         caif_assert(offsetof(struct cfsrvl, layer) == 0);
@@ -38,7 +40,7 @@ static int cfvidl_receive(struct cflayer *layr, struct cfpkt *pkt)
 {
         u32 videoheader;
         if (cfpkt_extr_head(pkt, &videoheader, 4) < 0) {
-                pr_err("CAIF: %s(): Packet is erroneous!\n", __func__);
+                pr_err("Packet is erroneous!\n");
                 cfpkt_destroy(pkt);
                 return -EPROTO;
         }
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 4293e190ec53..84a422c98941 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -5,6 +5,8 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
+
 #include <linux/version.h>
 #include <linux/fs.h>
 #include <linux/init.h>
@@ -28,9 +30,6 @@
 #define CONNECT_TIMEOUT (5 * HZ)
 #define CAIF_NET_DEFAULT_QUEUE_LEN 500
 
-#undef pr_debug
-#define pr_debug pr_warning
-
 /*This list is protected by the rtnl lock. */
 static LIST_HEAD(chnl_net_list);
 
@@ -142,8 +141,7 @@ static void chnl_flowctrl_cb(struct cflayer *layr, enum caif_ctrlcmd flow,
                                 int phyid)
 {
         struct chnl_net *priv = container_of(layr, struct chnl_net, chnl);
-        pr_debug("CAIF: %s(): NET flowctrl func called flow: %s\n",
-                __func__,
+        pr_debug("NET flowctrl func called flow: %s\n",
                 flow == CAIF_CTRLCMD_FLOW_ON_IND ? "ON" :
                 flow == CAIF_CTRLCMD_INIT_RSP ? "INIT" :
                 flow == CAIF_CTRLCMD_FLOW_OFF_IND ? "OFF" :
@@ -196,12 +194,12 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
         priv = netdev_priv(dev);
 
         if (skb->len > priv->netdev->mtu) {
-                pr_warning("CAIF: %s(): Size of skb exceeded MTU\n", __func__);
+                pr_warn("Size of skb exceeded MTU\n");
                 return -ENOSPC;
         }
 
         if (!priv->flowenabled) {
-                pr_debug("CAIF: %s(): dropping packets flow off\n", __func__);
+                pr_debug("dropping packets flow off\n");
                 return NETDEV_TX_BUSY;
         }
 
@@ -237,7 +235,7 @@ static int chnl_net_open(struct net_device *dev)
         ASSERT_RTNL();
         priv = netdev_priv(dev);
         if (!priv) {
-                pr_debug("CAIF: %s(): chnl_net_open: no priv\n", __func__);
+                pr_debug("chnl_net_open: no priv\n");
                 return -ENODEV;
         }
 
@@ -246,18 +244,17 @@ static int chnl_net_open(struct net_device *dev)
                 result = caif_connect_client(&priv->conn_req, &priv->chnl,
                                         &llifindex, &headroom, &tailroom);
                 if (result != 0) {
-                                pr_debug("CAIF: %s(): err: "
-                                        "Unable to register and open device,"
-                                        " Err:%d\n",
-                                        __func__,
-                                        result);
+                                pr_debug("err: "
+                                         "Unable to register and open device,"
+                                         " Err:%d\n",
+                                         result);
                                 goto error;
                 }
 
                 lldev = dev_get_by_index(dev_net(dev), llifindex);
 
                 if (lldev == NULL) {
-                        pr_debug("CAIF: %s(): no interface?\n", __func__);
+                        pr_debug("no interface?\n");
                         result = -ENODEV;
                         goto error;
                 }
@@ -279,9 +276,7 @@ static int chnl_net_open(struct net_device *dev)
                 dev_put(lldev);
 
                 if (mtu < 100) {
-                        pr_warning("CAIF: %s(): "
-                                "CAIF Interface MTU too small (%d)\n",
-                                __func__, mtu);
+                        pr_warn("CAIF Interface MTU too small (%d)\n", mtu);
                         result = -ENODEV;
                         goto error;
                 }
@@ -296,33 +291,32 @@ static int chnl_net_open(struct net_device *dev)
         rtnl_lock();
 
         if (result == -ERESTARTSYS) {
-                pr_debug("CAIF: %s(): wait_event_interruptible"
-                         " woken by a signal\n", __func__);
+                pr_debug("wait_event_interruptible woken by a signal\n");
                 result = -ERESTARTSYS;
                 goto error;
         }
 
         if (result == 0) {
-                pr_debug("CAIF: %s(): connect timeout\n", __func__);
+                pr_debug("connect timeout\n");
                 caif_disconnect_client(&priv->chnl);
                 priv->state = CAIF_DISCONNECTED;
-                pr_debug("CAIF: %s(): state disconnected\n", __func__);
+                pr_debug("state disconnected\n");
                 result = -ETIMEDOUT;
                 goto error;
         }
 
         if (priv->state != CAIF_CONNECTED) {
-                pr_debug("CAIF: %s(): connect failed\n", __func__);
+                pr_debug("connect failed\n");
                 result = -ECONNREFUSED;
                 goto error;
         }
-        pr_debug("CAIF: %s(): CAIF Netdevice connected\n", __func__);
+        pr_debug("CAIF Netdevice connected\n");
         return 0;
 
 error:
         caif_disconnect_client(&priv->chnl);
         priv->state = CAIF_DISCONNECTED;
-        pr_debug("CAIF: %s(): state disconnected\n", __func__);
+        pr_debug("state disconnected\n");
         return result;
 
 }
@@ -413,7 +407,7 @@ static void caif_netlink_parms(struct nlattr *data[],
                                 struct caif_connect_request *conn_req)
 {
         if (!data) {
-                pr_warning("CAIF: %s: no params data found\n", __func__);
+                pr_warn("no params data found\n");
                 return;
         }
         if (data[IFLA_CAIF_IPV4_CONNID])
@@ -442,8 +436,7 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
 
         ret = register_netdevice(dev);
         if (ret)
-                pr_warning("CAIF: %s(): device rtml registration failed\n",
-                           __func__);
+                pr_warn("device rtml registration failed\n");
         return ret;
 }
 
diff --git a/net/can/raw.c b/net/can/raw.c
index a10e3338f084..7d77e67e57af 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -647,12 +647,12 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
         err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
         if (err < 0)
                 goto free_skb;
-        err = sock_tx_timestamp(msg, sk, skb_tx(skb));
+        err = sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
         if (err < 0)
                 goto free_skb;
 
         /* to be able to check the received tx sock reference in raw_rcv() */
-        skb_tx(skb)->prevent_sk_orphan = 1;
+        skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
 
         skb->dev = dev;
         skb->sk  = sk;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 251997a95483..4df1b7a6c1bf 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -746,13 +746,12 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/core/dev.c b/net/core/dev.c
index 660dd41aaaa6..42b200fdf12e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -129,6 +129,7 @@
 #include <linux/random.h>
 #include <trace/events/napi.h>
 #include <linux/pci.h>
+#include <linux/inetdevice.h>
 
 #include "net-sysfs.h"
 
@@ -371,6 +372,14 @@ static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
  *                                                      --ANK (980803)
  */
 
+static inline struct list_head *ptype_head(const struct packet_type *pt)
+{
+        if (pt->type == htons(ETH_P_ALL))
+                return &ptype_all;
+        else
+                return &ptype_base[ntohs(pt->type) & PTYPE_HASH_MASK];
+}
+
 /**
  *      dev_add_pack - add packet handler
  *      @pt: packet type declaration
@@ -386,16 +395,11 @@ static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
 
 void dev_add_pack(struct packet_type *pt)
 {
-        int hash;
+        struct list_head *head = ptype_head(pt);
 
-        spin_lock_bh(&ptype_lock);
-        if (pt->type == htons(ETH_P_ALL))
-                list_add_rcu(&pt->list, &ptype_all);
-        else {
-                hash = ntohs(pt->type) & PTYPE_HASH_MASK;
-                list_add_rcu(&pt->list, &ptype_base[hash]);
-        }
-        spin_unlock_bh(&ptype_lock);
+        spin_lock(&ptype_lock);
+        list_add_rcu(&pt->list, head);
+        spin_unlock(&ptype_lock);
 }
 EXPORT_SYMBOL(dev_add_pack);
 
@@ -414,15 +418,10 @@ EXPORT_SYMBOL(dev_add_pack);
  */
 void __dev_remove_pack(struct packet_type *pt)
 {
-        struct list_head *head;
+        struct list_head *head = ptype_head(pt);
         struct packet_type *pt1;
 
-        spin_lock_bh(&ptype_lock);
-
-        if (pt->type == htons(ETH_P_ALL))
-                head = &ptype_all;
-        else
-                head = &ptype_base[ntohs(pt->type) & PTYPE_HASH_MASK];
+        spin_lock(&ptype_lock);
 
         list_for_each_entry(pt1, head, list) {
                 if (pt == pt1) {
@@ -433,7 +432,7 @@ void __dev_remove_pack(struct packet_type *pt)
 
         printk(KERN_WARNING "dev_remove_pack: %p not found.\n", pt);
 out:
-        spin_unlock_bh(&ptype_lock);
+        spin_unlock(&ptype_lock);
 }
 EXPORT_SYMBOL(__dev_remove_pack);
 
@@ -1902,14 +1901,14 @@ static int dev_gso_segment(struct sk_buff *skb)
 
 /*
  * Try to orphan skb early, right before transmission by the device.
- * We cannot orphan skb if tx timestamp is requested, since
- * drivers need to call skb_tstamp_tx() to send the timestamp.
+ * We cannot orphan skb if tx timestamp is requested or the sk-reference
+ * is needed on driver level for other reasons, e.g. see net/can/raw.c
  */
 static inline void skb_orphan_try(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
-        if (sk && !skb_tx(skb)->flags) {
+        if (sk && !skb_shinfo(skb)->tx_flags) {
                 /* skb_tx_hash() wont be able to get sk.
                  * We copy sk_hash into skb->rxhash
                  */
@@ -1930,7 +1929,7 @@ static inline int skb_needs_linearize(struct sk_buff *skb,
                                       struct net_device *dev)
 {
         return skb_is_nonlinear(skb) &&
-               ((skb_has_frags(skb) && !(dev->features & NETIF_F_FRAGLIST)) ||
+               ((skb_has_frag_list(skb) && !(dev->features & NETIF_F_FRAGLIST)) ||
                 (skb_shinfo(skb)->nr_frags && (!(dev->features & NETIF_F_SG) ||
                                               illegal_highdma(dev, skb))));
 }
@@ -2259,69 +2258,44 @@ static inline void ____napi_schedule(struct softnet_data *sd,
         __raise_softirq_irqoff(NET_RX_SOFTIRQ);
 }
 
-#ifdef CONFIG_RPS
-
-/* One global table that all flow-based protocols share. */
-struct rps_sock_flow_table *rps_sock_flow_table __read_mostly;
-EXPORT_SYMBOL(rps_sock_flow_table);
-
 /*
- * get_rps_cpu is called from netif_receive_skb and returns the target
- * CPU from the RPS map of the receiving queue for a given skb.
- * rcu_read_lock must be held on entry.
+ * __skb_get_rxhash: calculate a flow hash based on src/dst addresses
+ * and src/dst port numbers. Returns a non-zero hash number on success
+ * and 0 on failure.
  */
-static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
-                       struct rps_dev_flow **rflowp)
+__u32 __skb_get_rxhash(struct sk_buff *skb)
 {
+        int nhoff, hash = 0, poff;
         struct ipv6hdr *ip6;
         struct iphdr *ip;
-        struct netdev_rx_queue *rxqueue;
-        struct rps_map *map;
-        struct rps_dev_flow_table *flow_table;
-        struct rps_sock_flow_table *sock_flow_table;
-        int cpu = -1;
         u8 ip_proto;
-        u16 tcpu;
         u32 addr1, addr2, ihl;
         union {
                 u32 v32;
                 u16 v16[2];
         } ports;
 
-        if (skb_rx_queue_recorded(skb)) {
-                u16 index = skb_get_rx_queue(skb);
-                if (unlikely(index >= dev->num_rx_queues)) {
-                        WARN_ONCE(dev->num_rx_queues > 1, "%s received packet "
-                                "on queue %u, but number of RX queues is %u\n",
-                                dev->name, index, dev->num_rx_queues);
-                        goto done;
-                }
-                rxqueue = dev->_rx + index;
-        } else
-                rxqueue = dev->_rx;
-
-        if (!rxqueue->rps_map && !rxqueue->rps_flow_table)
-                goto done;
-
-        if (skb->rxhash)
-                goto got_hash; /* Skip hash computation on packet header */
+        nhoff = skb_network_offset(skb);
 
         switch (skb->protocol) {
         case __constant_htons(ETH_P_IP):
-                if (!pskb_may_pull(skb, sizeof(*ip)))
+                if (!pskb_may_pull(skb, sizeof(*ip) + nhoff))
                         goto done;
 
-                ip = (struct iphdr *) skb->data;
-                ip_proto = ip->protocol;
+                ip = (struct iphdr *) (skb->data + nhoff);
+                if (ip->frag_off & htons(IP_MF | IP_OFFSET))
+                        ip_proto = 0;
+                else
+                        ip_proto = ip->protocol;
                 addr1 = (__force u32) ip->saddr;
                 addr2 = (__force u32) ip->daddr;
                 ihl = ip->ihl;
                 break;
         case __constant_htons(ETH_P_IPV6):
-                if (!pskb_may_pull(skb, sizeof(*ip6)))
+                if (!pskb_may_pull(skb, sizeof(*ip6) + nhoff))
                         goto done;
 
-                ip6 = (struct ipv6hdr *) skb->data;
+                ip6 = (struct ipv6hdr *) (skb->data + nhoff);
                 ip_proto = ip6->nexthdr;
                 addr1 = (__force u32) ip6->saddr.s6_addr32[3];
                 addr2 = (__force u32) ip6->daddr.s6_addr32[3];
@@ -2330,33 +2304,80 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         default:
                 goto done;
         }
-        switch (ip_proto) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_DCCP:
-        case IPPROTO_ESP:
-        case IPPROTO_AH:
-        case IPPROTO_SCTP:
-        case IPPROTO_UDPLITE:
-                if (pskb_may_pull(skb, (ihl * 4) + 4)) {
-                        ports.v32 = * (__force u32 *) (skb->data + (ihl * 4));
+
+        ports.v32 = 0;
+        poff = proto_ports_offset(ip_proto);
+        if (poff >= 0) {
+                nhoff += ihl * 4 + poff;
+                if (pskb_may_pull(skb, nhoff + 4)) {
+                        ports.v32 = * (__force u32 *) (skb->data + nhoff);
                         if (ports.v16[1] < ports.v16[0])
                                 swap(ports.v16[0], ports.v16[1]);
-                        break;
                 }
-        default:
-                ports.v32 = 0;
-                break;
         }
 
         /* get a consistent hash (same value on both flow directions) */
         if (addr2 < addr1)
                 swap(addr1, addr2);
-        skb->rxhash = jhash_3words(addr1, addr2, ports.v32, hashrnd);
-        if (!skb->rxhash)
-                skb->rxhash = 1;
 
-got_hash:
+        hash = jhash_3words(addr1, addr2, ports.v32, hashrnd);
+        if (!hash)
+                hash = 1;
+
+done:
+        return hash;
+}
+EXPORT_SYMBOL(__skb_get_rxhash);
+
+#ifdef CONFIG_RPS
+
+/* One global table that all flow-based protocols share. */
+struct rps_sock_flow_table *rps_sock_flow_table __read_mostly;
+EXPORT_SYMBOL(rps_sock_flow_table);
+
+/*
+ * get_rps_cpu is called from netif_receive_skb and returns the target
+ * CPU from the RPS map of the receiving queue for a given skb.
+ * rcu_read_lock must be held on entry.
+ */
+static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
+                       struct rps_dev_flow **rflowp)
+{
+        struct netdev_rx_queue *rxqueue;
+        struct rps_map *map = NULL;
+        struct rps_dev_flow_table *flow_table;
+        struct rps_sock_flow_table *sock_flow_table;
+        int cpu = -1;
+        u16 tcpu;
+
+        if (skb_rx_queue_recorded(skb)) {
+                u16 index = skb_get_rx_queue(skb);
+                if (unlikely(index >= dev->num_rx_queues)) {
+                        WARN_ONCE(dev->num_rx_queues > 1, "%s received packet "
+                                "on queue %u, but number of RX queues is %u\n",
+                                dev->name, index, dev->num_rx_queues);
+                        goto done;
+                }
+                rxqueue = dev->_rx + index;
+        } else
+                rxqueue = dev->_rx;
+
+        if (rxqueue->rps_map) {
+                map = rcu_dereference(rxqueue->rps_map);
+                if (map && map->len == 1) {
+                        tcpu = map->cpus[0];
+                        if (cpu_online(tcpu))
+                                cpu = tcpu;
+                        goto done;
+                }
+        } else if (!rxqueue->rps_flow_table) {
+                goto done;
+        }
+
+        skb_reset_network_header(skb);
+        if (!skb_get_rxhash(skb))
+                goto done;
+
         flow_table = rcu_dereference(rxqueue->rps_flow_table);
         sock_flow_table = rcu_dereference(rps_sock_flow_table);
         if (flow_table && sock_flow_table) {
@@ -2396,7 +2417,6 @@ got_hash:
                 }
         }
 
-        map = rcu_dereference(rxqueue->rps_map);
         if (map) {
                 tcpu = map->cpus[((u64) skb->rxhash * map->len) >> 32];
 
@@ -2828,8 +2848,8 @@ static int __netif_receive_skb(struct sk_buff *skb)
         if (!netdev_tstamp_prequeue)
                 net_timestamp_check(skb);
 
-        if (vlan_tx_tag_present(skb) && vlan_hwaccel_do_receive(skb))
-                return NET_RX_SUCCESS;
+        if (vlan_tx_tag_present(skb))
+                vlan_hwaccel_do_receive(skb);
 
         /* if we've gotten here through NAPI, check netpoll */
         if (netpoll_receive_skb(skb))
@@ -3050,7 +3070,7 @@ out:
         return netif_receive_skb(skb);
 }
 
-static void napi_gro_flush(struct napi_struct *napi)
+inline void napi_gro_flush(struct napi_struct *napi)
 {
         struct sk_buff *skb, *next;
 
@@ -3063,6 +3083,7 @@ static void napi_gro_flush(struct napi_struct *napi)
         napi->gro_count = 0;
         napi->gro_list = NULL;
 }
+EXPORT_SYMBOL(napi_gro_flush);
 
 enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
@@ -3077,7 +3098,7 @@ enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         if (!(skb->dev->features & NETIF_F_GRO) || netpoll_rx_on(skb))
                 goto normal;
 
-        if (skb_is_gso(skb) || skb_has_frags(skb))
+        if (skb_is_gso(skb) || skb_has_frag_list(skb))
                 goto normal;
 
         rcu_read_lock();
@@ -3156,16 +3177,18 @@ normal:
 }
 EXPORT_SYMBOL(dev_gro_receive);
 
-static gro_result_t
+static inline gro_result_t
 __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff *p;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow =
-                        (p->dev == skb->dev) &&
-                        !compare_ether_header(skb_mac_header(p),
+                unsigned long diffs;
+
+                diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
+                diffs |= compare_ether_header(skb_mac_header(p),
                                               skb_gro_mac_header(skb));
+                NAPI_GRO_CB(p)->same_flow = !diffs;
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
@@ -4941,6 +4964,34 @@ void netif_stacked_transfer_operstate(const struct net_device *rootdev,
 }
 EXPORT_SYMBOL(netif_stacked_transfer_operstate);
 
+static int netif_alloc_rx_queues(struct net_device *dev)
+{
+#ifdef CONFIG_RPS
+        unsigned int i, count = dev->num_rx_queues;
+
+        if (count) {
+                struct netdev_rx_queue *rx;
+
+                rx = kcalloc(count, sizeof(struct netdev_rx_queue), GFP_KERNEL);
+                if (!rx) {
+                        pr_err("netdev: Unable to allocate %u rx queues.\n",
+                               count);
+                        return -ENOMEM;
+                }
+                dev->_rx = rx;
+                atomic_set(&rx->count, count);
+
+                /*
+                 * Set a pointer to first element in the array which holds the
+                 * reference count.
+                 */
+                for (i = 0; i < count; i++)
+                        rx[i].first = rx;
+        }
+#endif
+        return 0;
+}
+
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -4978,24 +5029,10 @@ int register_netdevice(struct net_device *dev)
 
         dev->iflink = -1;
 
-#ifdef CONFIG_RPS
-        if (!dev->num_rx_queues) {
-                /*
-                 * Allocate a single RX queue if driver never called
-                 * alloc_netdev_mq
-                 */
-
-                dev->_rx = kzalloc(sizeof(struct netdev_rx_queue), GFP_KERNEL);
-                if (!dev->_rx) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+        ret = netif_alloc_rx_queues(dev);
+        if (ret)
+                goto out;
 
-                dev->_rx->first = dev->_rx;
-                atomic_set(&dev->_rx->count, 1);
-                dev->num_rx_queues = 1;
-        }
-#endif
         /* Init, if this function is available */
         if (dev->netdev_ops->ndo_init) {
                 ret = dev->netdev_ops->ndo_init(dev);
@@ -5035,6 +5072,12 @@ int register_netdevice(struct net_device *dev)
         if (dev->features & NETIF_F_SG)
                 dev->features |= NETIF_F_GSO;
 
+        /* Enable GRO and NETIF_F_HIGHDMA for vlans by default,
+         * vlan_dev_init() will do the dev->features check, so these features
+         * are enabled only if supported by underlying device.
+         */
+        dev->vlan_features |= (NETIF_F_GRO | NETIF_F_HIGHDMA);
+
         ret = call_netdevice_notifiers(NETDEV_POST_INIT, dev);
         ret = notifier_to_errno(ret);
         if (ret)
@@ -5264,7 +5307,7 @@ void netdev_run_todo(void)
 
                 /* paranoia */
                 BUG_ON(atomic_read(&dev->refcnt));
-                WARN_ON(dev->ip_ptr);
+                WARN_ON(rcu_dereference_raw(dev->ip_ptr));
                 WARN_ON(dev->ip6_ptr);
                 WARN_ON(dev->dn_ptr);
 
@@ -5386,10 +5429,6 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         struct net_device *dev;
         size_t alloc_size;
         struct net_device *p;
-#ifdef CONFIG_RPS
-        struct netdev_rx_queue *rx;
-        int i;
-#endif
 
         BUG_ON(strlen(name) >= sizeof(dev->name));
 
@@ -5415,29 +5454,12 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
                 goto free_p;
         }
 
-#ifdef CONFIG_RPS
-        rx = kcalloc(queue_count, sizeof(struct netdev_rx_queue), GFP_KERNEL);
-        if (!rx) {
-                printk(KERN_ERR "alloc_netdev: Unable to allocate "
-                       "rx queues.\n");
-                goto free_tx;
-        }
-
-        atomic_set(&rx->count, queue_count);
-
-        /*
-         * Set a pointer to first element in the array which holds the
-         * reference count.
-         */
-        for (i = 0; i < queue_count; i++)
-                rx[i].first = rx;
-#endif
 
         dev = PTR_ALIGN(p, NETDEV_ALIGN);
         dev->padded = (char *)dev - (char *)p;
 
         if (dev_addr_init(dev))
-                goto free_rx;
+                goto free_tx;
 
         dev_mc_init(dev);
         dev_uc_init(dev);
@@ -5449,7 +5471,6 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         dev->real_num_tx_queues = queue_count;
 
 #ifdef CONFIG_RPS
-        dev->_rx = rx;
         dev->num_rx_queues = queue_count;
 #endif
 
@@ -5467,11 +5488,7 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         strcpy(dev->name, name);
         return dev;
 
-free_rx:
-#ifdef CONFIG_RPS
-        kfree(rx);
 free_tx:
-#endif
         kfree(tx);
 free_p:
         kfree(p);
@@ -5658,6 +5675,10 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
 
         /* Notify protocols, that we are about to destroy
            this device. They should clean all the things.
+
+           Note that dev->reg_state stays at NETREG_REGISTERED.
+           This is wanted because this way 8021q and macvlan know
+           the device is just moving and can keep their slaves up.
         */
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
         call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 7a85367b3c2f..7d7e572cedc7 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -19,6 +19,7 @@
 #include <linux/netdevice.h>
 #include <linux/bitops.h>
 #include <linux/uaccess.h>
+#include <linux/vmalloc.h>
 #include <linux/slab.h>
 
 /*
@@ -205,18 +206,24 @@ static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev,
         struct ethtool_drvinfo info;
         const struct ethtool_ops *ops = dev->ethtool_ops;
 
-        if (!ops->get_drvinfo)
-                return -EOPNOTSUPP;
-
         memset(&info, 0, sizeof(info));
         info.cmd = ETHTOOL_GDRVINFO;
-        ops->get_drvinfo(dev, &info);
+        if (ops && ops->get_drvinfo) {
+                ops->get_drvinfo(dev, &info);
+        } else if (dev->dev.parent && dev->dev.parent->driver) {
+                strlcpy(info.bus_info, dev_name(dev->dev.parent),
+                        sizeof(info.bus_info));
+                strlcpy(info.driver, dev->dev.parent->driver->name,
+                        sizeof(info.driver));
+        } else {
+                return -EOPNOTSUPP;
+        }
 
         /*
          * this method of obtaining string set info is deprecated;
          * Use ETHTOOL_GSSET_INFO instead.
          */
-        if (ops->get_sset_count) {
+        if (ops && ops->get_sset_count) {
                 int rc;
 
                 rc = ops->get_sset_count(dev, ETH_SS_TEST);
@@ -229,9 +236,9 @@ static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev,
                 if (rc >= 0)
                         info.n_priv_flags = rc;
         }
-        if (ops->get_regs_len)
+        if (ops && ops->get_regs_len)
                 info.regdump_len = ops->get_regs_len(dev);
-        if (ops->get_eeprom_len)
+        if (ops && ops->get_eeprom_len)
                 info.eedump_len = ops->get_eeprom_len(dev);
 
         if (copy_to_user(useraddr, &info, sizeof(info)))
@@ -479,6 +486,38 @@ static void __rx_ntuple_filter_add(struct ethtool_rx_ntuple_list *list,
         list->count++;
 }
 
+/*
+ * ethtool does not (or did not) set masks for flow parameters that are
+ * not specified, so if both value and mask are 0 then this must be
+ * treated as equivalent to a mask with all bits set.  Implement that
+ * here rather than in drivers.
+ */
+static void rx_ntuple_fix_masks(struct ethtool_rx_ntuple_flow_spec *fs)
+{
+        struct ethtool_tcpip4_spec *entry = &fs->h_u.tcp_ip4_spec;
+        struct ethtool_tcpip4_spec *mask = &fs->m_u.tcp_ip4_spec;
+
+        if (fs->flow_type != TCP_V4_FLOW &&
+            fs->flow_type != UDP_V4_FLOW &&
+            fs->flow_type != SCTP_V4_FLOW)
+                return;
+
+        if (!(entry->ip4src | mask->ip4src))
+                mask->ip4src = htonl(0xffffffff);
+        if (!(entry->ip4dst | mask->ip4dst))
+                mask->ip4dst = htonl(0xffffffff);
+        if (!(entry->psrc | mask->psrc))
+                mask->psrc = htons(0xffff);
+        if (!(entry->pdst | mask->pdst))
+                mask->pdst = htons(0xffff);
+        if (!(entry->tos | mask->tos))
+                mask->tos = 0xff;
+        if (!(fs->vlan_tag | fs->vlan_tag_mask))
+                fs->vlan_tag_mask = 0xffff;
+        if (!(fs->data | fs->data_mask))
+                fs->data_mask = 0xffffffffffffffffULL;
+}
+
 static noinline_for_stack int ethtool_set_rx_ntuple(struct net_device *dev,
                                                     void __user *useraddr)
 {
@@ -493,6 +532,8 @@ static noinline_for_stack int ethtool_set_rx_ntuple(struct net_device *dev,
         if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
                 return -EFAULT;
 
+        rx_ntuple_fix_masks(&cmd.fs);
+
         /*
          * Cache filter in dev struct for GET operation only if
          * the underlying driver doesn't have its own GET operation, and
@@ -667,19 +708,19 @@ static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
                         break;
                 case IP_USER_FLOW:
                         sprintf(p, "\tSrc IP addr: 0x%x\n",
-                                fsc->fs.h_u.raw_ip4_spec.ip4src);
+                                fsc->fs.h_u.usr_ip4_spec.ip4src);
                         p += ETH_GSTRING_LEN;
                         num_strings++;
                         sprintf(p, "\tSrc IP mask: 0x%x\n",
-                                fsc->fs.m_u.raw_ip4_spec.ip4src);
+                                fsc->fs.m_u.usr_ip4_spec.ip4src);
                         p += ETH_GSTRING_LEN;
                         num_strings++;
                         sprintf(p, "\tDest IP addr: 0x%x\n",
-                                fsc->fs.h_u.raw_ip4_spec.ip4dst);
+                                fsc->fs.h_u.usr_ip4_spec.ip4dst);
                         p += ETH_GSTRING_LEN;
                         num_strings++;
                         sprintf(p, "\tDest IP mask: 0x%x\n",
-                                fsc->fs.m_u.raw_ip4_spec.ip4dst);
+                                fsc->fs.m_u.usr_ip4_spec.ip4dst);
                         p += ETH_GSTRING_LEN;
                         num_strings++;
                         break;
@@ -775,7 +816,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = kmalloc(reglen, GFP_USER);
+        regbuf = vmalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
@@ -790,7 +831,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         ret = 0;
 
  out:
-        kfree(regbuf);
+        vfree(regbuf);
         return ret;
 }
 
@@ -1175,8 +1216,11 @@ static int ethtool_set_gro(struct net_device *dev, char __user *useraddr)
                 return -EFAULT;
 
         if (edata.data) {
-                if (!dev->ethtool_ops->get_rx_csum ||
-                    !dev->ethtool_ops->get_rx_csum(dev))
+                u32 rxcsum = dev->ethtool_ops->get_rx_csum ?
+                                dev->ethtool_ops->get_rx_csum(dev) :
+                                ethtool_op_get_rx_csum(dev);
+
+                if (!rxcsum)
                         return -EINVAL;
                 dev->features |= NETIF_F_GRO;
         } else
@@ -1402,14 +1446,22 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         if (!dev || !netif_device_present(dev))
                 return -ENODEV;
 
-        if (!dev->ethtool_ops)
-                return -EOPNOTSUPP;
-
         if (copy_from_user(&ethcmd, useraddr, sizeof(ethcmd)))
                 return -EFAULT;
 
+        if (!dev->ethtool_ops) {
+                /* ETHTOOL_GDRVINFO does not require any driver support.
+                 * It is also unprivileged and does not change anything,
+                 * so we can take a shortcut to it. */
+                if (ethcmd == ETHTOOL_GDRVINFO)
+                        return ethtool_get_drvinfo(dev, useraddr);
+                else
+                        return -EOPNOTSUPP;
+        }
+
         /* Allow some commands to be done by anyone */
         switch (ethcmd) {
+        case ETHTOOL_GSET:
         case ETHTOOL_GDRVINFO:
         case ETHTOOL_GMSGLVL:
         case ETHTOOL_GCOALESCE:
diff --git a/net/core/flow.c b/net/core/flow.c
index f67dcbfe54ef..127c8a7ffd61 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -53,8 +53,7 @@ struct flow_flush_info {
 
 struct flow_cache {
         u32                             hash_shift;
-        unsigned long                   order;
-        struct flow_cache_percpu        *percpu;
+        struct flow_cache_percpu __percpu *percpu;
         struct notifier_block           hotcpu_notifier;
         int                             low_watermark;
         int                             high_watermark;
@@ -64,7 +63,7 @@ struct flow_cache {
 atomic_t flow_cache_genid = ATOMIC_INIT(0);
 EXPORT_SYMBOL(flow_cache_genid);
 static struct flow_cache flow_cache_global;
-static struct kmem_cache *flow_cachep;
+static struct kmem_cache *flow_cachep __read_mostly;
 
 static DEFINE_SPINLOCK(flow_cache_gc_lock);
 static LIST_HEAD(flow_cache_gc_list);
@@ -177,15 +176,11 @@ static u32 flow_hash_code(struct flow_cache *fc,
 {
         u32 *k = (u32 *) key;
 
-        return (jhash2(k, (sizeof(*key) / sizeof(u32)), fcp->hash_rnd)
-                & (flow_cache_hash_size(fc) - 1));
+        return jhash2(k, (sizeof(*key) / sizeof(u32)), fcp->hash_rnd)
+                & (flow_cache_hash_size(fc) - 1);
 }
 
-#if (BITS_PER_LONG == 64)
-typedef u64 flow_compare_t;
-#else
-typedef u32 flow_compare_t;
-#endif
+typedef unsigned long flow_compare_t;
 
 /* I hear what you're saying, use memcmp.  But memcmp cannot make
  * important assumptions that we can here, such as alignment and
@@ -357,62 +352,73 @@ void flow_cache_flush(void)
         put_online_cpus();
 }
 
-static void __init flow_cache_cpu_prepare(struct flow_cache *fc,
-                                          struct flow_cache_percpu *fcp)
+static int __cpuinit flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
 {
-        fcp->hash_table = (struct hlist_head *)
-                __get_free_pages(GFP_KERNEL|__GFP_ZERO, fc->order);
-        if (!fcp->hash_table)
-                panic("NET: failed to allocate flow cache order %lu\n", fc->order);
+        struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, cpu);
+        size_t sz = sizeof(struct hlist_head) * flow_cache_hash_size(fc);
 
-        fcp->hash_rnd_recalc = 1;
-        fcp->hash_count = 0;
-        tasklet_init(&fcp->flush_tasklet, flow_cache_flush_tasklet, 0);
+        if (!fcp->hash_table) {
+                fcp->hash_table = kzalloc_node(sz, GFP_KERNEL, cpu_to_node(cpu));
+                if (!fcp->hash_table) {
+                        pr_err("NET: failed to allocate flow cache sz %zu\n", sz);
+                        return -ENOMEM;
+                }
+                fcp->hash_rnd_recalc = 1;
+                fcp->hash_count = 0;
+                tasklet_init(&fcp->flush_tasklet, flow_cache_flush_tasklet, 0);
+        }
+        return 0;
 }
 
-static int flow_cache_cpu(struct notifier_block *nfb,
+static int __cpuinit flow_cache_cpu(struct notifier_block *nfb,
                           unsigned long action,
                           void *hcpu)
 {
         struct flow_cache *fc = container_of(nfb, struct flow_cache, hotcpu_notifier);
-        int cpu = (unsigned long) hcpu;
+        int res, cpu = (unsigned long) hcpu;
         struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, cpu);
 
-        if (action == CPU_DEAD || action == CPU_DEAD_FROZEN)
+        switch (action) {
+        case CPU_UP_PREPARE:
+        case CPU_UP_PREPARE_FROZEN:
+                res = flow_cache_cpu_prepare(fc, cpu);
+                if (res)
+                        return notifier_from_errno(res);
+                break;
+        case CPU_DEAD:
+        case CPU_DEAD_FROZEN:
                 __flow_cache_shrink(fc, fcp, 0);
+                break;
+        }
         return NOTIFY_OK;
 }
 
-static int flow_cache_init(struct flow_cache *fc)
+static int __init flow_cache_init(struct flow_cache *fc)
 {
-        unsigned long order;
         int i;
 
         fc->hash_shift = 10;
         fc->low_watermark = 2 * flow_cache_hash_size(fc);
         fc->high_watermark = 4 * flow_cache_hash_size(fc);
 
-        for (order = 0;
-             (PAGE_SIZE << order) <
-                     (sizeof(struct hlist_head)*flow_cache_hash_size(fc));
-             order++)
-                /* NOTHING */;
-        fc->order = order;
         fc->percpu = alloc_percpu(struct flow_cache_percpu);
+        if (!fc->percpu)
+                return -ENOMEM;
 
-        setup_timer(&fc->rnd_timer, flow_cache_new_hashrnd,
-                    (unsigned long) fc);
-        fc->rnd_timer.expires = jiffies + FLOW_HASH_RND_PERIOD;
-        add_timer(&fc->rnd_timer);
-
-        for_each_possible_cpu(i)
-                flow_cache_cpu_prepare(fc, per_cpu_ptr(fc->percpu, i));
-
+        for_each_online_cpu(i) {
+                if (flow_cache_cpu_prepare(fc, i))
+                        return -ENOMEM;
+        }
         fc->hotcpu_notifier = (struct notifier_block){
                 .notifier_call = flow_cache_cpu,
         };
         register_hotcpu_notifier(&fc->hotcpu_notifier);
 
+        setup_timer(&fc->rnd_timer, flow_cache_new_hashrnd,
+                    (unsigned long) fc);
+        fc->rnd_timer.expires = jiffies + FLOW_HASH_RND_PERIOD;
+        add_timer(&fc->rnd_timer);
+
         return 0;
 }
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 6743146e4d6b..7c2373321b74 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -274,9 +274,9 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
         while ((e = gen_find_node(bstats, rate_est))) {
                 rb_erase(&e->node, &est_root);
 
-                write_lock_bh(&est_lock);
+                write_lock(&est_lock);
                 e->bstats = NULL;
-                write_unlock_bh(&est_lock);
+                write_unlock(&est_lock);
 
                 list_del_rcu(&e->list);
                 call_rcu(&e->e_rcu, __gen_kill_estimator);
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 1cd98df412df..f4657c2127b4 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -41,7 +41,9 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
 
         if (m->msg_namelen) {
                 if (mode == VERIFY_READ) {
-                        err = move_addr_to_kernel(m->msg_name, m->msg_namelen,
+                        void __user *namep;
+                        namep = (void __user __force *) m->msg_name;
+                        err = move_addr_to_kernel(namep, m->msg_namelen,
                                                   address);
                         if (err < 0)
                                 return err;
@@ -52,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
         }
 
         size = m->msg_iovlen * sizeof(struct iovec);
-        if (copy_from_user(iov, m->msg_iov, size))
+        if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
                 return -EFAULT;
 
         m->msg_iov = iov;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a4e0a7482c2b..96b1a749abb4 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -122,7 +122,7 @@ static void neigh_cleanup_and_release(struct neighbour *neigh)
 
 unsigned long neigh_rand_reach_time(unsigned long base)
 {
-        return (base ? (net_random() % base) + (base >> 1) : 0);
+        return base ? (net_random() % base) + (base >> 1) : 0;
 }
 EXPORT_SYMBOL(neigh_rand_reach_time);
 
@@ -766,9 +766,9 @@ next_elt:
 static __inline__ int neigh_max_probes(struct neighbour *n)
 {
         struct neigh_parms *p = n->parms;
-        return (n->nud_state & NUD_PROBE ?
+        return (n->nud_state & NUD_PROBE) ?
                 p->ucast_probes :
-                p->ucast_probes + p->app_probes + p->mcast_probes);
+                p->ucast_probes + p->app_probes + p->mcast_probes;
 }
 
 static void neigh_invalidate(struct neighbour *neigh)
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index af4dfbadf2a0..76485a3f910b 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -515,7 +515,7 @@ static ssize_t rx_queue_attr_store(struct kobject *kobj, struct attribute *attr,
         return attribute->store(queue, attribute, buf, count);
 }
 
-static struct sysfs_ops rx_queue_sysfs_ops = {
+static const struct sysfs_ops rx_queue_sysfs_ops = {
         .show = rx_queue_attr_show,
         .store = rx_queue_attr_store,
 };
@@ -789,12 +789,13 @@ static const void *net_netlink_ns(struct sock *sk)
         return sock_net(sk);
 }
 
-static struct kobj_ns_type_operations net_ns_type_operations = {
+struct kobj_ns_type_operations net_ns_type_operations = {
         .type = KOBJ_NS_TYPE_NET,
         .current_ns = net_current_ns,
         .netlink_ns = net_netlink_ns,
         .initial_ns = net_initial_ns,
 };
+EXPORT_SYMBOL_GPL(net_ns_type_operations);
 
 static void net_kobj_ns_exit(struct net *net)
 {
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 10a1ea72010d..2c0df0f95b3d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -729,16 +729,14 @@ static int hex32_arg(const char __user *user_buffer, unsigned long maxlen,
         *num = 0;
 
         for (; i < maxlen; i++) {
+                int value;
                 char c;
                 *num <<= 4;
                 if (get_user(c, &user_buffer[i]))
                         return -EFAULT;
-                if ((c >= '0') && (c <= '9'))
-                        *num |= c - '0';
-                else if ((c >= 'a') && (c <= 'f'))
-                        *num |= c - 'a' + 10;
-                else if ((c >= 'A') && (c <= 'F'))
-                        *num |= c - 'A' + 10;
+                value = hex_to_bin(c);
+                if (value >= 0)
+                        *num |= value;
                 else
                         break;
         }
@@ -3907,8 +3905,6 @@ static void __exit pg_cleanup(void)
 {
         struct pktgen_thread *t;
         struct list_head *q, *n;
-        wait_queue_head_t queue;
-        init_waitqueue_head(&queue);
 
         /* Stop all interfaces & threads */
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f78d821bd935..b2a718dfd720 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -612,36 +612,7 @@ static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
 
 static void copy_rtnl_link_stats64(void *v, const struct rtnl_link_stats64 *b)
 {
-        struct rtnl_link_stats64 a;
-
-        a.rx_packets = b->rx_packets;
-        a.tx_packets = b->tx_packets;
-        a.rx_bytes = b->rx_bytes;
-        a.tx_bytes = b->tx_bytes;
-        a.rx_errors = b->rx_errors;
-        a.tx_errors = b->tx_errors;
-        a.rx_dropped = b->rx_dropped;
-        a.tx_dropped = b->tx_dropped;
-
-        a.multicast = b->multicast;
-        a.collisions = b->collisions;
-
-        a.rx_length_errors = b->rx_length_errors;
-        a.rx_over_errors = b->rx_over_errors;
-        a.rx_crc_errors = b->rx_crc_errors;
-        a.rx_frame_errors = b->rx_frame_errors;
-        a.rx_fifo_errors = b->rx_fifo_errors;
-        a.rx_missed_errors = b->rx_missed_errors;
-
-        a.tx_aborted_errors = b->tx_aborted_errors;
-        a.tx_carrier_errors = b->tx_carrier_errors;
-        a.tx_fifo_errors = b->tx_fifo_errors;
-        a.tx_heartbeat_errors = b->tx_heartbeat_errors;
-        a.tx_window_errors = b->tx_window_errors;
-
-        a.rx_compressed = b->rx_compressed;
-        a.tx_compressed = b->tx_compressed;
-        memcpy(v, &a, sizeof(a));
+        memcpy(v, b, sizeof(*b));
 }
 
 /* All VF info */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c83b421341c0..752c1972b3a7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -202,8 +202,6 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         skb->data = data;
         skb_reset_tail_pointer(skb);
         skb->end = skb->tail + size;
-        kmemcheck_annotate_bitfield(skb, flags1);
-        kmemcheck_annotate_bitfield(skb, flags2);
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
         skb->mac_header = ~0U;
 #endif
@@ -340,7 +338,7 @@ static void skb_release_data(struct sk_buff *skb)
                                 put_page(skb_shinfo(skb)->frags[i].page);
                 }
 
-                if (skb_has_frags(skb))
+                if (skb_has_frag_list(skb))
                         skb_drop_fraglist(skb);
 
                 kfree(skb->head);
@@ -685,16 +683,10 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 
 struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 {
-        int headerlen = skb->data - skb->head;
-        /*
-         *      Allocate the copy buffer
-         */
-        struct sk_buff *n;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        n = alloc_skb(skb->end + skb->data_len, gfp_mask);
-#else
-        n = alloc_skb(skb->end - skb->head + skb->data_len, gfp_mask);
-#endif
+        int headerlen = skb_headroom(skb);
+        unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
+        struct sk_buff *n = alloc_skb(size, gfp_mask);
+
         if (!n)
                 return NULL;
 
@@ -726,20 +718,14 @@ EXPORT_SYMBOL(skb_copy);
 
 struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
 {
-        /*
-         *      Allocate the copy buffer
-         */
-        struct sk_buff *n;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        n = alloc_skb(skb->end, gfp_mask);
-#else
-        n = alloc_skb(skb->end - skb->head, gfp_mask);
-#endif
+        unsigned int size = skb_end_pointer(skb) - skb->head;
+        struct sk_buff *n = alloc_skb(size, gfp_mask);
+
         if (!n)
                 goto out;
 
         /* Set the data pointer */
-        skb_reserve(n, skb->data - skb->head);
+        skb_reserve(n, skb_headroom(skb));
         /* Set the tail pointer and length */
         skb_put(n, skb_headlen(skb));
         /* Copy the bytes */
@@ -759,7 +745,7 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
                 skb_shinfo(n)->nr_frags = i;
         }
 
-        if (skb_has_frags(skb)) {
+        if (skb_has_frag_list(skb)) {
                 skb_shinfo(n)->frag_list = skb_shinfo(skb)->frag_list;
                 skb_clone_fraglist(n);
         }
@@ -791,12 +777,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 {
         int i;
         u8 *data;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        int size = nhead + skb->end + ntail;
-#else
-        int size = nhead + (skb->end - skb->head) + ntail;
-#endif
+        int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
         long off;
+        bool fastpath;
 
         BUG_ON(nhead < 0);
 
@@ -810,23 +793,36 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                 goto nodata;
 
         /* Copy only real data... and, alas, header. This should be
-         * optimized for the cases when header is void. */
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        memcpy(data + nhead, skb->head, skb->tail);
-#else
-        memcpy(data + nhead, skb->head, skb->tail - skb->head);
-#endif
-        memcpy(data + size, skb_end_pointer(skb),
+         * optimized for the cases when header is void.
+         */
+        memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
+
+        memcpy((struct skb_shared_info *)(data + size),
+               skb_shinfo(skb),
                offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
-                get_page(skb_shinfo(skb)->frags[i].page);
+        /* Check if we can avoid taking references on fragments if we own
+         * the last reference on skb->head. (see skb_release_data())
+         */
+        if (!skb->cloned)
+                fastpath = true;
+        else {
+                int delta = skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1;
 
-        if (skb_has_frags(skb))
-                skb_clone_fraglist(skb);
+                fastpath = atomic_read(&skb_shinfo(skb)->dataref) == delta;
+        }
 
-        skb_release_data(skb);
+        if (fastpath) {
+                kfree(skb->head);
+        } else {
+                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+                        get_page(skb_shinfo(skb)->frags[i].page);
 
+                if (skb_has_frag_list(skb))
+                        skb_clone_fraglist(skb);
+
+                skb_release_data(skb);
+        }
         off = (data + nhead) - skb->head;
 
         skb->head     = data;
@@ -1099,7 +1095,7 @@ drop_pages:
                 for (; i < nfrags; i++)
                         put_page(skb_shinfo(skb)->frags[i].page);
 
-                if (skb_has_frags(skb))
+                if (skb_has_frag_list(skb))
                         skb_drop_fraglist(skb);
                 goto done;
         }
@@ -1194,7 +1190,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
         /* Optimization: no fragments, no reasons to preestimate
          * size of pulled pages. Superb.
          */
-        if (!skb_has_frags(skb))
+        if (!skb_has_frag_list(skb))
                 goto pull_pages;
 
         /* Estimate size of pulled pages. */
@@ -2323,7 +2319,7 @@ next_skb:
                 st->frag_data = NULL;
         }
 
-        if (st->root_skb == st->cur_skb && skb_has_frags(st->root_skb)) {
+        if (st->root_skb == st->cur_skb && skb_has_frag_list(st->root_skb)) {
                 st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
                 st->frag_idx = 0;
                 goto next_skb;
@@ -2893,7 +2889,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
                 return -ENOMEM;
 
         /* Easy case. Most of packets will go this way. */
-        if (!skb_has_frags(skb)) {
+        if (!skb_has_frag_list(skb)) {
                 /* A little of trouble, not enough of space for trailer.
                  * This should not happen, when stack is tuned to generate
                  * good frames. OK, on miss we reallocate and reserve even more
@@ -2928,7 +2924,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 
                 if (skb1->next == NULL && tailbits) {
                         if (skb_shinfo(skb1)->nr_frags ||
-                            skb_has_frags(skb1) ||
+                            skb_has_frag_list(skb1) ||
                             skb_tailroom(skb1) < tailbits)
                                 ntail = tailbits + 128;
                 }
@@ -2937,7 +2933,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
                     skb_cloned(skb1) ||
                     ntail ||
                     skb_shinfo(skb1)->nr_frags ||
-                    skb_has_frags(skb1)) {
+                    skb_has_frag_list(skb1)) {
                         struct sk_buff *skb2;
 
                         /* Fuck, we are miserable poor guys... */
@@ -3020,7 +3016,7 @@ void skb_tstamp_tx(struct sk_buff *orig_skb,
         } else {
                 /*
                  * no hardware time stamps available,
-                 * so keep the skb_shared_tx and only
+                 * so keep the shared tx_flags and only
                  * store software time stamp
                  */
                 skb->tstamp = ktime_get_real();
diff --git a/net/core/sock.c b/net/core/sock.c
index ef30e9d286e7..42365deeba27 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1557,6 +1557,8 @@ struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
 EXPORT_SYMBOL(sock_alloc_send_skb);
 
 static void __lock_sock(struct sock *sk)
+        __releases(&sk->sk_lock.slock)
+        __acquires(&sk->sk_lock.slock)
 {
         DEFINE_WAIT(wait);
 
@@ -1573,6 +1575,8 @@ static void __lock_sock(struct sock *sk)
 }
 
 static void __release_sock(struct sock *sk)
+        __releases(&sk->sk_lock.slock)
+        __acquires(&sk->sk_lock.slock)
 {
         struct sk_buff *skb = sk->sk_backlog.head;
 
diff --git a/net/core/utils.c b/net/core/utils.c
index f41854470539..5fea0ab21902 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -75,7 +75,7 @@ __be32 in_aton(const char *str)
                                 str++;
                 }
         }
-        return(htonl(l));
+        return htonl(l);
 }
 EXPORT_SYMBOL(in_aton);
 
@@ -92,18 +92,19 @@ EXPORT_SYMBOL(in_aton);
 
 static inline int xdigit2bin(char c, int delim)
 {
+        int val;
+
         if (c == delim || c == '\0')
                 return IN6PTON_DELIM;
         if (c == ':')
                 return IN6PTON_COLON_MASK;
         if (c == '.')
                 return IN6PTON_DOT;
-        if (c >= '0' && c <= '9')
-                return (IN6PTON_XDIGIT | IN6PTON_DIGIT| (c - '0'));
-        if (c >= 'a' && c <= 'f')
-                return (IN6PTON_XDIGIT | (c - 'a' + 10));
-        if (c >= 'A' && c <= 'F')
-                return (IN6PTON_XDIGIT | (c - 'A' + 10));
+
+        val = hex_to_bin(c);
+        if (val >= 0)
+                return val | IN6PTON_XDIGIT | (val < 10 ? IN6PTON_DIGIT : 0);
+
         if (delim == -1)
                 return IN6PTON_DELIM;
         return IN6PTON_UNKNOWN;
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 6df6f8ac9636..6d16a9070ff0 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -62,18 +62,14 @@ struct ccid_operations {
         void            (*ccid_hc_tx_exit)(struct sock *sk);
         void            (*ccid_hc_rx_packet_recv)(struct sock *sk,
                                                   struct sk_buff *skb);
-        int             (*ccid_hc_rx_parse_options)(struct sock *sk,
-                                                    unsigned char option,
-                                                    unsigned char len, u16 idx,
-                                                    unsigned char* value);
+        int             (*ccid_hc_rx_parse_options)(struct sock *sk, u8 pkt,
+                                                    u8 opt, u8 *val, u8 len);
         int             (*ccid_hc_rx_insert_options)(struct sock *sk,
                                                      struct sk_buff *skb);
         void            (*ccid_hc_tx_packet_recv)(struct sock *sk,
                                                   struct sk_buff *skb);
-        int             (*ccid_hc_tx_parse_options)(struct sock *sk,
-                                                    unsigned char option,
-                                                    unsigned char len, u16 idx,
-                                                    unsigned char* value);
+        int             (*ccid_hc_tx_parse_options)(struct sock *sk, u8 pkt,
+                                                    u8 opt, u8 *val, u8 len);
         int             (*ccid_hc_tx_send_packet)(struct sock *sk,
                                                   struct sk_buff *skb);
         void            (*ccid_hc_tx_packet_sent)(struct sock *sk,
@@ -168,27 +164,31 @@ static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk,
                 ccid->ccid_ops->ccid_hc_tx_packet_recv(sk, skb);
 }
 
+/**
+ * ccid_hc_tx_parse_options  -  Parse CCID-specific options sent by the receiver
+ * @pkt: type of packet that @opt appears on (RFC 4340, 5.1)
+ * @opt: the CCID-specific option type (RFC 4340, 5.8 and 10.3)
+ * @val: value of @opt
+ * @len: length of @val in bytes
+ */
 static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
-                                           unsigned char option,
-                                           unsigned char len, u16 idx,
-                                           unsigned char* value)
+                                           u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        int rc = 0;
-        if (ccid->ccid_ops->ccid_hc_tx_parse_options != NULL)
-                rc = ccid->ccid_ops->ccid_hc_tx_parse_options(sk, option, len, idx,
-                                                    value);
-        return rc;
+        if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
+                return 0;
+        return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
 }
 
+/**
+ * ccid_hc_rx_parse_options  -  Parse CCID-specific options sent by the sender
+ * Arguments are analogous to ccid_hc_tx_parse_options()
+ */
 static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
-                                           unsigned char option,
-                                           unsigned char len, u16 idx,
-                                           unsigned char* value)
+                                           u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        int rc = 0;
-        if (ccid->ccid_ops->ccid_hc_rx_parse_options != NULL)
-                rc = ccid->ccid_ops->ccid_hc_rx_parse_options(sk, option, len, idx, value);
-        return rc;
+        if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
+                return 0;
+        return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
 }
 
 static inline int ccid_hc_rx_insert_options(struct ccid *ccid, struct sock *sk,
diff --git a/net/dccp/ccids/Kconfig b/net/dccp/ccids/Kconfig
index 8408398cd44e..0581143cb800 100644
--- a/net/dccp/ccids/Kconfig
+++ b/net/dccp/ccids/Kconfig
@@ -47,37 +47,6 @@ config IP_DCCP_CCID3_DEBUG
 
           If in doubt, say N.
 
-config IP_DCCP_CCID3_RTO
-          int "Use higher bound for nofeedback timer"
-          default 100
-          depends on IP_DCCP_CCID3 && EXPERIMENTAL
-          ---help---
-            Use higher lower bound for nofeedback timer expiration.
-
-            The TFRC nofeedback timer normally expires after the maximum of 4
-            RTTs and twice the current send interval (RFC 3448, 4.3). On LANs
-            with a small RTT this can mean a high processing load and reduced
-            performance, since then the nofeedback timer is triggered very
-            frequently.
-
-            This option enables to set a higher lower bound for the nofeedback
-            value. Values in units of milliseconds can be set here.
-
-            A value of 0 disables this feature by enforcing the value specified
-            in RFC 3448. The following values have been suggested as bounds for
-            experimental use:
-                * 16-20ms to match the typical multimedia inter-frame interval
-                * 100ms as a reasonable compromise [default]
-                * 1000ms corresponds to the lower TCP RTO bound (RFC 2988, 2.4)
-
-            The default of 100ms is a compromise between a large value for
-            efficient DCCP implementations, and a small value to avoid disrupting
-            the network in times of congestion.
-
-            The purpose of the nofeedback timer is to slow DCCP down when there
-            is serious network congestion: experimenting with larger values should
-            therefore not be performed on WANs.
-
 config IP_DCCP_TFRC_LIB
         def_bool y if IP_DCCP_CCID3
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 9b3ae9922be1..dc18172b1e59 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -25,59 +25,14 @@
  */
 #include <linux/slab.h>
 #include "../feat.h"
-#include "../ccid.h"
-#include "../dccp.h"
 #include "ccid2.h"
 
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
 static int ccid2_debug;
 #define ccid2_pr_debug(format, a...)    DCCP_PR_DEBUG(ccid2_debug, format, ##a)
-
-static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hc)
-{
-        int len = 0;
-        int pipe = 0;
-        struct ccid2_seq *seqp = hc->tx_seqh;
-
-        /* there is data in the chain */
-        if (seqp != hc->tx_seqt) {
-                seqp = seqp->ccid2s_prev;
-                len++;
-                if (!seqp->ccid2s_acked)
-                        pipe++;
-
-                while (seqp != hc->tx_seqt) {
-                        struct ccid2_seq *prev = seqp->ccid2s_prev;
-
-                        len++;
-                        if (!prev->ccid2s_acked)
-                                pipe++;
-
-                        /* packets are sent sequentially */
-                        BUG_ON(dccp_delta_seqno(seqp->ccid2s_seq,
-                                                prev->ccid2s_seq ) >= 0);
-                        BUG_ON(time_before(seqp->ccid2s_sent,
-                                           prev->ccid2s_sent));
-
-                        seqp = prev;
-                }
-        }
-
-        BUG_ON(pipe != hc->tx_pipe);
-        ccid2_pr_debug("len of chain=%d\n", len);
-
-        do {
-                seqp = seqp->ccid2s_prev;
-                len++;
-        } while (seqp != hc->tx_seqh);
-
-        ccid2_pr_debug("total len=%d\n", len);
-        BUG_ON(len != hc->tx_seqbufc * CCID2_SEQBUF_LEN);
-}
 #else
 #define ccid2_pr_debug(format, a...)
-#define ccid2_hc_tx_check_sanity(hc)
 #endif
 
 static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
@@ -156,19 +111,10 @@ static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
         dp->dccps_l_ack_ratio = val;
 }
 
-static void ccid2_change_srtt(struct ccid2_hc_tx_sock *hc, long val)
-{
-        ccid2_pr_debug("change SRTT to %ld\n", val);
-        hc->tx_srtt = val;
-}
-
-static void ccid2_start_rto_timer(struct sock *sk);
-
 static void ccid2_hc_tx_rto_expire(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
-        long s;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) {
@@ -178,23 +124,19 @@ static void ccid2_hc_tx_rto_expire(unsigned long data)
 
         ccid2_pr_debug("RTO_EXPIRE\n");
 
-        ccid2_hc_tx_check_sanity(hc);
-
         /* back-off timer */
         hc->tx_rto <<= 1;
+        if (hc->tx_rto > DCCP_RTO_MAX)
+                hc->tx_rto = DCCP_RTO_MAX;
 
-        s = hc->tx_rto / HZ;
-        if (s > 60)
-                hc->tx_rto = 60 * HZ;
-
-        ccid2_start_rto_timer(sk);
+        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 
         /* adjust pipe, cwnd etc */
         hc->tx_ssthresh = hc->tx_cwnd / 2;
         if (hc->tx_ssthresh < 2)
                 hc->tx_ssthresh = 2;
-        hc->tx_cwnd      = 1;
-        hc->tx_pipe      = 0;
+        hc->tx_cwnd     = 1;
+        hc->tx_pipe     = 0;
 
         /* clear state about stuff we sent */
         hc->tx_seqt = hc->tx_seqh;
@@ -204,22 +146,11 @@ static void ccid2_hc_tx_rto_expire(unsigned long data)
         hc->tx_rpseq    = 0;
         hc->tx_rpdupack = -1;
         ccid2_change_l_ack_ratio(sk, 1);
-        ccid2_hc_tx_check_sanity(hc);
 out:
         bh_unlock_sock(sk);
         sock_put(sk);
 }
 
-static void ccid2_start_rto_timer(struct sock *sk)
-{
-        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
-
-        ccid2_pr_debug("setting RTO timeout=%ld\n", hc->tx_rto);
-
-        BUG_ON(timer_pending(&hc->tx_rtotimer));
-        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
-}
-
 static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -230,7 +161,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
 
         hc->tx_seqh->ccid2s_seq   = dp->dccps_gss;
         hc->tx_seqh->ccid2s_acked = 0;
-        hc->tx_seqh->ccid2s_sent  = jiffies;
+        hc->tx_seqh->ccid2s_sent  = ccid2_time_stamp;
 
         next = hc->tx_seqh->ccid2s_next;
         /* check if we need to alloc more space */
@@ -296,23 +227,20 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
         }
 #endif
 
-        /* setup RTO timer */
-        if (!timer_pending(&hc->tx_rtotimer))
-                ccid2_start_rto_timer(sk);
+        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
         do {
                 struct ccid2_seq *seqp = hc->tx_seqt;
 
                 while (seqp != hc->tx_seqh) {
-                        ccid2_pr_debug("out seq=%llu acked=%d time=%lu\n",
+                        ccid2_pr_debug("out seq=%llu acked=%d time=%u\n",
                                        (unsigned long long)seqp->ccid2s_seq,
                                        seqp->ccid2s_acked, seqp->ccid2s_sent);
                         seqp = seqp->ccid2s_next;
                 }
         } while (0);
         ccid2_pr_debug("=========\n");
-        ccid2_hc_tx_check_sanity(hc);
 #endif
 }
 
@@ -378,17 +306,87 @@ out_invalid_option:
         return -1;
 }
 
-static void ccid2_hc_tx_kill_rto_timer(struct sock *sk)
+/**
+ * ccid2_rtt_estimator - Sample RTT and compute RTO using RFC2988 algorithm
+ * This code is almost identical with TCP's tcp_rtt_estimator(), since
+ * - it has a higher sampling frequency (recommended by RFC 1323),
+ * - the RTO does not collapse into RTT due to RTTVAR going towards zero,
+ * - it is simple (cf. more complex proposals such as Eifel timer or research
+ *   which suggests that the gain should be set according to window size),
+ * - in tests it was found to work well with CCID2 [gerrit].
+ */
+static void ccid2_rtt_estimator(struct sock *sk, const long mrtt)
 {
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
+        long m = mrtt ? : 1;
 
-        sk_stop_timer(sk, &hc->tx_rtotimer);
-        ccid2_pr_debug("deleted RTO timer\n");
+        if (hc->tx_srtt == 0) {
+                /* First measurement m */
+                hc->tx_srtt = m << 3;
+                hc->tx_mdev = m << 1;
+
+                hc->tx_mdev_max = max(hc->tx_mdev, tcp_rto_min(sk));
+                hc->tx_rttvar   = hc->tx_mdev_max;
+
+                hc->tx_rtt_seq  = dccp_sk(sk)->dccps_gss;
+        } else {
+                /* Update scaled SRTT as SRTT += 1/8 * (m - SRTT) */
+                m -= (hc->tx_srtt >> 3);
+                hc->tx_srtt += m;
+
+                /* Similarly, update scaled mdev with regard to |m| */
+                if (m < 0) {
+                        m = -m;
+                        m -= (hc->tx_mdev >> 2);
+                        /*
+                         * This neutralises RTO increase when RTT < SRTT - mdev
+                         * (see P. Sarolahti, A. Kuznetsov,"Congestion Control
+                         * in Linux TCP", USENIX 2002, pp. 49-62).
+                         */
+                        if (m > 0)
+                                m >>= 3;
+                } else {
+                        m -= (hc->tx_mdev >> 2);
+                }
+                hc->tx_mdev += m;
+
+                if (hc->tx_mdev > hc->tx_mdev_max) {
+                        hc->tx_mdev_max = hc->tx_mdev;
+                        if (hc->tx_mdev_max > hc->tx_rttvar)
+                                hc->tx_rttvar = hc->tx_mdev_max;
+                }
+
+                /*
+                 * Decay RTTVAR at most once per flight, exploiting that
+                 *  1) pipe <= cwnd <= Sequence_Window = W  (RFC 4340, 7.5.2)
+                 *  2) AWL = GSS-W+1 <= GAR <= GSS          (RFC 4340, 7.5.1)
+                 * GAR is a useful bound for FlightSize = pipe.
+                 * AWL is probably too low here, as it over-estimates pipe.
+                 */
+                if (after48(dccp_sk(sk)->dccps_gar, hc->tx_rtt_seq)) {
+                        if (hc->tx_mdev_max < hc->tx_rttvar)
+                                hc->tx_rttvar -= (hc->tx_rttvar -
+                                                  hc->tx_mdev_max) >> 2;
+                        hc->tx_rtt_seq  = dccp_sk(sk)->dccps_gss;
+                        hc->tx_mdev_max = tcp_rto_min(sk);
+                }
+        }
+
+        /*
+         * Set RTO from SRTT and RTTVAR
+         * As in TCP, 4 * RTTVAR >= TCP_RTO_MIN, giving a minimum RTO of 200 ms.
+         * This agrees with RFC 4341, 5:
+         *      "Because DCCP does not retransmit data, DCCP does not require
+         *       TCP's recommended minimum timeout of one second".
+         */
+        hc->tx_rto = (hc->tx_srtt >> 3) + hc->tx_rttvar;
+
+        if (hc->tx_rto > DCCP_RTO_MAX)
+                hc->tx_rto = DCCP_RTO_MAX;
 }
 
-static inline void ccid2_new_ack(struct sock *sk,
-                                 struct ccid2_seq *seqp,
-                                 unsigned int *maxincr)
+static void ccid2_new_ack(struct sock *sk, struct ccid2_seq *seqp,
+                          unsigned int *maxincr)
 {
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
@@ -402,93 +400,27 @@ static inline void ccid2_new_ack(struct sock *sk,
                         hc->tx_cwnd += 1;
                         hc->tx_packets_acked = 0;
         }
-
-        /* update RTO */
-        if (hc->tx_srtt == -1 ||
-            time_after(jiffies, hc->tx_lastrtt + hc->tx_srtt)) {
-                unsigned long r = (long)jiffies - (long)seqp->ccid2s_sent;
-                int s;
-
-                /* first measurement */
-                if (hc->tx_srtt == -1) {
-                        ccid2_pr_debug("R: %lu Time=%lu seq=%llu\n",
-                                       r, jiffies,
-                                       (unsigned long long)seqp->ccid2s_seq);
-                        ccid2_change_srtt(hc, r);
-                        hc->tx_rttvar = r >> 1;
-                } else {
-                        /* RTTVAR */
-                        long tmp = hc->tx_srtt - r;
-                        long srtt;
-
-                        if (tmp < 0)
-                                tmp *= -1;
-
-                        tmp >>= 2;
-                        hc->tx_rttvar *= 3;
-                        hc->tx_rttvar >>= 2;
-                        hc->tx_rttvar += tmp;
-
-                        /* SRTT */
-                        srtt = hc->tx_srtt;
-                        srtt *= 7;
-                        srtt >>= 3;
-                        tmp = r >> 3;
-                        srtt += tmp;
-                        ccid2_change_srtt(hc, srtt);
-                }
-                s = hc->tx_rttvar << 2;
-                /* clock granularity is 1 when based on jiffies */
-                if (!s)
-                        s = 1;
-                hc->tx_rto = hc->tx_srtt + s;
-
-                /* must be at least a second */
-                s = hc->tx_rto / HZ;
-                /* DCCP doesn't require this [but I like it cuz my code sux] */
-#if 1
-                if (s < 1)
-                        hc->tx_rto = HZ;
-#endif
-                /* max 60 seconds */
-                if (s > 60)
-                        hc->tx_rto = HZ * 60;
-
-                hc->tx_lastrtt = jiffies;
-
-                ccid2_pr_debug("srtt: %ld rttvar: %ld rto: %ld (HZ=%d) R=%lu\n",
-                               hc->tx_srtt, hc->tx_rttvar,
-                               hc->tx_rto, HZ, r);
-        }
-
-        /* we got a new ack, so re-start RTO timer */
-        ccid2_hc_tx_kill_rto_timer(sk);
-        ccid2_start_rto_timer(sk);
-}
-
-static void ccid2_hc_tx_dec_pipe(struct sock *sk)
-{
-        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
-
-        if (hc->tx_pipe == 0)
-                DCCP_BUG("pipe == 0");
-        else
-                hc->tx_pipe--;
-
-        if (hc->tx_pipe == 0)
-                ccid2_hc_tx_kill_rto_timer(sk);
+        /*
+         * FIXME: RTT is sampled several times per acknowledgment (for each
+         * entry in the Ack Vector), instead of once per Ack (as in TCP SACK).
+         * This causes the RTT to be over-estimated, since the older entries
+         * in the Ack Vector have earlier sending times.
+         * The cleanest solution is to not use the ccid2s_sent field at all
+         * and instead use DCCP timestamps: requires changes in other places.
+         */
+        ccid2_rtt_estimator(sk, ccid2_time_stamp - seqp->ccid2s_sent);
 }
 
 static void ccid2_congestion_event(struct sock *sk, struct ccid2_seq *seqp)
 {
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (time_before(seqp->ccid2s_sent, hc->tx_last_cong)) {
+        if ((s32)(seqp->ccid2s_sent - hc->tx_last_cong) < 0) {
                 ccid2_pr_debug("Multiple losses in an RTT---treating as one\n");
                 return;
         }
 
-        hc->tx_last_cong = jiffies;
+        hc->tx_last_cong = ccid2_time_stamp;
 
         hc->tx_cwnd      = hc->tx_cwnd / 2 ? : 1U;
         hc->tx_ssthresh  = max(hc->tx_cwnd, 2U);
@@ -510,7 +442,6 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         int done = 0;
         unsigned int maxincr = 0;
 
-        ccid2_hc_tx_check_sanity(hc);
         /* check reverse path congestion */
         seqno = DCCP_SKB_CB(skb)->dccpd_seq;
 
@@ -620,7 +551,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                         seqp->ccid2s_acked = 1;
                                         ccid2_pr_debug("Got ack for %llu\n",
                                                        (unsigned long long)seqp->ccid2s_seq);
-                                        ccid2_hc_tx_dec_pipe(sk);
+                                        hc->tx_pipe--;
                                 }
                                 if (seqp == hc->tx_seqt) {
                                         done = 1;
@@ -677,7 +608,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                  * one ack vector.
                                  */
                                 ccid2_congestion_event(sk, seqp);
-                                ccid2_hc_tx_dec_pipe(sk);
+                                hc->tx_pipe--;
                         }
                         if (seqp == hc->tx_seqt)
                                 break;
@@ -695,7 +626,11 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 hc->tx_seqt = hc->tx_seqt->ccid2s_next;
         }
 
-        ccid2_hc_tx_check_sanity(hc);
+        /* restart RTO timer if not all outstanding data has been acked */
+        if (hc->tx_pipe == 0)
+                sk_stop_timer(sk, &hc->tx_rtotimer);
+        else
+                sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 }
 
 static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
@@ -707,12 +642,8 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
         /* RFC 4341, 5: initialise ssthresh to arbitrarily high (max) value */
         hc->tx_ssthresh = ~0U;
 
-        /*
-         * RFC 4341, 5: "The cwnd parameter is initialized to at most four
-         * packets for new connections, following the rules from [RFC3390]".
-         * We need to convert the bytes of RFC3390 into the packets of RFC 4341.
-         */
-        hc->tx_cwnd = clamp(4380U / dp->dccps_mss_cache, 2U, 4U);
+        /* Use larger initial windows (RFC 4341, section 5). */
+        hc->tx_cwnd = rfc3390_bytes_to_packets(dp->dccps_mss_cache);
 
         /* Make sure that Ack Ratio is enabled and within bounds. */
         max_ratio = DIV_ROUND_UP(hc->tx_cwnd, 2);
@@ -723,15 +654,11 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
         if (ccid2_hc_tx_alloc_seq(hc))
                 return -ENOMEM;
 
-        hc->tx_rto       = 3 * HZ;
-        ccid2_change_srtt(hc, -1);
-        hc->tx_rttvar    = -1;
+        hc->tx_rto       = DCCP_TIMEOUT_INIT;
         hc->tx_rpdupack  = -1;
-        hc->tx_last_cong = jiffies;
+        hc->tx_last_cong = ccid2_time_stamp;
         setup_timer(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire,
                         (unsigned long)sk);
-
-        ccid2_hc_tx_check_sanity(hc);
         return 0;
 }
 
@@ -740,7 +667,7 @@ static void ccid2_hc_tx_exit(struct sock *sk)
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         int i;
 
-        ccid2_hc_tx_kill_rto_timer(sk);
+        sk_stop_timer(sk, &hc->tx_rtotimer);
 
         for (i = 0; i < hc->tx_seqbufc; i++)
                 kfree(hc->tx_seqbuf[i]);
diff --git a/net/dccp/ccids/ccid2.h b/net/dccp/ccids/ccid2.h
index 1ec6a30103bb..9731c2dc1487 100644
--- a/net/dccp/ccids/ccid2.h
+++ b/net/dccp/ccids/ccid2.h
@@ -18,18 +18,23 @@
 #ifndef _DCCP_CCID2_H_
 #define _DCCP_CCID2_H_
 
-#include <linux/dccp.h>
 #include <linux/timer.h>
 #include <linux/types.h>
 #include "../ccid.h"
+#include "../dccp.h"
+
+/*
+ * CCID-2 timestamping faces the same issues as TCP timestamping.
+ * Hence we reuse/share as much of the code as possible.
+ */
+#define ccid2_time_stamp        tcp_time_stamp
+
 /* NUMDUPACK parameter from RFC 4341, p. 6 */
 #define NUMDUPACK       3
 
-struct sock;
-
 struct ccid2_seq {
         u64                     ccid2s_seq;
-        unsigned long           ccid2s_sent;
+        u32                     ccid2s_sent;
         int                     ccid2s_acked;
         struct ccid2_seq        *ccid2s_prev;
         struct ccid2_seq        *ccid2s_next;
@@ -42,7 +47,12 @@ struct ccid2_seq {
  * struct ccid2_hc_tx_sock - CCID2 TX half connection
  * @tx_{cwnd,ssthresh,pipe}: as per RFC 4341, section 5
  * @tx_packets_acked:        Ack counter for deriving cwnd growth (RFC 3465)
- * @tx_lastrtt:              time RTT was last measured
+ * @tx_srtt:                 smoothed RTT estimate, scaled by 2^3
+ * @tx_mdev:                 smoothed RTT variation, scaled by 2^2
+ * @tx_mdev_max:             maximum of @mdev during one flight
+ * @tx_rttvar:               moving average/maximum of @mdev_max
+ * @tx_rto:                  RTO value deriving from SRTT and RTTVAR (RFC 2988)
+ * @tx_rtt_seq:              to decay RTTVAR at most once per flight
  * @tx_rpseq:                last consecutive seqno
  * @tx_rpdupack:             dupacks since rpseq
  */
@@ -55,14 +65,19 @@ struct ccid2_hc_tx_sock {
         int                     tx_seqbufc;
         struct ccid2_seq        *tx_seqh;
         struct ccid2_seq        *tx_seqt;
-        long                    tx_rto;
-        long                    tx_srtt;
-        long                    tx_rttvar;
-        unsigned long           tx_lastrtt;
+
+        /* RTT measurement: variables/principles are the same as in TCP */
+        u32                     tx_srtt,
+                                tx_mdev,
+                                tx_mdev_max,
+                                tx_rttvar,
+                                tx_rto;
+        u64                     tx_rtt_seq:48;
         struct timer_list       tx_rtotimer;
+
         u64                     tx_rpseq;
         int                     tx_rpdupack;
-        unsigned long           tx_last_cong;
+        u32                     tx_last_cong;
         u64                     tx_high_ack;
 };
 
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 95f752986497..c3f3a25bbd7a 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -54,7 +54,6 @@ static const char *ccid3_tx_state_name(enum ccid3_hc_tx_states state)
         [TFRC_SSTATE_NO_SENT]  = "NO_SENT",
         [TFRC_SSTATE_NO_FBACK] = "NO_FBACK",
         [TFRC_SSTATE_FBACK]    = "FBACK",
-        [TFRC_SSTATE_TERM]     = "TERM",
         };
 
         return ccid3_state_names[state];
@@ -91,19 +90,16 @@ static inline u64 rfc3390_initial_rate(struct sock *sk)
         return scaled_div(w_init << 6, hc->tx_rtt);
 }
 
-/*
- * Recalculate t_ipi and delta (should be called whenever X changes)
+/**
+ * ccid3_update_send_interval  -  Calculate new t_ipi = s / X_inst
+ * This respects the granularity of X_inst (64 * bytes/second).
  */
 static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hc)
 {
-        /* Calculate new t_ipi = s / X_inst (X_inst is in 64 * bytes/second) */
         hc->tx_t_ipi = scaled_div32(((u64)hc->tx_s) << 6, hc->tx_x);
 
-        /* Calculate new delta by delta = min(t_ipi / 2, t_gran / 2) */
-        hc->tx_delta = min_t(u32, hc->tx_t_ipi / 2, TFRC_OPSYS_HALF_TIME_GRAN);
-
-        ccid3_pr_debug("t_ipi=%u, delta=%u, s=%u, X=%u\n", hc->tx_t_ipi,
-                       hc->tx_delta, hc->tx_s, (unsigned)(hc->tx_x >> 6));
+        ccid3_pr_debug("t_ipi=%u, s=%u, X=%u\n", hc->tx_t_ipi,
+                       hc->tx_s, (unsigned)(hc->tx_x >> 6));
 }
 
 static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hc, ktime_t now)
@@ -211,16 +207,19 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
         ccid3_pr_debug("%s(%p, state=%s) - entry\n", dccp_role(sk), sk,
                        ccid3_tx_state_name(hc->tx_state));
 
+        /* Ignore and do not restart after leaving the established state */
+        if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
+                goto out;
+
+        /* Reset feedback state to "no feedback received" */
         if (hc->tx_state == TFRC_SSTATE_FBACK)
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
-        else if (hc->tx_state != TFRC_SSTATE_NO_FBACK)
-                goto out;
 
         /*
          * Determine new allowed sending rate X as per draft rfc3448bis-00, 4.4
+         * RTO is 0 if and only if no feedback has been received yet.
          */
-        if (hc->tx_t_rto == 0 ||        /* no feedback received yet */
-            hc->tx_p == 0) {
+        if (hc->tx_t_rto == 0 || hc->tx_p == 0) {
 
                 /* halve send rate directly */
                 hc->tx_x = max(hc->tx_x / 2,
@@ -256,7 +255,7 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
          * Set new timeout for the nofeedback timer.
          * See comments in packet_recv() regarding the value of t_RTO.
          */
-        if (unlikely(hc->tx_t_rto == 0))        /* no feedback yet */
+        if (unlikely(hc->tx_t_rto == 0))        /* no feedback received yet */
                 t_nfb = TFRC_INITIAL_TIMEOUT;
         else
                 t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
@@ -290,8 +289,7 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
         if (unlikely(skb->len == 0))
                 return -EBADMSG;
 
-        switch (hc->tx_state) {
-        case TFRC_SSTATE_NO_SENT:
+        if (hc->tx_state == TFRC_SSTATE_NO_SENT) {
                 sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies +
                                usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
                 hc->tx_last_win_count   = 0;
@@ -326,27 +324,22 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                 ccid3_update_send_interval(hc);
 
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
-                break;
-        case TFRC_SSTATE_NO_FBACK:
-        case TFRC_SSTATE_FBACK:
+
+        } else {
                 delay = ktime_us_delta(hc->tx_t_nom, now);
                 ccid3_pr_debug("delay=%ld\n", (long)delay);
                 /*
-                 *      Scheduling of packet transmissions [RFC 3448, 4.6]
+                 *      Scheduling of packet transmissions (RFC 5348, 8.3)
                  *
                  * if (t_now > t_nom - delta)
                  *       // send the packet now
                  * else
                  *       // send the packet in (t_nom - t_now) milliseconds.
                  */
-                if (delay - (s64)hc->tx_delta >= 1000)
-                        return (u32)delay / 1000L;
+                if (delay >= TFRC_T_DELTA)
+                        return (u32)delay / USEC_PER_MSEC;
 
                 ccid3_hc_tx_update_win_count(hc, now);
-                break;
-        case TFRC_SSTATE_TERM:
-                DCCP_BUG("%s(%p) - Illegal state TERM", dccp_role(sk), sk);
-                return -EINVAL;
         }
 
         /* prepare to send now (add options etc.) */
@@ -372,48 +365,34 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, int more,
 static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
-        struct ccid3_options_received *opt_recv;
+        struct tfrc_tx_hist_entry *acked;
         ktime_t now;
         unsigned long t_nfb;
-        u32 pinv, r_sample;
+        u32 r_sample;
 
         /* we are only interested in ACKs */
         if (!(DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_ACK ||
               DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_DATAACK))
                 return;
-        /* ... and only in the established state */
-        if (hc->tx_state != TFRC_SSTATE_FBACK &&
-            hc->tx_state != TFRC_SSTATE_NO_FBACK)
-                return;
-
-        opt_recv = &hc->tx_options_received;
-        now = ktime_get_real();
-
-        /* Estimate RTT from history if ACK number is valid */
-        r_sample = tfrc_tx_hist_rtt(hc->tx_hist,
-                                    DCCP_SKB_CB(skb)->dccpd_ack_seq, now);
-        if (r_sample == 0) {
-                DCCP_WARN("%s(%p): %s with bogus ACK-%llu\n", dccp_role(sk), sk,
-                          dccp_packet_name(DCCP_SKB_CB(skb)->dccpd_type),
-                          (unsigned long long)DCCP_SKB_CB(skb)->dccpd_ack_seq);
-                return;
-        }
-
-        /* Update receive rate in units of 64 * bytes/second */
-        hc->tx_x_recv = opt_recv->ccid3or_receive_rate;
-        hc->tx_x_recv <<= 6;
-
-        /* Update loss event rate (which is scaled by 1e6) */
-        pinv = opt_recv->ccid3or_loss_event_rate;
-        if (pinv == ~0U || pinv == 0)          /* see RFC 4342, 8.5   */
-                hc->tx_p = 0;
-        else                                   /* can not exceed 100% */
-                hc->tx_p = scaled_div(1, pinv);
         /*
-         * Validate new RTT sample and update moving average
+         * Locate the acknowledged packet in the TX history.
+         *
+         * Returning "entry not found" here can for instance happen when
+         *  - the host has not sent out anything (e.g. a passive server),
+         *  - the Ack is outdated (packet with higher Ack number was received),
+         *  - it is a bogus Ack (for a packet not sent on this connection).
          */
-        r_sample = dccp_sample_rtt(sk, r_sample);
+        acked = tfrc_tx_hist_find_entry(hc->tx_hist, dccp_hdr_ack_seq(skb));
+        if (acked == NULL)
+                return;
+        /* For the sake of RTT sampling, ignore/remove all older entries */
+        tfrc_tx_hist_purge(&acked->next);
+
+        /* Update the moving average for the RTT estimate (RFC 3448, 4.3) */
+        now       = ktime_get_real();
+        r_sample  = dccp_sample_rtt(sk, ktime_us_delta(now, acked->stamp));
         hc->tx_rtt = tfrc_ewma(hc->tx_rtt, r_sample, 9);
+
         /*
          * Update allowed sending rate X as per draft rfc3448bis-00, 4.2/3
          */
@@ -461,13 +440,12 @@ done_computing_x:
         sk->sk_write_space(sk);
 
         /*
-         * Update timeout interval for the nofeedback timer.
-         * We use a configuration option to increase the lower bound.
-         * This can help avoid triggering the nofeedback timer too
-         * often ('spinning') on LANs with small RTTs.
+         * Update timeout interval for the nofeedback timer. In order to control
+         * rate halving on networks with very low RTTs (<= 1 ms), use per-route
+         * tunable RTAX_RTO_MIN value as the lower bound.
          */
-        hc->tx_t_rto = max_t(u32, 4 * hc->tx_rtt, (CONFIG_IP_DCCP_CCID3_RTO *
-                                                       (USEC_PER_SEC / 1000)));
+        hc->tx_t_rto = max_t(u32, 4 * hc->tx_rtt,
+                                  USEC_PER_SEC/HZ * tcp_rto_min(sk));
         /*
          * Schedule no feedback timer to expire in
          * max(t_RTO, 2 * s/X)  =  max(t_RTO, 2 * t_ipi)
@@ -482,66 +460,41 @@ done_computing_x:
                            jiffies + usecs_to_jiffies(t_nfb));
 }
 
-static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
-                                     unsigned char len, u16 idx,
-                                     unsigned char *value)
+static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+                                     u8 option, u8 *optval, u8 optlen)
 {
-        int rc = 0;
-        const struct dccp_sock *dp = dccp_sk(sk);
         struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
-        struct ccid3_options_received *opt_recv;
         __be32 opt_val;
 
-        opt_recv = &hc->tx_options_received;
-
-        if (opt_recv->ccid3or_seqno != dp->dccps_gsr) {
-                opt_recv->ccid3or_seqno              = dp->dccps_gsr;
-                opt_recv->ccid3or_loss_event_rate    = ~0;
-                opt_recv->ccid3or_loss_intervals_idx = 0;
-                opt_recv->ccid3or_loss_intervals_len = 0;
-                opt_recv->ccid3or_receive_rate       = 0;
-        }
-
         switch (option) {
+        case TFRC_OPT_RECEIVE_RATE:
         case TFRC_OPT_LOSS_EVENT_RATE:
-                if (unlikely(len != 4)) {
-                        DCCP_WARN("%s(%p), invalid len %d "
-                                  "for TFRC_OPT_LOSS_EVENT_RATE\n",
-                                  dccp_role(sk), sk, len);
-                        rc = -EINVAL;
-                } else {
-                        opt_val = get_unaligned((__be32 *)value);
-                        opt_recv->ccid3or_loss_event_rate = ntohl(opt_val);
-                        ccid3_pr_debug("%s(%p), LOSS_EVENT_RATE=%u\n",
-                                       dccp_role(sk), sk,
-                                       opt_recv->ccid3or_loss_event_rate);
+                /* Must be ignored on Data packets, cf. RFC 4342 8.3 and 8.5 */
+                if (packet_type == DCCP_PKT_DATA)
+                        break;
+                if (unlikely(optlen != 4)) {
+                        DCCP_WARN("%s(%p), invalid len %d for %u\n",
+                                  dccp_role(sk), sk, optlen, option);
+                        return -EINVAL;
                 }
-                break;
-        case TFRC_OPT_LOSS_INTERVALS:
-                opt_recv->ccid3or_loss_intervals_idx = idx;
-                opt_recv->ccid3or_loss_intervals_len = len;
-                ccid3_pr_debug("%s(%p), LOSS_INTERVALS=(%u, %u)\n",
-                               dccp_role(sk), sk,
-                               opt_recv->ccid3or_loss_intervals_idx,
-                               opt_recv->ccid3or_loss_intervals_len);
-                break;
-        case TFRC_OPT_RECEIVE_RATE:
-                if (unlikely(len != 4)) {
-                        DCCP_WARN("%s(%p), invalid len %d "
-                                  "for TFRC_OPT_RECEIVE_RATE\n",
-                                  dccp_role(sk), sk, len);
-                        rc = -EINVAL;
-                } else {
-                        opt_val = get_unaligned((__be32 *)value);
-                        opt_recv->ccid3or_receive_rate = ntohl(opt_val);
+                opt_val = ntohl(get_unaligned((__be32 *)optval));
+
+                if (option == TFRC_OPT_RECEIVE_RATE) {
+                        /* Receive Rate is kept in units of 64 bytes/second */
+                        hc->tx_x_recv = opt_val;
+                        hc->tx_x_recv <<= 6;
+
                         ccid3_pr_debug("%s(%p), RECEIVE_RATE=%u\n",
-                                       dccp_role(sk), sk,
-                                       opt_recv->ccid3or_receive_rate);
+                                       dccp_role(sk), sk, opt_val);
+                } else {
+                        /* Update the fixpoint Loss Event Rate fraction */
+                        hc->tx_p = tfrc_invert_loss_event_rate(opt_val);
+
+                        ccid3_pr_debug("%s(%p), LOSS_EVENT_RATE=%u\n",
+                                       dccp_role(sk), sk, opt_val);
                 }
-                break;
         }
-
-        return rc;
+        return 0;
 }
 
 static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
@@ -559,42 +512,36 @@ static void ccid3_hc_tx_exit(struct sock *sk)
 {
         struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
 
-        ccid3_hc_tx_set_state(sk, TFRC_SSTATE_TERM);
         sk_stop_timer(sk, &hc->tx_no_feedback_timer);
-
         tfrc_tx_hist_purge(&hc->tx_hist);
 }
 
 static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        struct ccid3_hc_tx_sock *hc;
-
-        /* Listen socks doesn't have a private CCID block */
-        if (sk->sk_state == DCCP_LISTEN)
-                return;
-
-        hc = ccid3_hc_tx_sk(sk);
-        info->tcpi_rto = hc->tx_t_rto;
-        info->tcpi_rtt = hc->tx_rtt;
+        info->tcpi_rto = ccid3_hc_tx_sk(sk)->tx_t_rto;
+        info->tcpi_rtt = ccid3_hc_tx_sk(sk)->tx_rtt;
 }
 
 static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_tx_sock *hc;
+        const struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        struct tfrc_tx_info tfrc;
         const void *val;
 
-        /* Listen socks doesn't have a private CCID block */
-        if (sk->sk_state == DCCP_LISTEN)
-                return -EINVAL;
-
-        hc = ccid3_hc_tx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_TX_INFO:
-                if (len < sizeof(hc->tx_tfrc))
+                if (len < sizeof(tfrc))
                         return -EINVAL;
-                len = sizeof(hc->tx_tfrc);
-                val = &hc->tx_tfrc;
+                tfrc.tfrctx_x      = hc->tx_x;
+                tfrc.tfrctx_x_recv = hc->tx_x_recv;
+                tfrc.tfrctx_x_calc = hc->tx_x_calc;
+                tfrc.tfrctx_rtt    = hc->tx_rtt;
+                tfrc.tfrctx_p      = hc->tx_p;
+                tfrc.tfrctx_rto    = hc->tx_t_rto;
+                tfrc.tfrctx_ipi    = hc->tx_t_ipi;
+                len = sizeof(tfrc);
+                val = &tfrc;
                 break;
         default:
                 return -ENOPROTOOPT;
@@ -624,7 +571,6 @@ static const char *ccid3_rx_state_name(enum ccid3_hc_rx_states state)
         static const char *const ccid3_rx_state_names[] = {
         [TFRC_RSTATE_NO_DATA] = "NO_DATA",
         [TFRC_RSTATE_DATA]    = "DATA",
-        [TFRC_RSTATE_TERM]    = "TERM",
         };
 
         return ccid3_rx_state_names[state];
@@ -650,14 +596,9 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 {
         struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         struct dccp_sock *dp = dccp_sk(sk);
-        ktime_t now;
+        ktime_t now = ktime_get_real();
         s64 delta = 0;
 
-        if (unlikely(hc->rx_state == TFRC_RSTATE_TERM))
-                return;
-
-        now = ktime_get_real();
-
         switch (fbtype) {
         case CCID3_FBACK_INITIAL:
                 hc->rx_x_recv = 0;
@@ -701,14 +642,12 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 
 static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
 {
-        const struct ccid3_hc_rx_sock *hc;
+        const struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         __be32 x_recv, pinv;
 
         if (!(sk->sk_state == DCCP_OPEN || sk->sk_state == DCCP_PARTOPEN))
                 return 0;
 
-        hc = ccid3_hc_rx_sk(sk);
-
         if (dccp_packet_without_ack(skb))
                 return 0;
 
@@ -749,10 +688,11 @@ static u32 ccid3_first_li(struct sock *sk)
         x_recv = scaled_div32(hc->rx_bytes_recv, delta);
         if (x_recv == 0) {              /* would also trigger divide-by-zero */
                 DCCP_WARN("X_recv==0\n");
-                if ((x_recv = hc->rx_x_recv) == 0) {
+                if (hc->rx_x_recv == 0) {
                         DCCP_BUG("stored value of X_recv is zero");
                         return ~0U;
                 }
+                x_recv = hc->rx_x_recv;
         }
 
         fval = scaled_div(hc->rx_s, hc->rx_rtt);
@@ -862,46 +802,31 @@ static void ccid3_hc_rx_exit(struct sock *sk)
 {
         struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
 
-        ccid3_hc_rx_set_state(sk, TFRC_RSTATE_TERM);
-
         tfrc_rx_hist_purge(&hc->rx_hist);
         tfrc_lh_cleanup(&hc->rx_li_hist);
 }
 
 static void ccid3_hc_rx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        const struct ccid3_hc_rx_sock *hc;
-
-        /* Listen socks doesn't have a private CCID block */
-        if (sk->sk_state == DCCP_LISTEN)
-                return;
-
-        hc = ccid3_hc_rx_sk(sk);
-        info->tcpi_ca_state = hc->rx_state;
+        info->tcpi_ca_state = ccid3_hc_rx_sk(sk)->rx_state;
         info->tcpi_options  |= TCPI_OPT_TIMESTAMPS;
-        info->tcpi_rcv_rtt  = hc->rx_rtt;
+        info->tcpi_rcv_rtt  = ccid3_hc_rx_sk(sk)->rx_rtt;
 }
 
 static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_rx_sock *hc;
+        const struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         struct tfrc_rx_info rx_info;
         const void *val;
 
-        /* Listen socks doesn't have a private CCID block */
-        if (sk->sk_state == DCCP_LISTEN)
-                return -EINVAL;
-
-        hc = ccid3_hc_rx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_RX_INFO:
                 if (len < sizeof(rx_info))
                         return -EINVAL;
                 rx_info.tfrcrx_x_recv = hc->rx_x_recv;
                 rx_info.tfrcrx_rtt    = hc->rx_rtt;
-                rx_info.tfrcrx_p      = hc->rx_pinv == 0 ? ~0U :
-                                           scaled_div(1, hc->rx_pinv);
+                rx_info.tfrcrx_p      = tfrc_invert_loss_event_rate(hc->rx_pinv);
                 len = sizeof(rx_info);
                 val = &rx_info;
                 break;
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index 032635776653..1a9933c29672 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -42,35 +42,36 @@
 #include "lib/tfrc.h"
 #include "../ccid.h"
 
-/* Two seconds as per RFC 3448 4.2 */
+/* Two seconds as per RFC 5348, 4.2 */
 #define TFRC_INITIAL_TIMEOUT       (2 * USEC_PER_SEC)
 
-/* In usecs - half the scheduling granularity as per RFC3448 4.6 */
-#define TFRC_OPSYS_HALF_TIME_GRAN  (USEC_PER_SEC / (2 * HZ))
-
 /* Parameter t_mbi from [RFC 3448, 4.3]: backoff interval in seconds */
 #define TFRC_T_MBI                 64
 
+/*
+ * The t_delta parameter (RFC 5348, 8.3): delays of less than %USEC_PER_MSEC are
+ * rounded down to 0, since sk_reset_timer() here uses millisecond granularity.
+ * Hence we can use a constant t_delta = %USEC_PER_MSEC when HZ >= 500. A coarse
+ * resolution of HZ < 500 means that the error is below one timer tick (t_gran)
+ * when using the constant t_delta  =  t_gran / 2  =  %USEC_PER_SEC / (2 * HZ).
+ */
+#if (HZ >= 500)
+# define TFRC_T_DELTA              USEC_PER_MSEC
+#else
+# define TFRC_T_DELTA              (USEC_PER_SEC / (2 * HZ))
+#endif
+
 enum ccid3_options {
         TFRC_OPT_LOSS_EVENT_RATE = 192,
         TFRC_OPT_LOSS_INTERVALS  = 193,
         TFRC_OPT_RECEIVE_RATE    = 194,
 };
 
-struct ccid3_options_received {
-        u64 ccid3or_seqno:48,
-            ccid3or_loss_intervals_idx:16;
-        u16 ccid3or_loss_intervals_len;
-        u32 ccid3or_loss_event_rate;
-        u32 ccid3or_receive_rate;
-};
-
 /* TFRC sender states */
 enum ccid3_hc_tx_states {
         TFRC_SSTATE_NO_SENT = 1,
         TFRC_SSTATE_NO_FBACK,
         TFRC_SSTATE_FBACK,
-        TFRC_SSTATE_TERM,
 };
 
 /**
@@ -90,19 +91,16 @@ enum ccid3_hc_tx_states {
  * @tx_no_feedback_timer: Handle to no feedback timer
  * @tx_t_ld:              Time last doubled during slow start
  * @tx_t_nom:             Nominal send time of next packet
- * @tx_delta:             Send timer delta (RFC 3448, 4.6) in usecs
  * @tx_hist:              Packet history
- * @tx_options_received:  Parsed set of retrieved options
  */
 struct ccid3_hc_tx_sock {
-        struct tfrc_tx_info             tx_tfrc;
-#define tx_x                            tx_tfrc.tfrctx_x
-#define tx_x_recv                       tx_tfrc.tfrctx_x_recv
-#define tx_x_calc                       tx_tfrc.tfrctx_x_calc
-#define tx_rtt                          tx_tfrc.tfrctx_rtt
-#define tx_p                            tx_tfrc.tfrctx_p
-#define tx_t_rto                        tx_tfrc.tfrctx_rto
-#define tx_t_ipi                        tx_tfrc.tfrctx_ipi
+        u64                             tx_x;
+        u64                             tx_x_recv;
+        u32                             tx_x_calc;
+        u32                             tx_rtt;
+        u32                             tx_p;
+        u32                             tx_t_rto;
+        u32                             tx_t_ipi;
         u16                             tx_s;
         enum ccid3_hc_tx_states         tx_state:8;
         u8                              tx_last_win_count;
@@ -110,9 +108,7 @@ struct ccid3_hc_tx_sock {
         struct timer_list               tx_no_feedback_timer;
         ktime_t                         tx_t_ld;
         ktime_t                         tx_t_nom;
-        u32                             tx_delta;
         struct tfrc_tx_hist_entry       *tx_hist;
-        struct ccid3_options_received   tx_options_received;
 };
 
 static inline struct ccid3_hc_tx_sock *ccid3_hc_tx_sk(const struct sock *sk)
@@ -126,21 +122,16 @@ static inline struct ccid3_hc_tx_sock *ccid3_hc_tx_sk(const struct sock *sk)
 enum ccid3_hc_rx_states {
         TFRC_RSTATE_NO_DATA = 1,
         TFRC_RSTATE_DATA,
-        TFRC_RSTATE_TERM    = 127,
 };
 
 /**
  * struct ccid3_hc_rx_sock - CCID3 receiver half-connection socket
- * @rx_x_recv:               Receiver estimate of send rate (RFC 3448 4.3)
- * @rx_rtt:                  Receiver estimate of rtt (non-standard)
- * @rx_p:                    Current loss event rate (RFC 3448 5.4)
  * @rx_last_counter:         Tracks window counter (RFC 4342, 8.1)
  * @rx_state:                Receiver state, one of %ccid3_hc_rx_states
  * @rx_bytes_recv:           Total sum of DCCP payload bytes
  * @rx_x_recv:               Receiver estimate of send rate (RFC 3448, sec. 4.3)
  * @rx_rtt:                  Receiver estimate of RTT
  * @rx_tstamp_last_feedback: Time at which last feedback was sent
- * @rx_tstamp_last_ack:      Time at which last feedback was sent
  * @rx_hist:                 Packet history (loss detection + RTT sampling)
  * @rx_li_hist:              Loss Interval database
  * @rx_s:                    Received packet size in bytes
diff --git a/net/dccp/ccids/lib/loss_interval.c b/net/dccp/ccids/lib/loss_interval.c
index 8fc3cbf79071..497723c4d4bb 100644
--- a/net/dccp/ccids/lib/loss_interval.c
+++ b/net/dccp/ccids/lib/loss_interval.c
@@ -116,7 +116,7 @@ u8 tfrc_lh_update_i_mean(struct tfrc_loss_hist *lh, struct sk_buff *skb)
         cur->li_length = len;
         tfrc_lh_calc_i_mean(lh);
 
-        return (lh->i_mean < old_i_mean);
+        return lh->i_mean < old_i_mean;
 }
 
 /* Determine if `new_loss' does begin a new loss interval [RFC 4342, 10.2] */
diff --git a/net/dccp/ccids/lib/packet_history.c b/net/dccp/ccids/lib/packet_history.c
index 3a4f414e94a0..de8fe294bf0b 100644
--- a/net/dccp/ccids/lib/packet_history.c
+++ b/net/dccp/ccids/lib/packet_history.c
@@ -38,18 +38,6 @@
 #include "packet_history.h"
 #include "../../dccp.h"
 
-/**
- *  tfrc_tx_hist_entry  -  Simple singly-linked TX history list
- *  @next:  next oldest entry (LIFO order)
- *  @seqno: sequence number of this entry
- *  @stamp: send time of packet with sequence number @seqno
- */
-struct tfrc_tx_hist_entry {
-        struct tfrc_tx_hist_entry *next;
-        u64                       seqno;
-        ktime_t                   stamp;
-};
-
 /*
  * Transmitter History Routines
  */
@@ -71,15 +59,6 @@ void tfrc_tx_packet_history_exit(void)
         }
 }
 
-static struct tfrc_tx_hist_entry *
-        tfrc_tx_hist_find_entry(struct tfrc_tx_hist_entry *head, u64 seqno)
-{
-        while (head != NULL && head->seqno != seqno)
-                head = head->next;
-
-        return head;
-}
-
 int tfrc_tx_hist_add(struct tfrc_tx_hist_entry **headp, u64 seqno)
 {
         struct tfrc_tx_hist_entry *entry = kmem_cache_alloc(tfrc_tx_hist_slab, gfp_any());
@@ -107,24 +86,6 @@ void tfrc_tx_hist_purge(struct tfrc_tx_hist_entry **headp)
         *headp = NULL;
 }
 
-u32 tfrc_tx_hist_rtt(struct tfrc_tx_hist_entry *head, const u64 seqno,
-                     const ktime_t now)
-{
-        u32 rtt = 0;
-        struct tfrc_tx_hist_entry *packet = tfrc_tx_hist_find_entry(head, seqno);
-
-        if (packet != NULL) {
-                rtt = ktime_us_delta(now, packet->stamp);
-                /*
-                 * Garbage-collect older (irrelevant) entries:
-                 */
-                tfrc_tx_hist_purge(&packet->next);
-        }
-
-        return rtt;
-}
-
-
 /*
  *      Receiver History Routines
  */
diff --git a/net/dccp/ccids/lib/packet_history.h b/net/dccp/ccids/lib/packet_history.h
index 7df6c5299999..7ee4a9d9d335 100644
--- a/net/dccp/ccids/lib/packet_history.h
+++ b/net/dccp/ccids/lib/packet_history.h
@@ -40,12 +40,28 @@
 #include <linux/slab.h>
 #include "tfrc.h"
 
-struct tfrc_tx_hist_entry;
+/**
+ *  tfrc_tx_hist_entry  -  Simple singly-linked TX history list
+ *  @next:  next oldest entry (LIFO order)
+ *  @seqno: sequence number of this entry
+ *  @stamp: send time of packet with sequence number @seqno
+ */
+struct tfrc_tx_hist_entry {
+        struct tfrc_tx_hist_entry *next;
+        u64                       seqno;
+        ktime_t                   stamp;
+};
+
+static inline struct tfrc_tx_hist_entry *
+        tfrc_tx_hist_find_entry(struct tfrc_tx_hist_entry *head, u64 seqno)
+{
+        while (head != NULL && head->seqno != seqno)
+                head = head->next;
+        return head;
+}
 
 extern int  tfrc_tx_hist_add(struct tfrc_tx_hist_entry **headp, u64 seqno);
 extern void tfrc_tx_hist_purge(struct tfrc_tx_hist_entry **headp);
-extern u32  tfrc_tx_hist_rtt(struct tfrc_tx_hist_entry *head,
-                             const u64 seqno, const ktime_t now);
 
 /* Subtraction a-b modulo-16, respects circular wrap-around */
 #define SUB16(a, b) (((a) + 16 - (b)) & 0xF)
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index 01bb48e96c2e..f8ee3f549770 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -57,6 +57,7 @@ static inline u32 tfrc_ewma(const u32 avg, const u32 newval, const u8 weight)
 
 extern u32  tfrc_calc_x(u16 s, u32 R, u32 p);
 extern u32  tfrc_calc_x_reverse_lookup(u32 fvalue);
+extern u32  tfrc_invert_loss_event_rate(u32 loss_event_rate);
 
 extern int  tfrc_tx_packet_history_init(void);
 extern void tfrc_tx_packet_history_exit(void);
diff --git a/net/dccp/ccids/lib/tfrc_equation.c b/net/dccp/ccids/lib/tfrc_equation.c
index 22ca1cf0eb55..a052a4377e26 100644
--- a/net/dccp/ccids/lib/tfrc_equation.c
+++ b/net/dccp/ccids/lib/tfrc_equation.c
@@ -687,3 +687,17 @@ u32 tfrc_calc_x_reverse_lookup(u32 fvalue)
         index = tfrc_binsearch(fvalue, 0);
         return (index + 1) * 1000000 / TFRC_CALC_X_ARRSIZE;
 }
+
+/**
+ * tfrc_invert_loss_event_rate  -  Compute p so that 10^6 corresponds to 100%
+ * When @loss_event_rate is large, there is a chance that p is truncated to 0.
+ * To avoid re-entering slow-start in that case, we set p = TFRC_SMALLEST_P > 0.
+ */
+u32 tfrc_invert_loss_event_rate(u32 loss_event_rate)
+{
+        if (loss_event_rate == UINT_MAX)                /* see RFC 4342, 8.5 */
+                return 0;
+        if (unlikely(loss_event_rate == 0))             /* map 1/0 into 100% */
+                return 1000000;
+        return max_t(u32, scaled_div(1, loss_event_rate), TFRC_SMALLEST_P);
+}
diff --git a/net/dccp/options.c b/net/dccp/options.c
index bfda087bd90d..92718511eac5 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -96,18 +96,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                 }
 
                 /*
-                 * CCID-Specific Options (from RFC 4340, sec. 10.3):
-                 *
-                 * Option numbers 128 through 191 are for options sent from the
-                 * HC-Sender to the HC-Receiver; option numbers 192 through 255
-                 * are for options sent from the HC-Receiver to the HC-Sender.
-                 *
                  * CCID-specific options are ignored during connection setup, as
                  * negotiation may still be in progress (see RFC 4340, 10.3).
                  * The same applies to Ack Vectors, as these depend on the CCID.
-                 *
                  */
-                if (dreq != NULL && (opt >= 128 ||
+                if (dreq != NULL && (opt >= DCCPO_MIN_RX_CCID_SPECIFIC ||
                     opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1))
                         goto ignore_option;
 
@@ -226,23 +219,15 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                         dccp_pr_debug("%s rx opt: ELAPSED_TIME=%d\n",
                                       dccp_role(sk), elapsed_time);
                         break;
-                case 128 ... 191: {
-                        const u16 idx = value - options;
-
+                case DCCPO_MIN_RX_CCID_SPECIFIC ... DCCPO_MAX_RX_CCID_SPECIFIC:
                         if (ccid_hc_rx_parse_options(dp->dccps_hc_rx_ccid, sk,
-                                                     opt, len, idx,
-                                                     value) != 0)
+                                                     pkt_type, opt, value, len))
                                 goto out_invalid_option;
-                }
                         break;
-                case 192 ... 255: {
-                        const u16 idx = value - options;
-
+                case DCCPO_MIN_TX_CCID_SPECIFIC ... DCCPO_MAX_TX_CCID_SPECIFIC:
                         if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk,
-                                                     opt, len, idx,
-                                                     value) != 0)
+                                                     pkt_type, opt, value, len))
                                 goto out_invalid_option;
-                }
                         break;
                 default:
                         DCCP_CRIT("DCCP(%p): option %d(len=%d) not "
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index baeb1eaf011b..2ef115277bea 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -693,22 +693,22 @@ void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
         aux = scp->accessdata.acc_userl;
         *skb_put(skb, 1) = aux;
         if (aux > 0)
-        memcpy(skb_put(skb, aux), scp->accessdata.acc_user, aux);
+                memcpy(skb_put(skb, aux), scp->accessdata.acc_user, aux);
 
         aux = scp->accessdata.acc_passl;
         *skb_put(skb, 1) = aux;
         if (aux > 0)
-        memcpy(skb_put(skb, aux), scp->accessdata.acc_pass, aux);
+                memcpy(skb_put(skb, aux), scp->accessdata.acc_pass, aux);
 
         aux = scp->accessdata.acc_accl;
         *skb_put(skb, 1) = aux;
         if (aux > 0)
-        memcpy(skb_put(skb, aux), scp->accessdata.acc_acc, aux);
+                memcpy(skb_put(skb, aux), scp->accessdata.acc_acc, aux);
 
         aux = (__u8)le16_to_cpu(scp->conndata_out.opt_optl);
         *skb_put(skb, 1) = aux;
         if (aux > 0)
-        memcpy(skb_put(skb,aux), scp->conndata_out.opt_data, aux);
+                memcpy(skb_put(skb, aux), scp->conndata_out.opt_data, aux);
 
         scp->persist = dn_nsp_persist(sk);
         scp->persist_fxn = dn_nsp_retrans_conninit;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index dc54bd0d083b..f8c1ae4b41f0 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -392,7 +392,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 dev_queue_xmit(skb);
                 dev_put(dev);
                 mutex_unlock(&econet_mutex);
-                return(len);
+                return len;
 
         out_free:
                 kfree_skb(skb);
@@ -637,7 +637,7 @@ static int econet_create(struct net *net, struct socket *sock, int protocol,
         eo->num = protocol;
 
         econet_insert_socket(&econet_sklist, sk);
-        return(0);
+        return 0;
 out:
         return err;
 }
@@ -1009,7 +1009,6 @@ static int __init aun_udp_initialise(void)
         struct sockaddr_in sin;
 
         skb_queue_head_init(&aun_queue);
-        spin_lock_init(&aun_queue_lock);
         setup_timer(&ab_cleanup_timer, ab_cleanup, 0);
         ab_cleanup_timer.expires = jiffies + (HZ*2);
         add_timer(&ab_cleanup_timer);
@@ -1167,7 +1166,6 @@ static int __init econet_proto_init(void)
                 goto out;
         sock_register(&econet_family_ops);
 #ifdef CONFIG_ECONET_AUNUDP
-        spin_lock_init(&aun_queue_lock);
         aun_udp_initialise();
 #endif
 #ifdef CONFIG_ECONET_NATIVE
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 215c83986a9d..f00ef2f1d814 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -367,7 +367,7 @@ struct net_device *alloc_etherdev_mq(int sizeof_priv, unsigned int queue_count)
 EXPORT_SYMBOL(alloc_etherdev_mq);
 
 static size_t _format_mac_addr(char *buf, int buflen,
-                                const unsigned char *addr, int len)
+                               const unsigned char *addr, int len)
 {
         int i;
         char *cp = buf;
@@ -376,7 +376,7 @@ static size_t _format_mac_addr(char *buf, int buflen,
                 cp += scnprintf(cp, buflen - (cp - buf), "%02x", addr[i]);
                 if (i == len - 1)
                         break;
-                cp += strlcpy(cp, ":", buflen - (cp - buf));
+                cp += scnprintf(cp, buflen - (cp - buf), ":");
         }
         return cp - buf;
 }
@@ -386,7 +386,7 @@ ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len)
         size_t l;
 
         l = _format_mac_addr(buf, PAGE_SIZE, addr, len);
-        l += strlcpy(buf + l, "\n", PAGE_SIZE - l);
-        return ((ssize_t) l);
+        l += scnprintf(buf + l, PAGE_SIZE - l, "\n");
+        return (ssize_t)l;
 }
 EXPORT_SYMBOL(sysfs_format_mac);
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 571f8950ed06..5462e2d147a6 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -215,8 +215,15 @@ config NET_IPIP
           be inserted in and removed from the running kernel whenever you
           want). Most people won't need this and can say N.
 
+config NET_IPGRE_DEMUX
+        tristate "IP: GRE demultiplexer"
+        help
+         This is helper module to demultiplex GRE packets on GRE version field criteria.
+         Required by ip_gre and pptp modules.
+
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
+        depends on NET_IPGRE_DEMUX
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 80ff87ce43aa..4978d22f9a75 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
+obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_SYN_COOKIES) += syncookies.o
 obj-$(CONFIG_INET_AH) += ah4.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 6a1100c25a9f..f581f77d1097 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -227,18 +227,16 @@ EXPORT_SYMBOL(inet_ehash_secret);
 
 /*
  * inet_ehash_secret must be set exactly once
- * Instead of using a dedicated spinlock, we (ab)use inetsw_lock
  */
 void build_ehash_secret(void)
 {
         u32 rnd;
+
         do {
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
-        spin_lock_bh(&inetsw_lock);
-        if (!inet_ehash_secret)
-                inet_ehash_secret = rnd;
-        spin_unlock_bh(&inetsw_lock);
+
+        cmpxchg(&inet_ehash_secret, 0, rnd);
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 96c1955b3e2f..4083c186fd30 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -55,7 +55,7 @@
  *              Stuart Cheshire :       Metricom and grat arp fixes
  *                                      *** FOR 2.1 clean this up ***
  *              Lawrence V. Stefani: (08/12/96) Added FDDI support.
- *              Alan Cox        :       Took the AP1000 nasty FDDI hack and
+ *              Alan Cox        :       Took the AP1000 nasty FDDI hack and
  *                                      folded into the mainstream FDDI code.
  *                                      Ack spit, Linus how did you allow that
  *                                      one in...
@@ -120,7 +120,7 @@ EXPORT_SYMBOL(clip_tbl_hook);
 #endif
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <linux/netfilter_arp.h>
 
@@ -173,32 +173,32 @@ const struct neigh_ops arp_broken_ops = {
 EXPORT_SYMBOL(arp_broken_ops);
 
 struct neigh_table arp_tbl = {
-        .family =       AF_INET,
-        .entry_size =   sizeof(struct neighbour) + 4,
-        .key_len =      4,
-        .hash =         arp_hash,
-        .constructor =  arp_constructor,
-        .proxy_redo =   parp_redo,
-        .id =           "arp_cache",
-        .parms = {
-                .tbl =                  &arp_tbl,
-                .base_reachable_time =  30 * HZ,
-                .retrans_time = 1 * HZ,
-                .gc_staletime = 60 * HZ,
-                .reachable_time =               30 * HZ,
-                .delay_probe_time =     5 * HZ,
-                .queue_len =            3,
-                .ucast_probes = 3,
-                .mcast_probes = 3,
-                .anycast_delay =        1 * HZ,
-                .proxy_delay =          (8 * HZ) / 10,
-                .proxy_qlen =           64,
-                .locktime =             1 * HZ,
+        .family         = AF_INET,
+        .entry_size     = sizeof(struct neighbour) + 4,
+        .key_len        = 4,
+        .hash           = arp_hash,
+        .constructor    = arp_constructor,
+        .proxy_redo     = parp_redo,
+        .id             = "arp_cache",
+        .parms          = {
+                .tbl                    = &arp_tbl,
+                .base_reachable_time    = 30 * HZ,
+                .retrans_time           = 1 * HZ,
+                .gc_staletime           = 60 * HZ,
+                .reachable_time         = 30 * HZ,
+                .delay_probe_time       = 5 * HZ,
+                .queue_len              = 3,
+                .ucast_probes           = 3,
+                .mcast_probes           = 3,
+                .anycast_delay          = 1 * HZ,
+                .proxy_delay            = (8 * HZ) / 10,
+                .proxy_qlen             = 64,
+                .locktime               = 1 * HZ,
         },
-        .gc_interval =  30 * HZ,
-        .gc_thresh1 =   128,
-        .gc_thresh2 =   512,
-        .gc_thresh3 =   1024,
+        .gc_interval    = 30 * HZ,
+        .gc_thresh1     = 128,
+        .gc_thresh2     = 512,
+        .gc_thresh3     = 1024,
 };
 EXPORT_SYMBOL(arp_tbl);
 
@@ -233,7 +233,7 @@ static u32 arp_hash(const void *pkey, const struct net_device *dev)
 
 static int arp_constructor(struct neighbour *neigh)
 {
-        __be32 addr = *(__be32*)neigh->primary_key;
+        __be32 addr = *(__be32 *)neigh->primary_key;
         struct net_device *dev = neigh->dev;
         struct in_device *in_dev;
         struct neigh_parms *parms;
@@ -296,16 +296,19 @@ static int arp_constructor(struct neighbour *neigh)
                         neigh->ops = &arp_broken_ops;
                         neigh->output = neigh->ops->output;
                         return 0;
+#else
+                        break;
 #endif
-                ;}
+                }
 #endif
                 if (neigh->type == RTN_MULTICAST) {
                         neigh->nud_state = NUD_NOARP;
                         arp_mc_map(addr, neigh->ha, dev, 1);
-                } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
+                } else if (dev->flags & (IFF_NOARP | IFF_LOOPBACK)) {
                         neigh->nud_state = NUD_NOARP;
                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
-                } else if (neigh->type == RTN_BROADCAST || dev->flags&IFF_POINTOPOINT) {
+                } else if (neigh->type == RTN_BROADCAST ||
+                           (dev->flags & IFF_POINTOPOINT)) {
                         neigh->nud_state = NUD_NOARP;
                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
                 }
@@ -315,7 +318,7 @@ static int arp_constructor(struct neighbour *neigh)
                 else
                         neigh->ops = &arp_generic_ops;
 
-                if (neigh->nud_state&NUD_VALID)
+                if (neigh->nud_state & NUD_VALID)
                         neigh->output = neigh->ops->connected_output;
                 else
                         neigh->output = neigh->ops->output;
@@ -334,7 +337,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         __be32 saddr = 0;
         u8  *dst_ha = NULL;
         struct net_device *dev = neigh->dev;
-        __be32 target = *(__be32*)neigh->primary_key;
+        __be32 target = *(__be32 *)neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
         struct in_device *in_dev;
 
@@ -347,7 +350,8 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         switch (IN_DEV_ARP_ANNOUNCE(in_dev)) {
         default:
         case 0:         /* By default announce any local IP */
-                if (skb && inet_addr_type(dev_net(dev), ip_hdr(skb)->saddr) == RTN_LOCAL)
+                if (skb && inet_addr_type(dev_net(dev),
+                                          ip_hdr(skb)->saddr) == RTN_LOCAL)
                         saddr = ip_hdr(skb)->saddr;
                 break;
         case 1:         /* Restrict announcements of saddr in same subnet */
@@ -369,16 +373,21 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         if (!saddr)
                 saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
 
-        if ((probes -= neigh->parms->ucast_probes) < 0) {
-                if (!(neigh->nud_state&NUD_VALID))
-                        printk(KERN_DEBUG "trying to ucast probe in NUD_INVALID\n");
+        probes -= neigh->parms->ucast_probes;
+        if (probes < 0) {
+                if (!(neigh->nud_state & NUD_VALID))
+                        printk(KERN_DEBUG
+                               "trying to ucast probe in NUD_INVALID\n");
                 dst_ha = neigh->ha;
                 read_lock_bh(&neigh->lock);
-        } else if ((probes -= neigh->parms->app_probes) < 0) {
+        } else {
+                probes -= neigh->parms->app_probes;
+                if (probes < 0) {
 #ifdef CONFIG_ARPD
-                neigh_app_ns(neigh);
+                        neigh_app_ns(neigh);
 #endif
-                return;
+                        return;
+                }
         }
 
         arp_send(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
@@ -451,7 +460,8 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
  *      is allowed to use this function, it is scheduled to be removed. --ANK
  */
 
-static int arp_set_predefined(int addr_hint, unsigned char * haddr, __be32 paddr, struct net_device * dev)
+static int arp_set_predefined(int addr_hint, unsigned char *haddr,
+                              __be32 paddr, struct net_device *dev)
 {
         switch (addr_hint) {
         case RTN_LOCAL:
@@ -483,7 +493,8 @@ int arp_find(unsigned char *haddr, struct sk_buff *skb)
 
         paddr = skb_rtable(skb)->rt_gateway;
 
-        if (arp_set_predefined(inet_addr_type(dev_net(dev), paddr), haddr, paddr, dev))
+        if (arp_set_predefined(inet_addr_type(dev_net(dev), paddr), haddr,
+                               paddr, dev))
                 return 0;
 
         n = __neigh_lookup(&arp_tbl, &paddr, dev, 1);
@@ -515,13 +526,14 @@ int arp_bind_neighbour(struct dst_entry *dst)
                 return -EINVAL;
         if (n == NULL) {
                 __be32 nexthop = ((struct rtable *)dst)->rt_gateway;
-                if (dev->flags&(IFF_LOOPBACK|IFF_POINTOPOINT))
+                if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
                         nexthop = 0;
                 n = __neigh_lookup_errno(
 #if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
-                    dev->type == ARPHRD_ATM ? clip_tbl_hook :
+                                         dev->type == ARPHRD_ATM ?
+                                         clip_tbl_hook :
 #endif
-                    &arp_tbl, &nexthop, dev);
+                                         &arp_tbl, &nexthop, dev);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
                 dst->neighbour = n;
@@ -543,8 +555,8 @@ static inline int arp_fwd_proxy(struct in_device *in_dev,
 
         if (!IN_DEV_PROXY_ARP(in_dev))
                 return 0;
-
-        if ((imi = IN_DEV_MEDIUM_ID(in_dev)) == 0)
+        imi = IN_DEV_MEDIUM_ID(in_dev);
+        if (imi == 0)
                 return 1;
         if (imi == -1)
                 return 0;
@@ -555,7 +567,7 @@ static inline int arp_fwd_proxy(struct in_device *in_dev,
         if (out_dev)
                 omi = IN_DEV_MEDIUM_ID(out_dev);
 
-        return (omi != imi && omi != -1);
+        return omi != imi && omi != -1;
 }
 
 /*
@@ -685,7 +697,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
         arp->ar_pln = 4;
         arp->ar_op = htons(type);
 
-        arp_ptr=(unsigned char *)(arp+1);
+        arp_ptr = (unsigned char *)(arp + 1);
 
         memcpy(arp_ptr, src_hw, dev->addr_len);
         arp_ptr += dev->addr_len;
@@ -735,9 +747,8 @@ void arp_send(int type, int ptype, __be32 dest_ip,
 
         skb = arp_create(type, ptype, dest_ip, dev, src_ip,
                          dest_hw, src_hw, target_hw);
-        if (skb == NULL) {
+        if (skb == NULL)
                 return;
-        }
 
         arp_xmit(skb);
 }
@@ -815,7 +826,7 @@ static int arp_process(struct sk_buff *skb)
 /*
  *      Extract fields
  */
-        arp_ptr= (unsigned char *)(arp+1);
+        arp_ptr = (unsigned char *)(arp + 1);
         sha     = arp_ptr;
         arp_ptr += dev->addr_len;
         memcpy(&sip, arp_ptr, 4);
@@ -869,16 +880,17 @@ static int arp_process(struct sk_buff *skb)
                 addr_type = rt->rt_type;
 
                 if (addr_type == RTN_LOCAL) {
-                        int dont_send = 0;
+                        int dont_send;
 
-                        if (!dont_send)
-                                dont_send |= arp_ignore(in_dev,sip,tip);
+                        dont_send = arp_ignore(in_dev, sip, tip);
                         if (!dont_send && IN_DEV_ARPFILTER(in_dev))
-                                dont_send |= arp_filter(sip,tip,dev);
+                                dont_send |= arp_filter(sip, tip, dev);
                         if (!dont_send) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n) {
-                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
+                                                 dev, tip, sha, dev->dev_addr,
+                                                 sha);
                                         neigh_release(n);
                                 }
                         }
@@ -887,8 +899,7 @@ static int arp_process(struct sk_buff *skb)
                         if (addr_type == RTN_UNICAST  &&
                             (arp_fwd_proxy(in_dev, dev, rt) ||
                              arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
-                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))
-                        {
+                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
@@ -896,9 +907,12 @@ static int arp_process(struct sk_buff *skb)
                                 if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                     skb->pkt_type == PACKET_HOST ||
                                     in_dev->arp_parms->proxy_delay == 0) {
-                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
+                                                 dev, tip, sha, dev->dev_addr,
+                                                 sha);
                                 } else {
-                                        pneigh_enqueue(&arp_tbl, in_dev->arp_parms, skb);
+                                        pneigh_enqueue(&arp_tbl,
+                                                       in_dev->arp_parms, skb);
                                         return 0;
                                 }
                                 goto out;
@@ -939,7 +953,8 @@ static int arp_process(struct sk_buff *skb)
                 if (arp->ar_op != htons(ARPOP_REPLY) ||
                     skb->pkt_type != PACKET_HOST)
                         state = NUD_STALE;
-                neigh_update(n, sha, state, override ? NEIGH_UPDATE_F_OVERRIDE : 0);
+                neigh_update(n, sha, state,
+                             override ? NEIGH_UPDATE_F_OVERRIDE : 0);
                 neigh_release(n);
         }
 
@@ -975,7 +990,8 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
             arp->ar_pln != 4)
                 goto freeskb;
 
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (skb == NULL)
                 goto out_of_mem;
 
         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
@@ -1019,7 +1035,7 @@ static int arp_req_set_public(struct net *net, struct arpreq *r,
                 return -EINVAL;
         if (!dev && (r->arp_flags & ATF_COM)) {
                 dev = dev_getbyhwaddr(net, r->arp_ha.sa_family,
-                                r->arp_ha.sa_data);
+                                      r->arp_ha.sa_data);
                 if (!dev)
                         return -ENODEV;
         }
@@ -1033,7 +1049,7 @@ static int arp_req_set_public(struct net *net, struct arpreq *r,
 }
 
 static int arp_req_set(struct net *net, struct arpreq *r,
-                struct net_device * dev)
+                       struct net_device *dev)
 {
         __be32 ip;
         struct neighbour *neigh;
@@ -1046,10 +1062,11 @@ static int arp_req_set(struct net *net, struct arpreq *r,
         if (r->arp_flags & ATF_PERM)
                 r->arp_flags |= ATF_COM;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip,
-                                                         .tos = RTO_ONLINK } } };
-                struct rtable * rt;
-                if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
+                struct flowi fl = { .nl_u.ip4_u = { .daddr = ip,
+                                                    .tos = RTO_ONLINK } };
+                struct rtable *rt;
+                err = ip_route_output_key(net, &rt, &fl);
+                if (err != 0)
                         return err;
                 dev = rt->dst.dev;
                 ip_rt_put(rt);
@@ -1083,9 +1100,9 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                 unsigned state = NUD_STALE;
                 if (r->arp_flags & ATF_PERM)
                         state = NUD_PERMANENT;
-                err = neigh_update(neigh, (r->arp_flags&ATF_COM) ?
+                err = neigh_update(neigh, (r->arp_flags & ATF_COM) ?
                                    r->arp_ha.sa_data : NULL, state,
-                                   NEIGH_UPDATE_F_OVERRIDE|
+                                   NEIGH_UPDATE_F_OVERRIDE |
                                    NEIGH_UPDATE_F_ADMIN);
                 neigh_release(neigh);
         }
@@ -1094,12 +1111,12 @@ static int arp_req_set(struct net *net, struct arpreq *r,
 
 static unsigned arp_state_to_flags(struct neighbour *neigh)
 {
-        unsigned flags = 0;
         if (neigh->nud_state&NUD_PERMANENT)
-                flags = ATF_PERM|ATF_COM;
+                return ATF_PERM | ATF_COM;
         else if (neigh->nud_state&NUD_VALID)
-                flags = ATF_COM;
-        return flags;
+                return ATF_COM;
+        else
+                return 0;
 }
 
 /*
@@ -1142,7 +1159,7 @@ static int arp_req_delete_public(struct net *net, struct arpreq *r,
 }
 
 static int arp_req_delete(struct net *net, struct arpreq *r,
-                struct net_device * dev)
+                          struct net_device *dev)
 {
         int err;
         __be32 ip;
@@ -1153,10 +1170,11 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
 
         ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip,
-                                                         .tos = RTO_ONLINK } } };
-                struct rtable * rt;
-                if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
+                struct flowi fl = { .nl_u.ip4_u = { .daddr = ip,
+                                                    .tos = RTO_ONLINK } };
+                struct rtable *rt;
+                err = ip_route_output_key(net, &rt, &fl);
+                if (err != 0)
                         return err;
                 dev = rt->dst.dev;
                 ip_rt_put(rt);
@@ -1166,7 +1184,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
         err = -ENXIO;
         neigh = neigh_lookup(&arp_tbl, &ip, dev);
         if (neigh) {
-                if (neigh->nud_state&~NUD_NOARP)
+                if (neigh->nud_state & ~NUD_NOARP)
                         err = neigh_update(neigh, NULL, NUD_FAILED,
                                            NEIGH_UPDATE_F_OVERRIDE|
                                            NEIGH_UPDATE_F_ADMIN);
@@ -1186,24 +1204,24 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         struct net_device *dev = NULL;
 
         switch (cmd) {
-                case SIOCDARP:
-                case SIOCSARP:
-                        if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
-                case SIOCGARP:
-                        err = copy_from_user(&r, arg, sizeof(struct arpreq));
-                        if (err)
-                                return -EFAULT;
-                        break;
-                default:
-                        return -EINVAL;
+        case SIOCDARP:
+        case SIOCSARP:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        case SIOCGARP:
+                err = copy_from_user(&r, arg, sizeof(struct arpreq));
+                if (err)
+                        return -EFAULT;
+                break;
+        default:
+                return -EINVAL;
         }
 
         if (r.arp_pa.sa_family != AF_INET)
                 return -EPFNOSUPPORT;
 
         if (!(r.arp_flags & ATF_PUBL) &&
-            (r.arp_flags & (ATF_NETMASK|ATF_DONTPUB)))
+            (r.arp_flags & (ATF_NETMASK | ATF_DONTPUB)))
                 return -EINVAL;
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
@@ -1211,7 +1229,8 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         rtnl_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                if ((dev = __dev_get_by_name(net, r.arp_dev)) == NULL)
+                dev = __dev_get_by_name(net, r.arp_dev);
+                if (dev == NULL)
                         goto out;
 
                 /* Mmmm... It is wrong... ARPHRD_NETROM==0 */
@@ -1243,7 +1262,8 @@ out:
         return err;
 }
 
-static int arp_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
+static int arp_netdev_event(struct notifier_block *this, unsigned long event,
+                            void *ptr)
 {
         struct net_device *dev = ptr;
 
@@ -1311,12 +1331,13 @@ static char *ax2asc2(ax25_address *a, char *buf)
         for (n = 0, s = buf; n < 6; n++) {
                 c = (a->ax25_call[n] >> 1) & 0x7F;
 
-                if (c != ' ') *s++ = c;
+                if (c != ' ')
+                        *s++ = c;
         }
 
         *s++ = '-';
-
-        if ((n = ((a->ax25_call[6] >> 1) & 0x0F)) > 9) {
+        n = (a->ax25_call[6] >> 1) & 0x0F;
+        if (n > 9) {
                 *s++ = '1';
                 n -= 10;
         }
@@ -1325,10 +1346,9 @@ static char *ax2asc2(ax25_address *a, char *buf)
         *s++ = '\0';
 
         if (*buf == '\0' || *buf == '-')
-           return "*";
+                return "*";
 
         return buf;
-
 }
 #endif /* CONFIG_AX25 */
 
@@ -1408,10 +1428,10 @@ static void *arp_seq_start(struct seq_file *seq, loff_t *pos)
 /* ------------------------------------------------------------------------ */
 
 static const struct seq_operations arp_seq_ops = {
-        .start  = arp_seq_start,
-        .next   = neigh_seq_next,
-        .stop   = neigh_seq_stop,
-        .show   = arp_seq_show,
+        .start  = arp_seq_start,
+        .next   = neigh_seq_next,
+        .stop   = neigh_seq_stop,
+        .show   = arp_seq_show,
 };
 
 static int arp_seq_open(struct inode *inode, struct file *file)
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 721a8a37b45c..174be6caa5c8 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -73,6 +73,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         inet->inet_id = jiffies;
 
         sk_dst_set(sk, &rt->dst);
-        return(0);
+        return 0;
 }
 EXPORT_SYMBOL(ip4_datagram_connect);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index da14c49284f4..c2ff48fa18c7 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -209,7 +209,7 @@ static void inetdev_destroy(struct in_device *in_dev)
                 inet_free_ifa(ifa);
         }
 
-        dev->ip_ptr = NULL;
+        rcu_assign_pointer(dev->ip_ptr, NULL);
 
         devinet_sysctl_unregister(in_dev);
         neigh_parms_release(&arp_tbl, in_dev->arp_parms);
@@ -1059,7 +1059,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_REGISTER:
                 printk(KERN_DEBUG "inetdev_event: bug\n");
-                dev->ip_ptr = NULL;
+                rcu_assign_pointer(dev->ip_ptr, NULL);
                 break;
         case NETDEV_UP:
                 if (!inetdev_valid_mtu(dev->mtu))
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 4a8e370862bc..a96e5ec211a0 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -186,9 +186,7 @@ static inline struct tnode *node_parent_rcu(struct node *node)
 {
         struct tnode *ret = node_parent(node);
 
-        return rcu_dereference_check(ret,
-                                     rcu_read_lock_held() ||
-                                     lockdep_rtnl_is_held());
+        return rcu_dereference_rtnl(ret);
 }
 
 /* Same as rcu_assign_pointer
@@ -211,9 +209,7 @@ static inline struct node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
 {
         struct node *ret = tnode_get_child(tn, i);
 
-        return rcu_dereference_check(ret,
-                                     rcu_read_lock_held() ||
-                                     lockdep_rtnl_is_held());
+        return rcu_dereference_rtnl(ret);
 }
 
 static inline int tnode_child_length(const struct tnode *tn)
@@ -459,8 +455,8 @@ static struct tnode *tnode_new(t_key key, int pos, int bits)
                 tn->empty_children = 1<<bits;
         }
 
-        pr_debug("AT %p s=%u %lu\n", tn, (unsigned int) sizeof(struct tnode),
-                 (unsigned long) (sizeof(struct node) << bits));
+        pr_debug("AT %p s=%zu %zu\n", tn, sizeof(struct tnode),
+                 sizeof(struct node) << bits);
         return tn;
 }
 
@@ -609,11 +605,10 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 
         /* Keep root node larger  */
 
-        if (!node_parent((struct node*) tn)) {
+        if (!node_parent((struct node *)tn)) {
                 inflate_threshold_use = inflate_threshold_root;
                 halve_threshold_use = halve_threshold_root;
-        }
-        else {
+        } else {
                 inflate_threshold_use = inflate_threshold;
                 halve_threshold_use = halve_threshold;
         }
@@ -639,7 +634,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         check_tnode(tn);
 
         /* Return if at least one inflate is run */
-        if( max_work != MAX_WORK)
+        if (max_work != MAX_WORK)
                 return (struct node *) tn;
 
         /*
@@ -966,9 +961,7 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n = rcu_dereference_check(t->trie,
-                                  rcu_read_lock_held() ||
-                                  lockdep_rtnl_is_held());
+        n = rcu_dereference_rtnl(t->trie);
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
@@ -1748,16 +1741,14 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct node *c)
 
                 /* Node empty, walk back up to parent */
                 c = (struct node *) p;
-        } while ( (p = node_parent_rcu(c)) != NULL);
+        } while ((p = node_parent_rcu(c)) != NULL);
 
         return NULL; /* Root of trie */
 }
 
 static struct leaf *trie_firstleaf(struct trie *t)
 {
-        struct tnode *n = (struct tnode *) rcu_dereference_check(t->trie,
-                                                        rcu_read_lock_held() ||
-                                                        lockdep_rtnl_is_held());
+        struct tnode *n = (struct tnode *)rcu_dereference_rtnl(t->trie);
 
         if (!n)
                 return NULL;
@@ -2043,14 +2034,14 @@ struct fib_trie_iter {
         struct seq_net_private p;
         struct fib_table *tb;
         struct tnode *tnode;
-        unsigned index;
-        unsigned depth;
+        unsigned int index;
+        unsigned int depth;
 };
 
 static struct node *fib_trie_get_next(struct fib_trie_iter *iter)
 {
         struct tnode *tn = iter->tnode;
-        unsigned cindex = iter->index;
+        unsigned int cindex = iter->index;
         struct tnode *p;
 
         /* A single entry routing table */
@@ -2159,7 +2150,7 @@ static void trie_collect_stats(struct trie *t, struct trie_stat *s)
  */
 static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
 {
-        unsigned i, max, pointers, bytes, avdepth;
+        unsigned int i, max, pointers, bytes, avdepth;
 
         if (stat->leaves)
                 avdepth = stat->totdepth*100 / stat->leaves;
@@ -2356,7 +2347,8 @@ static void fib_trie_seq_stop(struct seq_file *seq, void *v)
 
 static void seq_indent(struct seq_file *seq, int n)
 {
-        while (n-- > 0) seq_puts(seq, "   ");
+        while (n-- > 0)
+                seq_puts(seq, "   ");
 }
 
 static inline const char *rtn_scope(char *buf, size_t len, enum rt_scope_t s)
@@ -2388,7 +2380,7 @@ static const char *const rtn_type_names[__RTN_MAX] = {
         [RTN_XRESOLVE] = "XRESOLVE",
 };
 
-static inline const char *rtn_type(char *buf, size_t len, unsigned t)
+static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
 {
         if (t < __RTN_MAX && rtn_type_names[t])
                 return rtn_type_names[t];
@@ -2544,13 +2536,12 @@ static void fib_route_seq_stop(struct seq_file *seq, void *v)
         rcu_read_unlock();
 }
 
-static unsigned fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
+static unsigned int fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
 {
-        static unsigned type2flags[RTN_MAX + 1] = {
-                [7] = RTF_REJECT, [8] = RTF_REJECT,
-        };
-        unsigned flags = type2flags[type];
+        unsigned int flags = 0;
 
+        if (type == RTN_UNREACHABLE || type == RTN_PROHIBIT)
+                flags = RTF_REJECT;
         if (fi && fi->fib_nh->nh_gw)
                 flags |= RTF_GATEWAY;
         if (mask == htonl(0xFFFFFFFF))
@@ -2562,7 +2553,7 @@ static unsigned fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
 /*
  *      This outputs /proc/net/route.
  *      The format of the file is not supposed to be changed
- *      and needs to be same as fib_hash output to avoid breaking
+ *      and needs to be same as fib_hash output to avoid breaking
  *      legacy utilities
  */
 static int fib_route_seq_show(struct seq_file *seq, void *v)
@@ -2587,7 +2578,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
 
                 list_for_each_entry_rcu(fa, &li->falh, fa_list) {
                         const struct fib_info *fi = fa->fa_info;
-                        unsigned flags = fib_flag_trans(fa->fa_type, mask, fi);
+                        unsigned int flags = fib_flag_trans(fa->fa_type, mask, fi);
                         int len;
 
                         if (fa->fa_type == RTN_BROADCAST
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
new file mode 100644
index 000000000000..b546736da2e1
--- /dev/null
+++ b/net/ipv4/gre.c
@@ -0,0 +1,151 @@
+/*
+ *      GRE over IPv4 demultiplexer driver
+ *
+ *      Authors: Dmitry Kozlov (xeb@mail.ru)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/skbuff.h>
+#include <linux/in.h>
+#include <linux/netdevice.h>
+#include <linux/version.h>
+#include <linux/spinlock.h>
+#include <net/protocol.h>
+#include <net/gre.h>
+
+
+const struct gre_protocol *gre_proto[GREPROTO_MAX] __read_mostly;
+static DEFINE_SPINLOCK(gre_proto_lock);
+
+int gre_add_protocol(const struct gre_protocol *proto, u8 version)
+{
+        if (version >= GREPROTO_MAX)
+                goto err_out;
+
+        spin_lock(&gre_proto_lock);
+        if (gre_proto[version])
+                goto err_out_unlock;
+
+        rcu_assign_pointer(gre_proto[version], proto);
+        spin_unlock(&gre_proto_lock);
+        return 0;
+
+err_out_unlock:
+        spin_unlock(&gre_proto_lock);
+err_out:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(gre_add_protocol);
+
+int gre_del_protocol(const struct gre_protocol *proto, u8 version)
+{
+        if (version >= GREPROTO_MAX)
+                goto err_out;
+
+        spin_lock(&gre_proto_lock);
+        if (gre_proto[version] != proto)
+                goto err_out_unlock;
+        rcu_assign_pointer(gre_proto[version], NULL);
+        spin_unlock(&gre_proto_lock);
+        synchronize_rcu();
+        return 0;
+
+err_out_unlock:
+        spin_unlock(&gre_proto_lock);
+err_out:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(gre_del_protocol);
+
+static int gre_rcv(struct sk_buff *skb)
+{
+        const struct gre_protocol *proto;
+        u8 ver;
+        int ret;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        ver = skb->data[1]&0x7f;
+        if (ver >= GREPROTO_MAX)
+                goto drop;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (!proto || !proto->handler)
+                goto drop_unlock;
+        ret = proto->handler(skb);
+        rcu_read_unlock();
+        return ret;
+
+drop_unlock:
+        rcu_read_unlock();
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static void gre_err(struct sk_buff *skb, u32 info)
+{
+        const struct gre_protocol *proto;
+        u8 ver;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        ver = skb->data[1]&0x7f;
+        if (ver >= GREPROTO_MAX)
+                goto drop;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (!proto || !proto->err_handler)
+                goto drop_unlock;
+        proto->err_handler(skb, info);
+        rcu_read_unlock();
+        return;
+
+drop_unlock:
+        rcu_read_unlock();
+drop:
+        kfree_skb(skb);
+}
+
+static const struct net_protocol net_gre_protocol = {
+        .handler     = gre_rcv,
+        .err_handler = gre_err,
+        .netns_ok    = 1,
+};
+
+static int __init gre_init(void)
+{
+        pr_info("GRE over IPv4 demultiplexor driver");
+
+        if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
+                pr_err("gre: can't add protocol\n");
+                return -EAGAIN;
+        }
+
+        return 0;
+}
+
+static void __exit gre_exit(void)
+{
+        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
+}
+
+module_init(gre_init);
+module_exit(gre_exit);
+
+MODULE_DESCRIPTION("GRE over IPv4 demultiplexer driver");
+MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
+MODULE_LICENSE("GPL");
+
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a0d847c7cba5..96bc7f9475a3 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -379,7 +379,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         inet->tos = ip_hdr(skb)->tos;
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
         if (icmp_param->replyopts.optlen) {
                 ipc.opt = &icmp_param->replyopts;
                 if (ipc.opt->srr)
@@ -538,7 +538,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         inet_sk(sk)->tos = tos;
         ipc.addr = iph->saddr;
         ipc.opt = &icmp_param.replyopts;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         {
                 struct flowi fl = {
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index e5fa2ddce320..ba8042665849 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -425,7 +425,7 @@ static int inet_diag_bc_run(const void *bc, int len,
                         bc += op->no;
                 }
         }
-        return (len == 0);
+        return len == 0;
 }
 
 static int valid_cc(const void *bc, int len, int cc)
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index b7c41654dde5..168440834ade 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -116,11 +116,11 @@ static int ip4_frag_match(struct inet_frag_queue *q, void *a)
         struct ip4_create_arg *arg = a;
 
         qp = container_of(q, struct ipq, q);
-        return (qp->id == arg->iph->id &&
+        return  qp->id == arg->iph->id &&
                         qp->saddr == arg->iph->saddr &&
                         qp->daddr == arg->iph->daddr &&
                         qp->protocol == arg->iph->protocol &&
-                        qp->user == arg->user);
+                        qp->user == arg->user;
 }
 
 /* Memory Tracking Functions. */
@@ -542,7 +542,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 35c93e8b6a46..5d6ddcb7403b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -44,6 +44,7 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
+#include <net/gre.h>
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/ipv6.h>
@@ -128,7 +129,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev);
 
 static int ipgre_net_id __read_mostly;
 struct ipgre_net {
-        struct ip_tunnel *tunnels[4][HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels[4][HASH_SIZE];
 
         struct net_device *fb_tunnel_dev;
 };
@@ -158,9 +159,8 @@ struct ipgre_net {
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ipgre_lock);
 
 #define for_each_ip_tunnel_rcu(start) \
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
@@ -173,8 +173,8 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
 {
         struct net *net = dev_net(dev);
         int link = dev->ifindex;
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(key);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(key);
         struct ip_tunnel *t, *cand = NULL;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
@@ -289,13 +289,13 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         return NULL;
 }
 
-static struct ip_tunnel **__ipgre_bucket(struct ipgre_net *ign,
+static struct ip_tunnel __rcu **__ipgre_bucket(struct ipgre_net *ign,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
         __be32 key = parms->i_key;
-        unsigned h = HASH(key);
+        unsigned int h = HASH(key);
         int prio = 0;
 
         if (local)
@@ -308,7 +308,7 @@ static struct ip_tunnel **__ipgre_bucket(struct ipgre_net *ign,
         return &ign->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipgre_bucket(struct ipgre_net *ign,
+static inline struct ip_tunnel __rcu **ipgre_bucket(struct ipgre_net *ign,
                 struct ip_tunnel *t)
 {
         return __ipgre_bucket(ign, &t->parms);
@@ -316,23 +316,22 @@ static inline struct ip_tunnel **ipgre_bucket(struct ipgre_net *ign,
 
 static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipgre_bucket(ign, t);
+        struct ip_tunnel __rcu **tp = ipgre_bucket(ign, t);
 
-        spin_lock_bh(&ipgre_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ipgre_lock);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ipgre_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ipgre_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipgre_bucket(ign, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -346,10 +345,13 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
         __be32 local = parms->iph.saddr;
         __be32 key = parms->i_key;
         int link = parms->link;
-        struct ip_tunnel *t, **tp;
+        struct ip_tunnel *t;
+        struct ip_tunnel __rcu **tp;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 
-        for (tp = __ipgre_bucket(ign, parms); (t = *tp) != NULL; tp = &t->next)
+        for (tp = __ipgre_bucket(ign, parms);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next)
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     key == t->parms.i_key &&
@@ -360,7 +362,7 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
         return t;
 }
 
-static struct ip_tunnel * ipgre_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
         struct ip_tunnel *t, *nt;
@@ -645,9 +647,11 @@ static int ipgre_rcv(struct sk_buff *skb)
                 skb_reset_network_header(skb);
                 ipgre_ecn_decapsulate(iph, skb);
 
-                netif_rx(skb);
+                if (netif_rx(skb) == NET_RX_DROP)
+                        stats->rx_dropped++;
+
                 rcu_read_unlock();
-                return(0);
+                return 0;
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
@@ -655,7 +659,7 @@ drop:
         rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
-        return(0);
+        return 0;
 }
 
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -668,7 +672,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         u8     tos;
         __be16 df;
         struct rtable *rt;                      /* Route to the other host */
-        struct net_device *tdev;                        /* Device to other host */
+        struct net_device *tdev;                /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         int    gre_hlen;
@@ -1012,7 +1016,7 @@ ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                         break;
                                 }
                         } else {
-                                unsigned nflags = 0;
+                                unsigned int nflags = 0;
 
                                 t = netdev_priv(dev);
 
@@ -1125,7 +1129,7 @@ static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 
 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
                         unsigned short type,
-                        const void *daddr, const void *saddr, unsigned len)
+                        const void *daddr, const void *saddr, unsigned int len)
 {
         struct ip_tunnel *t = netdev_priv(dev);
         struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
@@ -1274,14 +1278,13 @@ static void ipgre_fb_tunnel_init(struct net_device *dev)
         tunnel->hlen            = sizeof(struct iphdr) + 4;
 
         dev_hold(dev);
-        ign->tunnels_wc[0]      = tunnel;
+        rcu_assign_pointer(ign->tunnels_wc[0], tunnel);
 }
 
 
-static const struct net_protocol ipgre_protocol = {
-        .handler        =       ipgre_rcv,
-        .err_handler    =       ipgre_err,
-        .netns_ok       =       1,
+static const struct gre_protocol ipgre_protocol = {
+        .handler     = ipgre_rcv,
+        .err_handler = ipgre_err,
 };
 
 static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
@@ -1291,11 +1294,13 @@ static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
         for (prio = 0; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t = ign->tunnels[prio][h];
+                        struct ip_tunnel *t;
+
+                        t = rtnl_dereference(ign->tunnels[prio][h]);
 
                         while (t != NULL) {
                                 unregister_netdevice_queue(t->dev, head);
-                                t = t->next;
+                                t = rtnl_dereference(t->next);
                         }
                 }
         }
@@ -1522,7 +1527,7 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                 t = nt;
 
                 if (dev->type != ARPHRD_ETHER) {
-                        unsigned nflags = 0;
+                        unsigned int nflags = 0;
 
                         if (ipv4_is_multicast(p.iph.daddr))
                                 nflags = IFF_BROADCAST;
@@ -1663,7 +1668,7 @@ static int __init ipgre_init(void)
         if (err < 0)
                 return err;
 
-        err = inet_add_protocol(&ipgre_protocol, IPPROTO_GRE);
+        err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
         if (err < 0) {
                 printk(KERN_INFO "ipgre init: can't add protocol\n");
                 goto add_proto_failed;
@@ -1683,7 +1688,7 @@ out:
 tap_ops_failed:
         rtnl_link_unregister(&ipgre_link_ops);
 rtnl_link_failed:
-        inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
+        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
 add_proto_failed:
         unregister_pernet_device(&ipgre_net_ops);
         goto out;
@@ -1693,7 +1698,7 @@ static void __exit ipgre_fini(void)
 {
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
-        if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
+        if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
         unregister_pernet_device(&ipgre_net_ops);
 }
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ba9836c488ed..1906fa35860c 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -466,7 +466,7 @@ error:
         }
         return -EINVAL;
 }
-
+EXPORT_SYMBOL(ip_options_compile);
 
 /*
  *      Undo all the changes done by ip_options_compile().
@@ -646,3 +646,4 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         }
         return 0;
 }
+EXPORT_SYMBOL(ip_options_rcv_srr);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7649d7750075..439d2a34ee44 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -487,7 +487,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          * LATER: this step can be merged to real generation of fragments,
          * we can switch to copy when see the first bad fragment.
          */
-        if (skb_has_frags(skb)) {
+        if (skb_has_frag_list(skb)) {
                 struct sk_buff *frag, *frag2;
                 int first_len = skb_pagelen(skb);
 
@@ -844,10 +844,9 @@ int ip_append_data(struct sock *sk,
                 inet->cork.length = 0;
                 sk->sk_sndmsg_page = NULL;
                 sk->sk_sndmsg_off = 0;
-                if ((exthdrlen = rt->dst.header_len) != 0) {
-                        length += exthdrlen;
-                        transhdrlen += exthdrlen;
-                }
+                exthdrlen = rt->dst.header_len;
+                length += exthdrlen;
+                transhdrlen += exthdrlen;
         } else {
                 rt = (struct rtable *)inet->cork.dst;
                 if (inet->cork.flags & IPCORK_OPT)
@@ -934,16 +933,19 @@ alloc_new_skb:
                             !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
                         else
-                                alloclen = datalen + fragheaderlen;
+                                alloclen = fraglen;
 
                         /* The last fragment gets additional space at tail.
                          * Note, with MSG_MORE we overallocate on fragments,
                          * because we have no idea what fragment will be
                          * the last.
                          */
-                        if (datalen == length + fraggap)
+                        if (datalen == length + fraggap) {
                                 alloclen += rt->dst.trailer_len;
-
+                                /* make sure mtu is not reached */
+                                if (datalen > mtu - fragheaderlen - rt->dst.trailer_len)
+                                        datalen -= ALIGN(rt->dst.trailer_len, 8);
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len + 15,
@@ -960,7 +962,7 @@ alloc_new_skb:
                                 else
                                         /* only the initial fragment is
                                            time stamped */
-                                        ipc->shtx.flags = 0;
+                                        ipc->tx_flags = 0;
                         }
                         if (skb == NULL)
                                 goto error;
@@ -971,7 +973,7 @@ alloc_new_skb:
                         skb->ip_summed = csummode;
                         skb->csum = 0;
                         skb_reserve(skb, hh_len);
-                        *skb_tx(skb) = ipc->shtx;
+                        skb_shinfo(skb)->tx_flags = ipc->tx_flags;
 
                         /*
                          *      Find where to start putting bytes.
@@ -1391,7 +1393,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
 
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         if (replyopts.opt.optlen) {
                 ipc.opt = &replyopts.opt;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index ec036731a70b..babd25278106 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -122,11 +122,11 @@
 
 static int ipip_net_id __read_mostly;
 struct ipip_net {
-        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_r[HASH_SIZE];
-        struct ip_tunnel *tunnels_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_wc[1];
-        struct ip_tunnel **tunnels[4];
+        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_wc[1];
+        struct ip_tunnel __rcu **tunnels[4];
 
         struct net_device *fb_tunnel_dev;
 };
@@ -135,9 +135,8 @@ static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ipip_lock);
 
 #define for_each_ip_tunnel_rcu(start) \
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
@@ -145,8 +144,8 @@ static DEFINE_SPINLOCK(ipip_lock);
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
@@ -169,12 +168,12 @@ static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
         return NULL;
 }
 
-static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
+static struct ip_tunnel __rcu **__ipip_bucket(struct ipip_net *ipn,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        unsigned h = 0;
+        unsigned int h = 0;
         int prio = 0;
 
         if (remote) {
@@ -188,7 +187,7 @@ static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
         return &ipn->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
+static inline struct ip_tunnel __rcu **ipip_bucket(struct ipip_net *ipn,
                 struct ip_tunnel *t)
 {
         return __ipip_bucket(ipn, &t->parms);
@@ -196,13 +195,14 @@ static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
 
 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ipip_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ipip_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipip_bucket(ipn, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -210,12 +210,10 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipip_bucket(ipn, t);
+        struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
 
-        spin_lock_bh(&ipip_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ipip_lock);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -223,12 +221,15 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, **tp, *nt;
+        struct ip_tunnel *t, *nt;
+        struct ip_tunnel __rcu **tp;
         struct net_device *dev;
         char name[IFNAMSIZ];
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (tp = __ipip_bucket(ipn, parms); (t = *tp) != NULL; tp = &t->next) {
+        for (tp = __ipip_bucket(ipn, parms);
+                 (t = rtnl_dereference(*tp)) != NULL;
+                 tp = &t->next) {
                 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
                         return t;
         }
@@ -268,16 +269,15 @@ failed_free:
         return NULL;
 }
 
+/* called with RTNL */
 static void ipip_tunnel_uninit(struct net_device *dev)
 {
         struct net *net = dev_net(dev);
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        if (dev == ipn->fb_tunnel_dev) {
-                spin_lock_bh(&ipip_lock);
-                ipn->tunnels_wc[0] = NULL;
-                spin_unlock_bh(&ipip_lock);
-        } else
+        if (dev == ipn->fb_tunnel_dev)
+                rcu_assign_pointer(ipn->tunnels_wc[0], NULL);
+        else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
 }
@@ -377,7 +377,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 skb_tunnel_rx(skb, tunnel->dev);
 
                 ipip_ecn_decapsulate(iph, skb);
-                netif_rx(skb);
+
+                if (netif_rx(skb) == NET_RX_DROP)
+                        tunnel->dev->stats.rx_dropped++;
+
                 rcu_read_unlock();
                 return 0;
         }
@@ -741,10 +744,10 @@ static void __net_init ipip_fb_tunnel_init(struct net_device *dev)
         iph->ihl                = 5;
 
         dev_hold(dev);
-        ipn->tunnels_wc[0]      = tunnel;
+        rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
 }
 
-static struct xfrm_tunnel ipip_handler = {
+static struct xfrm_tunnel ipip_handler __read_mostly = {
         .handler        =       ipip_rcv,
         .err_handler    =       ipip_err,
         .priority       =       1,
@@ -760,11 +763,12 @@ static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t = ipn->tunnels[prio][h];
+                        struct ip_tunnel *t;
 
+                        t = rtnl_dereference(ipn->tunnels[prio][h]);
                         while (t != NULL) {
                                 unregister_netdevice_queue(t->dev, head);
-                                t = t->next;
+                                t = rtnl_dereference(t->next);
                         }
                 }
         }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 179fcab866fc..10b24c02deb0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -724,7 +724,7 @@ static int vif_add(struct net *net, struct mr_table *mrt,
         case 0:
                 if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
                         dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
-                        if (dev && dev->ip_ptr == NULL) {
+                        if (dev && __in_dev_get_rtnl(dev) == NULL) {
                                 dev_put(dev);
                                 return -EADDRNOTAVAIL;
                         }
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index e8f4f9a57f12..8b642f152468 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -72,7 +72,7 @@ static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
         for (i = 0; i < len; i++)
                 ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];
 
-        return (ret != 0);
+        return ret != 0;
 }
 
 /*
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 3a43cf36db87..1e26a4897655 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -29,6 +29,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/net_namespace.h>
 #include <net/checksum.h>
+#include <net/ip.h>
 
 #define CLUSTERIP_VERSION "0.8"
 
@@ -231,24 +232,22 @@ clusterip_hashfn(const struct sk_buff *skb,
 {
         const struct iphdr *iph = ip_hdr(skb);
         unsigned long hashval;
-        u_int16_t sport, dport;
-        const u_int16_t *ports;
-
-        switch (iph->protocol) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE:
-        case IPPROTO_SCTP:
-        case IPPROTO_DCCP:
-        case IPPROTO_ICMP:
-                ports = (const void *)iph+iph->ihl*4;
-                sport = ports[0];
-                dport = ports[1];
-                break;
-        default:
+        u_int16_t sport = 0, dport = 0;
+        int poff;
+
+        poff = proto_ports_offset(iph->protocol);
+        if (poff >= 0) {
+                const u_int16_t *ports;
+                u16 _ports[2];
+
+                ports = skb_header_pointer(skb, iph->ihl * 4 + poff, 4, _ports);
+                if (ports) {
+                        sport = ports[0];
+                        dport = ports[1];
+                }
+        } else {
                 if (net_ratelimit())
                         pr_info("unknown protocol %u\n", iph->protocol);
-                sport = dport = 0;
         }
 
         switch (config->hash_mode) {
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index f2d297351405..65699c24411c 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -28,8 +28,7 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 
-const struct net_protocol *inet_protos[MAX_INET_PROTOS] ____cacheline_aligned_in_smp;
-static DEFINE_SPINLOCK(inet_proto_lock);
+const struct net_protocol *inet_protos[MAX_INET_PROTOS] __read_mostly;
 
 /*
  *      Add a protocol handler to the hash tables
@@ -37,20 +36,9 @@ static DEFINE_SPINLOCK(inet_proto_lock);
 
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
-        int hash, ret;
+        int hash = protocol & (MAX_INET_PROTOS - 1);
 
-        hash = protocol & (MAX_INET_PROTOS - 1);
-
-        spin_lock_bh(&inet_proto_lock);
-        if (inet_protos[hash]) {
-                ret = -1;
-        } else {
-                inet_protos[hash] = prot;
-                ret = 0;
-        }
-        spin_unlock_bh(&inet_proto_lock);
-
-        return ret;
+        return !cmpxchg(&inet_protos[hash], NULL, prot) ? 0 : -1;
 }
 EXPORT_SYMBOL(inet_add_protocol);
 
@@ -60,18 +48,9 @@ EXPORT_SYMBOL(inet_add_protocol);
 
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
-        int hash, ret;
-
-        hash = protocol & (MAX_INET_PROTOS - 1);
+        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
 
-        spin_lock_bh(&inet_proto_lock);
-        if (inet_protos[hash] == prot) {
-                inet_protos[hash] = NULL;
-                ret = 0;
-        } else {
-                ret = -1;
-        }
-        spin_unlock_bh(&inet_proto_lock);
+        ret = (cmpxchg(&inet_protos[hash], prot, NULL) == prot) ? 0 : -1;
 
         synchronize_net();
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 009a7b2aa1ef..1f85ef289895 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -505,7 +505,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
 
         if (msg->msg_controllen) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6298f75d5e93..98beda47bc99 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1268,18 +1268,11 @@ skip_hashing:
 
 void rt_bind_peer(struct rtable *rt, int create)
 {
-        static DEFINE_SPINLOCK(rt_peer_lock);
         struct inet_peer *peer;
 
         peer = inet_getpeer(rt->rt_dst, create);
 
-        spin_lock_bh(&rt_peer_lock);
-        if (rt->peer == NULL) {
-                rt->peer = peer;
-                peer = NULL;
-        }
-        spin_unlock_bh(&rt_peer_lock);
-        if (peer)
+        if (peer && cmpxchg(&rt->peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
 }
 
@@ -2586,7 +2579,7 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                         goto out;
 
                 /* RACE: Check return value of inet_select_addr instead. */
-                if (__in_dev_get_rtnl(dev_out) == NULL) {
+                if (rcu_dereference_raw(dev_out->ip_ptr) == NULL) {
                         dev_put(dev_out);
                         goto out;       /* Wrong error code */
                 }
@@ -2798,7 +2791,7 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
 
         dst_release(&(*rp)->dst);
         *rp = rt;
-        return (rt ? 0 : -ENOMEM);
+        return rt ? 0 : -ENOMEM;
 }
 
 int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 95d75d443927..19192c5fe67a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2392,7 +2392,12 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 err = tp->af_specific->md5_parse(sk, optval, optlen);
                 break;
 #endif
-
+        case TCP_USER_TIMEOUT:
+                /* Cap the max timeout in ms TCP will retry/retrans
+                 * before giving up and aborting (ETIMEDOUT) a connection.
+                 */
+                icsk->icsk_user_timeout = msecs_to_jiffies(val);
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -2611,6 +2616,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
         case TCP_THIN_DUPACK:
                 val = tp->thin_dupack;
                 break;
+
+        case TCP_USER_TIMEOUT:
+                val = jiffies_to_msecs(icsk->icsk_user_timeout);
+                break;
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 149e79ac2891..fabc09a58d7f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -805,25 +805,12 @@ void tcp_update_metrics(struct sock *sk)
         }
 }
 
-/* Numbers are taken from RFC3390.
- *
- * John Heffner states:
- *
- *      The RFC specifies a window of no more than 4380 bytes
- *      unless 2*MSS > 4380.  Reading the pseudocode in the RFC
- *      is a bit misleading because they use a clamp at 4380 bytes
- *      rather than use a multiplier in the relevant range.
- */
 __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
 {
         __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
 
-        if (!cwnd) {
-                if (tp->mss_cache > 1460)
-                        cwnd = 2;
-                else
-                        cwnd = (tp->mss_cache > 1095) ? 3 : 4;
-        }
+        if (!cwnd)
+                cwnd = rfc3390_bytes_to_packets(tp->mss_cache);
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
 
@@ -2314,7 +2301,7 @@ static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 
 static inline int tcp_skb_timedout(struct sock *sk, struct sk_buff *skb)
 {
-        return (tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto);
+        return tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto;
 }
 
 static inline int tcp_head_timedout(struct sock *sk)
@@ -3411,8 +3398,8 @@ static void tcp_ack_probe(struct sock *sk)
 
 static inline int tcp_ack_is_dubious(const struct sock *sk, const int flag)
 {
-        return (!(flag & FLAG_NOT_DUP) || (flag & FLAG_CA_ALERT) ||
-                inet_csk(sk)->icsk_ca_state != TCP_CA_Open);
+        return !(flag & FLAG_NOT_DUP) || (flag & FLAG_CA_ALERT) ||
+                inet_csk(sk)->icsk_ca_state != TCP_CA_Open;
 }
 
 static inline int tcp_may_raise_cwnd(const struct sock *sk, const int flag)
@@ -3429,9 +3416,9 @@ static inline int tcp_may_update_window(const struct tcp_sock *tp,
                                         const u32 ack, const u32 ack_seq,
                                         const u32 nwin)
 {
-        return (after(ack, tp->snd_una) ||
+        return  after(ack, tp->snd_una) ||
                 after(ack_seq, tp->snd_wl1) ||
-                (ack_seq == tp->snd_wl1 && nwin > tp->snd_wnd));
+                (ack_seq == tp->snd_wl1 && nwin > tp->snd_wnd);
 }
 
 /* Update our send window.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 020766292bb0..a0232f3a358b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2571,7 +2571,6 @@ struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         return tcp_gro_receive(head, skb);
 }
-EXPORT_SYMBOL(tcp4_gro_receive);
 
 int tcp4_gro_complete(struct sk_buff *skb)
 {
@@ -2584,7 +2583,6 @@ int tcp4_gro_complete(struct sk_buff *skb)
 
         return tcp_gro_complete(skb);
 }
-EXPORT_SYMBOL(tcp4_gro_complete);
 
 struct proto tcp_prot = {
         .name                   = "TCP",
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index f25b56cb85cb..43cf901d7659 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -55,7 +55,7 @@ static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
                 return 1;
         if (after(end_seq, s_win) && before(seq, e_win))
                 return 1;
-        return (seq == e_win && seq == end_seq);
+        return seq == e_win && seq == end_seq;
 }
 
 /*
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index de3bd8458588..05b1ecf36763 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -224,16 +224,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 }
         }
 
-        /* Set initial window to value enough for senders,
-         * following RFC2414. Senders, not following this RFC,
-         * will be satisfied with 2.
-         */
+        /* Set initial window to value enough for senders, following RFC5681. */
         if (mss > (1 << *rcv_wscale)) {
-                int init_cwnd = 4;
-                if (mss > 1460 * 3)
-                        init_cwnd = 2;
-                else if (mss > 1460)
-                        init_cwnd = 3;
+                int init_cwnd = rfc3390_bytes_to_packets(mss);
+
                 /* when initializing use the value from init_rcv_wnd
                  * rather than the default from above
                  */
@@ -1376,9 +1370,9 @@ static inline int tcp_nagle_check(const struct tcp_sock *tp,
                                   const struct sk_buff *skb,
                                   unsigned mss_now, int nonagle)
 {
-        return (skb->len < mss_now &&
+        return skb->len < mss_now &&
                 ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp))));
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
 }
 
 /* Return non-zero if the Nagle test allows this packet to be
@@ -1449,10 +1443,10 @@ int tcp_may_send_now(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb = tcp_send_head(sk);
 
-        return (skb &&
+        return skb &&
                 tcp_snd_test(sk, skb, tcp_current_mss(sk),
                              (tcp_skb_is_last(sk, skb) ?
-                              tp->nonagle : TCP_NAGLE_PUSH)));
+                              tp->nonagle : TCP_NAGLE_PUSH));
 }
 
 /* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
@@ -2429,6 +2423,12 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                 __u8 rcv_wscale;
                 /* Set this up on the first call only */
                 req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
+
+                /* limit the window selection if the user enforce a smaller rx buffer */
+                if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+                    (req->window_clamp > tcp_full_space(sk) || req->window_clamp == 0))
+                        req->window_clamp = tcp_full_space(sk);
+
                 /* tcp_full_space because it is guaranteed to be the first packet */
                 tcp_select_initial_window(tcp_full_space(sk),
                         mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
@@ -2555,6 +2555,11 @@ static void tcp_connect_init(struct sock *sk)
 
         tcp_initialize_rcv_mss(sk);
 
+        /* limit the window selection if the user enforce a smaller rx buffer */
+        if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+            (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
+                tp->window_clamp = tcp_full_space(sk);
+
         tcp_select_initial_window(tcp_full_space(sk),
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c35b469e851c..baea4a129022 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -138,10 +138,10 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
  * retransmissions with an initial RTO of TCP_RTO_MIN.
  */
 static bool retransmits_timed_out(struct sock *sk,
-                                  unsigned int boundary)
+                                  unsigned int boundary,
+                                  unsigned int timeout)
 {
-        unsigned int timeout, linear_backoff_thresh;
-        unsigned int start_ts;
+        unsigned int linear_backoff_thresh, start_ts;
 
         if (!inet_csk(sk)->icsk_retransmits)
                 return false;
@@ -151,14 +151,15 @@ static bool retransmits_timed_out(struct sock *sk,
         else
                 start_ts = tcp_sk(sk)->retrans_stamp;
 
-        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
-
-        if (boundary <= linear_backoff_thresh)
-                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
-        else
-                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
-                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+        if (likely(timeout == 0)) {
+                linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
 
+                if (boundary <= linear_backoff_thresh)
+                        timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+                else
+                        timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                                (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+        }
         return (tcp_time_stamp - start_ts) >= timeout;
 }
 
@@ -174,7 +175,7 @@ static int tcp_write_timeout(struct sock *sk)
                         dst_negative_advice(sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
-                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
@@ -187,14 +188,16 @@ static int tcp_write_timeout(struct sock *sk)
 
                         retry_until = tcp_orphan_retries(sk, alive);
                         do_reset = alive ||
-                                   !retransmits_timed_out(sk, retry_until);
+                                   !retransmits_timed_out(sk, retry_until, 0);
 
                         if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (retransmits_timed_out(sk, retry_until)) {
+        if (retransmits_timed_out(sk, retry_until,
+            (1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV) ? 0 :
+            icsk->icsk_user_timeout)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -436,7 +439,7 @@ out_reset_timer:
                 icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
         }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
                 __sk_dst_reset(sk);
 
 out:;
@@ -556,7 +559,14 @@ static void tcp_keepalive_timer (unsigned long data)
         elapsed = keepalive_time_elapsed(tp);
 
         if (elapsed >= keepalive_time_when(tp)) {
-                if (icsk->icsk_probes_out >= keepalive_probes(tp)) {
+                /* If the TCP_USER_TIMEOUT option is enabled, use that
+                 * to determine when to timeout instead.
+                 */
+                if ((icsk->icsk_user_timeout != 0 &&
+                    elapsed >= icsk->icsk_user_timeout &&
+                    icsk->icsk_probes_out > 0) ||
+                    (icsk->icsk_user_timeout == 0 &&
+                    icsk->icsk_probes_out >= keepalive_probes(tp))) {
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         tcp_write_err(sk);
                         goto out;
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
index 20151d6a6241..a534dda5456e 100644
--- a/net/ipv4/tcp_westwood.c
+++ b/net/ipv4/tcp_westwood.c
@@ -80,7 +80,7 @@ static void tcp_westwood_init(struct sock *sk)
  */
 static inline u32 westwood_do_filter(u32 a, u32 b)
 {
-        return (((7 * a) + b) >> 3);
+        return ((7 * a) + b) >> 3;
 }
 
 static void westwood_filter(struct westwood *w, u32 delta)
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index 59186ca7808a..9a17bd2a0a37 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -14,8 +14,8 @@
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm_tunnel *tunnel4_handlers;
-static struct xfrm_tunnel *tunnel64_handlers;
+static struct xfrm_tunnel *tunnel4_handlers __read_mostly;
+static struct xfrm_tunnel *tunnel64_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel4_mutex);
 
 static inline struct xfrm_tunnel **fam_handlers(unsigned short family)
@@ -39,7 +39,7 @@ int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family)
         }
 
         handler->next = *pprev;
-        *pprev = handler;
+        rcu_assign_pointer(*pprev, handler);
 
         ret = 0;
 
@@ -73,6 +73,11 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family)
 }
 EXPORT_SYMBOL(xfrm4_tunnel_deregister);
 
+#define for_each_tunnel_rcu(head, handler)              \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+        
 static int tunnel4_rcv(struct sk_buff *skb)
 {
         struct xfrm_tunnel *handler;
@@ -80,7 +85,7 @@ static int tunnel4_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto drop;
 
-        for (handler = tunnel4_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel4_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -99,7 +104,7 @@ static int tunnel64_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto drop;
 
-        for (handler = tunnel64_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel64_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -115,7 +120,7 @@ static void tunnel4_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler;
 
-        for (handler = tunnel4_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel4_handlers, handler)
                 if (!handler->err_handler(skb, info))
                         break;
 }
@@ -125,7 +130,7 @@ static void tunnel64_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler;
 
-        for (handler = tunnel64_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel64_handlers, handler)
                 if (!handler->err_handler(skb, info))
                         break;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index fb23c2e63b52..b3f7e8cf18ac 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -797,7 +797,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 return -EOPNOTSUPP;
 
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         if (up->pending) {
                 /*
@@ -845,7 +845,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
-        err = sock_tx_timestamp(msg, sk, &ipc.shtx);
+        err = sock_tx_timestamp(sk, &ipc.tx_flags);
         if (err)
                 return err;
         if (msg->msg_controllen) {
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 41f5982d2087..82806455e859 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -58,14 +58,14 @@ static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)
         return -ENOENT;
 }
 
-static struct xfrm_tunnel xfrm_tunnel_handler = {
+static struct xfrm_tunnel xfrm_tunnel_handler __read_mostly = {
         .handler        =       xfrm_tunnel_rcv,
         .err_handler    =       xfrm_tunnel_err,
         .priority       =       2,
 };
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-static struct xfrm_tunnel xfrm64_tunnel_handler = {
+static struct xfrm_tunnel xfrm64_tunnel_handler __read_mostly = {
         .handler        =       xfrm_tunnel_rcv,
         .err_handler    =       xfrm_tunnel_err,
         .priority       =       2,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 324fac3b6c16..8c88340278f5 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -243,7 +243,7 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
 /* Check if a route is valid prefix route */
 static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
 {
-        return ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0);
+        return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
 }
 
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
@@ -2964,7 +2964,8 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
            start sending router solicitations.
          */
 
-        if (ifp->idev->cnf.forwarding == 0 &&
+        if ((ifp->idev->cnf.forwarding == 0 ||
+             ifp->idev->cnf.forwarding == 2) &&
             ifp->idev->cnf.rtr_solicits > 0 &&
             (dev->flags&IFF_LOOPBACK) == 0 &&
             (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 8175f802651b..c8993e5a337c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -518,10 +518,9 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
 static inline int ip6addrlbl_msgsize(void)
 {
-        return (NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
+        return NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
                 + nla_total_size(16)    /* IFAL_ADDRESS */
-                + nla_total_size(4)     /* IFAL_LABEL */
-        );
+                + nla_total_size(4);    /* IFAL_LABEL */
 }
 
 static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 56b9bf2516f4..60220985bb80 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -467,7 +467,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 sin->sin6_scope_id = sk->sk_bound_dev_if;
         *uaddr_len = sizeof(*sin);
-        return(0);
+        return 0;
 }
 
 EXPORT_SYMBOL(inet6_getname);
@@ -488,7 +488,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCADDRT:
         case SIOCDELRT:
 
-                return(ipv6_route_ioctl(net, cmd, (void __user *)arg));
+                return ipv6_route_ioctl(net, cmd, (void __user *)arg);
 
         case SIOCSIFADDR:
                 return addrconf_add_ifaddr(net, (void __user *) arg);
@@ -502,7 +502,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return sk->sk_prot->ioctl(sk, cmd, arg);
         }
         /*NOTREACHED*/
-        return(0);
+        return 0;
 }
 
 EXPORT_SYMBOL(inet6_ioctl);
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index e1caa5d526c2..14ed0a955b56 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -13,12 +13,12 @@ int ipv6_ext_hdr(u8 nexthdr)
         /*
          * find out if nexthdr is an extension header or a protocol
          */
-        return ( (nexthdr == NEXTHDR_HOP)       ||
+        return   (nexthdr == NEXTHDR_HOP)       ||
                  (nexthdr == NEXTHDR_ROUTING)   ||
                  (nexthdr == NEXTHDR_FRAGMENT)  ||
                  (nexthdr == NEXTHDR_AUTH)      ||
                  (nexthdr == NEXTHDR_NONE)      ||
-                 (nexthdr == NEXTHDR_DEST) );
+                 (nexthdr == NEXTHDR_DEST);
 }
 
 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 980912ed7a38..99157b4cd56e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -637,7 +637,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         }
         mtu -= hlen + sizeof(struct frag_hdr);
 
-        if (skb_has_frags(skb)) {
+        if (skb_has_frag_list(skb)) {
                 int first_len = skb_pagelen(skb);
                 struct sk_buff *frag2;
 
@@ -878,8 +878,8 @@ static inline int ip6_rt_check(struct rt6key *rt_key,
                                struct in6_addr *fl_addr,
                                struct in6_addr *addr_cache)
 {
-        return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
-                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
+        return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
+                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 }
 
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0fd027f3f47e..f6d9f683543e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -83,15 +83,14 @@ struct ip6_tnl_net {
         /* the IPv6 tunnel fallback device */
         struct net_device *fb_tnl_dev;
         /* lists for storing tunnels in use */
-        struct ip6_tnl *tnls_r_l[HASH_SIZE];
-        struct ip6_tnl *tnls_wc[1];
-        struct ip6_tnl **tnls[2];
+        struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
+        struct ip6_tnl __rcu *tnls_wc[1];
+        struct ip6_tnl __rcu **tnls[2];
 };
 
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ip6_tnl_lock);
 
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -138,8 +137,8 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
@@ -167,7 +166,7 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
  * Return: head of IPv6 tunnel list
  **/
 
-static struct ip6_tnl **
+static struct ip6_tnl __rcu **
 ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
 {
         struct in6_addr *remote = &p->raddr;
@@ -190,12 +189,10 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
 static void
 ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
+        struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
 
-        spin_lock_bh(&ip6_tnl_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next , rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ip6_tnl_lock);
 }
 
 /**
@@ -206,13 +203,14 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 static void
 ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp;
-
-        for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ip6_tnl_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ip6_tnl_lock);
+        struct ip6_tnl __rcu **tp;
+        struct ip6_tnl *iter;
+
+        for (tp = ip6_tnl_bucket(ip6n, &t->parms);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -290,10 +288,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
 {
         struct in6_addr *remote = &p->raddr;
         struct in6_addr *local = &p->laddr;
+        struct ip6_tnl __rcu **tp;
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        for (t = *ip6_tnl_bucket(ip6n, p); t; t = t->next) {
+        for (tp = ip6_tnl_bucket(ip6n, p);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr))
                         return t;
@@ -318,13 +319,10 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        if (dev == ip6n->fb_tnl_dev) {
-                spin_lock_bh(&ip6_tnl_lock);
-                ip6n->tnls_wc[0] = NULL;
-                spin_unlock_bh(&ip6_tnl_lock);
-        } else {
+        if (dev == ip6n->fb_tnl_dev)
+                rcu_assign_pointer(ip6n->tnls_wc[0], NULL);
+        else
                 ip6_tnl_unlink(ip6n, t);
-        }
         ip6_tnl_dst_reset(t);
         dev_put(dev);
 }
@@ -727,7 +725,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 skb_tunnel_rx(skb, t->dev);
 
                 dscp_ecn_decapsulate(t, ipv6h, skb);
-                netif_rx(skb);
+
+                if (netif_rx(skb) == NET_RX_DROP)
+                        t->dev->stats.rx_dropped++;
+
                 rcu_read_unlock();
                 return 0;
         }
@@ -1369,16 +1370,16 @@ static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
         ip6_tnl_dev_init_gen(dev);
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
-        ip6n->tnls_wc[0] = t;
+        rcu_assign_pointer(ip6n->tnls_wc[0], t);
 }
 
-static struct xfrm6_tunnel ip4ip6_handler = {
+static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
         .handler        = ip4ip6_rcv,
         .err_handler    = ip4ip6_err,
         .priority       =       1,
 };
 
-static struct xfrm6_tunnel ip6ip6_handler = {
+static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
         .handler        = ip6ip6_rcv,
         .err_handler    = ip6ip6_err,
         .priority       =       1,
@@ -1391,14 +1392,14 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
         LIST_HEAD(list);
 
         for (h = 0; h < HASH_SIZE; h++) {
-                t = ip6n->tnls_r_l[h];
+                t = rtnl_dereference(ip6n->tnls_r_l[h]);
                 while (t != NULL) {
                         unregister_netdevice_queue(t->dev, &list);
-                        t = t->next;
+                        t = rtnl_dereference(t->next);
                 }
         }
 
-        t = ip6n->tnls_wc[0];
+        t = rtnl_dereference(ip6n->tnls_wc[0]);
         unregister_netdevice_queue(t->dev, &list);
         unregister_netdevice_many(&list);
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 66078dad7fe8..2640c9be589d 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -666,7 +666,9 @@ static int pim6_rcv(struct sk_buff *skb)
 
         skb_tunnel_rx(skb, reg_dev);
 
-        netif_rx(skb);
+        if (netif_rx(skb) == NET_RX_DROP)
+                reg_dev->stats.rx_dropped++;
+
         dev_put(reg_dev);
         return 0;
  drop:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 58841c4ae947..b3dd844cd34f 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -228,12 +228,12 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
         do {
                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
         } while(cur < end && cur->nd_opt_type != type);
-        return (cur <= end && cur->nd_opt_type == type ? cur : NULL);
+        return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 }
 
 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 {
-        return (opt->nd_opt_type == ND_OPT_RDNSS);
+        return opt->nd_opt_type == ND_OPT_RDNSS;
 }
 
 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
@@ -244,7 +244,7 @@ static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
         do {
                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
         } while(cur < end && !ndisc_is_useropt(cur));
-        return (cur <= end && ndisc_is_useropt(cur) ? cur : NULL);
+        return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 }
 
 static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
@@ -319,7 +319,7 @@ static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
         int prepad = ndisc_addr_option_pad(dev->type);
         if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
                 return NULL;
-        return (lladdr + prepad);
+        return lladdr + prepad;
 }
 
 int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
@@ -1105,6 +1105,18 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
 }
 
+static inline int accept_ra(struct inet6_dev *in6_dev)
+{
+        /*
+         * If forwarding is enabled, RA are not accepted unless the special
+         * hybrid mode (accept_ra=2) is enabled.
+         */
+        if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
+                return 0;
+
+        return in6_dev->cnf.accept_ra;
+}
+
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
@@ -1158,8 +1170,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
 
-        /* skip route and link configuration on routers */
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+        if (!accept_ra(in6_dev))
                 goto skip_linkparms;
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1309,8 +1320,7 @@ skip_linkparms:
                              NEIGH_UPDATE_F_ISROUTER);
         }
 
-        /* skip route and link configuration on routers */
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+        if (!accept_ra(in6_dev))
                 goto out;
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 8e754be92c24..6b331e9b5706 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -82,13 +82,13 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 int
 ip6t_ext_hdr(u8 nexthdr)
 {
-        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
-                 (nexthdr == IPPROTO_ROUTING)   ||
-                 (nexthdr == IPPROTO_FRAGMENT)  ||
-                 (nexthdr == IPPROTO_ESP)       ||
-                 (nexthdr == IPPROTO_AH)        ||
-                 (nexthdr == IPPROTO_NONE)      ||
-                 (nexthdr == IPPROTO_DSTOPTS) );
+        return  (nexthdr == IPPROTO_HOPOPTS)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_DSTOPTS);
 }
 
 /* Returns whether matches rule or not. */
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 578f3c1a16db..138a8b362706 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -363,7 +363,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 1fa3468f0f32..9bb936ae2452 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -25,28 +25,14 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 
-const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS];
-static DEFINE_SPINLOCK(inet6_proto_lock);
-
+const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS] __read_mostly;
 
 int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
-        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
-
-        spin_lock_bh(&inet6_proto_lock);
-
-        if (inet6_protos[hash]) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = prot;
-                ret = 0;
-        }
-
-        spin_unlock_bh(&inet6_proto_lock);
+        int hash = protocol & (MAX_INET_PROTOS - 1);
 
-        return ret;
+        return !cmpxchg(&inet6_protos[hash], NULL, prot) ? 0 : -1;
 }
-
 EXPORT_SYMBOL(inet6_add_protocol);
 
 /*
@@ -57,20 +43,10 @@ int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol
 {
         int ret, hash = protocol & (MAX_INET_PROTOS - 1);
 
-        spin_lock_bh(&inet6_proto_lock);
-
-        if (inet6_protos[hash] != prot) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = NULL;
-                ret = 0;
-        }
-
-        spin_unlock_bh(&inet6_proto_lock);
+        ret = (cmpxchg(&inet6_protos[hash], prot, NULL) == prot) ? 0 : -1;
 
         synchronize_net();
 
         return ret;
 }
-
 EXPORT_SYMBOL(inet6_del_protocol);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e677937a07fc..45e6efb7f171 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -764,7 +764,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                         return -EINVAL;
 
                 if (sin6->sin6_family && sin6->sin6_family != AF_INET6)
-                        return(-EAFNOSUPPORT);
+                        return -EAFNOSUPPORT;
 
                 /* port is the proto value [0..255] carried in nexthdr */
                 proto = ntohs(sin6->sin6_port);
@@ -772,10 +772,10 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (!proto)
                         proto = inet->inet_num;
                 else if (proto != inet->inet_num)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (proto > 255)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 daddr = &sin6->sin6_addr;
                 if (np->sndflow) {
@@ -985,7 +985,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                         /* You may get strange result with a positive odd offset;
                            RFC2292bis agrees with me. */
                         if (val > 0 && (val&1))
-                                return(-EINVAL);
+                                return -EINVAL;
                         if (val < 0) {
                                 rp->checksum = 0;
                         } else {
@@ -997,7 +997,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 default:
-                        return(-ENOPROTOOPT);
+                        return -ENOPROTOOPT;
         }
 }
 
@@ -1190,7 +1190,7 @@ static int rawv6_init_sk(struct sock *sk)
         default:
                 break;
         }
-        return(0);
+        return 0;
 }
 
 struct proto rawv6_prot = {
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 64cfef1b0a4c..c7ba3149633f 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -458,7 +458,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d126365ac046..25b0beda4331 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -217,14 +217,14 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES &&
-                time_after(jiffies, rt->rt6i_expires));
+        return (rt->rt6i_flags & RTF_EXPIRES) &&
+                time_after(jiffies, rt->rt6i_expires);
 }
 
 static inline int rt6_need_strict(struct in6_addr *daddr)
 {
-        return (ipv6_addr_type(daddr) &
-                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK));
+        return ipv6_addr_type(daddr) &
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
 
 /*
@@ -440,7 +440,7 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
                   __func__, match);
 
         net = dev_net(rt0->rt6i_dev);
-        return (match ? match : net->ipv6.ip6_null_entry);
+        return match ? match : net->ipv6.ip6_null_entry;
 }
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
@@ -859,7 +859,7 @@ int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl
 
         dst_release(*dstp);
         *dstp = new;
-        return (new ? 0 : -ENOMEM);
+        return new ? 0 : -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(ip6_dst_blackhole);
 
@@ -1070,7 +1070,7 @@ static int ip6_dst_gc(struct dst_ops *ops)
                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
 out:
         net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
-        return (atomic_read(&ops->entries) > rt_max_size);
+        return atomic_read(&ops->entries) > rt_max_size;
 }
 
 /* Clean host part of a prefix. Not necessary in radix tree,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 4699cd3c3118..8a0399822230 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -68,19 +68,18 @@ static void ipip6_tunnel_setup(struct net_device *dev);
 
 static int sit_net_id __read_mostly;
 struct sit_net {
-        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_r[HASH_SIZE];
-        struct ip_tunnel *tunnels_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_wc[1];
-        struct ip_tunnel **tunnels[4];
+        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_wc[1];
+        struct ip_tunnel __rcu **tunnels[4];
 
         struct net_device *fb_tunnel_dev;
 };
 
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ipip6_lock);
 
 #define for_each_ip_tunnel_rcu(start) \
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
@@ -91,8 +90,8 @@ static DEFINE_SPINLOCK(ipip6_lock);
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
@@ -121,12 +120,12 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
         return NULL;
 }
 
-static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
+static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        unsigned h = 0;
+        unsigned int h = 0;
         int prio = 0;
 
         if (remote) {
@@ -140,7 +139,7 @@ static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
         return &sitn->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
+static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
                 struct ip_tunnel *t)
 {
         return __ipip6_bucket(sitn, &t->parms);
@@ -148,13 +147,14 @@ static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
 
 static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ipip6_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ipip6_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipip6_bucket(sitn, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -162,12 +162,10 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 
 static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipip6_bucket(sitn, t);
+        struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
 
-        spin_lock_bh(&ipip6_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ipip6_lock);
 }
 
 static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
@@ -187,17 +185,20 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 #endif
 }
 
-static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, **tp, *nt;
+        struct ip_tunnel *t, *nt;
+        struct ip_tunnel __rcu **tp;
         struct net_device *dev;
         char name[IFNAMSIZ];
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for (tp = __ipip6_bucket(sitn, parms); (t = *tp) != NULL; tp = &t->next) {
+        for (tp = __ipip6_bucket(sitn, parms);
+            (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     parms->link == t->parms.link) {
@@ -340,7 +341,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
 
         ASSERT_RTNL();
 
-        for (p = t->prl; p; p = p->next) {
+        for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
                 if (p->addr == a->addr) {
                         if (chg) {
                                 p->flags = a->flags;
@@ -451,15 +452,12 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                spin_lock_bh(&ipip6_lock);
-                sitn->tunnels_wc[0] = NULL;
-                spin_unlock_bh(&ipip6_lock);
-                dev_put(dev);
+                rcu_assign_pointer(sitn->tunnels_wc[0], NULL);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
                 ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
-                dev_put(dev);
         }
+        dev_put(dev);
 }
 
 
@@ -566,7 +564,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                 skb_tunnel_rx(skb, tunnel->dev);
 
                 ipip6_ecn_decapsulate(iph, skb);
-                netif_rx(skb);
+
+                if (netif_rx(skb) == NET_RX_DROP)
+                        tunnel->dev->stats.rx_dropped++;
+
                 rcu_read_unlock();
                 return 0;
         }
@@ -590,7 +591,7 @@ __be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 #ifdef CONFIG_IPV6_SIT_6RD
         if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
                               tunnel->ip6rd.prefixlen)) {
-                unsigned pbw0, pbi0;
+                unsigned int pbw0, pbi0;
                 int pbi1;
                 u32 d;
 
@@ -1132,7 +1133,7 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         sitn->tunnels_wc[0]     = tunnel;
 }
 
-static struct xfrm_tunnel sit_handler = {
+static struct xfrm_tunnel sit_handler __read_mostly = {
         .handler        =       ipip6_rcv,
         .err_handler    =       ipip6_err,
         .priority       =       1,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index fe6d40418c0b..8d93f6d81979 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -139,7 +139,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 return -EINVAL;
 
         if (usin->sin6_family != AF_INET6)
-                return(-EAFNOSUPPORT);
+                return -EAFNOSUPPORT;
 
         memset(&fl, 0, sizeof(fl));
 
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index fc3c86a47452..d9864725d0c6 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -30,8 +30,8 @@
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm6_tunnel *tunnel6_handlers;
-static struct xfrm6_tunnel *tunnel46_handlers;
+static struct xfrm6_tunnel *tunnel6_handlers __read_mostly;
+static struct xfrm6_tunnel *tunnel46_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel6_mutex);
 
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
@@ -51,7 +51,7 @@ int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
         }
 
         handler->next = *pprev;
-        *pprev = handler;
+        rcu_assign_pointer(*pprev, handler);
 
         ret = 0;
 
@@ -88,6 +88,11 @@ int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 
 EXPORT_SYMBOL(xfrm6_tunnel_deregister);
 
+#define for_each_tunnel_rcu(head, handler)              \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+
 static int tunnel6_rcv(struct sk_buff *skb)
 {
         struct xfrm6_tunnel *handler;
@@ -95,7 +100,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto drop;
 
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -113,7 +118,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto drop;
 
-        for (handler = tunnel46_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel46_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -129,7 +134,7 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct xfrm6_tunnel *handler;
 
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                 if (!handler->err_handler(skb, opt, type, code, offset, info))
                         break;
 }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6baeabbbca82..39676eac3a37 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -199,7 +199,7 @@ static inline int xfrm6_garbage_collect(struct dst_ops *ops)
         struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
 
         xfrm6_policy_afinfo.garbage_collect(net);
-        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
+        return atomic_read(&ops->entries) > ops->gc_thresh * 2;
 }
 
 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 2ce3a8278f26..ac7584b946a5 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -317,13 +317,13 @@ static const struct xfrm_type xfrm6_tunnel_type = {
         .output         = xfrm6_tunnel_output,
 };
 
-static struct xfrm6_tunnel xfrm6_tunnel_handler = {
+static struct xfrm6_tunnel xfrm6_tunnel_handler __read_mostly = {
         .handler        = xfrm6_tunnel_rcv,
         .err_handler    = xfrm6_tunnel_err,
         .priority       = 2,
 };
 
-static struct xfrm6_tunnel xfrm46_tunnel_handler = {
+static struct xfrm6_tunnel xfrm46_tunnel_handler __read_mostly = {
         .handler        = xfrm6_tunnel_rcv,
         .err_handler    = xfrm6_tunnel_err,
         .priority       = 2,
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index fd55b5135de5..bf3635129b17 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -573,9 +573,9 @@ static int irda_find_lsap_sel(struct irda_sock *self, char *name)
                 /* Requested object/attribute doesn't exist */
                 if((self->errno == IAS_CLASS_UNKNOWN) ||
                    (self->errno == IAS_ATTRIB_UNKNOWN))
-                        return (-EADDRNOTAVAIL);
+                        return -EADDRNOTAVAIL;
                 else
-                        return (-EHOSTUNREACH);
+                        return -EHOSTUNREACH;
         }
 
         /* Get the remote TSAP selector */
@@ -663,7 +663,7 @@ static int irda_discover_daddr_and_lsap_sel(struct irda_sock *self, char *name)
                                            __func__, name);
                                 self->daddr = DEV_ADDR_ANY;
                                 kfree(discoveries);
-                                return(-ENOTUNIQ);
+                                return -ENOTUNIQ;
                         }
                         /* First time we found that one, save it ! */
                         daddr = self->daddr;
@@ -677,7 +677,7 @@ static int irda_discover_daddr_and_lsap_sel(struct irda_sock *self, char *name)
                         IRDA_DEBUG(0, "%s(), unexpected IAS query failure\n", __func__);
                         self->daddr = DEV_ADDR_ANY;
                         kfree(discoveries);
-                        return(-EHOSTUNREACH);
+                        return -EHOSTUNREACH;
                         break;
                 }
         }
@@ -689,7 +689,7 @@ static int irda_discover_daddr_and_lsap_sel(struct irda_sock *self, char *name)
                 IRDA_DEBUG(1, "%s(), cannot discover service ''%s'' in any device !!!\n",
                            __func__, name);
                 self->daddr = DEV_ADDR_ANY;
-                return(-EADDRNOTAVAIL);
+                return -EADDRNOTAVAIL;
         }
 
         /* Revert back to discovered device & service */
@@ -2465,9 +2465,9 @@ bed:
                         /* Requested object/attribute doesn't exist */
                         if((self->errno == IAS_CLASS_UNKNOWN) ||
                            (self->errno == IAS_ATTRIB_UNKNOWN))
-                                return (-EADDRNOTAVAIL);
+                                return -EADDRNOTAVAIL;
                         else
-                                return (-EHOSTUNREACH);
+                                return -EHOSTUNREACH;
                 }
 
                 /* Translate from internal to user structure */
diff --git a/net/irda/discovery.c b/net/irda/discovery.c
index c1c8ae939126..36c3f037f172 100644
--- a/net/irda/discovery.c
+++ b/net/irda/discovery.c
@@ -315,7 +315,7 @@ struct irda_device_info *irlmp_copy_discoveries(hashbin_t *log, int *pn,
 
         /* Get the actual number of device in the buffer and return */
         *pn = i;
-        return(buffer);
+        return buffer;
 }
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index faa82ca2dfdc..a39cca8331df 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -449,8 +449,8 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
                 }
 
 #ifdef SERIAL_DO_RESTART
-                return ((self->flags & ASYNC_HUP_NOTIFY) ?
-                        -EAGAIN : -ERESTARTSYS);
+                return (self->flags & ASYNC_HUP_NOTIFY) ?
+                        -EAGAIN : -ERESTARTSYS;
 #else
                 return -EAGAIN;
 #endif
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 5bb8353105cc..8ee1ff6c742f 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -45,13 +45,11 @@ static int  irlan_eth_close(struct net_device *dev);
 static netdev_tx_t  irlan_eth_xmit(struct sk_buff *skb,
                                          struct net_device *dev);
 static void irlan_eth_set_multicast_list( struct net_device *dev);
-static struct net_device_stats *irlan_eth_get_stats(struct net_device *dev);
 
 static const struct net_device_ops irlan_eth_netdev_ops = {
         .ndo_open               = irlan_eth_open,
         .ndo_stop               = irlan_eth_close,
         .ndo_start_xmit         = irlan_eth_xmit,
-        .ndo_get_stats          = irlan_eth_get_stats,
         .ndo_set_multicast_list = irlan_eth_set_multicast_list,
         .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
@@ -208,10 +206,10 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
                  * tried :-) DB
                  */
                 /* irttp_data_request already free the packet */
-                self->stats.tx_dropped++;
+                dev->stats.tx_dropped++;
         } else {
-                self->stats.tx_packets++;
-                self->stats.tx_bytes += len;
+                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += len;
         }
 
         return NETDEV_TX_OK;
@@ -226,15 +224,16 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
 int irlan_eth_receive(void *instance, void *sap, struct sk_buff *skb)
 {
         struct irlan_cb *self = instance;
+        struct net_device *dev = self->dev;
 
         if (skb == NULL) {
-                ++self->stats.rx_dropped;
+                dev->stats.rx_dropped++;
                 return 0;
         }
         if (skb->len < ETH_HLEN) {
                 IRDA_DEBUG(0, "%s() : IrLAN frame too short (%d)\n",
                            __func__, skb->len);
-                ++self->stats.rx_dropped;
+                dev->stats.rx_dropped++;
                 dev_kfree_skb(skb);
                 return 0;
         }
@@ -244,10 +243,10 @@ int irlan_eth_receive(void *instance, void *sap, struct sk_buff *skb)
          * might have been previously set by the low level IrDA network
          * device driver
          */
-        skb->protocol = eth_type_trans(skb, self->dev); /* Remove eth header */
+        skb->protocol = eth_type_trans(skb, dev); /* Remove eth header */
 
-        self->stats.rx_packets++;
-        self->stats.rx_bytes += skb->len;
+        dev->stats.rx_packets++;
+        dev->stats.rx_bytes += skb->len;
 
         netif_rx(skb);   /* Eat it! */
 
@@ -348,16 +347,3 @@ static void irlan_eth_set_multicast_list(struct net_device *dev)
         else
                 irlan_set_broadcast_filter(self, FALSE);
 }
-
-/*
- * Function irlan_get_stats (dev)
- *
- *    Get the current statistics for this device
- *
- */
-static struct net_device_stats *irlan_eth_get_stats(struct net_device *dev)
-{
-        struct irlan_cb *self = netdev_priv(dev);
-
-        return &self->stats;
-}
diff --git a/net/irda/irlan/irlan_event.c b/net/irda/irlan/irlan_event.c
index cbcb4eb54037..43f16040a6fe 100644
--- a/net/irda/irlan/irlan_event.c
+++ b/net/irda/irlan/irlan_event.c
@@ -24,7 +24,7 @@
 
 #include <net/irda/irlan_event.h>
 
-char *irlan_state[] = {
+const char * const irlan_state[] = {
         "IRLAN_IDLE",
         "IRLAN_QUERY",
         "IRLAN_CONN",
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 0e7d8bde145d..6115a44c0a24 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -939,7 +939,7 @@ struct irda_device_info *irlmp_get_discoveries(int *pn, __u16 mask, int nslots)
         }
 
         /* Return current cached discovery log */
-        return(irlmp_copy_discoveries(irlmp->cachelog, pn, mask, TRUE));
+        return irlmp_copy_discoveries(irlmp->cachelog, pn, mask, TRUE);
 }
 EXPORT_SYMBOL(irlmp_get_discoveries);
 
diff --git a/net/irda/irlmp_frame.c b/net/irda/irlmp_frame.c
index 3750884094da..062e63b1c5c4 100644
--- a/net/irda/irlmp_frame.c
+++ b/net/irda/irlmp_frame.c
@@ -448,7 +448,7 @@ static struct lsap_cb *irlmp_find_lsap(struct lap_cb *self, __u8 dlsap_sel,
             (self->cache.slsap_sel == slsap_sel) &&
             (self->cache.dlsap_sel == dlsap_sel))
         {
-                return (self->cache.lsap);
+                return self->cache.lsap;
         }
 #endif
 
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index e98e40d76f4f..7f17a8020e8a 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -238,7 +238,7 @@ irnet_ias_to_tsap(irnet_socket *	self,
   DEXIT(IRDA_SR_TRACE, "\n");
 
   /* Return the TSAP */
-  return(dtsap_sel);
+  return dtsap_sel;
 }
 
 /*------------------------------------------------------------------*/
@@ -301,7 +301,7 @@ irnet_connect_tsap(irnet_socket *	self)
     {
       clear_bit(0, &self->ttp_connect);
       DERROR(IRDA_SR_ERROR, "connect aborted!\n");
-      return(err);
+      return err;
     }
 
   /* Connect to remote device */
@@ -312,7 +312,7 @@ irnet_connect_tsap(irnet_socket *	self)
     {
       clear_bit(0, &self->ttp_connect);
       DERROR(IRDA_SR_ERROR, "connect aborted!\n");
-      return(err);
+      return err;
     }
 
   /* The above call is non-blocking.
@@ -321,7 +321,7 @@ irnet_connect_tsap(irnet_socket *	self)
    * See you there ;-) */
 
   DEXIT(IRDA_SR_TRACE, "\n");
-  return(err);
+  return err;
 }
 
 /*------------------------------------------------------------------*/
@@ -362,10 +362,10 @@ irnet_discover_next_daddr(irnet_socket *	self)
       /* The above request is non-blocking.
        * After a while, IrDA will call us back in irnet_discovervalue_confirm()
        * We will then call irnet_ias_to_tsap() and come back here again... */
-      return(0);
+      return 0;
     }
   else
-    return(1);
+    return 1;
 }
 
 /*------------------------------------------------------------------*/
@@ -436,7 +436,7 @@ irnet_discover_daddr_and_lsap_sel(irnet_socket *	self)
   /* Follow me in irnet_discovervalue_confirm() */
 
   DEXIT(IRDA_SR_TRACE, "\n");
-  return(0);
+  return 0;
 }
 
 /*------------------------------------------------------------------*/
@@ -485,7 +485,7 @@ irnet_dname_to_daddr(irnet_socket *	self)
   /* No luck ! */
   DEBUG(IRDA_SR_INFO, "cannot discover device ``%s'' !!!\n", self->rname);
   kfree(discoveries);
-  return(-EADDRNOTAVAIL);
+  return -EADDRNOTAVAIL;
 }
 
 
@@ -527,7 +527,7 @@ irda_irnet_create(irnet_socket *	self)
   INIT_WORK(&self->disconnect_work, irnet_ppp_disconnect);
 
   DEXIT(IRDA_SOCK_TRACE, "\n");
-  return(0);
+  return 0;
 }
 
 /*------------------------------------------------------------------*/
@@ -601,7 +601,7 @@ irda_irnet_connect(irnet_socket *	self)
    * We will finish the connection procedure in irnet_connect_tsap().
    */
   DEXIT(IRDA_SOCK_TRACE, "\n");
-  return(0);
+  return 0;
 }
 
 /*------------------------------------------------------------------*/
@@ -733,7 +733,7 @@ irnet_daddr_to_dname(irnet_socket *	self)
   /* No luck ! */
   DEXIT(IRDA_SERV_INFO, ": cannot discover device 0x%08x !!!\n", self->daddr);
   kfree(discoveries);
-  return(-EADDRNOTAVAIL);
+  return -EADDRNOTAVAIL;
 }
 
 /*------------------------------------------------------------------*/
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index dfe7b38dd4af..69f1fa64994e 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -166,7 +166,7 @@ irnet_ctrl_write(irnet_socket *	ap,
     }
 
   /* Success : we have parsed all commands successfully */
-  return(count);
+  return count;
 }
 
 #ifdef INITIAL_DISCOVERY
@@ -300,7 +300,7 @@ irnet_ctrl_read(irnet_socket *	ap,
         }
 
       DEXIT(CTRL_TRACE, "\n");
-      return(strlen(event));
+      return strlen(event);
     }
 #endif /* INITIAL_DISCOVERY */
 
@@ -409,7 +409,7 @@ irnet_ctrl_read(irnet_socket *	ap,
     }
 
   DEXIT(CTRL_TRACE, "\n");
-  return(strlen(event));
+  return strlen(event);
 }
 
 /*------------------------------------------------------------------*/
@@ -623,7 +623,7 @@ dev_irnet_poll(struct file *	file,
     mask |= irnet_ctrl_poll(ap, file, wait);
 
   DEXIT(FS_TRACE, " - mask=0x%X\n", mask);
-  return(mask);
+  return mask;
 }
 
 /*------------------------------------------------------------------*/
diff --git a/net/irda/irnet/irnet_ppp.h b/net/irda/irnet/irnet_ppp.h
index b5df2418f90c..940225866da0 100644
--- a/net/irda/irnet/irnet_ppp.h
+++ b/net/irda/irnet/irnet_ppp.h
@@ -103,7 +103,8 @@ static const struct file_operations irnet_device_fops =
         .poll           = dev_irnet_poll,
         .unlocked_ioctl = dev_irnet_ioctl,
         .open           = dev_irnet_open,
-        .release        = dev_irnet_close
+        .release        = dev_irnet_close,
+        .llseek         = noop_llseek,
   /* Also : llseek, readdir, mmap, flush, fsync, fasync, lock, readv, writev */
 };
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 43040e97c474..d87c22df6f1e 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -565,12 +565,12 @@ pfkey_proto2satype(uint16_t proto)
 
 static uint8_t pfkey_proto_to_xfrm(uint8_t proto)
 {
-        return (proto == IPSEC_PROTO_ANY ? 0 : proto);
+        return proto == IPSEC_PROTO_ANY ? 0 : proto;
 }
 
 static uint8_t pfkey_proto_from_xfrm(uint8_t proto)
 {
-        return (proto ? proto : IPSEC_PROTO_ANY);
+        return proto ? proto : IPSEC_PROTO_ANY;
 }
 
 static inline int pfkey_sockaddr_len(sa_family_t family)
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 1ae697681bc7..8d9ce0accc98 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -144,7 +144,6 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
         nf_reset(skb);
 
         if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) {
-                dev->last_rx = jiffies;
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += data_len;
         } else
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ff954b3e94b6..39a21d0c61c4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1768,7 +1768,7 @@ static const struct proto_ops pppol2tp_ops = {
         .ioctl          = pppox_ioctl,
 };
 
-static struct pppox_proto pppol2tp_proto = {
+static const struct pppox_proto pppol2tp_proto = {
         .create         = pppol2tp_create,
         .ioctl          = pppol2tp_ioctl
 };
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index a87cb3ba2df6..d2b03e0851ef 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -138,10 +138,8 @@ struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
         struct crypto_cipher *tfm;
 
         tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
-                return NULL;
-
-        crypto_cipher_setkey(tfm, key, ALG_CCMP_KEY_LEN);
+        if (!IS_ERR(tfm))
+                crypto_cipher_setkey(tfm, key, ALG_CCMP_KEY_LEN);
 
         return tfm;
 }
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
index 3d097b3d7b62..b4d66cca76d6 100644
--- a/net/mac80211/aes_cmac.c
+++ b/net/mac80211/aes_cmac.c
@@ -119,10 +119,8 @@ struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[])
         struct crypto_cipher *tfm;
 
         tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
-                return NULL;
-
-        crypto_cipher_setkey(tfm, key, AES_CMAC_KEY_LEN);
+        if (!IS_ERR(tfm))
+                crypto_cipher_setkey(tfm, key, AES_CMAC_KEY_LEN);
 
         return tfm;
 }
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 965b272499fd..58eab9e8e4ee 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -86,6 +86,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      tid, 0, reason);
 
         del_timer_sync(&tid_rx->session_timer);
+        del_timer_sync(&tid_rx->reorder_timer);
 
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
@@ -120,6 +121,20 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
 }
 
+static void sta_rx_agg_reorder_timer_expired(unsigned long data)
+{
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                        timer_to_tid[0]);
+
+        rcu_read_lock();
+        spin_lock(&sta->lock);
+        ieee80211_release_reorder_timeout(sta, *ptid);
+        spin_unlock(&sta->lock);
+        rcu_read_unlock();
+}
+
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
                                       u8 dialog_token, u16 status, u16 policy,
                                       u16 buf_size, u16 timeout)
@@ -251,11 +266,18 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end;
         }
 
+        spin_lock_init(&tid_agg_rx->reorder_lock);
+
         /* rx timer */
         tid_agg_rx->session_timer.function = sta_rx_agg_session_timer_expired;
         tid_agg_rx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&tid_agg_rx->session_timer);
 
+        /* rx reorder timer */
+        tid_agg_rx->reorder_timer.function = sta_rx_agg_reorder_timer_expired;
+        tid_agg_rx->reorder_timer.data = (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&tid_agg_rx->reorder_timer);
+
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
                 kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 29ac8e1a509e..c981604b71e6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -19,33 +19,6 @@
 #include "rate.h"
 #include "mesh.h"
 
-static bool nl80211_type_check(enum nl80211_iftype type)
-{
-        switch (type) {
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_MONITOR:
-#ifdef CONFIG_MAC80211_MESH
-        case NL80211_IFTYPE_MESH_POINT:
-#endif
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_WDS:
-                return true;
-        default:
-                return false;
-        }
-}
-
-static bool nl80211_params_check(enum nl80211_iftype type,
-                                 struct vif_params *params)
-{
-        if (!nl80211_type_check(type))
-                return false;
-
-        return true;
-}
-
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
                                enum nl80211_iftype type, u32 *flags,
                                struct vif_params *params)
@@ -55,9 +28,6 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        if (!nl80211_params_check(type, params))
-                return -EINVAL;
-
         err = ieee80211_if_add(local, name, &dev, type, params);
         if (err || type != NL80211_IFTYPE_MONITOR || !flags)
                 return err;
@@ -82,12 +52,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         int ret;
 
-        if (ieee80211_sdata_running(sdata))
-                return -EBUSY;
-
-        if (!nl80211_params_check(type, params))
-                return -EINVAL;
-
         ret = ieee80211_if_change_type(sdata, type);
         if (ret)
                 return ret;
@@ -114,44 +78,30 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, const u8 *mac_addr,
                              struct key_params *params)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sta_info *sta = NULL;
-        enum ieee80211_key_alg alg;
         struct ieee80211_key *key;
         int err;
 
-        if (!netif_running(dev))
+        if (!ieee80211_sdata_running(sdata))
                 return -ENETDOWN;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
+        /* reject WEP and TKIP keys if WEP failed to initialize */
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
-        case WLAN_CIPHER_SUITE_WEP104:
-                alg = ALG_WEP;
-                break;
         case WLAN_CIPHER_SUITE_TKIP:
-                alg = ALG_TKIP;
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                alg = ALG_CCMP;
-                break;
-        case WLAN_CIPHER_SUITE_AES_CMAC:
-                alg = ALG_AES_CMAC;
+        case WLAN_CIPHER_SUITE_WEP104:
+                if (IS_ERR(sdata->local->wep_tx_tfm))
+                        return -EINVAL;
                 break;
         default:
-                return -EINVAL;
+                break;
         }
 
-        /* reject WEP and TKIP keys if WEP failed to initialize */
-        if ((alg == ALG_WEP || alg == ALG_TKIP) &&
-            IS_ERR(sdata->local->wep_tx_tfm))
-                return -EINVAL;
-
-        key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key,
-                                  params->seq_len, params->seq);
-        if (!key)
-                return -ENOMEM;
+        key = ieee80211_key_alloc(params->cipher, key_idx, params->key_len,
+                                  params->key, params->seq_len, params->seq);
+        if (IS_ERR(key))
+                return PTR_ERR(key);
 
         mutex_lock(&sdata->local->sta_mtx);
 
@@ -164,9 +114,10 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 }
         }
 
-        ieee80211_key_link(key, sdata, sta);
+        err = ieee80211_key_link(key, sdata, sta);
+        if (err)
+                ieee80211_key_free(sdata->local, key);
 
-        err = 0;
  out_unlock:
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -247,10 +198,10 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
 
         memset(&params, 0, sizeof(params));
 
-        switch (key->conf.alg) {
-        case ALG_TKIP:
-                params.cipher = WLAN_CIPHER_SUITE_TKIP;
+        params.cipher = key->conf.cipher;
 
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
                 iv32 = key->u.tkip.tx.iv32;
                 iv16 = key->u.tkip.tx.iv16;
 
@@ -268,8 +219,7 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 params.seq = seq;
                 params.seq_len = 6;
                 break;
-        case ALG_CCMP:
-                params.cipher = WLAN_CIPHER_SUITE_CCMP;
+        case WLAN_CIPHER_SUITE_CCMP:
                 seq[0] = key->u.ccmp.tx_pn[5];
                 seq[1] = key->u.ccmp.tx_pn[4];
                 seq[2] = key->u.ccmp.tx_pn[3];
@@ -279,14 +229,7 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 params.seq = seq;
                 params.seq_len = 6;
                 break;
-        case ALG_WEP:
-                if (key->conf.keylen == 5)
-                        params.cipher = WLAN_CIPHER_SUITE_WEP40;
-                else
-                        params.cipher = WLAN_CIPHER_SUITE_WEP104;
-                break;
-        case ALG_AES_CMAC:
-                params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 seq[0] = key->u.aes_cmac.tx_pn[5];
                 seq[1] = key->u.aes_cmac.tx_pn[4];
                 seq[2] = key->u.aes_cmac.tx_pn[3];
@@ -634,6 +577,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                                  struct sta_info *sta,
                                  struct station_parameters *params)
 {
+        unsigned long flags;
         u32 rates;
         int i, j;
         struct ieee80211_supported_band *sband;
@@ -642,7 +586,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         sband = local->hw.wiphy->bands[local->oper_channel->band];
 
-        spin_lock_bh(&sta->lock);
+        spin_lock_irqsave(&sta->flaglock, flags);
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
 
@@ -669,7 +613,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
         }
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
          * cfg80211 validates this (1-2007) and allows setting the AID
@@ -1143,9 +1087,9 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         p.uapsd = false;
 
         if (drv_conf_tx(local, params->queue, &p)) {
-                printk(KERN_DEBUG "%s: failed to set TX queue "
-                       "parameters for queue %d\n",
-                       wiphy_name(local->hw.wiphy), params->queue);
+                wiphy_debug(local->hw.wiphy,
+                            "failed to set TX queue parameters for queue %d\n",
+                            params->queue);
                 return -EINVAL;
         }
 
@@ -1207,15 +1151,26 @@ static int ieee80211_scan(struct wiphy *wiphy,
                           struct net_device *dev,
                           struct cfg80211_scan_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
-            (sdata->vif.type != NL80211_IFTYPE_AP || sdata->u.ap.beacon))
+        switch (ieee80211_vif_type_p2p(&sdata->vif)) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                if (sdata->local->ops->hw_scan)
+                        break;
+                /* FIXME: implement NoA while scanning in software */
+                return -EOPNOTSUPP;
+        case NL80211_IFTYPE_AP:
+                if (sdata->u.ap.beacon)
+                        return -EOPNOTSUPP;
+                break;
+        default:
                 return -EOPNOTSUPP;
+        }
 
         return ieee80211_request_scan(sdata, req);
 }
@@ -1541,11 +1496,11 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
         return ieee80211_wk_cancel_remain_on_channel(sdata, cookie);
 }
 
-static int ieee80211_action(struct wiphy *wiphy, struct net_device *dev,
-                            struct ieee80211_channel *chan,
-                            enum nl80211_channel_type channel_type,
-                            bool channel_type_valid,
-                            const u8 *buf, size_t len, u64 *cookie)
+static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
+                             struct ieee80211_channel *chan,
+                             enum nl80211_channel_type channel_type,
+                             bool channel_type_valid,
+                             const u8 *buf, size_t len, u64 *cookie)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1575,8 +1530,6 @@ static int ieee80211_action(struct wiphy *wiphy, struct net_device *dev,
                         return -ENOLINK;
                 break;
         case NL80211_IFTYPE_STATION:
-                if (!(sdata->u.mgd.flags & IEEE80211_STA_MFP_ENABLED))
-                        flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -1647,6 +1600,6 @@ struct cfg80211_ops mac80211_config_ops = {
         .set_bitrate_mask = ieee80211_set_bitrate_mask,
         .remain_on_channel = ieee80211_remain_on_channel,
         .cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
-        .action = ieee80211_action,
+        .mgmt_tx = ieee80211_mgmt_tx,
         .set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 32be11e4c4d9..5b24740fc0b0 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -11,7 +11,7 @@ __ieee80211_get_channel_mode(struct ieee80211_local *local,
 {
         struct ieee80211_sub_if_data *sdata;
 
-        WARN_ON(!mutex_is_locked(&local->iflist_mtx));
+        lockdep_assert_held(&local->iflist_mtx);
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata == ignore)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index a694c593ff6a..e81ef4e8cb32 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -85,13 +85,15 @@ static ssize_t tsf_write(struct file *file,
         if (strncmp(buf, "reset", 5) == 0) {
                 if (local->ops->reset_tsf) {
                         drv_reset_tsf(local);
-                        printk(KERN_INFO "%s: debugfs reset TSF\n", wiphy_name(local->hw.wiphy));
+                        wiphy_info(local->hw.wiphy, "debugfs reset TSF\n");
                 }
         } else {
                 tsf = simple_strtoul(buf, NULL, 0);
                 if (local->ops->set_tsf) {
                         drv_set_tsf(local, tsf);
-                        printk(KERN_INFO "%s: debugfs set TSF to %#018llx\n", wiphy_name(local->hw.wiphy), tsf);
+                        wiphy_info(local->hw.wiphy,
+                                   "debugfs set TSF to %#018llx\n", tsf);
+
                 }
         }
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index fa5e76e658ef..1647f8dc5cda 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -64,26 +64,13 @@ static ssize_t key_algorithm_read(struct file *file,
                                   char __user *userbuf,
                                   size_t count, loff_t *ppos)
 {
-        char *alg;
+        char buf[15];
         struct ieee80211_key *key = file->private_data;
+        u32 c = key->conf.cipher;
 
-        switch (key->conf.alg) {
-        case ALG_WEP:
-                alg = "WEP\n";
-                break;
-        case ALG_TKIP:
-                alg = "TKIP\n";
-                break;
-        case ALG_CCMP:
-                alg = "CCMP\n";
-                break;
-        case ALG_AES_CMAC:
-                alg = "AES-128-CMAC\n";
-                break;
-        default:
-                return 0;
-        }
-        return simple_read_from_buffer(userbuf, count, ppos, alg, strlen(alg));
+        sprintf(buf, "%.2x-%.2x-%.2x:%d\n",
+                c >> 24, (c >> 16) & 0xff, (c >> 8) & 0xff, c & 0xff);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, strlen(buf));
 }
 KEY_OPS(algorithm);
 
@@ -95,21 +82,22 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
         int len;
         struct ieee80211_key *key = file->private_data;
 
-        switch (key->conf.alg) {
-        case ALG_WEP:
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 len = scnprintf(buf, sizeof(buf), "\n");
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 len = scnprintf(buf, sizeof(buf), "%08x %04x\n",
                                 key->u.tkip.tx.iv32,
                                 key->u.tkip.tx.iv16);
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 tpn = key->u.ccmp.tx_pn;
                 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
                                 tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], tpn[5]);
                 break;
-        case ALG_AES_CMAC:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 tpn = key->u.aes_cmac.tx_pn;
                 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
                                 tpn[0], tpn[1], tpn[2], tpn[3], tpn[4],
@@ -130,11 +118,12 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
         int i, len;
         const u8 *rpn;
 
-        switch (key->conf.alg) {
-        case ALG_WEP:
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 len = scnprintf(buf, sizeof(buf), "\n");
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
                         p += scnprintf(p, sizeof(buf)+buf-p,
                                        "%08x %04x\n",
@@ -142,7 +131,7 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                                        key->u.tkip.rx[i].iv16);
                 len = p - buf;
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 for (i = 0; i < NUM_RX_DATA_QUEUES + 1; i++) {
                         rpn = key->u.ccmp.rx_pn[i];
                         p += scnprintf(p, sizeof(buf)+buf-p,
@@ -152,7 +141,7 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 }
                 len = p - buf;
                 break;
-        case ALG_AES_CMAC:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 rpn = key->u.aes_cmac.rx_pn;
                 p += scnprintf(p, sizeof(buf)+buf-p,
                                "%02x%02x%02x%02x%02x%02x\n",
@@ -174,11 +163,11 @@ static ssize_t key_replays_read(struct file *file, char __user *userbuf,
         char buf[20];
         int len;
 
-        switch (key->conf.alg) {
-        case ALG_CCMP:
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_CCMP:
                 len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
                 break;
-        case ALG_AES_CMAC:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 len = scnprintf(buf, sizeof(buf), "%u\n",
                                 key->u.aes_cmac.replays);
                 break;
@@ -196,8 +185,8 @@ static ssize_t key_icverrors_read(struct file *file, char __user *userbuf,
         char buf[20];
         int len;
 
-        switch (key->conf.alg) {
-        case ALG_AES_CMAC:
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 len = scnprintf(buf, sizeof(buf), "%u\n",
                                 key->u.aes_cmac.icverrors);
                 break;
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 14123dce544b..16983825f8e8 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -54,6 +54,20 @@ static inline int drv_add_interface(struct ieee80211_local *local,
         return ret;
 }
 
+static inline int drv_change_interface(struct ieee80211_local *local,
+                                       struct ieee80211_sub_if_data *sdata,
+                                       enum nl80211_iftype type, bool p2p)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_change_interface(local, sdata, type, p2p);
+        ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
 static inline void drv_remove_interface(struct ieee80211_local *local,
                                         struct ieee80211_vif *vif)
 {
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 5d5d2a974668..6831fb1641c8 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -25,12 +25,14 @@ static inline void trace_ ## name(proto) {}
 #define STA_PR_FMT      " sta:%pM"
 #define STA_PR_ARG      __entry->sta_addr
 
-#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, sdata) \
+#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, sdata)   \
+                        __field(bool, p2p)                                              \
                         __string(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
-#define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata; \
+#define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata;    \
+                        __entry->p2p = sdata->vif.p2p;                                  \
                         __assign_str(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
-#define VIF_PR_FMT      " vif:%s(%d)"
-#define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type
+#define VIF_PR_FMT      " vif:%s(%d%s)"
+#define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type, __entry->p2p ? "/p2p" : ""
 
 /*
  * Tracing for driver callbacks.
@@ -136,6 +138,34 @@ TRACE_EVENT(drv_add_interface,
         )
 );
 
+TRACE_EVENT(drv_change_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 enum nl80211_iftype type, bool p2p),
+
+        TP_ARGS(local, sdata, type, p2p),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(u32, new_type)
+                __field(bool, new_p2p)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->new_type = type;
+                __entry->new_p2p = p2p;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " new type:%d%s",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->new_type,
+                __entry->new_p2p ? "/p2p" : ""
+        )
+);
+
 TRACE_EVENT(drv_remove_interface,
         TP_PROTO(struct ieee80211_local *local, struct ieee80211_sub_if_data *sdata),
 
@@ -336,7 +366,7 @@ TRACE_EVENT(drv_set_key,
                 LOCAL_ENTRY
                 VIF_ENTRY
                 STA_ENTRY
-                __field(enum ieee80211_key_alg, alg)
+                __field(u32, cipher)
                 __field(u8, hw_key_idx)
                 __field(u8, flags)
                 __field(s8, keyidx)
@@ -346,7 +376,7 @@ TRACE_EVENT(drv_set_key,
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
                 STA_ASSIGN;
-                __entry->alg = key->alg;
+                __entry->cipher = key->cipher;
                 __entry->flags = key->flags;
                 __entry->keyidx = key->keyidx;
                 __entry->hw_key_idx = key->hw_key_idx;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 9d101fb33861..11f74f5f7b2f 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -265,3 +265,31 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
 
         return 0;
 }
+
+void ieee80211_request_smps_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.request_smps_work);
+
+        mutex_lock(&sdata->u.mgd.mtx);
+        __ieee80211_request_smps(sdata, sdata->u.mgd.driver_smps_mode);
+        mutex_unlock(&sdata->u.mgd.mtx);
+}
+
+void ieee80211_request_smps(struct ieee80211_vif *vif,
+                            enum ieee80211_smps_mode smps_mode)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
+                smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+        ieee80211_queue_work(&sdata->local->hw,
+                             &sdata->u.mgd.request_smps_work);
+}
+/* this might change ... don't want non-open drivers using it */
+EXPORT_SYMBOL_GPL(ieee80211_request_smps);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index c691780725a7..1a3aae54f0cf 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -427,8 +427,8 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), addr, sdata->name);
+        wiphy_debug(local->hw.wiphy, "Adding new IBSS station %pM (dev=%s)\n",
+                    addr, sdata->name);
 #endif
 
         sta = sta_info_alloc(sdata, addr, gfp);
@@ -920,12 +920,14 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
         sdata->u.ibss.ssid_len = params->ssid_len;
 
+        mutex_unlock(&sdata->u.ibss.mtx);
+
+        mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&sdata->local->mtx);
 
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 
-        mutex_unlock(&sdata->u.ibss.mtx);
-
         return 0;
 }
 
@@ -980,7 +982,9 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         mutex_unlock(&sdata->u.ibss.mtx);
 
+        mutex_lock(&local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&local->mtx);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 65e0ed6c2975..9346a6b0f400 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -50,12 +50,6 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
-/*
- * Time after which we ignore scan results and no longer report/use
- * them in any way.
- */
-#define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
-
 #define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
 
 #define IEEE80211_DEFAULT_UAPSD_QUEUES \
@@ -170,6 +164,7 @@ typedef unsigned __bitwise__ ieee80211_rx_result;
 #define IEEE80211_RX_RA_MATCH           BIT(1)
 #define IEEE80211_RX_AMSDU              BIT(2)
 #define IEEE80211_RX_FRAGMENTED         BIT(3)
+#define IEEE80211_MALFORMED_ACTION_FRM  BIT(4)
 /* only add flags here that do not change with subframes of an aMPDU */
 
 struct ieee80211_rx_data {
@@ -343,7 +338,10 @@ struct ieee80211_if_managed {
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
-                                 ap_smps; /* smps mode AP thinks we're in */
+                                 ap_smps, /* smps mode AP thinks we're in */
+                                 driver_smps_mode; /* smps mode request */
+
+        struct work_struct request_smps_work;
 
         unsigned int flags;
 
@@ -371,6 +369,13 @@ struct ieee80211_if_managed {
         int ave_beacon_signal;
 
         /*
+         * Number of Beacon frames used in ave_beacon_signal. This can be used
+         * to avoid generating less reliable cqm events that would be based
+         * only on couple of received frames.
+         */
+        unsigned int count_beacon_signal;
+
+        /*
          * Last Beacon frame signal strength average (ave_beacon_signal / 16)
          * that triggered a cqm event. 0 indicates that no event has been
          * generated for the current association.
@@ -474,6 +479,19 @@ enum ieee80211_sub_if_data_flags {
         IEEE80211_SDATA_DONT_BRIDGE_PACKETS     = BIT(3),
 };
 
+/**
+ * enum ieee80211_sdata_state_bits - virtual interface state bits
+ * @SDATA_STATE_RUNNING: virtual interface is up & running; this
+ *      mirrors netif_running() but is separate for interface type
+ *      change handling while the interface is up
+ * @SDATA_STATE_OFFCHANNEL: This interface is currently in offchannel
+ *      mode, so queues are stopped
+ */
+enum ieee80211_sdata_state_bits {
+        SDATA_STATE_RUNNING,
+        SDATA_STATE_OFFCHANNEL,
+};
+
 struct ieee80211_sub_if_data {
         struct list_head list;
 
@@ -487,6 +505,8 @@ struct ieee80211_sub_if_data {
 
         unsigned int flags;
 
+        unsigned long state;
+
         int drop_unencrypted;
 
         char name[IFNAMSIZ];
@@ -497,6 +517,9 @@ struct ieee80211_sub_if_data {
          */
         bool ht_opmode_valid;
 
+        /* to detect idle changes */
+        bool old_idle;
+
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -508,6 +531,8 @@ struct ieee80211_sub_if_data {
         struct ieee80211_key *default_mgmt_key;
 
         u16 sequence_number;
+        __be16 control_port_protocol;
+        bool control_port_no_encrypt;
 
         struct work_struct work;
         struct sk_buff_head skb_queue;
@@ -595,11 +620,17 @@ enum queue_stop_reason {
  *      determine if we are on the operating channel or not
  * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
  *      gets only set in conjunction with SCAN_SW_SCANNING
+ * @SCAN_COMPLETED: Set for our scan work function when the driver reported
+ *      that the scan completed.
+ * @SCAN_ABORTED: Set for our scan work function when the driver reported
+ *      a scan complete for an aborted scan.
  */
 enum {
         SCAN_SW_SCANNING,
         SCAN_HW_SCANNING,
         SCAN_OFF_CHANNEL,
+        SCAN_COMPLETED,
+        SCAN_ABORTED,
 };
 
 /**
@@ -634,7 +665,6 @@ struct ieee80211_local {
         /*
          * work stuff, potentially off-channel (in the future)
          */
-        struct mutex work_mtx;
         struct list_head work_list;
         struct timer_list work_timer;
         struct work_struct work_work;
@@ -656,6 +686,8 @@ struct ieee80211_local {
         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
         unsigned int filter_flags; /* FIF_* */
 
+        bool wiphy_ciphers_allocated;
+
         /* protects the aggregated multicast list and filter calls */
         spinlock_t filter_lock;
 
@@ -746,9 +778,10 @@ struct ieee80211_local {
          */
         struct mutex key_mtx;
 
+        /* mutex for scan and work locking */
+        struct mutex mtx;
 
         /* Scanning and BSS list */
-        struct mutex scan_mtx;
         unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request *int_scan_req;
@@ -870,6 +903,11 @@ struct ieee80211_local {
                 struct dentry *keys;
         } debugfs;
 #endif
+
+        /* dummy netdev for use w/ NAPI */
+        struct net_device napi_dev;
+
+        struct napi_struct napi;
 };
 
 static inline struct ieee80211_sub_if_data *
@@ -1003,6 +1041,8 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
+void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1071,7 +1111,7 @@ void ieee80211_recalc_idle(struct ieee80211_local *local);
 
 static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
 {
-        return netif_running(sdata->dev);
+        return test_bit(SDATA_STATE_RUNNING, &sdata->state);
 }
 
 /* tx handling */
@@ -1105,6 +1145,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
 int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
                                enum ieee80211_smps_mode smps, const u8 *da,
                                const u8 *bssid);
+void ieee80211_request_smps_work(struct work_struct *work);
 
 void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      u16 initiator, u16 reason);
@@ -1131,6 +1172,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
 void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
+void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
 
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
@@ -1146,6 +1188,12 @@ int __ieee80211_suspend(struct ieee80211_hw *hw);
 
 static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 {
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
+                "%s: resume with hardware scan still in progress\n",
+                wiphy_name(hw->wiphy));
+
         return ieee80211_reconfig(hw_to_local(hw));
 }
 #else
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ebbe264e2b0b..66785739dad3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -94,21 +94,14 @@ static inline int identical_mac_addr_allowed(int type1, int type2)
                          type2 == NL80211_IFTYPE_AP_VLAN));
 }
 
-static int ieee80211_open(struct net_device *dev)
+static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
+                                            enum nl80211_iftype iftype)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_sub_if_data *nsdata;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        u32 changed = 0;
-        int res;
-        u32 hw_reconf_flags = 0;
-        u8 null_addr[ETH_ALEN] = {0};
+        struct ieee80211_sub_if_data *nsdata;
+        struct net_device *dev = sdata->dev;
 
-        /* fail early if user set an invalid address */
-        if (compare_ether_addr(dev->dev_addr, null_addr) &&
-            !is_valid_ether_addr(dev->dev_addr))
-                return -EADDRNOTAVAIL;
+        ASSERT_RTNL();
 
         /* we hold the RTNL here so can safely walk the list */
         list_for_each_entry(nsdata, &local->interfaces, list) {
@@ -125,7 +118,7 @@ static int ieee80211_open(struct net_device *dev)
                          * belonging to the same hardware. Then, however, we're
                          * faced with having to adopt two different TSF timers...
                          */
-                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                        if (iftype == NL80211_IFTYPE_ADHOC &&
                             nsdata->vif.type == NL80211_IFTYPE_ADHOC)
                                 return -EBUSY;
 
@@ -139,19 +132,36 @@ static int ieee80211_open(struct net_device *dev)
                         /*
                          * check whether it may have the same address
                          */
-                        if (!identical_mac_addr_allowed(sdata->vif.type,
+                        if (!identical_mac_addr_allowed(iftype,
                                                         nsdata->vif.type))
                                 return -ENOTUNIQ;
 
                         /*
                          * can only add VLANs to enabled APs
                          */
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                        if (iftype == NL80211_IFTYPE_AP_VLAN &&
                             nsdata->vif.type == NL80211_IFTYPE_AP)
                                 sdata->bss = &nsdata->u.ap;
                 }
         }
 
+        return 0;
+}
+
+/*
+ * NOTE: Be very careful when changing this function, it must NOT return
+ * an error on interface type changes that have been pre-checked, so most
+ * checks should be in ieee80211_check_concurrent_iface.
+ */
+static int ieee80211_do_open(struct net_device *dev, bool coming_up)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        u32 changed = 0;
+        int res;
+        u32 hw_reconf_flags = 0;
+
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_WDS:
                 if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
@@ -177,7 +187,9 @@ static int ieee80211_open(struct net_device *dev)
                 /* no special treatment */
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
-        case __NL80211_IFTYPE_AFTER_LAST:
+        case NUM_NL80211_IFTYPES:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
                 /* cannot happen */
                 WARN_ON(1);
                 break;
@@ -187,39 +199,30 @@ static int ieee80211_open(struct net_device *dev)
                 res = drv_start(local);
                 if (res)
                         goto err_del_bss;
+                if (local->ops->napi_poll)
+                        napi_enable(&local->napi);
                 /* we're brought up, everything changes */
                 hw_reconf_flags = ~0;
                 ieee80211_led_radio(local, true);
         }
 
         /*
-         * Check all interfaces and copy the hopefully now-present
-         * MAC address to those that have the special null one.
+         * Copy the hopefully now-present MAC address to
+         * this interface, if it has the special null one.
          */
-        list_for_each_entry(nsdata, &local->interfaces, list) {
-                struct net_device *ndev = nsdata->dev;
-
-                /*
-                 * No need to check running since we do not allow
-                 * it to start up with this invalid address.
-                 */
-                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0) {
-                        memcpy(ndev->dev_addr,
-                               local->hw.wiphy->perm_addr,
-                               ETH_ALEN);
-                        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
+        if (is_zero_ether_addr(dev->dev_addr)) {
+                memcpy(dev->dev_addr,
+                       local->hw.wiphy->perm_addr,
+                       ETH_ALEN);
+                memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
+
+                if (!is_valid_ether_addr(dev->dev_addr)) {
+                        if (!local->open_count)
+                                drv_stop(local);
+                        return -EADDRNOTAVAIL;
                 }
         }
 
-        /*
-         * Validate the MAC address for this device.
-         */
-        if (!is_valid_ether_addr(dev->dev_addr)) {
-                if (!local->open_count)
-                        drv_stop(local);
-                return -EADDRNOTAVAIL;
-        }
-
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
                 /* no need to tell driver */
@@ -253,9 +256,11 @@ static int ieee80211_open(struct net_device *dev)
                 netif_carrier_on(dev);
                 break;
         default:
-                res = drv_add_interface(local, &sdata->vif);
-                if (res)
-                        goto err_stop;
+                if (coming_up) {
+                        res = drv_add_interface(local, &sdata->vif);
+                        if (res)
+                                goto err_stop;
+                }
 
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
                         local->fif_other_bss++;
@@ -277,6 +282,8 @@ static int ieee80211_open(struct net_device *dev)
                         netif_carrier_on(dev);
         }
 
+        set_bit(SDATA_STATE_RUNNING, &sdata->state);
+
         if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 /* Create STA entry for the WDS peer */
                 sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
@@ -307,9 +314,13 @@ static int ieee80211_open(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_inc(&local->iff_promiscs);
 
+        mutex_lock(&local->mtx);
         hw_reconf_flags |= __ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
+
+        if (coming_up)
+                local->open_count++;
 
-        local->open_count++;
         if (hw_reconf_flags) {
                 ieee80211_hw_config(local, hw_reconf_flags);
                 /*
@@ -334,22 +345,42 @@ static int ieee80211_open(struct net_device *dev)
         sdata->bss = NULL;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 list_del(&sdata->u.vlan.list);
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
         return res;
 }
 
-static int ieee80211_stop(struct net_device *dev)
+static int ieee80211_open(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        int err;
+
+        /* fail early if user set an invalid address */
+        if (!is_zero_ether_addr(dev->dev_addr) &&
+            !is_valid_ether_addr(dev->dev_addr))
+                return -EADDRNOTAVAIL;
+
+        err = ieee80211_check_concurrent_iface(sdata, sdata->vif.type);
+        if (err)
+                return err;
+
+        return ieee80211_do_open(dev, true);
+}
+
+static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+                              bool going_down)
+{
         struct ieee80211_local *local = sdata->local;
         unsigned long flags;
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
         int i;
 
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
         /*
          * Stop TX on this interface first.
          */
-        netif_tx_stop_all_queues(dev);
+        netif_tx_stop_all_queues(sdata->dev);
 
         /*
          * Purge work for this interface.
@@ -366,12 +397,9 @@ static int ieee80211_stop(struct net_device *dev)
          * (because if we remove a STA after ops->remove_interface()
          * the driver will have removed the vif info already!)
          *
-         * We could relax this and only unlink the stations from the
-         * hash table and list but keep them on a per-sdata list that
-         * will be inserted back again when the interface is brought
-         * up again, but I don't currently see a use case for that,
-         * except with WDS which gets a STA entry created when it is
-         * brought up.
+         * This is relevant only in AP, WDS and mesh modes, since in
+         * all other modes we've already removed all stations when
+         * disconnecting etc.
          */
         sta_info_flush(local, sdata);
 
@@ -390,11 +418,12 @@ static int ieee80211_stop(struct net_device *dev)
         if (sdata->vif.type == NL80211_IFTYPE_AP)
                 local->fif_pspoll--;
 
-        netif_addr_lock_bh(dev);
+        netif_addr_lock_bh(sdata->dev);
         spin_lock_bh(&local->filter_lock);
-        __hw_addr_unsync(&local->mc_list, &dev->mc, dev->addr_len);
+        __hw_addr_unsync(&local->mc_list, &sdata->dev->mc,
+                         sdata->dev->addr_len);
         spin_unlock_bh(&local->filter_lock);
-        netif_addr_unlock_bh(dev);
+        netif_addr_unlock_bh(sdata->dev);
 
         ieee80211_configure_filter(local);
 
@@ -406,11 +435,21 @@ static int ieee80211_stop(struct net_device *dev)
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
                 struct beacon_data *old_beacon = sdata->u.ap.beacon;
 
+                /* sdata_running will return false, so this will disable */
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_BEACON_ENABLED);
+
                 /* remove beacon */
                 rcu_assign_pointer(sdata->u.ap.beacon, NULL);
                 synchronize_rcu();
                 kfree(old_beacon);
 
+                /* free all potentially still buffered bcast frames */
+                while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
+                        local->total_ps_buffered--;
+                        dev_kfree_skb(skb);
+                }
+
                 /* down all dependent devices, that is VLANs */
                 list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
                                          u.vlan.list)
@@ -418,7 +457,8 @@ static int ieee80211_stop(struct net_device *dev)
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
         }
 
-        local->open_count--;
+        if (going_down)
+                local->open_count--;
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
@@ -450,27 +490,6 @@ static int ieee80211_stop(struct net_device *dev)
 
                 ieee80211_configure_filter(local);
                 break;
-        case NL80211_IFTYPE_STATION:
-                del_timer_sync(&sdata->u.mgd.chswitch_timer);
-                del_timer_sync(&sdata->u.mgd.timer);
-                del_timer_sync(&sdata->u.mgd.conn_mon_timer);
-                del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
-                /*
-                 * If any of the timers fired while we waited for it, it will
-                 * have queued its work. Now the work will be running again
-                 * but will not rearm the timer again because it checks
-                 * whether the interface is running, which, at this point,
-                 * it no longer is.
-                 */
-                cancel_work_sync(&sdata->u.mgd.chswitch_work);
-                cancel_work_sync(&sdata->u.mgd.monitor_work);
-                cancel_work_sync(&sdata->u.mgd.beacon_connection_loss_work);
-
-                /* fall through */
-        case NL80211_IFTYPE_ADHOC:
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                        del_timer_sync(&sdata->u.ibss.timer);
-                /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
                         /* other_bss and allmulti are always set on mesh
@@ -498,27 +517,34 @@ static int ieee80211_stop(struct net_device *dev)
                         ieee80211_scan_cancel(local);
 
                 /*
-                 * Disable beaconing for AP and mesh, IBSS can't
-                 * still be joined to a network at this point.
+                 * Disable beaconing here for mesh only, AP and IBSS
+                 * are already taken care of.
                  */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
+                if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                         ieee80211_bss_info_change_notify(sdata,
                                 BSS_CHANGED_BEACON_ENABLED);
-                }
 
-                /* free all remaining keys, there shouldn't be any */
+                /*
+                 * Free all remaining keys, there shouldn't be any,
+                 * except maybe group keys in AP more or WDS?
+                 */
                 ieee80211_free_keys(sdata);
-                drv_remove_interface(local, &sdata->vif);
+
+                if (going_down)
+                        drv_remove_interface(local, &sdata->vif);
         }
 
         sdata->bss = NULL;
 
+        mutex_lock(&local->mtx);
         hw_reconf_flags |= __ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
 
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
+                if (local->ops->napi_poll)
+                        napi_disable(&local->napi);
                 ieee80211_clear_tx_pending(local);
                 ieee80211_stop_device(local);
 
@@ -541,6 +567,13 @@ static int ieee80211_stop(struct net_device *dev)
                 }
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
+static int ieee80211_stop(struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        ieee80211_do_stop(sdata, true);
 
         return 0;
 }
@@ -585,8 +618,6 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct beacon_data *beacon;
-        struct sk_buff *skb;
         int flushed;
         int i;
 
@@ -599,37 +630,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                 __skb_queue_purge(&sdata->fragments[i].skb_list);
         sdata->fragment_next = 0;
 
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-                beacon = sdata->u.ap.beacon;
-                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
-                synchronize_rcu();
-                kfree(beacon);
-
-                while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
-                        local->total_ps_buffered--;
-                        dev_kfree_skb(skb);
-                }
-
-                break;
-        case NL80211_IFTYPE_MESH_POINT:
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        mesh_rmc_free(sdata);
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                if (WARN_ON(sdata->u.ibss.presp))
-                        kfree_skb(sdata->u.ibss.presp);
-                break;
-        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_WDS:
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_MONITOR:
-                break;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case __NL80211_IFTYPE_AFTER_LAST:
-                BUG();
-                break;
-        }
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                mesh_rmc_free(sdata);
 
         flushed = sta_info_flush(local, sdata);
         WARN_ON(flushed);
@@ -844,9 +846,13 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 
         /* and set some type-dependent values */
         sdata->vif.type = type;
+        sdata->vif.p2p = false;
         sdata->dev->netdev_ops = &ieee80211_dataif_ops;
         sdata->wdev.iftype = type;
 
+        sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
+        sdata->control_port_no_encrypt = false;
+
         /* only monitor differs */
         sdata->dev->type = ARPHRD_ETHER;
 
@@ -854,10 +860,20 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         INIT_WORK(&sdata->work, ieee80211_iface_work);
 
         switch (type) {
+        case NL80211_IFTYPE_P2P_GO:
+                type = NL80211_IFTYPE_AP;
+                sdata->vif.type = type;
+                sdata->vif.p2p = true;
+                /* fall through */
         case NL80211_IFTYPE_AP:
                 skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
                 break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                type = NL80211_IFTYPE_STATION;
+                sdata->vif.type = type;
+                sdata->vif.p2p = true;
+                /* fall through */
         case NL80211_IFTYPE_STATION:
                 ieee80211_sta_setup_sdata(sdata);
                 break;
@@ -878,7 +894,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP_VLAN:
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
-        case __NL80211_IFTYPE_AFTER_LAST:
+        case NUM_NL80211_IFTYPES:
                 BUG();
                 break;
         }
@@ -886,12 +902,85 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         ieee80211_debugfs_add_netdev(sdata);
 }
 
+static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+                                           enum nl80211_iftype type)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret, err;
+        enum nl80211_iftype internal_type = type;
+        bool p2p = false;
+
+        ASSERT_RTNL();
+
+        if (!local->ops->change_interface)
+                return -EBUSY;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                /*
+                 * Could maybe also all others here?
+                 * Just not sure how that interacts
+                 * with the RX/config path e.g. for
+                 * mesh.
+                 */
+                break;
+        default:
+                return -EBUSY;
+        }
+
+        switch (type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                /*
+                 * Could probably support everything
+                 * but WDS here (WDS do_open can fail
+                 * under memory pressure, which this
+                 * code isn't prepared to handle).
+                 */
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                p2p = true;
+                internal_type = NL80211_IFTYPE_STATION;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                p2p = true;
+                internal_type = NL80211_IFTYPE_AP;
+                break;
+        default:
+                return -EBUSY;
+        }
+
+        ret = ieee80211_check_concurrent_iface(sdata, internal_type);
+        if (ret)
+                return ret;
+
+        ieee80211_do_stop(sdata, false);
+
+        ieee80211_teardown_sdata(sdata->dev);
+
+        ret = drv_change_interface(local, sdata, internal_type, p2p);
+        if (ret)
+                type = sdata->vif.type;
+
+        ieee80211_setup_sdata(sdata, type);
+
+        err = ieee80211_do_open(sdata->dev, false);
+        WARN(err, "type change: do_open returned %d", err);
+
+        return ret;
+}
+
 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type)
 {
+        int ret;
+
         ASSERT_RTNL();
 
-        if (type == sdata->vif.type)
+        if (type == ieee80211_vif_type_p2p(&sdata->vif))
                 return 0;
 
         /* Setting ad-hoc mode on non-IBSS channel is not supported. */
@@ -899,18 +988,15 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
             type == NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
-        /*
-         * We could, here, on changes between IBSS/STA/MESH modes,
-         * invoke an MLME function instead that disassociates etc.
-         * and goes into the requested mode.
-         */
-
-        if (ieee80211_sdata_running(sdata))
-                return -EBUSY;
-
-        /* Purge and reset type-dependent state. */
-        ieee80211_teardown_sdata(sdata->dev);
-        ieee80211_setup_sdata(sdata, type);
+        if (ieee80211_sdata_running(sdata)) {
+                ret = ieee80211_runtime_change_iftype(sdata, type);
+                if (ret)
+                        return ret;
+        } else {
+                /* Purge and reset type-dependent state. */
+                ieee80211_teardown_sdata(sdata->dev);
+                ieee80211_setup_sdata(sdata, type);
+        }
 
         /* reset some values that shouldn't be kept across type changes */
         sdata->vif.bss_conf.basic_rates =
@@ -1167,8 +1253,7 @@ static u32 ieee80211_idle_off(struct ieee80211_local *local,
                 return 0;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: device no longer idle - %s\n",
-               wiphy_name(local->hw.wiphy), reason);
+        wiphy_debug(local->hw.wiphy, "device no longer idle - %s\n", reason);
 #endif
 
         local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
@@ -1181,8 +1266,7 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
                 return 0;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: device now idle\n",
-               wiphy_name(local->hw.wiphy));
+        wiphy_debug(local->hw.wiphy, "device now idle\n");
 #endif
 
         drv_flush(local, false);
@@ -1195,28 +1279,61 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
         int count = 0;
+        bool working = false, scanning = false;
+        struct ieee80211_work *wk;
 
-        if (!list_empty(&local->work_list))
-                return ieee80211_idle_off(local, "working");
-
-        if (local->scanning)
-                return ieee80211_idle_off(local, "scanning");
+#ifdef CONFIG_PROVE_LOCKING
+        WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
+                !lockdep_is_held(&local->iflist_mtx));
+#endif
+        lockdep_assert_held(&local->mtx);
 
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
+                if (!ieee80211_sdata_running(sdata)) {
+                        sdata->vif.bss_conf.idle = true;
                         continue;
+                }
+
+                sdata->old_idle = sdata->vif.bss_conf.idle;
+
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated)
+                    !sdata->u.mgd.associated) {
+                        sdata->vif.bss_conf.idle = true;
                         continue;
+                }
                 /* do not count unused IBSS interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    !sdata->u.ibss.ssid_len)
+                    !sdata->u.ibss.ssid_len) {
+                        sdata->vif.bss_conf.idle = true;
                         continue;
+                }
                 /* count everything else */
                 count++;
         }
 
+        list_for_each_entry(wk, &local->work_list, list) {
+                working = true;
+                wk->sdata->vif.bss_conf.idle = false;
+        }
+
+        if (local->scan_sdata) {
+                scanning = true;
+                local->scan_sdata->vif.bss_conf.idle = false;
+        }
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->old_idle == sdata->vif.bss_conf.idle)
+                        continue;
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+        }
+
+        if (working)
+                return ieee80211_idle_off(local, "working");
+        if (scanning)
+                return ieee80211_idle_off(local, "scanning");
         if (!count)
                 return ieee80211_idle_on(local);
         else
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 1b9d87ed143a..6a63d1abd14d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -49,7 +49,7 @@ static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
 static void assert_key_lock(struct ieee80211_local *local)
 {
-        WARN_ON(!mutex_is_locked(&local->key_mtx));
+        lockdep_assert_held(&local->key_mtx);
 }
 
 static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
@@ -60,7 +60,7 @@ static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
         return NULL;
 }
 
-static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
+static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_sta *sta;
@@ -68,8 +68,10 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         might_sleep();
 
-        if (!key->local->ops->set_key)
-                return;
+        if (!key->local->ops->set_key) {
+                ret = -EOPNOTSUPP;
+                goto out_unsupported;
+        }
 
         assert_key_lock(key->local);
 
@@ -87,10 +89,27 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
-                printk(KERN_ERR "mac80211-%s: failed to set key "
-                       "(%d, %pM) to hardware (%d)\n",
-                       wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
+                wiphy_err(key->local->hw.wiphy,
+                          "failed to set key (%d, %pM) to hardware (%d)\n",
+                          key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
+
+out_unsupported:
+        if (ret) {
+                switch (key->conf.cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                case WLAN_CIPHER_SUITE_TKIP:
+                case WLAN_CIPHER_SUITE_CCMP:
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        /* all of these we can do in software */
+                        ret = 0;
+                        break;
+                default:
+                        ret = -EINVAL;
+                }
+        }
+
+        return ret;
 }
 
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
@@ -121,10 +140,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                           sta, &key->conf);
 
         if (ret)
-                printk(KERN_ERR "mac80211-%s: failed to remove key "
-                       "(%d, %pM) from hardware (%d)\n",
-                       wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
+                wiphy_err(key->local->hw.wiphy,
+                          "failed to remove key (%d, %pM) from hardware (%d)\n",
+                          key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 }
@@ -227,20 +245,18 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
         }
 }
 
-struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
-                                          int idx,
-                                          size_t key_len,
+struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                                           const u8 *key_data,
                                           size_t seq_len, const u8 *seq)
 {
         struct ieee80211_key *key;
-        int i, j;
+        int i, j, err;
 
         BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
         if (!key)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         /*
          * Default to software encryption; we'll later upload the
@@ -249,15 +265,16 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
         key->conf.flags = 0;
         key->flags = 0;
 
-        key->conf.alg = alg;
+        key->conf.cipher = cipher;
         key->conf.keyidx = idx;
         key->conf.keylen = key_len;
-        switch (alg) {
-        case ALG_WEP:
+        switch (cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 key->conf.iv_len = WEP_IV_LEN;
                 key->conf.icv_len = WEP_ICV_LEN;
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 key->conf.iv_len = TKIP_IV_LEN;
                 key->conf.icv_len = TKIP_ICV_LEN;
                 if (seq) {
@@ -269,7 +286,7 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                         }
                 }
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 key->conf.iv_len = CCMP_HDR_LEN;
                 key->conf.icv_len = CCMP_MIC_LEN;
                 if (seq) {
@@ -278,42 +295,38 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                         key->u.ccmp.rx_pn[i][j] =
                                                 seq[CCMP_PN_LEN - j - 1];
                 }
-                break;
-        case ALG_AES_CMAC:
-                key->conf.iv_len = 0;
-                key->conf.icv_len = sizeof(struct ieee80211_mmie);
-                if (seq)
-                        for (j = 0; j < 6; j++)
-                                key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
-                break;
-        }
-        memcpy(key->conf.key, key_data, key_len);
-        INIT_LIST_HEAD(&key->list);
-
-        if (alg == ALG_CCMP) {
                 /*
                  * Initialize AES key state here as an optimization so that
                  * it does not need to be initialized for every packet.
                  */
                 key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
-                if (!key->u.ccmp.tfm) {
+                if (IS_ERR(key->u.ccmp.tfm)) {
+                        err = PTR_ERR(key->u.ccmp.tfm);
                         kfree(key);
-                        return NULL;
+                        key = ERR_PTR(err);
                 }
-        }
-
-        if (alg == ALG_AES_CMAC) {
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                key->conf.iv_len = 0;
+                key->conf.icv_len = sizeof(struct ieee80211_mmie);
+                if (seq)
+                        for (j = 0; j < 6; j++)
+                                key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
                 /*
                  * Initialize AES key state here as an optimization so that
                  * it does not need to be initialized for every packet.
                  */
                 key->u.aes_cmac.tfm =
                         ieee80211_aes_cmac_key_setup(key_data);
-                if (!key->u.aes_cmac.tfm) {
+                if (IS_ERR(key->u.aes_cmac.tfm)) {
+                        err = PTR_ERR(key->u.aes_cmac.tfm);
                         kfree(key);
-                        return NULL;
+                        key = ERR_PTR(err);
                 }
+                break;
         }
+        memcpy(key->conf.key, key_data, key_len);
+        INIT_LIST_HEAD(&key->list);
 
         return key;
 }
@@ -326,9 +339,9 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         if (key->local)
                 ieee80211_key_disable_hw_accel(key);
 
-        if (key->conf.alg == ALG_CCMP)
+        if (key->conf.cipher == WLAN_CIPHER_SUITE_CCMP)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
-        if (key->conf.alg == ALG_AES_CMAC)
+        if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
                 ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
         if (key->local)
                 ieee80211_debugfs_key_remove(key);
@@ -336,12 +349,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         kfree(key);
 }
 
-void ieee80211_key_link(struct ieee80211_key *key,
-                        struct ieee80211_sub_if_data *sdata,
-                        struct sta_info *sta)
+int ieee80211_key_link(struct ieee80211_key *key,
+                       struct ieee80211_sub_if_data *sdata,
+                       struct sta_info *sta)
 {
         struct ieee80211_key *old_key;
-        int idx;
+        int idx, ret;
 
         BUG_ON(!sdata);
         BUG_ON(!key);
@@ -396,9 +409,11 @@ void ieee80211_key_link(struct ieee80211_key *key,
 
         ieee80211_debugfs_key_add(key);
 
-        ieee80211_key_enable_hw_accel(key);
+        ret = ieee80211_key_enable_hw_accel(key);
 
         mutex_unlock(&sdata->local->key_mtx);
+
+        return ret;
 }
 
 static void __ieee80211_key_free(struct ieee80211_key *key)
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index b665bbb7a471..cb9a4a65cc68 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -123,18 +123,16 @@ struct ieee80211_key {
         struct ieee80211_key_conf conf;
 };
 
-struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
-                                          int idx,
-                                          size_t key_len,
+struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                                           const u8 *key_data,
                                           size_t seq_len, const u8 *seq);
 /*
  * Insert a key into data structures (sdata, sta if necessary)
  * to make it used, free old key.
  */
-void ieee80211_key_link(struct ieee80211_key *key,
-                        struct ieee80211_sub_if_data *sdata,
-                        struct sta_info *sta);
+int __must_check ieee80211_key_link(struct ieee80211_key *key,
+                                    struct ieee80211_sub_if_data *sdata,
+                                    struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ded5c3843e06..fda97bb0018b 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -99,11 +99,13 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         int ret = 0;
         int power;
         enum nl80211_channel_type channel_type;
+        u32 offchannel_flag;
 
         might_sleep();
 
         scan_chan = local->scan_channel;
 
+        offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
         if (scan_chan) {
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
@@ -117,8 +119,9 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 channel_type = local->_oper_channel_type;
                 local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
         }
+        offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
 
-        if (chan != local->hw.conf.channel ||
+        if (offchannel_flag || chan != local->hw.conf.channel ||
             channel_type != local->hw.conf.channel_type) {
                 local->hw.conf.channel = chan;
                 local->hw.conf.channel_type = channel_type;
@@ -302,7 +305,16 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw)
 
         trace_api_restart_hw(local);
 
-        /* use this reason, __ieee80211_resume will unblock it */
+        /* wait for scan work complete */
+        flush_workqueue(local->workqueue);
+
+        WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
+                "%s called with hardware scan in progress\n", __func__);
+
+        if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)))
+                ieee80211_scan_cancel(local);
+
+        /* use this reason, ieee80211_reconfig will unblock it */
         ieee80211_stop_queues_by_reason(hw,
                 IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
@@ -336,9 +348,6 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         struct ieee80211_if_managed *ifmgd;
         int c = 0;
 
-        if (!netif_running(ndev))
-                return NOTIFY_DONE;
-
         /* Make sure it's our interface that got changed */
         if (!wdev)
                 return NOTIFY_DONE;
@@ -349,11 +358,14 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
         bss_conf = &sdata->vif.bss_conf;
 
+        if (!ieee80211_sdata_running(sdata))
+                return NOTIFY_DONE;
+
         /* ARP filtering is only supported in managed mode */
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return NOTIFY_DONE;
 
-        idev = sdata->dev->ip_ptr;
+        idev = __in_dev_get_rtnl(sdata->dev);
         if (!idev)
                 return NOTIFY_DONE;
 
@@ -390,6 +402,80 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 }
 #endif
 
+static int ieee80211_napi_poll(struct napi_struct *napi, int budget)
+{
+        struct ieee80211_local *local =
+                container_of(napi, struct ieee80211_local, napi);
+
+        return local->ops->napi_poll(&local->hw, budget);
+}
+
+void ieee80211_napi_schedule(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        napi_schedule(&local->napi);
+}
+EXPORT_SYMBOL(ieee80211_napi_schedule);
+
+void ieee80211_napi_complete(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        napi_complete(&local->napi);
+}
+EXPORT_SYMBOL(ieee80211_napi_complete);
+
+/* There isn't a lot of sense in it, but you can transmit anything you like */
+static const struct ieee80211_txrx_stypes
+ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_ADHOC] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4),
+        },
+        [NL80211_IFTYPE_STATION] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
+        },
+        [NL80211_IFTYPE_AP] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                        BIT(IEEE80211_STYPE_ACTION >> 4),
+        },
+        [NL80211_IFTYPE_AP_VLAN] = {
+                /* copy AP */
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                        BIT(IEEE80211_STYPE_ACTION >> 4),
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                        BIT(IEEE80211_STYPE_ACTION >> 4),
+        },
+};
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -419,6 +505,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         if (!wiphy)
                 return NULL;
 
+        wiphy->mgmt_stypes = ieee80211_default_mgmt_stypes;
+
         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
                         WIPHY_FLAG_4ADDR_AP |
                         WIPHY_FLAG_4ADDR_STATION;
@@ -455,7 +543,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         __hw_addr_init(&local->mc_list);
 
         mutex_init(&local->iflist_mtx);
-        mutex_init(&local->scan_mtx);
+        mutex_init(&local->mtx);
 
         mutex_init(&local->key_mtx);
         spin_lock_init(&local->filter_lock);
@@ -494,6 +582,9 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         skb_queue_head_init(&local->skb_queue);
         skb_queue_head_init(&local->skb_queue_unreliable);
 
+        /* init dummy netdev for use w/ NAPI */
+        init_dummy_netdev(&local->napi_dev);
+
         return local_to_hw(local);
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
@@ -506,6 +597,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         int channels, max_bitrates;
         bool supp_ht;
         static const u32 cipher_suites[] = {
+                /* keep WEP first, it may be removed below */
                 WLAN_CIPHER_SUITE_WEP40,
                 WLAN_CIPHER_SUITE_WEP104,
                 WLAN_CIPHER_SUITE_TKIP,
@@ -554,6 +646,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         /* mac80211 always supports monitor */
         local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
 
+#ifndef CONFIG_MAC80211_MESH
+        /* mesh depends on Kconfig, but drivers should set it if they want */
+        local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
+#endif
+
+        /* mac80211 supports control port protocol changing */
+        local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;
+
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
@@ -589,10 +689,41 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->max_scan_ie_len)
                 local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
 
-        local->hw.wiphy->cipher_suites = cipher_suites;
-        local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-        if (!(local->hw.flags & IEEE80211_HW_MFP_CAPABLE))
-                local->hw.wiphy->n_cipher_suites--;
+        /* Set up cipher suites unless driver already did */
+        if (!local->hw.wiphy->cipher_suites) {
+                local->hw.wiphy->cipher_suites = cipher_suites;
+                local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+                if (!(local->hw.flags & IEEE80211_HW_MFP_CAPABLE))
+                        local->hw.wiphy->n_cipher_suites--;
+        }
+        if (IS_ERR(local->wep_tx_tfm) || IS_ERR(local->wep_rx_tfm)) {
+                if (local->hw.wiphy->cipher_suites == cipher_suites) {
+                        local->hw.wiphy->cipher_suites += 2;
+                        local->hw.wiphy->n_cipher_suites -= 2;
+                } else {
+                        u32 *suites;
+                        int r, w = 0;
+
+                        /* Filter out WEP */
+
+                        suites = kmemdup(
+                                local->hw.wiphy->cipher_suites,
+                                sizeof(u32) * local->hw.wiphy->n_cipher_suites,
+                                GFP_KERNEL);
+                        if (!suites)
+                                return -ENOMEM;
+                        for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
+                                u32 suite = local->hw.wiphy->cipher_suites[r];
+                                if (suite == WLAN_CIPHER_SUITE_WEP40 ||
+                                    suite == WLAN_CIPHER_SUITE_WEP104)
+                                        continue;
+                                suites[w++] = suite;
+                        }
+                        local->hw.wiphy->cipher_suites = suites;
+                        local->hw.wiphy->n_cipher_suites = w;
+                        local->wiphy_ciphers_allocated = true;
+                }
+        }
 
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
@@ -641,16 +772,16 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         result = ieee80211_wep_init(local);
         if (result < 0)
-                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
-                       wiphy_name(local->hw.wiphy), result);
+                wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
+                            result);
 
         rtnl_lock();
 
         result = ieee80211_init_rate_ctrl_alg(local,
                                               hw->rate_control_algorithm);
         if (result < 0) {
-                printk(KERN_DEBUG "%s: Failed to initialize rate control "
-                       "algorithm\n", wiphy_name(local->hw.wiphy));
+                wiphy_debug(local->hw.wiphy,
+                            "Failed to initialize rate control algorithm\n");
                 goto fail_rate;
         }
 
@@ -659,8 +790,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 result = ieee80211_if_add(local, "wlan%d", NULL,
                                           NL80211_IFTYPE_STATION, NULL);
                 if (result)
-                        printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
-                               wiphy_name(local->hw.wiphy));
+                        wiphy_warn(local->hw.wiphy,
+                                   "Failed to add default virtual iface\n");
         }
 
         rtnl_unlock();
@@ -683,6 +814,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_ifa;
 #endif
 
+        netif_napi_add(&local->napi_dev, &local->napi, ieee80211_napi_poll,
+                        local->hw.napi_weight);
+
         return 0;
 
 #ifdef CONFIG_INET
@@ -703,6 +837,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
+        if (local->wiphy_ciphers_allocated)
+                kfree(local->hw.wiphy->cipher_suites);
         kfree(local->int_scan_req);
         return result;
 }
@@ -738,6 +874,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
          */
         del_timer_sync(&local->work_timer);
 
+        cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
 
         ieee80211_clear_tx_pending(local);
@@ -746,8 +883,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         if (skb_queue_len(&local->skb_queue) ||
             skb_queue_len(&local->skb_queue_unreliable))
-                printk(KERN_WARNING "%s: skb_queue not empty\n",
-                       wiphy_name(local->hw.wiphy));
+                wiphy_warn(local->hw.wiphy, "skb_queue not empty\n");
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
 
@@ -764,7 +900,10 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
 
         mutex_destroy(&local->iflist_mtx);
-        mutex_destroy(&local->scan_mtx);
+        mutex_destroy(&local->mtx);
+
+        if (local->wiphy_ciphers_allocated)
+                kfree(local->hw.wiphy->cipher_suites);
 
         wiphy_free(local->hw.wiphy);
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b6c163ac22da..8b733cf6f3ea 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -54,6 +54,12 @@
  */
 #define IEEE80211_SIGNAL_AVE_WEIGHT     3
 
+/*
+ * How many Beacon frames need to have been used in average signal strength
+ * before starting to indicate signal change events.
+ */
+#define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
+
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
@@ -86,7 +92,7 @@ enum rx_mgmt_action {
 /* utils */
 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
 {
-        WARN_ON(!mutex_is_locked(&ifmgd->mtx));
+        lockdep_assert_held(&ifmgd->mtx);
 }
 
 /*
@@ -109,7 +115,7 @@ static void run_again(struct ieee80211_if_managed *ifmgd,
                 mod_timer(&ifmgd->timer, timeout);
 }
 
-static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
+void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
                 return;
@@ -118,6 +124,19 @@ static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
                   round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
 }
 
+void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
+        mod_timer(&sdata->u.mgd.conn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
+
+        ifmgd->probe_send_count = 0;
+}
+
 static int ecw2cw(int ecw)
 {
         return (1 << ecw) - 1;
@@ -778,16 +797,17 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 params.uapsd = uapsd;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
-                       wiphy_name(local->hw.wiphy), queue, aci, acm,
-                       params.aifs, params.cw_min, params.cw_max, params.txop,
-                       params.uapsd);
+                wiphy_debug(local->hw.wiphy,
+                            "WMM queue=%d aci=%d acm=%d aifs=%d "
+                            "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
+                            queue, aci, acm,
+                            params.aifs, params.cw_min, params.cw_max,
+                            params.txop, params.uapsd);
 #endif
                 if (drv_conf_tx(local, queue, &params))
-                        printk(KERN_DEBUG "%s: failed to set TX queue "
-                               "parameters for queue %d\n",
-                               wiphy_name(local->hw.wiphy), queue);
+                        wiphy_debug(local->hw.wiphy,
+                                    "failed to set TX queue parameters for queue %d\n",
+                                    queue);
         }
 
         /* enable WMM or activate new settings */
@@ -990,6 +1010,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         if (remove_sta)
                 sta_info_destroy_addr(sdata, bssid);
+
+        del_timer_sync(&sdata->u.mgd.conn_mon_timer);
+        del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
+        del_timer_sync(&sdata->u.mgd.timer);
+        del_timer_sync(&sdata->u.mgd.chswitch_timer);
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1006,21 +1031,26 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
-        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                return;
-
-        mod_timer(&sdata->u.mgd.conn_mon_timer,
-                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
+        ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
+        u8 *dst = ifmgd->associated->bssid;
+        u8 unicast_limit = max(1, IEEE80211_MAX_PROBE_TRIES - 3);
+
+        /*
+         * Try sending broadcast probe requests for the last three
+         * probe requests after the first ones failed since some
+         * buggy APs only support broadcast probe requests.
+         */
+        if (ifmgd->probe_send_count >= unicast_limit)
+                dst = NULL;
 
         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, ifmgd->associated->bssid,
-                                 ssid + 2, ssid[1], NULL, 0);
+        ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
 
         ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
@@ -1103,8 +1133,11 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "Connection to AP %pM lost.\n", bssid);
 
         ieee80211_set_disassoc(sdata, true);
-        ieee80211_recalc_idle(local);
         mutex_unlock(&ifmgd->mtx);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
@@ -1173,7 +1206,9 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                         sdata->name, bssid, reason_code);
 
         ieee80211_set_disassoc(sdata, true);
+        mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&sdata->local->mtx);
 
         return RX_MGMT_CFG80211_DEAUTH;
 }
@@ -1203,7 +1238,9 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                         sdata->name, mgmt->sa, reason_code);
 
         ieee80211_set_disassoc(sdata, true);
+        mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&sdata->local->mtx);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -1362,7 +1399,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
          * Also start the timer that will detect beacon loss.
          */
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
-        mod_beacon_timer(sdata);
+        ieee80211_sta_reset_beacon_monitor(sdata);
 
         return true;
 }
@@ -1465,7 +1502,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                  * we have or will be receiving any beacons or data, so let's
                  * schedule the timers again, just in case.
                  */
-                mod_beacon_timer(sdata);
+                ieee80211_sta_reset_beacon_monitor(sdata);
 
                 mod_timer(&ifmgd->conn_mon_timer,
                           round_jiffies_up(jiffies +
@@ -1540,15 +1577,18 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ifmgd->last_beacon_signal = rx_status->signal;
         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
-                ifmgd->ave_beacon_signal = rx_status->signal;
+                ifmgd->ave_beacon_signal = rx_status->signal * 16;
                 ifmgd->last_cqm_event_signal = 0;
+                ifmgd->count_beacon_signal = 1;
         } else {
                 ifmgd->ave_beacon_signal =
                         (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
                          (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
                          ifmgd->ave_beacon_signal) / 16;
+                ifmgd->count_beacon_signal++;
         }
         if (bss_conf->cqm_rssi_thold &&
+            ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
             !(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
                 int sig = ifmgd->ave_beacon_signal / 16;
                 int last_event = ifmgd->last_cqm_event_signal;
@@ -1588,7 +1628,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
          * Push the beacon loss detection into the future since
          * we are processing a beacon from the AP just now.
          */
-        mod_beacon_timer(sdata);
+        ieee80211_sta_reset_beacon_monitor(sdata);
 
         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
@@ -1751,7 +1791,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_local *local = sdata->local;
                 struct ieee80211_work *wk;
 
-                mutex_lock(&local->work_mtx);
+                mutex_lock(&local->mtx);
                 list_for_each_entry(wk, &local->work_list, list) {
                         if (wk->sdata != sdata)
                                 continue;
@@ -1783,7 +1823,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         free_work(wk);
                         break;
                 }
-                mutex_unlock(&local->work_mtx);
+                mutex_unlock(&local->mtx);
 
                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
         }
@@ -1840,8 +1880,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
                         ieee80211_set_disassoc(sdata, true);
-                        ieee80211_recalc_idle(local);
                         mutex_unlock(&ifmgd->mtx);
+                        mutex_lock(&local->mtx);
+                        ieee80211_recalc_idle(local);
+                        mutex_unlock(&local->mtx);
                         /*
                          * must be outside lock due to cfg80211,
                          * but that's not a problem.
@@ -1917,6 +1959,8 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
          * time -- the code here is properly synchronised.
          */
 
+        cancel_work_sync(&ifmgd->request_smps_work);
+
         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
@@ -1952,6 +1996,7 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
         INIT_WORK(&ifmgd->beacon_connection_loss_work,
                   ieee80211_beacon_connection_loss_work);
+        INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
@@ -2249,6 +2294,9 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         else
                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
+        sdata->control_port_protocol = req->crypto.control_port_ethertype;
+        sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
+
         ieee80211_add_work(wk);
         return 0;
 }
@@ -2275,7 +2323,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
                 mutex_unlock(&ifmgd->mtx);
 
-                mutex_lock(&local->work_mtx);
+                mutex_lock(&local->mtx);
                 list_for_each_entry(wk, &local->work_list, list) {
                         if (wk->sdata != sdata)
                                 continue;
@@ -2294,7 +2342,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                         free_work(wk);
                         break;
                 }
-                mutex_unlock(&local->work_mtx);
+                mutex_unlock(&local->mtx);
 
                 /*
                  * If somebody requests authentication and we haven't
@@ -2319,7 +2367,9 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         if (assoc_bss)
                 sta_info_destroy_addr(sdata, bssid);
 
+        mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&sdata->local->mtx);
 
         return 0;
 }
@@ -2357,7 +2407,9 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                         cookie, !req->local_state_change);
         sta_info_destroy_addr(sdata, bssid);
 
+        mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&sdata->local->mtx);
 
         return 0;
 }
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index c36b1911987a..4b564091e51d 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -22,12 +22,16 @@
 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         local->offchannel_ps_enabled = false;
 
         /* FIXME: what to do when local->pspolling is true? */
 
         del_timer_sync(&local->dynamic_ps_timer);
+        del_timer_sync(&ifmgd->bcn_mon_timer);
+        del_timer_sync(&ifmgd->conn_mon_timer);
+
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
@@ -85,6 +89,9 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
                 mod_timer(&local->dynamic_ps_timer, jiffies +
                           msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
+
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
@@ -112,8 +119,10 @@ void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
                  * used from user space controlled off-channel operations.
                  */
                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR) {
+                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                         netif_tx_stop_all_queues(sdata->dev);
+                }
         }
         mutex_unlock(&local->iflist_mtx);
 }
@@ -131,6 +140,7 @@ void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
                         continue;
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                         netif_tx_stop_all_queues(sdata->dev);
                         if (sdata->u.mgd.associated)
                                 ieee80211_offchannel_ps_enable(sdata);
@@ -155,8 +165,20 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                                 ieee80211_offchannel_ps_disable(sdata);
                 }
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
+                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+                        /*
+                         * This may wake up queues even though the driver
+                         * currently has them stopped. This is not very
+                         * likely, since the driver won't have gotten any
+                         * (or hardly any) new packets while we weren't
+                         * on the right channel, and even if it happens
+                         * it will at most lead to queueing up one more
+                         * packet per queue in mac80211 rather than on
+                         * the interface qdisc.
+                         */
                         netif_tx_wake_all_queues(sdata->dev);
+                }
 
                 /* re-enable beaconing */
                 if (enable_beaconing &&
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index d287fde0431d..ce671dfd238c 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -12,7 +12,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
 
-        ieee80211_scan_cancel(local);
+        if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)))
+                ieee80211_scan_cancel(local);
 
         ieee80211_stop_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index be04d46110fe..b0cc385bf989 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -207,7 +207,7 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
 
         fc = hdr->frame_control;
 
-        return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
+        return (info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc);
 }
 
 static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
@@ -368,8 +368,8 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
 
         ref = rate_control_alloc(name, local);
         if (!ref) {
-                printk(KERN_WARNING "%s: Failed to select rate control "
-                       "algorithm\n", wiphy_name(local->hw.wiphy));
+                wiphy_warn(local->hw.wiphy,
+                           "Failed to select rate control algorithm\n");
                 return -ENOENT;
         }
 
@@ -380,9 +380,8 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                 sta_info_flush(local, NULL);
         }
 
-        printk(KERN_DEBUG "%s: Selected rate control "
-               "algorithm '%s'\n", wiphy_name(local->hw.wiphy),
-               ref->ops->name);
+        wiphy_debug(local->hw.wiphy, "Selected rate control algorithm '%s'\n",
+                    ref->ops->name);
 
         return 0;
 }
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 47438b4a9af5..135f36fd4d5d 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -162,7 +162,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         file_info->next_entry = (file_info->next_entry + 1) %
                                 RC_PID_EVENT_RING_SIZE;
 
-        /* Print information about the event. Note that userpace needs to
+        /* Print information about the event. Note that userspace needs to
          * provide large enough buffers. */
         length = length < RC_PID_PRINT_BUF_SIZE ?
                  length : RC_PID_PRINT_BUF_SIZE;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa0f37e4afe4..c0368152b721 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -538,20 +538,12 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
                                             int index,
                                             struct sk_buff_head *frames)
 {
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *rate = NULL;
         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
-        struct ieee80211_rx_status *status;
 
         if (!skb)
                 goto no_frame;
 
-        status = IEEE80211_SKB_RXCB(skb);
-
-        /* release the reordered frames to stack */
-        sband = hw->wiphy->bands[status->band];
-        if (!(status->flag & RX_FLAG_HT))
-                rate = &sband->bitrates[status->rate_idx];
+        /* release the frame from the reorder ring buffer */
         tid_agg_rx->stored_mpdu_num--;
         tid_agg_rx->reorder_buf[index] = NULL;
         __skb_queue_tail(frames, skb);
@@ -580,9 +572,78 @@ static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
  * frames that have not yet been received are assumed to be lost and the skb
  * can be released for processing. This may also release other skb's from the
  * reorder buffer if there are no additional gaps between the frames.
+ *
+ * Callers must hold tid_agg_rx->reorder_lock.
  */
 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 
+static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
+                                          struct tid_ampdu_rx *tid_agg_rx,
+                                          struct sk_buff_head *frames)
+{
+        int index, j;
+
+        /* release the buffer until next missing frame */
+        index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                tid_agg_rx->buf_size;
+        if (!tid_agg_rx->reorder_buf[index] &&
+            tid_agg_rx->stored_mpdu_num > 1) {
+                /*
+                 * No buffers ready to be released, but check whether any
+                 * frames in the reorder buffer have timed out.
+                 */
+                int skipped = 1;
+                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
+                     j = (j + 1) % tid_agg_rx->buf_size) {
+                        if (!tid_agg_rx->reorder_buf[j]) {
+                                skipped++;
+                                continue;
+                        }
+                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                                        HT_RX_REORDER_BUF_TIMEOUT))
+                                goto set_release_timer;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                wiphy_debug(hw->wiphy,
+                                            "release an RX reorder frame due to timeout on earlier frames\n");
+#endif
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
+                                                        j, frames);
+
+                        /*
+                         * Increment the head seq# also for the skipped slots.
+                         */
+                        tid_agg_rx->head_seq_num =
+                                (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
+                        skipped = 0;
+                }
+        } else while (tid_agg_rx->reorder_buf[index]) {
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                        tid_agg_rx->buf_size;
+        }
+
+        if (tid_agg_rx->stored_mpdu_num) {
+                j = index = seq_sub(tid_agg_rx->head_seq_num,
+                                    tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+
+                for (; j != (index - 1) % tid_agg_rx->buf_size;
+                     j = (j + 1) % tid_agg_rx->buf_size) {
+                        if (tid_agg_rx->reorder_buf[j])
+                                break;
+                }
+
+ set_release_timer:
+
+                mod_timer(&tid_agg_rx->reorder_timer,
+                          tid_agg_rx->reorder_time[j] +
+                          HT_RX_REORDER_BUF_TIMEOUT);
+        } else {
+                del_timer(&tid_agg_rx->reorder_timer);
+        }
+}
+
 /*
  * As this function belongs to the RX path it must be under
  * rcu_read_lock protection. It returns false if the frame
@@ -598,14 +659,16 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
         u16 head_seq_num, buf_size;
         int index;
+        bool ret = true;
 
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
 
+        spin_lock(&tid_agg_rx->reorder_lock);
         /* frame with out of date sequence number */
         if (seq_less(mpdu_seq_num, head_seq_num)) {
                 dev_kfree_skb(skb);
-                return true;
+                goto out;
         }
 
         /*
@@ -626,7 +689,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         /* check if we already stored this frame */
         if (tid_agg_rx->reorder_buf[index]) {
                 dev_kfree_skb(skb);
-                return true;
+                goto out;
         }
 
         /*
@@ -636,58 +699,19 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
             tid_agg_rx->stored_mpdu_num == 0) {
                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
-                return false;
+                ret = false;
+                goto out;
         }
 
         /* put the frame in the reordering buffer */
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
         tid_agg_rx->stored_mpdu_num++;
-        /* release the buffer until next missing frame */
-        index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                                tid_agg_rx->buf_size;
-        if (!tid_agg_rx->reorder_buf[index] &&
-            tid_agg_rx->stored_mpdu_num > 1) {
-                /*
-                 * No buffers ready to be released, but check whether any
-                 * frames in the reorder buffer have timed out.
-                 */
-                int j;
-                int skipped = 1;
-                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
-                     j = (j + 1) % tid_agg_rx->buf_size) {
-                        if (!tid_agg_rx->reorder_buf[j]) {
-                                skipped++;
-                                continue;
-                        }
-                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
-                                        HT_RX_REORDER_BUF_TIMEOUT))
-                                break;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: release an RX reorder "
-                                       "frame due to timeout on earlier "
-                                       "frames\n",
-                                       wiphy_name(hw->wiphy));
-#endif
-                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
-                                                        j, frames);
-
-                        /*
-                         * Increment the head seq# also for the skipped slots.
-                         */
-                        tid_agg_rx->head_seq_num =
-                                (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
-                        skipped = 0;
-                }
-        } else while (tid_agg_rx->reorder_buf[index]) {
-                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
-                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                                        tid_agg_rx->buf_size;
-        }
+        ieee80211_sta_reorder_release(hw, tid_agg_rx, frames);
 
-        return true;
+ out:
+        spin_unlock(&tid_agg_rx->reorder_lock);
+        return ret;
 }
 
 /*
@@ -873,6 +897,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                 rx->key = stakey;
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
                 /* Skip decryption if the frame is not protected. */
                 if (!ieee80211_has_protected(fc))
                         return RX_CONTINUE;
@@ -935,7 +962,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                  * pairwise or station-to-station keys, but for WEP we allow
                  * using a key index as well.
                  */
-                if (rx->key && rx->key->conf.alg != ALG_WEP &&
+                if (rx->key && rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
+                    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
                     !is_multicast_ether_addr(hdr->addr1))
                         rx->key = NULL;
         }
@@ -951,8 +979,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
         /* the hdr variable is invalid now! */
 
-        switch (rx->key->conf.alg) {
-        case ALG_WEP:
+        switch (rx->key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 /* Check for weak IVs if possible */
                 if (rx->sta && ieee80211_is_data(fc) &&
                     (!(status->flag & RX_FLAG_IV_STRIPPED) ||
@@ -962,15 +991,21 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
                 result = ieee80211_crypto_wep_decrypt(rx);
                 break;
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 result = ieee80211_crypto_tkip_decrypt(rx);
                 break;
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 result = ieee80211_crypto_ccmp_decrypt(rx);
                 break;
-        case ALG_AES_CMAC:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
                 break;
+        default:
+                /*
+                 * We can reach here only with HW-only algorithms
+                 * but why didn't it decrypt the frame?!
+                 */
+                return RX_DROP_UNUSABLE;
         }
 
         /* either the frame has been decrypted or will be dropped */
@@ -1265,7 +1300,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                 /* This is the first fragment of a new frame. */
                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
                                                  rx->queue, &(rx->skb));
-                if (rx->key && rx->key->conf.alg == ALG_CCMP &&
+                if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
                     ieee80211_has_protected(fc)) {
                         int queue = ieee80211_is_mgmt(fc) ?
                                 NUM_RX_DATA_QUEUES : rx->queue;
@@ -1294,7 +1329,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                 int i;
                 u8 pn[CCMP_PN_LEN], *rpn;
                 int queue;
-                if (!rx->key || rx->key->conf.alg != ALG_CCMP)
+                if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
                         return RX_DROP_UNUSABLE;
                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
@@ -1492,7 +1527,7 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
          * Allow EAPOL frames to us/the PAE group address regardless
          * of whether the frame was encrypted or not.
          */
-        if (ehdr->h_proto == htons(ETH_P_PAE) &&
+        if (ehdr->h_proto == rx->sdata->control_port_protocol &&
             (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
                 return true;
@@ -1909,13 +1944,36 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
 }
 
 static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+
+        /*
+         * From here on, look only at management frames.
+         * Data and control frames are already handled,
+         * and unknown (reserved) frames are useless.
+         */
+        if (rx->skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        if (!ieee80211_is_mgmt(mgmt->frame_control))
+                return RX_DROP_MONITOR;
+
+        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
+                return RX_DROP_MONITOR;
+
+        if (ieee80211_drop_unencrypted_mgmt(rx))
+                return RX_DROP_UNUSABLE;
+
+        return RX_CONTINUE;
+}
+
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
-        struct sk_buff *nskb;
-        struct ieee80211_rx_status *status;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
@@ -1931,9 +1989,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_UNUSABLE;
 
-        if (ieee80211_drop_unencrypted_mgmt(rx))
-                return RX_DROP_UNUSABLE;
-
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
                 /*
@@ -2024,17 +2079,36 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 goto queue;
         }
 
+        return RX_CONTINUE;
+
  invalid:
-        /*
-         * For AP mode, hostapd is responsible for handling any action
-         * frames that we didn't handle, including returning unknown
-         * ones. For all other modes we will return them to the sender,
-         * setting the 0x80 bit in the action category, as required by
-         * 802.11-2007 7.3.1.11.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_AP ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                return RX_DROP_MONITOR;
+        rx->flags |= IEEE80211_MALFORMED_ACTION_FRM;
+        /* will return in the next handlers */
+        return RX_CONTINUE;
+
+ handled:
+        if (rx->sta)
+                rx->sta->rx_packets++;
+        dev_kfree_skb(rx->skb);
+        return RX_QUEUED;
+
+ queue:
+        rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, rx->skb);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+        if (rx->sta)
+                rx->sta->rx_packets++;
+        return RX_QUEUED;
+}
+
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_rx_status *status;
+
+        /* skip known-bad action frames and return them in the next handler */
+        if (rx->flags & IEEE80211_MALFORMED_ACTION_FRM)
+                return RX_CONTINUE;
 
         /*
          * Getting here means the kernel doesn't know how to handle
@@ -2044,10 +2118,44 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
          */
         status = IEEE80211_SKB_RXCB(rx->skb);
 
-        if (cfg80211_rx_action(rx->sdata->dev, status->freq,
-                               rx->skb->data, rx->skb->len,
-                               GFP_ATOMIC))
-                goto handled;
+        if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
+                             rx->skb->data, rx->skb->len,
+                             GFP_ATOMIC)) {
+                if (rx->sta)
+                        rx->sta->rx_packets++;
+                dev_kfree_skb(rx->skb);
+                return RX_QUEUED;
+        }
+
+
+        return RX_CONTINUE;
+}
+
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        struct sk_buff *nskb;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+
+        if (!ieee80211_is_action(mgmt->frame_control))
+                return RX_CONTINUE;
+
+        /*
+         * For AP mode, hostapd is responsible for handling any action
+         * frames that we didn't handle, including returning unknown
+         * ones. For all other modes we will return them to the sender,
+         * setting the 0x80 bit in the action category, as required by
+         * 802.11-2007 7.3.1.11.
+         * Newer versions of hostapd shall also use the management frame
+         * registration mechanisms, but older ones still use cooked
+         * monitor interfaces so push all frames there.
+         */
+        if (!(rx->flags & IEEE80211_MALFORMED_ACTION_FRM) &&
+            (sdata->vif.type == NL80211_IFTYPE_AP ||
+             sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+                return RX_DROP_MONITOR;
 
         /* do not return rejected action frames */
         if (mgmt->u.action.category & 0x80)
@@ -2066,20 +2174,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                 ieee80211_tx_skb(rx->sdata, nskb);
         }
-
- handled:
-        if (rx->sta)
-                rx->sta->rx_packets++;
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
-
- queue:
-        rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
-        skb_queue_tail(&sdata->skb_queue, rx->skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
-        if (rx->sta)
-                rx->sta->rx_packets++;
-        return RX_QUEUED;
 }
 
 static ieee80211_rx_result debug_noinline
@@ -2090,15 +2186,6 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
         __le16 stype;
 
-        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
-                return RX_DROP_MONITOR;
-
-        if (rx->skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        if (ieee80211_drop_unencrypted_mgmt(rx))
-                return RX_DROP_UNUSABLE;
-
         rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
         if (rxs != RX_CONTINUE)
                 return rxs;
@@ -2267,19 +2354,46 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         dev_kfree_skb(skb);
 }
 
+static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
+                                         ieee80211_rx_result res)
+{
+        switch (res) {
+        case RX_DROP_MONITOR:
+                I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
+                if (rx->sta)
+                        rx->sta->rx_dropped++;
+                /* fall through */
+        case RX_CONTINUE: {
+                struct ieee80211_rate *rate = NULL;
+                struct ieee80211_supported_band *sband;
+                struct ieee80211_rx_status *status;
+
+                status = IEEE80211_SKB_RXCB((rx->skb));
+
+                sband = rx->local->hw.wiphy->bands[status->band];
+                if (!(status->flag & RX_FLAG_HT))
+                        rate = &sband->bitrates[status->rate_idx];
+
+                ieee80211_rx_cooked_monitor(rx, rate);
+                break;
+                }
+        case RX_DROP_UNUSABLE:
+                I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
+                if (rx->sta)
+                        rx->sta->rx_dropped++;
+                dev_kfree_skb(rx->skb);
+                break;
+        case RX_QUEUED:
+                I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
+                break;
+        }
+}
 
-static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_rx_data *rx,
-                                         struct sk_buff *skb,
-                                         struct ieee80211_rate *rate)
+static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
+                                  struct sk_buff_head *frames)
 {
-        struct sk_buff_head reorder_release;
         ieee80211_rx_result res = RX_DROP_MONITOR;
-
-        __skb_queue_head_init(&reorder_release);
-
-        rx->skb = skb;
-        rx->sdata = sdata;
+        struct sk_buff *skb;
 
 #define CALL_RXH(rxh)                   \
         do {                            \
@@ -2288,17 +2402,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                         goto rxh_next;  \
         } while (0);
 
-        /*
-         * NB: the rxh_next label works even if we jump
-         *     to it from here because then the list will
-         *     be empty, which is a trivial check
-         */
-        CALL_RXH(ieee80211_rx_h_passive_scan)
-        CALL_RXH(ieee80211_rx_h_check)
-
-        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
-
-        while ((skb = __skb_dequeue(&reorder_release))) {
+        while ((skb = __skb_dequeue(frames))) {
                 /*
                  * all the other fields are valid across frames
                  * that belong to an aMPDU since they are on the
@@ -2316,42 +2420,95 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                 CALL_RXH(ieee80211_rx_h_remove_qos_control)
                 CALL_RXH(ieee80211_rx_h_amsdu)
 #ifdef CONFIG_MAC80211_MESH
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&rx->sdata->vif))
                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
                 CALL_RXH(ieee80211_rx_h_data)
 
                 /* special treatment -- needs the queue */
-                res = ieee80211_rx_h_ctrl(rx, &reorder_release);
+                res = ieee80211_rx_h_ctrl(rx, frames);
                 if (res != RX_CONTINUE)
                         goto rxh_next;
 
+                CALL_RXH(ieee80211_rx_h_mgmt_check)
                 CALL_RXH(ieee80211_rx_h_action)
+                CALL_RXH(ieee80211_rx_h_userspace_mgmt)
+                CALL_RXH(ieee80211_rx_h_action_return)
                 CALL_RXH(ieee80211_rx_h_mgmt)
 
+ rxh_next:
+                ieee80211_rx_handlers_result(rx, res);
+
 #undef CALL_RXH
+        }
+}
+
+static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_rx_data *rx,
+                                         struct sk_buff *skb)
+{
+        struct sk_buff_head reorder_release;
+        ieee80211_rx_result res = RX_DROP_MONITOR;
+
+        __skb_queue_head_init(&reorder_release);
+
+        rx->skb = skb;
+        rx->sdata = sdata;
+
+#define CALL_RXH(rxh)                   \
+        do {                            \
+                res = rxh(rx);          \
+                if (res != RX_CONTINUE) \
+                        goto rxh_next;  \
+        } while (0);
+
+        CALL_RXH(ieee80211_rx_h_passive_scan)
+        CALL_RXH(ieee80211_rx_h_check)
+
+        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
+
+        ieee80211_rx_handlers(rx, &reorder_release);
+        return;
 
  rxh_next:
-                switch (res) {
-                case RX_DROP_MONITOR:
-                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-                        if (rx->sta)
-                                rx->sta->rx_dropped++;
-                        /* fall through */
-                case RX_CONTINUE:
-                        ieee80211_rx_cooked_monitor(rx, rate);
-                        break;
-                case RX_DROP_UNUSABLE:
-                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-                        if (rx->sta)
-                                rx->sta->rx_dropped++;
-                        dev_kfree_skb(rx->skb);
-                        break;
-                case RX_QUEUED:
-                        I802_DEBUG_INC(sdata->local->rx_handlers_queued);
-                        break;
-                }
-        }
+        ieee80211_rx_handlers_result(rx, res);
+
+#undef CALL_RXH
+}
+
+/*
+ * This function makes calls into the RX path. Therefore the
+ * caller must hold the sta_info->lock and everything has to
+ * be under rcu_read_lock protection as well.
+ */
+void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
+{
+        struct sk_buff_head frames;
+        struct ieee80211_rx_data rx = { };
+        struct tid_ampdu_rx *tid_agg_rx;
+
+        tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+        if (!tid_agg_rx)
+                return;
+
+        __skb_queue_head_init(&frames);
+
+        /* construct rx struct */
+        rx.sta = sta;
+        rx.sdata = sta->sdata;
+        rx.local = sta->local;
+        rx.queue = tid;
+        rx.flags |= IEEE80211_RX_RA_MATCH;
+
+        if (unlikely(test_bit(SCAN_HW_SCANNING, &sta->local->scanning) ||
+                     test_bit(SCAN_OFF_CHANNEL, &sta->local->scanning)))
+                rx.flags |= IEEE80211_RX_IN_SCAN;
+
+        spin_lock(&tid_agg_rx->reorder_lock);
+        ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx, &frames);
+        spin_unlock(&tid_agg_rx->reorder_lock);
+
+        ieee80211_rx_handlers(&rx, &frames);
 }
 
 /* main receive path */
@@ -2431,9 +2588,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
                         return 0;
                 break;
-        case NL80211_IFTYPE_MONITOR:
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case __NL80211_IFTYPE_AFTER_LAST:
+        default:
                 /* should never get here */
                 WARN_ON(1);
                 break;
@@ -2447,8 +2602,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
  * be called with rcu_read_lock protection.
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
-                                         struct sk_buff *skb,
-                                         struct ieee80211_rate *rate)
+                                         struct sk_buff *skb)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_local *local = hw_to_local(hw);
@@ -2550,13 +2704,12 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         skb_new = skb_copy(skb, GFP_ATOMIC);
                         if (!skb_new) {
                                 if (net_ratelimit())
-                                        printk(KERN_DEBUG "%s: failed to copy "
-                                               "multicast frame for %s\n",
-                                               wiphy_name(local->hw.wiphy),
-                                               prev->name);
+                                        wiphy_debug(local->hw.wiphy,
+                                                    "failed to copy multicast frame for %s\n",
+                                                    prev->name);
                                 goto next;
                         }
-                        ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
+                        ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
 next:
                         prev = sdata;
                 }
@@ -2572,7 +2725,7 @@ next:
                 }
         }
         if (prev)
-                ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
+                ieee80211_invoke_rx_handlers(prev, &rx, skb);
         else
                 dev_kfree_skb(skb);
 }
@@ -2615,28 +2768,37 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (WARN_ON(!local->started))
                 goto drop;
 
-        if (status->flag & RX_FLAG_HT) {
+        if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
                 /*
-                 * rate_idx is MCS index, which can be [0-76] as documented on:
-                 *
-                 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
-                 *
-                 * Anything else would be some sort of driver or hardware error.
-                 * The driver should catch hardware errors.
+                 * Validate the rate, unless a PLCP error means that
+                 * we probably can't have a valid rate here anyway.
                  */
-                if (WARN((status->rate_idx < 0 ||
-                         status->rate_idx > 76),
-                         "Rate marked as an HT rate but passed "
-                         "status->rate_idx is not "
-                         "an MCS index [0-76]: %d (0x%02x)\n",
-                         status->rate_idx,
-                         status->rate_idx))
-                        goto drop;
-        } else {
-                if (WARN_ON(status->rate_idx < 0 ||
-                            status->rate_idx >= sband->n_bitrates))
-                        goto drop;
-                rate = &sband->bitrates[status->rate_idx];
+
+                if (status->flag & RX_FLAG_HT) {
+                        /*
+                         * rate_idx is MCS index, which can be [0-76]
+                         * as documented on:
+                         *
+                         * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
+                         *
+                         * Anything else would be some sort of driver or
+                         * hardware error. The driver should catch hardware
+                         * errors.
+                         */
+                        if (WARN((status->rate_idx < 0 ||
+                                 status->rate_idx > 76),
+                                 "Rate marked as an HT rate but passed "
+                                 "status->rate_idx is not "
+                                 "an MCS index [0-76]: %d (0x%02x)\n",
+                                 status->rate_idx,
+                                 status->rate_idx))
+                                goto drop;
+                } else {
+                        if (WARN_ON(status->rate_idx < 0 ||
+                                    status->rate_idx >= sband->n_bitrates))
+                                goto drop;
+                        rate = &sband->bitrates[status->rate_idx];
+                }
         }
 
         /*
@@ -2658,7 +2820,7 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
         }
 
-        __ieee80211_rx_handle_packet(hw, skb, rate);
+        __ieee80211_rx_handle_packet(hw, skb);
 
         rcu_read_unlock();
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 872d7b6ef6b3..d60389ba9b95 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -248,14 +248,12 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         return true;
 }
 
-void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         bool was_hw_scan;
 
-        trace_api_scan_completed(local, aborted);
-
-        mutex_lock(&local->scan_mtx);
+        mutex_lock(&local->mtx);
 
         /*
          * It's ok to abort a not-yet-running scan (that
@@ -267,7 +265,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                 aborted = true;
 
         if (WARN_ON(!local->scan_req)) {
-                mutex_unlock(&local->scan_mtx);
+                mutex_unlock(&local->mtx);
                 return;
         }
 
@@ -275,7 +273,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
                 ieee80211_queue_delayed_work(&local->hw,
                                              &local->scan_work, 0);
-                mutex_unlock(&local->scan_mtx);
+                mutex_unlock(&local->mtx);
                 return;
         }
 
@@ -291,7 +289,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         local->scan_channel = NULL;
 
         /* we only have to protect scan_req and hw/sw scan */
-        mutex_unlock(&local->scan_mtx);
+        mutex_unlock(&local->mtx);
 
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
         if (was_hw_scan)
@@ -304,12 +302,26 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         ieee80211_offchannel_return(local, true);
 
  done:
+        mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
         ieee80211_queue_work(&local->hw, &local->work_work);
 }
+
+void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        trace_api_scan_completed(local, aborted);
+
+        set_bit(SCAN_COMPLETED, &local->scanning);
+        if (aborted)
+                set_bit(SCAN_ABORTED, &local->scanning);
+        ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
+}
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
 static int ieee80211_start_sw_scan(struct ieee80211_local *local)
@@ -447,7 +459,7 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
 
         /* if no more bands/channels left, complete scan and advance to the idle state */
         if (local->scan_channel_idx >= local->scan_req->n_channels) {
-                ieee80211_scan_completed(&local->hw, false);
+                __ieee80211_scan_completed(&local->hw, false);
                 return 1;
         }
 
@@ -639,17 +651,25 @@ void ieee80211_scan_work(struct work_struct *work)
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
         unsigned long next_delay = 0;
 
-        mutex_lock(&local->scan_mtx);
+        if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
+                bool aborted;
+
+                aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
+                __ieee80211_scan_completed(&local->hw, aborted);
+                return;
+        }
+
+        mutex_lock(&local->mtx);
         if (!sdata || !local->scan_req) {
-                mutex_unlock(&local->scan_mtx);
+                mutex_unlock(&local->mtx);
                 return;
         }
 
         if (local->hw_scan_req) {
                 int rc = drv_hw_scan(local, sdata, local->hw_scan_req);
-                mutex_unlock(&local->scan_mtx);
+                mutex_unlock(&local->mtx);
                 if (rc)
-                        ieee80211_scan_completed(&local->hw, true);
+                        __ieee80211_scan_completed(&local->hw, true);
                 return;
         }
 
@@ -661,20 +681,20 @@ void ieee80211_scan_work(struct work_struct *work)
                 local->scan_sdata = NULL;
 
                 rc = __ieee80211_start_scan(sdata, req);
-                mutex_unlock(&local->scan_mtx);
+                mutex_unlock(&local->mtx);
 
                 if (rc)
-                        ieee80211_scan_completed(&local->hw, true);
+                        __ieee80211_scan_completed(&local->hw, true);
                 return;
         }
 
-        mutex_unlock(&local->scan_mtx);
+        mutex_unlock(&local->mtx);
 
         /*
          * Avoid re-scheduling when the sdata is going away.
          */
         if (!ieee80211_sdata_running(sdata)) {
-                ieee80211_scan_completed(&local->hw, true);
+                __ieee80211_scan_completed(&local->hw, true);
                 return;
         }
 
@@ -711,9 +731,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 {
         int res;
 
-        mutex_lock(&sdata->local->scan_mtx);
+        mutex_lock(&sdata->local->mtx);
         res = __ieee80211_start_scan(sdata, req);
-        mutex_unlock(&sdata->local->scan_mtx);
+        mutex_unlock(&sdata->local->mtx);
 
         return res;
 }
@@ -726,7 +746,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         int ret = -EBUSY;
         enum ieee80211_band band;
 
-        mutex_lock(&local->scan_mtx);
+        mutex_lock(&local->mtx);
 
         /* busy scanning */
         if (local->scan_req)
@@ -761,7 +781,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 
         ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
  unlock:
-        mutex_unlock(&local->scan_mtx);
+        mutex_unlock(&local->mtx);
         return ret;
 }
 
@@ -775,11 +795,11 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
          * Only call this function when a scan can't be
          * queued -- mostly at suspend under RTNL.
          */
-        mutex_lock(&local->scan_mtx);
+        mutex_lock(&local->mtx);
         abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
                     (!local->scanning && local->scan_req);
-        mutex_unlock(&local->scan_mtx);
+        mutex_unlock(&local->mtx);
 
         if (abortscan)
-                ieee80211_scan_completed(&local->hw, true);
+                __ieee80211_scan_completed(&local->hw, true);
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 6d86f0c1ad04..44e10a9de0a7 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -125,7 +125,7 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
                 if ((sta->sdata == sdata ||
-                     sta->sdata->bss == sdata->bss) &&
+                     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
@@ -174,8 +174,7 @@ static void __sta_info_free(struct ieee80211_local *local,
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Destroyed STA %pM\n",
-               wiphy_name(local->hw.wiphy), sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Destroyed STA %pM\n", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         kfree(sta);
@@ -262,8 +261,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Allocated STA %pM\n",
-               wiphy_name(local->hw.wiphy), sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Allocated STA %pM\n", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
@@ -282,7 +280,7 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
         unsigned long flags;
         int err = 0;
 
-        WARN_ON(!mutex_is_locked(&local->sta_mtx));
+        lockdep_assert_held(&local->sta_mtx);
 
         /* notify driver */
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -300,8 +298,9 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
                 sta->uploaded = true;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (async)
-                        printk(KERN_DEBUG "%s: Finished adding IBSS STA %pM\n",
-                               wiphy_name(local->hw.wiphy), sta->sta.addr);
+                        wiphy_debug(local->hw.wiphy,
+                                    "Finished adding IBSS STA %pM\n",
+                                    sta->sta.addr);
 #endif
         }
 
@@ -411,8 +410,8 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
                 spin_unlock_irqrestore(&local->sta_lock, flags);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                printk(KERN_DEBUG "%s: Added IBSS STA %pM\n",
-                       wiphy_name(local->hw.wiphy), sta->sta.addr);
+                wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
+                            sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
                 ieee80211_queue_work(&local->hw, &local->sta_finish_work);
@@ -459,8 +458,7 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Inserted STA %pM\n",
-               wiphy_name(local->hw.wiphy), sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Inserted STA %pM\n", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /* move reference to rcu-protected */
@@ -690,8 +688,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 #endif
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Removed STA %pM\n",
-               wiphy_name(local->hw.wiphy), sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Removed STA %pM\n", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
         cancel_work_sync(&sta->drv_unblock_wk);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 54262e72376d..810c5ce98316 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -103,6 +103,7 @@ struct tid_ampdu_tx {
  * @reorder_buf: buffer to reorder incoming aggregated MPDUs
  * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
+ * @reorder_timer: releases expired frames from the reorder buffer.
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
@@ -110,20 +111,25 @@ struct tid_ampdu_tx {
  * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
  * @rcu_head: RCU head used for freeing this struct
+ * @reorder_lock: serializes access to reorder buffer, see below.
  *
  * This structure is protected by RCU and the per-station
  * spinlock. Assignments to the array holding it must hold
- * the spinlock, only the RX path can access it under RCU
- * lock-free. The RX path, since it is single-threaded,
- * can even modify the structure without locking since the
- * only other modifications to it are done when the struct
- * can not yet or no longer be found by the RX path.
+ * the spinlock.
+ *
+ * The @reorder_lock is used to protect the variables and
+ * arrays such as @reorder_buf, @reorder_time, @head_seq_num,
+ * @stored_mpdu_num and @reorder_time from being corrupted by
+ * concurrent access of the RX path and the expired frame
+ * release timer.
  */
 struct tid_ampdu_rx {
         struct rcu_head rcu_head;
+        spinlock_t reorder_lock;
         struct sk_buff **reorder_buf;
         unsigned long *reorder_time;
         struct timer_list session_timer;
+        struct timer_list reorder_timer;
         u16 head_seq_num;
         u16 stored_mpdu_num;
         u16 ssn;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 10caec5ea8fa..571b32bfc54c 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -114,11 +114,10 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (net_ratelimit())
-                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
-                       "queue_len=%d PS=%d @%lu\n",
-                       wiphy_name(local->hw.wiphy),
-                       skb_queue_len(&sta->tx_filtered),
-                       !!test_sta_flags(sta, WLAN_STA_PS_STA), jiffies);
+                wiphy_debug(local->hw.wiphy,
+                            "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
+                            skb_queue_len(&sta->tx_filtered),
+                            !!test_sta_flags(sta, WLAN_STA_PS_STA), jiffies);
 #endif
         dev_kfree_skb(skb);
 }
@@ -296,7 +295,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX)
-                cfg80211_action_tx_status(
+                cfg80211_mgmt_tx_status(
                         skb->dev, (unsigned long) skb, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c54db966926b..e1733dcb58a7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -351,8 +351,8 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 
         local->total_ps_buffered = total;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
-               wiphy_name(local->hw.wiphy), purged);
+        wiphy_debug(local->hw.wiphy, "PS buffers full - purged %d frames\n",
+                    purged);
 #endif
 }
 
@@ -509,6 +509,18 @@ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
+                     tx->sdata->control_port_no_encrypt))
+                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_key *key = NULL;
@@ -527,7 +539,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
-                 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
+                 (tx->skb->protocol != tx->sdata->control_port_protocol) &&
                  !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
                  (!ieee80211_is_robust_mgmt_frame(hdr) ||
                   (ieee80211_is_action(hdr->frame_control) &&
@@ -543,15 +555,16 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key->tx_rx_count++;
                 /* TODO: add threshold stuff again */
 
-                switch (tx->key->conf.alg) {
-                case ALG_WEP:
+                switch (tx->key->conf.cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
                         if (ieee80211_is_auth(hdr->frame_control))
                                 break;
-                case ALG_TKIP:
+                case WLAN_CIPHER_SUITE_TKIP:
                         if (!ieee80211_is_data_present(hdr->frame_control))
                                 tx->key = NULL;
                         break;
-                case ALG_CCMP:
+                case WLAN_CIPHER_SUITE_CCMP:
                         if (!ieee80211_is_data_present(hdr->frame_control) &&
                             !ieee80211_use_mfp(hdr->frame_control, tx->sta,
                                                tx->skb))
@@ -561,7 +574,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                                            IEEE80211_KEY_FLAG_SW_MGMT) &&
                                         ieee80211_is_mgmt(hdr->frame_control);
                         break;
-                case ALG_AES_CMAC:
+                case WLAN_CIPHER_SUITE_AES_CMAC:
                         if (!ieee80211_is_mgmt(hdr->frame_control))
                                 tx->key = NULL;
                         break;
@@ -946,22 +959,31 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         if (!tx->key)
                 return TX_CONTINUE;
 
-        switch (tx->key->conf.alg) {
-        case ALG_WEP:
+        switch (tx->key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
                 return ieee80211_crypto_wep_encrypt(tx);
-        case ALG_TKIP:
+        case WLAN_CIPHER_SUITE_TKIP:
                 return ieee80211_crypto_tkip_encrypt(tx);
-        case ALG_CCMP:
+        case WLAN_CIPHER_SUITE_CCMP:
                 return ieee80211_crypto_ccmp_encrypt(tx);
-        case ALG_AES_CMAC:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
                 return ieee80211_crypto_aes_cmac_encrypt(tx);
+        default:
+                /* handle hw-only algorithm */
+                if (info->control.hw_key) {
+                        ieee80211_tx_set_protected(tx);
+                        return TX_CONTINUE;
+                }
+                break;
+
         }
 
-        /* not reached */
-        WARN_ON(1);
         return TX_DROP;
 }
 
@@ -1339,6 +1361,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         CALL_TXH(ieee80211_tx_h_dynamic_ps);
         CALL_TXH(ieee80211_tx_h_check_assoc);
         CALL_TXH(ieee80211_tx_h_ps_buf);
+        CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
         CALL_TXH(ieee80211_tx_h_select_key);
         if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
                 CALL_TXH(ieee80211_tx_h_rate_ctrl);
@@ -1511,8 +1534,8 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
                 I802_DEBUG_INC(local->tx_expand_skb_head);
 
         if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
-                printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
-                       wiphy_name(local->hw.wiphy));
+                wiphy_debug(local->hw.wiphy,
+                            "failed to reallocate TX buffer\n");
                 return -ENOMEM;
         }
 
@@ -1586,6 +1609,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
+        hdr = (struct ieee80211_hdr *) skb->data;
         info->control.vif = &sdata->vif;
 
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
@@ -1699,7 +1723,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
         struct ieee80211_hdr hdr;
-        struct ieee80211s_hdr mesh_hdr;
+        struct ieee80211s_hdr mesh_hdr __maybe_unused;
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
@@ -1816,7 +1840,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 #endif
         case NL80211_IFTYPE_STATION:
                 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
-                if (sdata->u.mgd.use_4addr && ethertype != ETH_P_PAE) {
+                if (sdata->u.mgd.use_4addr &&
+                    cpu_to_be16(ethertype) != sdata->control_port_protocol) {
                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                         /* RA TA DA SA */
                         memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
@@ -1869,7 +1894,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
                 unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                       !(sta_flags & WLAN_STA_AUTHORIZED) &&
-                      !(ethertype == ETH_P_PAE &&
+                      !(cpu_to_be16(ethertype) == sdata->control_port_protocol &&
                        compare_ether_addr(sdata->vif.addr,
                                           skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -2068,8 +2093,7 @@ void ieee80211_tx_pending(unsigned long data)
 
                 if (skb_queue_empty(&local->pending[i]))
                         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                                netif_tx_wake_queue(
-                                        netdev_get_tx_queue(sdata->dev, i));
+                                netif_wake_subqueue(sdata->dev, i);
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 748387d45bc0..737f4267c335 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -283,8 +283,11 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 
         if (skb_queue_empty(&local->pending[queue])) {
                 rcu_read_lock();
-                list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                        netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue));
+                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                        if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+                                continue;
+                        netif_wake_subqueue(sdata->dev, queue);
+                }
                 rcu_read_unlock();
         } else
                 tasklet_schedule(&local->tx_pending_tasklet);
@@ -323,7 +326,7 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                netif_tx_stop_queue(netdev_get_tx_queue(sdata->dev, queue));
+                netif_stop_subqueue(sdata->dev, queue);
         rcu_read_unlock();
 }
 
@@ -471,16 +474,10 @@ void ieee80211_iterate_active_interfaces(
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
-                case __NL80211_IFTYPE_AFTER_LAST:
-                case NL80211_IFTYPE_UNSPECIFIED:
                 case NL80211_IFTYPE_MONITOR:
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
-                case NL80211_IFTYPE_AP:
-                case NL80211_IFTYPE_STATION:
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_WDS:
-                case NL80211_IFTYPE_MESH_POINT:
+                default:
                         break;
                 }
                 if (ieee80211_sdata_running(sdata))
@@ -505,16 +502,10 @@ void ieee80211_iterate_active_interfaces_atomic(
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
-                case __NL80211_IFTYPE_AFTER_LAST:
-                case NL80211_IFTYPE_UNSPECIFIED:
                 case NL80211_IFTYPE_MONITOR:
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
-                case NL80211_IFTYPE_AP:
-                case NL80211_IFTYPE_STATION:
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_WDS:
-                case NL80211_IFTYPE_MESH_POINT:
+                default:
                         break;
                 }
                 if (ieee80211_sdata_running(sdata))
@@ -1189,7 +1180,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         /* ignore virtual */
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
-                case __NL80211_IFTYPE_AFTER_LAST:
+                case NUM_NL80211_IFTYPES:
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
                         WARN_ON(1);
                         break;
                 }
@@ -1293,9 +1286,9 @@ void ieee80211_recalc_smps(struct ieee80211_local *local,
         int count = 0;
 
         if (forsdata)
-                WARN_ON(!mutex_is_locked(&forsdata->u.mgd.mtx));
+                lockdep_assert_held(&forsdata->u.mgd.mtx);
 
-        WARN_ON(!mutex_is_locked(&local->iflist_mtx));
+        lockdep_assert_held(&local->iflist_mtx);
 
         /*
          * This function could be improved to handle multiple
@@ -1308,7 +1301,7 @@ void ieee80211_recalc_smps(struct ieee80211_local *local,
          */
 
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         goto set;
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 9ebc8d8a1f5b..f27484c22b9f 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -240,7 +240,7 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
 
         keyidx = skb->data[hdrlen + 3] >> 6;
 
-        if (!key || keyidx != key->conf.keyidx || key->conf.alg != ALG_WEP)
+        if (!key || keyidx != key->conf.keyidx)
                 return -1;
 
         klen = 3 + key->conf.keylen;
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 81d4ad64184a..ae344d1ba056 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -43,7 +43,7 @@ enum work_action {
 /* utils */
 static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
 {
-        WARN_ON(!mutex_is_locked(&local->work_mtx));
+        lockdep_assert_held(&local->mtx);
 }
 
 /*
@@ -757,7 +757,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        mutex_lock(&local->work_mtx);
+        mutex_lock(&local->mtx);
 
         list_for_each_entry(wk, &local->work_list, list) {
                 const u8 *bssid = NULL;
@@ -833,7 +833,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                 WARN(1, "unexpected: %d", rma);
         }
 
-        mutex_unlock(&local->work_mtx);
+        mutex_unlock(&local->mtx);
 
         if (rma != WORK_ACT_DONE)
                 goto out;
@@ -845,9 +845,9 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
         case WORK_DONE_REQUEUE:
                 synchronize_rcu();
                 wk->started = false; /* restart */
-                mutex_lock(&local->work_mtx);
+                mutex_lock(&local->mtx);
                 list_add_tail(&wk->list, &local->work_list);
-                mutex_unlock(&local->work_mtx);
+                mutex_unlock(&local->mtx);
         }
 
  out:
@@ -888,9 +888,9 @@ static void ieee80211_work_work(struct work_struct *work)
         while ((skb = skb_dequeue(&local->work_skb_queue)))
                 ieee80211_work_rx_queued_mgmt(local, skb);
 
-        ieee80211_recalc_idle(local);
+        mutex_lock(&local->mtx);
 
-        mutex_lock(&local->work_mtx);
+        ieee80211_recalc_idle(local);
 
         list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
                 bool started = wk->started;
@@ -995,20 +995,16 @@ static void ieee80211_work_work(struct work_struct *work)
                 run_again(local, jiffies + HZ/2);
         }
 
-        mutex_lock(&local->scan_mtx);
-
         if (list_empty(&local->work_list) && local->scan_req &&
             !local->scanning)
                 ieee80211_queue_delayed_work(&local->hw,
                                              &local->scan_work,
                                              round_jiffies_relative(0));
 
-        mutex_unlock(&local->scan_mtx);
-
-        mutex_unlock(&local->work_mtx);
-
         ieee80211_recalc_idle(local);
 
+        mutex_unlock(&local->mtx);
+
         list_for_each_entry_safe(wk, tmp, &free_work, list) {
                 wk->done(wk, NULL);
                 list_del(&wk->list);
@@ -1035,16 +1031,15 @@ void ieee80211_add_work(struct ieee80211_work *wk)
         wk->started = false;
 
         local = wk->sdata->local;
-        mutex_lock(&local->work_mtx);
+        mutex_lock(&local->mtx);
         list_add_tail(&wk->list, &local->work_list);
-        mutex_unlock(&local->work_mtx);
+        mutex_unlock(&local->mtx);
 
         ieee80211_queue_work(&local->hw, &local->work_work);
 }
 
 void ieee80211_work_init(struct ieee80211_local *local)
 {
-        mutex_init(&local->work_mtx);
         INIT_LIST_HEAD(&local->work_list);
         setup_timer(&local->work_timer, ieee80211_work_timer,
                     (unsigned long)local);
@@ -1057,7 +1052,7 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_work *wk;
 
-        mutex_lock(&local->work_mtx);
+        mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {
                 if (wk->sdata != sdata)
                         continue;
@@ -1065,19 +1060,19 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
                 wk->started = true;
                 wk->timeout = jiffies;
         }
-        mutex_unlock(&local->work_mtx);
+        mutex_unlock(&local->mtx);
 
         /* run cleanups etc. */
         ieee80211_work_work(&local->work_work);
 
-        mutex_lock(&local->work_mtx);
+        mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {
                 if (wk->sdata != sdata)
                         continue;
                 WARN_ON(1);
                 break;
         }
-        mutex_unlock(&local->work_mtx);
+        mutex_unlock(&local->mtx);
 }
 
 ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -1163,7 +1158,7 @@ int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_work *wk, *tmp;
         bool found = false;
 
-        mutex_lock(&local->work_mtx);
+        mutex_lock(&local->mtx);
         list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
                 if ((unsigned long) wk == cookie) {
                         wk->timeout = jiffies;
@@ -1171,7 +1166,7 @@ int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
                         break;
                 }
         }
-        mutex_unlock(&local->work_mtx);
+        mutex_unlock(&local->mtx);
 
         if (!found)
                 return -ENOENT;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 8d59d27d887e..43882b36da55 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -36,8 +36,8 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         int tail;
 
         hdr = (struct ieee80211_hdr *)skb->data;
-        if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
-            !ieee80211_is_data_present(hdr->frame_control))
+        if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
+            skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
                 return TX_CONTINUE;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -94,7 +94,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         if (status->flag & RX_FLAG_MMIC_STRIPPED)
                 return RX_CONTINUE;
 
-        if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
+        if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
             !ieee80211_has_protected(hdr->frame_control) ||
             !ieee80211_is_data_present(hdr->frame_control))
                 return RX_CONTINUE;
@@ -221,19 +221,13 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || skb->len - hdrlen < 12)
                 return RX_DROP_UNUSABLE;
 
-        if (status->flag & RX_FLAG_DECRYPTED) {
-                if (status->flag & RX_FLAG_IV_STRIPPED) {
-                        /*
-                         * Hardware took care of all processing, including
-                         * replay protection, and stripped the ICV/IV so
-                         * we cannot do any checks here.
-                         */
-                        return RX_CONTINUE;
-                }
-
-                /* let TKIP code verify IV, but skip decryption */
+        /*
+         * Let TKIP code verify IV, but skip decryption.
+         * In the case where hardware checks the IV as well,
+         * we don't even get here, see ieee80211_rx_h_decrypt()
+         */
+        if (status->flag & RX_FLAG_DECRYPTED)
                 hwaccel = 1;
-        }
 
         res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
                                           key, skb->data + hdrlen,
@@ -447,10 +441,6 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || data_len < 0)
                 return RX_DROP_UNUSABLE;
 
-        if ((status->flag & RX_FLAG_DECRYPTED) &&
-            (status->flag & RX_FLAG_IV_STRIPPED))
-                return RX_CONTINUE;
-
         ccmp_hdr2pn(pn, skb->data + hdrlen);
 
         queue = ieee80211_is_mgmt(hdr->frame_control) ?
@@ -564,10 +554,6 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
         if (!ieee80211_is_mgmt(hdr->frame_control))
                 return RX_CONTINUE;
 
-        if ((status->flag & RX_FLAG_DECRYPTED) &&
-            (status->flag & RX_FLAG_IV_STRIPPED))
-                return RX_CONTINUE;
-
         if (skb->len < 24 + sizeof(*mmie))
                 return RX_DROP_UNUSABLE;
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4c2f89df5cce..0c043b6ce65e 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -40,6 +40,7 @@
 #include <net/udp.h>
 #include <net/icmp.h>                   /* for icmp_send */
 #include <net/route.h>
+#include <net/ip6_checksum.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
@@ -637,10 +638,12 @@ void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
         }
 
         /* And finally the ICMP checksum */
-        icmph->icmp6_cksum = 0;
-        /* TODO IPv6: is this correct for ICMPv6? */
-        ip_vs_checksum_complete(skb, icmp_offset);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        icmph->icmp6_cksum = ~csum_ipv6_magic(&iph->saddr, &iph->daddr,
+                                              skb->len - icmp_offset,
+                                              IPPROTO_ICMPV6, 0);
+        skb->csum_start = skb_network_header(skb) - skb->head + icmp_offset;
+        skb->csum_offset = offsetof(struct icmp6hdr, icmp6_cksum);
+        skb->ip_summed = CHECKSUM_PARTIAL;
 
         if (inout)
                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
@@ -1381,8 +1384,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
         if (af == AF_INET && (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
             cp->protocol == IPPROTO_SCTP) {
                 if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
-                        (atomic_read(&cp->in_pkts) %
-                         sysctl_ip_vs_sync_threshold[1]
+                        (pkts % sysctl_ip_vs_sync_threshold[1]
                          == sysctl_ip_vs_sync_threshold[0])) ||
                                 (cp->old_state != cp->state &&
                                  ((cp->state == IP_VS_SCTP_S_CLOSED) ||
@@ -1393,7 +1395,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
                 }
         }
 
-        if (af == AF_INET &&
+        /* Keep this block last: TCP and others with pp->num_states <= 1 */
+        else if (af == AF_INET &&
             (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
             (((cp->protocol != IPPROTO_TCP ||
                cp->state == IP_VS_TCP_S_ESTABLISHED) &&
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079c422a..ca8ec8c4f311 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -61,7 +61,7 @@ static DEFINE_RWLOCK(__ip_vs_svc_lock);
 static DEFINE_RWLOCK(__ip_vs_rs_lock);
 
 /* lock for state and timeout tables */
-static DEFINE_RWLOCK(__ip_vs_securetcp_lock);
+static DEFINE_SPINLOCK(ip_vs_securetcp_lock);
 
 /* lock for drop entry handling */
 static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
@@ -204,7 +204,7 @@ static void update_defense_level(void)
         spin_unlock(&__ip_vs_droppacket_lock);
 
         /* secure_tcp */
-        write_lock(&__ip_vs_securetcp_lock);
+        spin_lock(&ip_vs_securetcp_lock);
         switch (sysctl_ip_vs_secure_tcp) {
         case 0:
                 if (old_secure_tcp >= 2)
@@ -238,7 +238,7 @@ static void update_defense_level(void)
         old_secure_tcp = sysctl_ip_vs_secure_tcp;
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
-        write_unlock(&__ip_vs_securetcp_lock);
+        spin_unlock(&ip_vs_securetcp_lock);
 
         local_bh_enable();
 }
@@ -843,7 +843,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
                         return -EINVAL;
         }
 
-        dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
+        dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
         if (dest == NULL) {
                 pr_err("%s(): no memory.\n", __func__);
                 return -ENOMEM;
@@ -1177,7 +1177,7 @@ ip_vs_add_service(struct ip_vs_service_user_kern *u,
         }
 #endif
 
-        svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
+        svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
         if (svc == NULL) {
                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
                 ret = -ENOMEM;
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
         if (cmd != IP_VS_SO_SET_ADD
             && (svc == NULL || svc->protocol != usvc.protocol)) {
                 ret = -ESRCH;
-                goto out_unlock;
+                goto out_drop_service;
         }
 
         switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 ret = -EINVAL;
         }
 
+out_drop_service:
         if (svc)
                 ip_vs_service_put(svc);
 
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index bbc1ac795952..727e45b66953 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -35,7 +35,7 @@
 static LIST_HEAD(ip_vs_schedulers);
 
 /* lock for service table */
-static DEFINE_RWLOCK(__ip_vs_sched_lock);
+static DEFINE_SPINLOCK(ip_vs_sched_lock);
 
 
 /*
@@ -108,7 +108,7 @@ static struct ip_vs_scheduler *ip_vs_sched_getbyname(const char *sched_name)
 
         IP_VS_DBG(2, "%s(): sched_name \"%s\"\n", __func__, sched_name);
 
-        read_lock_bh(&__ip_vs_sched_lock);
+        spin_lock_bh(&ip_vs_sched_lock);
 
         list_for_each_entry(sched, &ip_vs_schedulers, n_list) {
                 /*
@@ -122,14 +122,14 @@ static struct ip_vs_scheduler *ip_vs_sched_getbyname(const char *sched_name)
                 }
                 if (strcmp(sched_name, sched->name)==0) {
                         /* HIT */
-                        read_unlock_bh(&__ip_vs_sched_lock);
+                        spin_unlock_bh(&ip_vs_sched_lock);
                         return sched;
                 }
                 if (sched->module)
                         module_put(sched->module);
         }
 
-        read_unlock_bh(&__ip_vs_sched_lock);
+        spin_unlock_bh(&ip_vs_sched_lock);
         return NULL;
 }
 
@@ -184,10 +184,10 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         /* increase the module use count */
         ip_vs_use_count_inc();
 
-        write_lock_bh(&__ip_vs_sched_lock);
+        spin_lock_bh(&ip_vs_sched_lock);
 
         if (!list_empty(&scheduler->n_list)) {
-                write_unlock_bh(&__ip_vs_sched_lock);
+                spin_unlock_bh(&ip_vs_sched_lock);
                 ip_vs_use_count_dec();
                 pr_err("%s(): [%s] scheduler already linked\n",
                        __func__, scheduler->name);
@@ -200,7 +200,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
          */
         list_for_each_entry(sched, &ip_vs_schedulers, n_list) {
                 if (strcmp(scheduler->name, sched->name) == 0) {
-                        write_unlock_bh(&__ip_vs_sched_lock);
+                        spin_unlock_bh(&ip_vs_sched_lock);
                         ip_vs_use_count_dec();
                         pr_err("%s(): [%s] scheduler already existed "
                                "in the system\n", __func__, scheduler->name);
@@ -211,7 +211,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
          *      Add it into the d-linked scheduler list
          */
         list_add(&scheduler->n_list, &ip_vs_schedulers);
-        write_unlock_bh(&__ip_vs_sched_lock);
+        spin_unlock_bh(&ip_vs_sched_lock);
 
         pr_info("[%s] scheduler registered.\n", scheduler->name);
 
@@ -229,9 +229,9 @@ int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
                 return -EINVAL;
         }
 
-        write_lock_bh(&__ip_vs_sched_lock);
+        spin_lock_bh(&ip_vs_sched_lock);
         if (list_empty(&scheduler->n_list)) {
-                write_unlock_bh(&__ip_vs_sched_lock);
+                spin_unlock_bh(&ip_vs_sched_lock);
                 pr_err("%s(): [%s] scheduler is not in the list. failed\n",
                        __func__, scheduler->name);
                 return -EINVAL;
@@ -241,7 +241,7 @@ int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
          *      Remove it from the d-linked scheduler list
          */
         list_del(&scheduler->n_list);
-        write_unlock_bh(&__ip_vs_sched_lock);
+        spin_unlock_bh(&ip_vs_sched_lock);
 
         /* decrease the module use count */
         ip_vs_use_count_dec();
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index b46a8390896d..9228ee0dc11a 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -448,6 +448,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 {
         __be16 _ports[2], *ports;
         u8 nexthdr;
+        int poff;
 
         memset(dst, 0, sizeof(*dst));
 
@@ -492,19 +493,13 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                 return 0;
         }
 
-        switch (nexthdr) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE:
-        case IPPROTO_SCTP:
-        case IPPROTO_DCCP:
-                ports = skb_header_pointer(skb, protoff, sizeof(_ports),
+        poff = proto_ports_offset(nexthdr);
+        if (poff >= 0) {
+                ports = skb_header_pointer(skb, protoff + poff, sizeof(_ports),
                                            &_ports);
-                break;
-        default:
+        } else {
                 _ports[0] = _ports[1] = 0;
                 ports = _ports;
-                break;
         }
         if (!ports)
                 return -1;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9a17f28b1253..3616f27b9d46 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -488,7 +488,7 @@ retry:
         skb->dev = dev;
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        err = sock_tx_timestamp(msg, sk, skb_tx(skb));
+        err = sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
         if (err < 0)
                 goto out_unlock;
 
@@ -1209,7 +1209,7 @@ static int packet_snd(struct socket *sock,
         err = skb_copy_datagram_from_iovec(skb, offset, msg->msg_iov, 0, len);
         if (err)
                 goto out_free;
-        err = sock_tx_timestamp(msg, sk, skb_tx(skb));
+        err = sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
         if (err < 0)
                 goto out_free;
 
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 73aee7f2fcdc..fd95beb72f5d 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -251,6 +251,16 @@ int pn_skb_send(struct sock *sk, struct sk_buff *skb,
         else if (phonet_address_lookup(net, daddr) == 0) {
                 dev = phonet_device_get(net);
                 skb->pkt_type = PACKET_LOOPBACK;
+        } else if (pn_sockaddr_get_object(target) == 0) {
+                /* Resource routing (small race until phonet_rcv()) */
+                struct sock *sk = pn_find_sock_by_res(net,
+                                                        target->spn_resource);
+                if (sk) {
+                        sock_put(sk);
+                        dev = phonet_device_get(net);
+                        skb->pkt_type = PACKET_LOOPBACK;
+                } else
+                        dev = phonet_route_output(net, daddr);
         } else
                 dev = phonet_route_output(net, daddr);
 
@@ -383,6 +393,13 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                 goto out;
         }
 
+        /* resource routing */
+        if (pn_sockaddr_get_object(&sa) == 0) {
+                struct sock *sk = pn_find_sock_by_res(net, sa.spn_resource);
+                if (sk)
+                        return sk_receive_skb(sk, skb, 0);
+        }
+
         /* check if we are the destination */
         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
                 /* Phonet packet input */
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 1bd38db4fe1e..2f032381bd45 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -52,6 +52,19 @@ static int pn_ioctl(struct sock *sk, int cmd, unsigned long arg)
                 answ = skb ? skb->len : 0;
                 release_sock(sk);
                 return put_user(answ, (int __user *)arg);
+
+        case SIOCPNADDRESOURCE:
+        case SIOCPNDELRESOURCE: {
+                        u32 res;
+                        if (get_user(res, (u32 __user *)arg))
+                                return -EFAULT;
+                        if (res >= 256)
+                                return -EINVAL;
+                        if (cmd == SIOCPNADDRESOURCE)
+                                return pn_sock_bind_res(sk, res);
+                        else
+                                return pn_sock_unbind_res(sk, res);
+                }
         }
 
         return -ENOIOCTLCMD;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b2a3ae6cad78..d0e7eb24c8b9 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -620,6 +620,28 @@ drop:
         return err;
 }
 
+static int pipe_do_remove(struct sock *sk)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        struct pnpipehdr *ph;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(MAX_PNPIPE_HEADER, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, MAX_PNPIPE_HEADER);
+        __skb_push(skb, sizeof(*ph));
+        skb_reset_transport_header(skb);
+        ph = pnp_hdr(skb);
+        ph->utid = 0;
+        ph->message_id = PNS_PIPE_REMOVE_REQ;
+        ph->pipe_handle = pn->pipe_handle;
+        ph->data[0] = PAD;
+
+        return pn_skb_send(sk, skb, &pipe_srv);
+}
+
 /* associated socket ceases to exist */
 static void pep_sock_close(struct sock *sk, long timeout)
 {
@@ -638,7 +660,10 @@ static void pep_sock_close(struct sock *sk, long timeout)
                 sk_for_each_safe(sknode, p, n, &pn->ackq)
                         sk_del_node_init(sknode);
                 sk->sk_state = TCP_CLOSE;
-        }
+        } else if ((1 << sk->sk_state) & (TCPF_SYN_RECV|TCPF_ESTABLISHED))
+                /* Forcefully remove dangling Phonet pipe */
+                pipe_do_remove(sk);
+
         ifindex = pn->ifindex;
         pn->ifindex = 0;
         release_sock(sk);
@@ -834,6 +859,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
 {
         struct pep_sock *pn = pep_sk(sk);
         struct pnpipehdr *ph;
+        int err;
 
         if (pn_flow_safe(pn->tx_fc) &&
             !atomic_add_unless(&pn->tx_credits, -1, 0)) {
@@ -852,7 +878,10 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
                 ph->message_id = PNS_PIPE_DATA;
         ph->pipe_handle = pn->pipe_handle;
 
-        return pn_skb_send(sk, skb, &pipe_srv);
+        err = pn_skb_send(sk, skb, &pipe_srv);
+        if (err && pn_flow_safe(pn->tx_fc))
+                atomic_inc(&pn->tx_credits);
+        return err;
 }
 
 static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
@@ -872,7 +901,7 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
                                         flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return -ENOBUFS;
+                return err;
 
         skb_reserve(skb, MAX_PHONET_HEADER + 3);
         err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b18e48fae975..947038ddd04c 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -292,8 +292,7 @@ static void phonet_route_autodel(struct net_device *dev)
         if (bitmap_empty(deleted, 64))
                 return; /* short-circuit RCU */
         synchronize_rcu();
-        for (i = find_first_bit(deleted, 64); i < 64;
-                        i = find_next_bit(deleted, 64, i + 1)) {
+        for_each_set_bit(i, deleted, 64) {
                 rtm_phonet_notify(RTM_DELROUTE, dev, i);
                 dev_put(dev);
         }
@@ -374,6 +373,7 @@ int __init phonet_device_init(void)
         if (err)
                 return err;
 
+        proc_net_fops_create(&init_net, "pnresource", 0, &pn_res_seq_fops);
         register_netdevice_notifier(&phonet_device_notifier);
         err = phonet_netlink_register();
         if (err)
@@ -386,6 +386,7 @@ void phonet_device_exit(void)
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
         unregister_pernet_device(&phonet_net_ops);
+        proc_net_remove(&init_net, "pnresource");
 }
 
 int phonet_route_add(struct net_device *dev, u8 daddr)
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 6e9848bf0370..aca8fba099e9 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -158,6 +158,7 @@ void pn_sock_unhash(struct sock *sk)
         spin_lock_bh(&pnsocks.lock);
         sk_del_node_init(sk);
         spin_unlock_bh(&pnsocks.lock);
+        pn_sock_unbind_all_res(sk);
 }
 EXPORT_SYMBOL(pn_sock_unhash);
 
@@ -281,7 +282,9 @@ static unsigned int pn_socket_poll(struct file *file, struct socket *sock,
         if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
                 return POLLHUP;
 
-        if (sk->sk_state == TCP_ESTABLISHED && atomic_read(&pn->tx_credits))
+        if (sk->sk_state == TCP_ESTABLISHED &&
+                atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf &&
+                atomic_read(&pn->tx_credits))
                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
 
         return mask;
@@ -563,3 +566,188 @@ const struct file_operations pn_sock_seq_fops = {
         .release = seq_release_net,
 };
 #endif
+
+static struct  {
+        struct sock *sk[256];
+} pnres;
+
+/*
+ * Find and hold socket based on resource.
+ */
+struct sock *pn_find_sock_by_res(struct net *net, u8 res)
+{
+        struct sock *sk;
+
+        if (!net_eq(net, &init_net))
+                return NULL;
+
+        rcu_read_lock();
+        sk = rcu_dereference(pnres.sk[res]);
+        if (sk)
+                sock_hold(sk);
+        rcu_read_unlock();
+        return sk;
+}
+
+static DEFINE_MUTEX(resource_mutex);
+
+int pn_sock_bind_res(struct sock *sk, u8 res)
+{
+        int ret = -EADDRINUSE;
+
+        if (!net_eq(sock_net(sk), &init_net))
+                return -ENOIOCTLCMD;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+        if (pn_socket_autobind(sk->sk_socket))
+                return -EAGAIN;
+
+        mutex_lock(&resource_mutex);
+        if (pnres.sk[res] == NULL) {
+                sock_hold(sk);
+                rcu_assign_pointer(pnres.sk[res], sk);
+                ret = 0;
+        }
+        mutex_unlock(&resource_mutex);
+        return ret;
+}
+
+int pn_sock_unbind_res(struct sock *sk, u8 res)
+{
+        int ret = -ENOENT;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        mutex_lock(&resource_mutex);
+        if (pnres.sk[res] == sk) {
+                rcu_assign_pointer(pnres.sk[res], NULL);
+                ret = 0;
+        }
+        mutex_unlock(&resource_mutex);
+
+        if (ret == 0) {
+                synchronize_rcu();
+                sock_put(sk);
+        }
+        return ret;
+}
+
+void pn_sock_unbind_all_res(struct sock *sk)
+{
+        unsigned res, match = 0;
+
+        mutex_lock(&resource_mutex);
+        for (res = 0; res < 256; res++) {
+                if (pnres.sk[res] == sk) {
+                        rcu_assign_pointer(pnres.sk[res], NULL);
+                        match++;
+                }
+        }
+        mutex_unlock(&resource_mutex);
+
+        if (match == 0)
+                return;
+        synchronize_rcu();
+        while (match > 0) {
+                sock_put(sk);
+                match--;
+        }
+}
+
+#ifdef CONFIG_PROC_FS
+static struct sock **pn_res_get_idx(struct seq_file *seq, loff_t pos)
+{
+        struct net *net = seq_file_net(seq);
+        unsigned i;
+
+        if (!net_eq(net, &init_net))
+                return NULL;
+
+        for (i = 0; i < 256; i++) {
+                if (pnres.sk[i] == NULL)
+                        continue;
+                if (!pos)
+                        return pnres.sk + i;
+                pos--;
+        }
+        return NULL;
+}
+
+static struct sock **pn_res_get_next(struct seq_file *seq, struct sock **sk)
+{
+        struct net *net = seq_file_net(seq);
+        unsigned i;
+
+        BUG_ON(!net_eq(net, &init_net));
+
+        for (i = (sk - pnres.sk) + 1; i < 256; i++)
+                if (pnres.sk[i])
+                        return pnres.sk + i;
+        return NULL;
+}
+
+static void *pn_res_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(resource_mutex)
+{
+        mutex_lock(&resource_mutex);
+        return *pos ? pn_res_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+}
+
+static void *pn_res_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct sock **sk;
+
+        if (v == SEQ_START_TOKEN)
+                sk = pn_res_get_idx(seq, 0);
+        else
+                sk = pn_res_get_next(seq, v);
+        (*pos)++;
+        return sk;
+}
+
+static void pn_res_seq_stop(struct seq_file *seq, void *v)
+        __releases(resource_mutex)
+{
+        mutex_unlock(&resource_mutex);
+}
+
+static int pn_res_seq_show(struct seq_file *seq, void *v)
+{
+        int len;
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%s%n", "rs   uid inode", &len);
+        else {
+                struct sock **psk = v;
+                struct sock *sk = *psk;
+
+                seq_printf(seq, "%02X %5d %lu%n",
+                           (int) (psk - pnres.sk), sock_i_uid(sk),
+                           sock_i_ino(sk), &len);
+        }
+        seq_printf(seq, "%*s\n", 63 - len, "");
+        return 0;
+}
+
+static const struct seq_operations pn_res_seq_ops = {
+        .start = pn_res_seq_start,
+        .next = pn_res_seq_next,
+        .stop = pn_res_seq_stop,
+        .show = pn_res_seq_show,
+};
+
+static int pn_res_open(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &pn_res_seq_ops,
+                                sizeof(struct seq_net_private));
+}
+
+const struct file_operations pn_res_seq_fops = {
+        .owner = THIS_MODULE,
+        .open = pn_res_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release_net,
+};
+#endif
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index aebfecbdb841..bb6ad81b671d 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -39,7 +39,15 @@
 #include <net/sock.h>
 
 #include "rds.h"
-#include "rdma.h"
+
+char *rds_str_array(char **array, size_t elements, size_t index)
+{
+        if ((index < elements) && array[index])
+                return array[index];
+        else
+                return "unknown";
+}
+EXPORT_SYMBOL(rds_str_array);
 
 /* this is just used for stats gathering :/ */
 static DEFINE_SPINLOCK(rds_sock_lock);
@@ -62,7 +70,7 @@ static int rds_release(struct socket *sock)
         struct rds_sock *rs;
         unsigned long flags;
 
-        if (sk == NULL)
+        if (!sk)
                 goto out;
 
         rs = rds_sk_to_rs(sk);
@@ -73,7 +81,15 @@ static int rds_release(struct socket *sock)
          * with the socket. */
         rds_clear_recv_queue(rs);
         rds_cong_remove_socket(rs);
+
+        /*
+         * the binding lookup hash uses rcu, we need to
+         * make sure we sychronize_rcu before we free our
+         * entry
+         */
         rds_remove_bound(rs);
+        synchronize_rcu();
+
         rds_send_drop_to(rs, NULL);
         rds_rdma_drop_keys(rs);
         rds_notify_queue_get(rs, NULL);
@@ -83,6 +99,8 @@ static int rds_release(struct socket *sock)
         rds_sock_count--;
         spin_unlock_irqrestore(&rds_sock_lock, flags);
 
+        rds_trans_put(rs->rs_transport);
+
         sock->sk = NULL;
         sock_put(sk);
 out:
@@ -514,7 +532,7 @@ out:
         spin_unlock_irqrestore(&rds_sock_lock, flags);
 }
 
-static void __exit rds_exit(void)
+static void rds_exit(void)
 {
         sock_unregister(rds_family_ops.family);
         proto_unregister(&rds_proto);
@@ -529,7 +547,7 @@ static void __exit rds_exit(void)
 }
 module_exit(rds_exit);
 
-static int __init rds_init(void)
+static int rds_init(void)
 {
         int ret;
 
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 5d95fc007f1a..2f6b3fcc79f8 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -34,45 +34,52 @@
 #include <net/sock.h>
 #include <linux/in.h>
 #include <linux/if_arp.h>
+#include <linux/jhash.h>
 #include "rds.h"
 
-/*
- * XXX this probably still needs more work.. no INADDR_ANY, and rbtrees aren't
- * particularly zippy.
- *
- * This is now called for every incoming frame so we arguably care much more
- * about it than we used to.
- */
+#define BIND_HASH_SIZE 1024
+static struct hlist_head bind_hash_table[BIND_HASH_SIZE];
 static DEFINE_SPINLOCK(rds_bind_lock);
-static struct rb_root rds_bind_tree = RB_ROOT;
 
-static struct rds_sock *rds_bind_tree_walk(__be32 addr, __be16 port,
-                                           struct rds_sock *insert)
+static struct hlist_head *hash_to_bucket(__be32 addr, __be16 port)
+{
+        return bind_hash_table + (jhash_2words((u32)addr, (u32)port, 0) &
+                                  (BIND_HASH_SIZE - 1));
+}
+
+static struct rds_sock *rds_bind_lookup(__be32 addr, __be16 port,
+                                        struct rds_sock *insert)
 {
-        struct rb_node **p = &rds_bind_tree.rb_node;
-        struct rb_node *parent = NULL;
         struct rds_sock *rs;
+        struct hlist_node *node;
+        struct hlist_head *head = hash_to_bucket(addr, port);
         u64 cmp;
         u64 needle = ((u64)be32_to_cpu(addr) << 32) | be16_to_cpu(port);
 
-        while (*p) {
-                parent = *p;
-                rs = rb_entry(parent, struct rds_sock, rs_bound_node);
-
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(rs, node, head, rs_bound_node) {
                 cmp = ((u64)be32_to_cpu(rs->rs_bound_addr) << 32) |
                       be16_to_cpu(rs->rs_bound_port);
 
-                if (needle < cmp)
-                        p = &(*p)->rb_left;
-                else if (needle > cmp)
-                        p = &(*p)->rb_right;
-                else
+                if (cmp == needle) {
+                        rcu_read_unlock();
                         return rs;
+                }
         }
+        rcu_read_unlock();
 
         if (insert) {
-                rb_link_node(&insert->rs_bound_node, parent, p);
-                rb_insert_color(&insert->rs_bound_node, &rds_bind_tree);
+                /*
+                 * make sure our addr and port are set before
+                 * we are added to the list, other people
+                 * in rcu will find us as soon as the
+                 * hlist_add_head_rcu is done
+                 */
+                insert->rs_bound_addr = addr;
+                insert->rs_bound_port = port;
+                rds_sock_addref(insert);
+
+                hlist_add_head_rcu(&insert->rs_bound_node, head);
         }
         return NULL;
 }
@@ -86,15 +93,13 @@ static struct rds_sock *rds_bind_tree_walk(__be32 addr, __be16 port,
 struct rds_sock *rds_find_bound(__be32 addr, __be16 port)
 {
         struct rds_sock *rs;
-        unsigned long flags;
 
-        spin_lock_irqsave(&rds_bind_lock, flags);
-        rs = rds_bind_tree_walk(addr, port, NULL);
+        rs = rds_bind_lookup(addr, port, NULL);
+
         if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
                 rds_sock_addref(rs);
         else
                 rs = NULL;
-        spin_unlock_irqrestore(&rds_bind_lock, flags);
 
         rdsdebug("returning rs %p for %pI4:%u\n", rs, &addr,
                 ntohs(port));
@@ -121,22 +126,15 @@ static int rds_add_bound(struct rds_sock *rs, __be32 addr, __be16 *port)
         do {
                 if (rover == 0)
                         rover++;
-                if (rds_bind_tree_walk(addr, cpu_to_be16(rover), rs) == NULL) {
-                        *port = cpu_to_be16(rover);
+                if (!rds_bind_lookup(addr, cpu_to_be16(rover), rs)) {
+                        *port = rs->rs_bound_port;
                         ret = 0;
+                        rdsdebug("rs %p binding to %pI4:%d\n",
+                          rs, &addr, (int)ntohs(*port));
                         break;
                 }
         } while (rover++ != last);
 
-        if (ret == 0)  {
-                rs->rs_bound_addr = addr;
-                rs->rs_bound_port = *port;
-                rds_sock_addref(rs);
-
-                rdsdebug("rs %p binding to %pI4:%d\n",
-                  rs, &addr, (int)ntohs(*port));
-        }
-
         spin_unlock_irqrestore(&rds_bind_lock, flags);
 
         return ret;
@@ -153,7 +151,7 @@ void rds_remove_bound(struct rds_sock *rs)
                   rs, &rs->rs_bound_addr,
                   ntohs(rs->rs_bound_port));
 
-                rb_erase(&rs->rs_bound_node, &rds_bind_tree);
+                hlist_del_init_rcu(&rs->rs_bound_node);
                 rds_sock_put(rs);
                 rs->rs_bound_addr = 0;
         }
@@ -184,7 +182,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
 
         trans = rds_trans_get_preferred(sin->sin_addr.s_addr);
-        if (trans == NULL) {
+        if (!trans) {
                 ret = -EADDRNOTAVAIL;
                 rds_remove_bound(rs);
                 if (printk_ratelimit())
@@ -198,5 +196,9 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
 out:
         release_sock(sk);
+
+        /* we might have called rds_remove_bound on error */
+        if (ret)
+                synchronize_rcu();
         return ret;
 }
diff --git a/net/rds/cong.c b/net/rds/cong.c
index 0871a29f0780..75ea686f27d5 100644
--- a/net/rds/cong.c
+++ b/net/rds/cong.c
@@ -141,7 +141,7 @@ static struct rds_cong_map *rds_cong_from_addr(__be32 addr)
         unsigned long flags;
 
         map = kzalloc(sizeof(struct rds_cong_map), GFP_KERNEL);
-        if (map == NULL)
+        if (!map)
                 return NULL;
 
         map->m_addr = addr;
@@ -159,7 +159,7 @@ static struct rds_cong_map *rds_cong_from_addr(__be32 addr)
         ret = rds_cong_tree_walk(addr, map);
         spin_unlock_irqrestore(&rds_cong_lock, flags);
 
-        if (ret == NULL) {
+        if (!ret) {
                 ret = map;
                 map = NULL;
         }
@@ -205,7 +205,7 @@ int rds_cong_get_maps(struct rds_connection *conn)
         conn->c_lcong = rds_cong_from_addr(conn->c_laddr);
         conn->c_fcong = rds_cong_from_addr(conn->c_faddr);
 
-        if (conn->c_lcong == NULL || conn->c_fcong == NULL)
+        if (!(conn->c_lcong && conn->c_fcong))
                 return -ENOMEM;
 
         return 0;
@@ -221,7 +221,7 @@ void rds_cong_queue_updates(struct rds_cong_map *map)
         list_for_each_entry(conn, &map->m_conn_list, c_map_item) {
                 if (!test_and_set_bit(0, &conn->c_map_queued)) {
                         rds_stats_inc(s_cong_update_queued);
-                        queue_delayed_work(rds_wq, &conn->c_send_w, 0);
+                        rds_send_xmit(conn);
                 }
         }
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 7619b671ca28..870992e08cae 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -37,7 +37,6 @@
 
 #include "rds.h"
 #include "loop.h"
-#include "rdma.h"
 
 #define RDS_CONNECTION_HASH_BITS 12
 #define RDS_CONNECTION_HASH_ENTRIES (1 << RDS_CONNECTION_HASH_BITS)
@@ -63,18 +62,7 @@ static struct hlist_head *rds_conn_bucket(__be32 laddr, __be32 faddr)
                 var |= RDS_INFO_CONNECTION_FLAG_##suffix;       \
 } while (0)
 
-static inline int rds_conn_is_sending(struct rds_connection *conn)
-{
-        int ret = 0;
-
-        if (!mutex_trylock(&conn->c_send_lock))
-                ret = 1;
-        else
-                mutex_unlock(&conn->c_send_lock);
-
-        return ret;
-}
-
+/* rcu read lock must be held or the connection spinlock */
 static struct rds_connection *rds_conn_lookup(struct hlist_head *head,
                                               __be32 laddr, __be32 faddr,
                                               struct rds_transport *trans)
@@ -82,7 +70,7 @@ static struct rds_connection *rds_conn_lookup(struct hlist_head *head,
         struct rds_connection *conn, *ret = NULL;
         struct hlist_node *pos;
 
-        hlist_for_each_entry(conn, pos, head, c_hash_node) {
+        hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
                 if (conn->c_faddr == faddr && conn->c_laddr == laddr &&
                                 conn->c_trans == trans) {
                         ret = conn;
@@ -129,10 +117,11 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
 {
         struct rds_connection *conn, *parent = NULL;
         struct hlist_head *head = rds_conn_bucket(laddr, faddr);
+        struct rds_transport *loop_trans;
         unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&rds_conn_lock, flags);
+        rcu_read_lock();
         conn = rds_conn_lookup(head, laddr, faddr, trans);
         if (conn && conn->c_loopback && conn->c_trans != &rds_loop_transport &&
             !is_outgoing) {
@@ -143,12 +132,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
                 parent = conn;
                 conn = parent->c_passive;
         }
-        spin_unlock_irqrestore(&rds_conn_lock, flags);
+        rcu_read_unlock();
         if (conn)
                 goto out;
 
         conn = kmem_cache_zalloc(rds_conn_slab, gfp);
-        if (conn == NULL) {
+        if (!conn) {
                 conn = ERR_PTR(-ENOMEM);
                 goto out;
         }
@@ -159,7 +148,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
         spin_lock_init(&conn->c_lock);
         conn->c_next_tx_seq = 1;
 
-        mutex_init(&conn->c_send_lock);
+        init_waitqueue_head(&conn->c_waitq);
         INIT_LIST_HEAD(&conn->c_send_queue);
         INIT_LIST_HEAD(&conn->c_retrans);
 
@@ -175,7 +164,9 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
          * can bind to the destination address then we'd rather the messages
          * flow through loopback rather than either transport.
          */
-        if (rds_trans_get_preferred(faddr)) {
+        loop_trans = rds_trans_get_preferred(faddr);
+        if (loop_trans) {
+                rds_trans_put(loop_trans);
                 conn->c_loopback = 1;
                 if (is_outgoing && trans->t_prefer_loopback) {
                         /* "outgoing" connection - and the transport
@@ -238,7 +229,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
                         kmem_cache_free(rds_conn_slab, conn);
                         conn = found;
                 } else {
-                        hlist_add_head(&conn->c_hash_node, head);
+                        hlist_add_head_rcu(&conn->c_hash_node, head);
                         rds_cong_add_conn(conn);
                         rds_conn_count++;
                 }
@@ -263,21 +254,91 @@ struct rds_connection *rds_conn_create_outgoing(__be32 laddr, __be32 faddr,
 }
 EXPORT_SYMBOL_GPL(rds_conn_create_outgoing);
 
+void rds_conn_shutdown(struct rds_connection *conn)
+{
+        /* shut it down unless it's down already */
+        if (!rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_DOWN)) {
+                /*
+                 * Quiesce the connection mgmt handlers before we start tearing
+                 * things down. We don't hold the mutex for the entire
+                 * duration of the shutdown operation, else we may be
+                 * deadlocking with the CM handler. Instead, the CM event
+                 * handler is supposed to check for state DISCONNECTING
+                 */
+                mutex_lock(&conn->c_cm_lock);
+                if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING)
+                 && !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) {
+                        rds_conn_error(conn, "shutdown called in state %d\n",
+                                        atomic_read(&conn->c_state));
+                        mutex_unlock(&conn->c_cm_lock);
+                        return;
+                }
+                mutex_unlock(&conn->c_cm_lock);
+
+                wait_event(conn->c_waitq,
+                           !test_bit(RDS_IN_XMIT, &conn->c_flags));
+
+                conn->c_trans->conn_shutdown(conn);
+                rds_conn_reset(conn);
+
+                if (!rds_conn_transition(conn, RDS_CONN_DISCONNECTING, RDS_CONN_DOWN)) {
+                        /* This can happen - eg when we're in the middle of tearing
+                         * down the connection, and someone unloads the rds module.
+                         * Quite reproduceable with loopback connections.
+                         * Mostly harmless.
+                         */
+                        rds_conn_error(conn,
+                                "%s: failed to transition to state DOWN, "
+                                "current state is %d\n",
+                                __func__,
+                                atomic_read(&conn->c_state));
+                        return;
+                }
+        }
+
+        /* Then reconnect if it's still live.
+         * The passive side of an IB loopback connection is never added
+         * to the conn hash, so we never trigger a reconnect on this
+         * conn - the reconnect is always triggered by the active peer. */
+        cancel_delayed_work_sync(&conn->c_conn_w);
+        rcu_read_lock();
+        if (!hlist_unhashed(&conn->c_hash_node)) {
+                rcu_read_unlock();
+                rds_queue_reconnect(conn);
+        } else {
+                rcu_read_unlock();
+        }
+}
+
+/*
+ * Stop and free a connection.
+ *
+ * This can only be used in very limited circumstances.  It assumes that once
+ * the conn has been shutdown that no one else is referencing the connection.
+ * We can only ensure this in the rmmod path in the current code.
+ */
 void rds_conn_destroy(struct rds_connection *conn)
 {
         struct rds_message *rm, *rtmp;
+        unsigned long flags;
 
         rdsdebug("freeing conn %p for %pI4 -> "
                  "%pI4\n", conn, &conn->c_laddr,
                  &conn->c_faddr);
 
-        hlist_del_init(&conn->c_hash_node);
+        /* Ensure conn will not be scheduled for reconnect */
+        spin_lock_irq(&rds_conn_lock);
+        hlist_del_init_rcu(&conn->c_hash_node);
+        spin_unlock_irq(&rds_conn_lock);
+        synchronize_rcu();
 
-        /* wait for the rds thread to shut it down */
-        atomic_set(&conn->c_state, RDS_CONN_ERROR);
-        cancel_delayed_work(&conn->c_conn_w);
-        queue_work(rds_wq, &conn->c_down_w);
-        flush_workqueue(rds_wq);
+        /* shut the connection down */
+        rds_conn_drop(conn);
+        flush_work(&conn->c_down_w);
+
+        /* make sure lingering queued work won't try to ref the conn */
+        cancel_delayed_work_sync(&conn->c_send_w);
+        cancel_delayed_work_sync(&conn->c_recv_w);
 
         /* tear down queued messages */
         list_for_each_entry_safe(rm, rtmp,
@@ -302,7 +363,9 @@ void rds_conn_destroy(struct rds_connection *conn)
         BUG_ON(!list_empty(&conn->c_retrans));
         kmem_cache_free(rds_conn_slab, conn);
 
+        spin_lock_irqsave(&rds_conn_lock, flags);
         rds_conn_count--;
+        spin_unlock_irqrestore(&rds_conn_lock, flags);
 }
 EXPORT_SYMBOL_GPL(rds_conn_destroy);
 
@@ -316,23 +379,23 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
         struct list_head *list;
         struct rds_connection *conn;
         struct rds_message *rm;
-        unsigned long flags;
         unsigned int total = 0;
+        unsigned long flags;
         size_t i;
 
         len /= sizeof(struct rds_info_message);
 
-        spin_lock_irqsave(&rds_conn_lock, flags);
+        rcu_read_lock();
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry(conn, pos, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
                         if (want_send)
                                 list = &conn->c_send_queue;
                         else
                                 list = &conn->c_retrans;
 
-                        spin_lock(&conn->c_lock);
+                        spin_lock_irqsave(&conn->c_lock, flags);
 
                         /* XXX too lazy to maintain counts.. */
                         list_for_each_entry(rm, list, m_conn_item) {
@@ -343,11 +406,10 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
                                                           conn->c_faddr, 0);
                         }
 
-                        spin_unlock(&conn->c_lock);
+                        spin_unlock_irqrestore(&conn->c_lock, flags);
                 }
         }
-
-        spin_unlock_irqrestore(&rds_conn_lock, flags);
+        rcu_read_unlock();
 
         lens->nr = total;
         lens->each = sizeof(struct rds_info_message);
@@ -377,19 +439,17 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
         uint64_t buffer[(item_len + 7) / 8];
         struct hlist_head *head;
         struct hlist_node *pos;
-        struct hlist_node *tmp;
         struct rds_connection *conn;
-        unsigned long flags;
         size_t i;
 
-        spin_lock_irqsave(&rds_conn_lock, flags);
+        rcu_read_lock();
 
         lens->nr = 0;
         lens->each = item_len;
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry_safe(conn, pos, tmp, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
 
                         /* XXX no c_lock usage.. */
                         if (!visitor(conn, buffer))
@@ -405,8 +465,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
                         lens->nr++;
                 }
         }
-
-        spin_unlock_irqrestore(&rds_conn_lock, flags);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(rds_for_each_conn_info);
 
@@ -423,8 +482,8 @@ static int rds_conn_info_visitor(struct rds_connection *conn,
                 sizeof(cinfo->transport));
         cinfo->flags = 0;
 
-        rds_conn_info_set(cinfo->flags,
-                          rds_conn_is_sending(conn), SENDING);
+        rds_conn_info_set(cinfo->flags, test_bit(RDS_IN_XMIT, &conn->c_flags),
+                          SENDING);
         /* XXX Future: return the state rather than these funky bits */
         rds_conn_info_set(cinfo->flags,
                           atomic_read(&conn->c_state) == RDS_CONN_CONNECTING,
@@ -444,12 +503,12 @@ static void rds_conn_info(struct socket *sock, unsigned int len,
                                 sizeof(struct rds_info_connection));
 }
 
-int __init rds_conn_init(void)
+int rds_conn_init(void)
 {
         rds_conn_slab = kmem_cache_create("rds_connection",
                                           sizeof(struct rds_connection),
                                           0, 0, NULL);
-        if (rds_conn_slab == NULL)
+        if (!rds_conn_slab)
                 return -ENOMEM;
 
         rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info);
@@ -487,6 +546,18 @@ void rds_conn_drop(struct rds_connection *conn)
 EXPORT_SYMBOL_GPL(rds_conn_drop);
 
 /*
+ * If the connection is down, trigger a connect. We may have scheduled a
+ * delayed reconnect however - in this case we should not interfere.
+ */
+void rds_conn_connect_if_down(struct rds_connection *conn)
+{
+        if (rds_conn_state(conn) == RDS_CONN_DOWN &&
+            !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
+                queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
+}
+EXPORT_SYMBOL_GPL(rds_conn_connect_if_down);
+
+/*
  * An error occurred on the connection
  */
 void
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 8f2d6dd7700a..b12a3951167d 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -53,12 +53,71 @@ MODULE_PARM_DESC(fmr_message_size, " Max size of a RDMA transfer");
 module_param(rds_ib_retry_count, int, 0444);
 MODULE_PARM_DESC(rds_ib_retry_count, " Number of hw retries before reporting an error");
 
+/*
+ * we have a clumsy combination of RCU and a rwsem protecting this list
+ * because it is used both in the get_mr fast path and while blocking in
+ * the FMR flushing path.
+ */
+DECLARE_RWSEM(rds_ib_devices_lock);
 struct list_head rds_ib_devices;
 
 /* NOTE: if also grabbing ibdev lock, grab this first */
 DEFINE_SPINLOCK(ib_nodev_conns_lock);
 LIST_HEAD(ib_nodev_conns);
 
+void rds_ib_nodev_connect(void)
+{
+        struct rds_ib_connection *ic;
+
+        spin_lock(&ib_nodev_conns_lock);
+        list_for_each_entry(ic, &ib_nodev_conns, ib_node)
+                rds_conn_connect_if_down(ic->conn);
+        spin_unlock(&ib_nodev_conns_lock);
+}
+
+void rds_ib_dev_shutdown(struct rds_ib_device *rds_ibdev)
+{
+        struct rds_ib_connection *ic;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rds_ibdev->spinlock, flags);
+        list_for_each_entry(ic, &rds_ibdev->conn_list, ib_node)
+                rds_conn_drop(ic->conn);
+        spin_unlock_irqrestore(&rds_ibdev->spinlock, flags);
+}
+
+/*
+ * rds_ib_destroy_mr_pool() blocks on a few things and mrs drop references
+ * from interrupt context so we push freing off into a work struct in krdsd.
+ */
+static void rds_ib_dev_free(struct work_struct *work)
+{
+        struct rds_ib_ipaddr *i_ipaddr, *i_next;
+        struct rds_ib_device *rds_ibdev = container_of(work,
+                                        struct rds_ib_device, free_work);
+
+        if (rds_ibdev->mr_pool)
+                rds_ib_destroy_mr_pool(rds_ibdev->mr_pool);
+        if (rds_ibdev->mr)
+                ib_dereg_mr(rds_ibdev->mr);
+        if (rds_ibdev->pd)
+                ib_dealloc_pd(rds_ibdev->pd);
+
+        list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) {
+                list_del(&i_ipaddr->list);
+                kfree(i_ipaddr);
+        }
+
+        kfree(rds_ibdev);
+}
+
+void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
+{
+        BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
+        if (atomic_dec_and_test(&rds_ibdev->refcount))
+                queue_work(rds_wq, &rds_ibdev->free_work);
+}
+
 void rds_ib_add_one(struct ib_device *device)
 {
         struct rds_ib_device *rds_ibdev;
@@ -77,11 +136,14 @@ void rds_ib_add_one(struct ib_device *device)
                 goto free_attr;
         }
 
-        rds_ibdev = kmalloc(sizeof *rds_ibdev, GFP_KERNEL);
+        rds_ibdev = kzalloc_node(sizeof(struct rds_ib_device), GFP_KERNEL,
+                                 ibdev_to_node(device));
         if (!rds_ibdev)
                 goto free_attr;
 
         spin_lock_init(&rds_ibdev->spinlock);
+        atomic_set(&rds_ibdev->refcount, 1);
+        INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
 
         rds_ibdev->max_wrs = dev_attr->max_qp_wr;
         rds_ibdev->max_sge = min(dev_attr->max_sge, RDS_IB_MAX_SGE);
@@ -91,68 +153,107 @@ void rds_ib_add_one(struct ib_device *device)
                         min_t(unsigned int, dev_attr->max_fmr, fmr_pool_size) :
                         fmr_pool_size;
 
+        rds_ibdev->max_initiator_depth = dev_attr->max_qp_init_rd_atom;
+        rds_ibdev->max_responder_resources = dev_attr->max_qp_rd_atom;
+
         rds_ibdev->dev = device;
         rds_ibdev->pd = ib_alloc_pd(device);
-        if (IS_ERR(rds_ibdev->pd))
-                goto free_dev;
+        if (IS_ERR(rds_ibdev->pd)) {
+                rds_ibdev->pd = NULL;
+                goto put_dev;
+        }
 
-        rds_ibdev->mr = ib_get_dma_mr(rds_ibdev->pd,
-                                      IB_ACCESS_LOCAL_WRITE);
-        if (IS_ERR(rds_ibdev->mr))
-                goto err_pd;
+        rds_ibdev->mr = ib_get_dma_mr(rds_ibdev->pd, IB_ACCESS_LOCAL_WRITE);
+        if (IS_ERR(rds_ibdev->mr)) {
+                rds_ibdev->mr = NULL;
+                goto put_dev;
+        }
 
         rds_ibdev->mr_pool = rds_ib_create_mr_pool(rds_ibdev);
         if (IS_ERR(rds_ibdev->mr_pool)) {
                 rds_ibdev->mr_pool = NULL;
-                goto err_mr;
+                goto put_dev;
         }
 
         INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
         INIT_LIST_HEAD(&rds_ibdev->conn_list);
-        list_add_tail(&rds_ibdev->list, &rds_ib_devices);
+
+        down_write(&rds_ib_devices_lock);
+        list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices);
+        up_write(&rds_ib_devices_lock);
+        atomic_inc(&rds_ibdev->refcount);
 
         ib_set_client_data(device, &rds_ib_client, rds_ibdev);
+        atomic_inc(&rds_ibdev->refcount);
 
-        goto free_attr;
+        rds_ib_nodev_connect();
 
-err_mr:
-        ib_dereg_mr(rds_ibdev->mr);
-err_pd:
-        ib_dealloc_pd(rds_ibdev->pd);
-free_dev:
-        kfree(rds_ibdev);
+put_dev:
+        rds_ib_dev_put(rds_ibdev);
 free_attr:
         kfree(dev_attr);
 }
 
+/*
+ * New connections use this to find the device to associate with the
+ * connection.  It's not in the fast path so we're not concerned about the
+ * performance of the IB call.  (As of this writing, it uses an interrupt
+ * blocking spinlock to serialize walking a per-device list of all registered
+ * clients.)
+ *
+ * RCU is used to handle incoming connections racing with device teardown.
+ * Rather than use a lock to serialize removal from the client_data and
+ * getting a new reference, we use an RCU grace period.  The destruction
+ * path removes the device from client_data and then waits for all RCU
+ * readers to finish.
+ *
+ * A new connection can get NULL from this if its arriving on a
+ * device that is in the process of being removed.
+ */
+struct rds_ib_device *rds_ib_get_client_data(struct ib_device *device)
+{
+        struct rds_ib_device *rds_ibdev;
+
+        rcu_read_lock();
+        rds_ibdev = ib_get_client_data(device, &rds_ib_client);
+        if (rds_ibdev)
+                atomic_inc(&rds_ibdev->refcount);
+        rcu_read_unlock();
+        return rds_ibdev;
+}
+
+/*
+ * The IB stack is letting us know that a device is going away.  This can
+ * happen if the underlying HCA driver is removed or if PCI hotplug is removing
+ * the pci function, for example.
+ *
+ * This can be called at any time and can be racing with any other RDS path.
+ */
 void rds_ib_remove_one(struct ib_device *device)
 {
         struct rds_ib_device *rds_ibdev;
-        struct rds_ib_ipaddr *i_ipaddr, *i_next;
 
         rds_ibdev = ib_get_client_data(device, &rds_ib_client);
         if (!rds_ibdev)
                 return;
 
-        list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) {
-                list_del(&i_ipaddr->list);
-                kfree(i_ipaddr);
-        }
+        rds_ib_dev_shutdown(rds_ibdev);
 
-        rds_ib_destroy_conns(rds_ibdev);
+        /* stop connection attempts from getting a reference to this device. */
+        ib_set_client_data(device, &rds_ib_client, NULL);
 
-        if (rds_ibdev->mr_pool)
-                rds_ib_destroy_mr_pool(rds_ibdev->mr_pool);
-
-        ib_dereg_mr(rds_ibdev->mr);
-
-        while (ib_dealloc_pd(rds_ibdev->pd)) {
-                rdsdebug("Failed to dealloc pd %p\n", rds_ibdev->pd);
-                msleep(1);
-        }
+        down_write(&rds_ib_devices_lock);
+        list_del_rcu(&rds_ibdev->list);
+        up_write(&rds_ib_devices_lock);
 
-        list_del(&rds_ibdev->list);
-        kfree(rds_ibdev);
+        /*
+         * This synchronize rcu is waiting for readers of both the ib
+         * client data and the devices list to finish before we drop
+         * both of those references.
+         */
+        synchronize_rcu();
+        rds_ib_dev_put(rds_ibdev);
+        rds_ib_dev_put(rds_ibdev);
 }
 
 struct ib_client rds_ib_client = {
@@ -186,7 +287,7 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                 rdma_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
                 rdma_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
 
-                rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
+                rds_ibdev = ic->rds_ibdev;
                 iinfo->max_send_wr = ic->i_send_ring.w_nr;
                 iinfo->max_recv_wr = ic->i_recv_ring.w_nr;
                 iinfo->max_send_sge = rds_ibdev->max_sge;
@@ -248,29 +349,36 @@ static int rds_ib_laddr_check(__be32 addr)
         return ret;
 }
 
+static void rds_ib_unregister_client(void)
+{
+        ib_unregister_client(&rds_ib_client);
+        /* wait for rds_ib_dev_free() to complete */
+        flush_workqueue(rds_wq);
+}
+
 void rds_ib_exit(void)
 {
         rds_info_deregister_func(RDS_INFO_IB_CONNECTIONS, rds_ib_ic_info);
+        rds_ib_unregister_client();
         rds_ib_destroy_nodev_conns();
-        ib_unregister_client(&rds_ib_client);
         rds_ib_sysctl_exit();
         rds_ib_recv_exit();
         rds_trans_unregister(&rds_ib_transport);
+        rds_ib_fmr_exit();
 }
 
 struct rds_transport rds_ib_transport = {
         .laddr_check            = rds_ib_laddr_check,
         .xmit_complete          = rds_ib_xmit_complete,
         .xmit                   = rds_ib_xmit,
-        .xmit_cong_map          = NULL,
         .xmit_rdma              = rds_ib_xmit_rdma,
+        .xmit_atomic            = rds_ib_xmit_atomic,
         .recv                   = rds_ib_recv,
         .conn_alloc             = rds_ib_conn_alloc,
         .conn_free              = rds_ib_conn_free,
         .conn_connect           = rds_ib_conn_connect,
         .conn_shutdown          = rds_ib_conn_shutdown,
         .inc_copy_to_user       = rds_ib_inc_copy_to_user,
-        .inc_purge              = rds_ib_inc_purge,
         .inc_free               = rds_ib_inc_free,
         .cm_initiate_connect    = rds_ib_cm_initiate_connect,
         .cm_handle_connect      = rds_ib_cm_handle_connect,
@@ -286,16 +394,20 @@ struct rds_transport rds_ib_transport = {
         .t_type                 = RDS_TRANS_IB
 };
 
-int __init rds_ib_init(void)
+int rds_ib_init(void)
 {
         int ret;
 
         INIT_LIST_HEAD(&rds_ib_devices);
 
-        ret = ib_register_client(&rds_ib_client);
+        ret = rds_ib_fmr_init();
         if (ret)
                 goto out;
 
+        ret = ib_register_client(&rds_ib_client);
+        if (ret)
+                goto out_fmr_exit;
+
         ret = rds_ib_sysctl_init();
         if (ret)
                 goto out_ibreg;
@@ -317,7 +429,9 @@ out_recv:
 out_sysctl:
         rds_ib_sysctl_exit();
 out_ibreg:
-        ib_unregister_client(&rds_ib_client);
+        rds_ib_unregister_client();
+out_fmr_exit:
+        rds_ib_fmr_exit();
 out:
         return ret;
 }
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 64df4e79b29f..7ad3d57e06a5 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -3,11 +3,13 @@
 
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
+#include <linux/pci.h>
+#include <linux/slab.h>
 #include "rds.h"
 #include "rdma_transport.h"
 
 #define RDS_FMR_SIZE                    256
-#define RDS_FMR_POOL_SIZE               4096
+#define RDS_FMR_POOL_SIZE               8192
 
 #define RDS_IB_MAX_SGE                  8
 #define RDS_IB_RECV_SGE                 2
@@ -19,6 +21,9 @@
 
 #define RDS_IB_SUPPORTED_PROTOCOLS      0x00000003      /* minor versions supported */
 
+#define RDS_IB_RECYCLE_BATCH_COUNT      32
+
+extern struct rw_semaphore rds_ib_devices_lock;
 extern struct list_head rds_ib_devices;
 
 /*
@@ -26,20 +31,29 @@ extern struct list_head rds_ib_devices;
  * try and minimize the amount of memory tied up both the device and
  * socket receive queues.
  */
-/* page offset of the final full frag that fits in the page */
-#define RDS_PAGE_LAST_OFF (((PAGE_SIZE  / RDS_FRAG_SIZE) - 1) * RDS_FRAG_SIZE)
 struct rds_page_frag {
         struct list_head        f_item;
-        struct page             *f_page;
-        unsigned long           f_offset;
-        dma_addr_t              f_mapped;
+        struct list_head        f_cache_entry;
+        struct scatterlist      f_sg;
 };
 
 struct rds_ib_incoming {
         struct list_head        ii_frags;
+        struct list_head        ii_cache_entry;
         struct rds_incoming     ii_inc;
 };
 
+struct rds_ib_cache_head {
+        struct list_head *first;
+        unsigned long count;
+};
+
+struct rds_ib_refill_cache {
+        struct rds_ib_cache_head *percpu;
+        struct list_head         *xfer;
+        struct list_head         *ready;
+};
+
 struct rds_ib_connect_private {
         /* Add new fields at the end, and don't permute existing fields. */
         __be32                  dp_saddr;
@@ -53,8 +67,7 @@ struct rds_ib_connect_private {
 };
 
 struct rds_ib_send_work {
-        struct rds_message      *s_rm;
-        struct rds_rdma_op      *s_op;
+        void                    *s_op;
         struct ib_send_wr       s_wr;
         struct ib_sge           s_sge[RDS_IB_MAX_SGE];
         unsigned long           s_queued;
@@ -92,10 +105,11 @@ struct rds_ib_connection {
 
         /* tx */
         struct rds_ib_work_ring i_send_ring;
-        struct rds_message      *i_rm;
+        struct rm_data_op       *i_data_op;
         struct rds_header       *i_send_hdrs;
         u64                     i_send_hdrs_dma;
         struct rds_ib_send_work *i_sends;
+        atomic_t                i_signaled_sends;
 
         /* rx */
         struct tasklet_struct   i_recv_tasklet;
@@ -106,8 +120,9 @@ struct rds_ib_connection {
         struct rds_header       *i_recv_hdrs;
         u64                     i_recv_hdrs_dma;
         struct rds_ib_recv_work *i_recvs;
-        struct rds_page_frag    i_frag;
         u64                     i_ack_recv;     /* last ACK received */
+        struct rds_ib_refill_cache i_cache_incs;
+        struct rds_ib_refill_cache i_cache_frags;
 
         /* sending acks */
         unsigned long           i_ack_flags;
@@ -138,7 +153,6 @@ struct rds_ib_connection {
 
         /* Batched completions */
         unsigned int            i_unsignaled_wrs;
-        long                    i_unsignaled_bytes;
 };
 
 /* This assumes that atomic_t is at least 32 bits */
@@ -164,9 +178,17 @@ struct rds_ib_device {
         unsigned int            max_fmrs;
         int                     max_sge;
         unsigned int            max_wrs;
+        unsigned int            max_initiator_depth;
+        unsigned int            max_responder_resources;
         spinlock_t              spinlock;       /* protect the above */
+        atomic_t                refcount;
+        struct work_struct      free_work;
 };
 
+#define pcidev_to_node(pcidev) pcibus_to_node(pcidev->bus)
+#define ibdev_to_node(ibdev) pcidev_to_node(to_pci_dev(ibdev->dma_device))
+#define rdsibdev_to_node(rdsibdev) ibdev_to_node(rdsibdev->dev)
+
 /* bits for i_ack_flags */
 #define IB_ACK_IN_FLIGHT        0
 #define IB_ACK_REQUESTED        1
@@ -202,6 +224,8 @@ struct rds_ib_statistics {
         uint64_t        s_ib_rdma_mr_pool_flush;
         uint64_t        s_ib_rdma_mr_pool_wait;
         uint64_t        s_ib_rdma_mr_pool_depleted;
+        uint64_t        s_ib_atomic_cswp;
+        uint64_t        s_ib_atomic_fadd;
 };
 
 extern struct workqueue_struct *rds_ib_wq;
@@ -243,6 +267,8 @@ static inline void rds_ib_dma_sync_sg_for_device(struct ib_device *dev,
 extern struct rds_transport rds_ib_transport;
 extern void rds_ib_add_one(struct ib_device *device);
 extern void rds_ib_remove_one(struct ib_device *device);
+struct rds_ib_device *rds_ib_get_client_data(struct ib_device *device);
+void rds_ib_dev_put(struct rds_ib_device *rds_ibdev);
 extern struct ib_client rds_ib_client;
 
 extern unsigned int fmr_pool_size;
@@ -258,7 +284,7 @@ void rds_ib_conn_free(void *arg);
 int rds_ib_conn_connect(struct rds_connection *conn);
 void rds_ib_conn_shutdown(struct rds_connection *conn);
 void rds_ib_state_change(struct sock *sk);
-int __init rds_ib_listen_init(void);
+int rds_ib_listen_init(void);
 void rds_ib_listen_stop(void);
 void __rds_ib_conn_error(struct rds_connection *conn, const char *, ...);
 int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
@@ -275,15 +301,7 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn,
 int rds_ib_update_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr);
 void rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn);
 void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn);
-void __rds_ib_destroy_conns(struct list_head *list, spinlock_t *list_lock);
-static inline void rds_ib_destroy_nodev_conns(void)
-{
-        __rds_ib_destroy_conns(&ib_nodev_conns, &ib_nodev_conns_lock);
-}
-static inline void rds_ib_destroy_conns(struct rds_ib_device *rds_ibdev)
-{
-        __rds_ib_destroy_conns(&rds_ibdev->conn_list, &rds_ibdev->spinlock);
-}
+void rds_ib_destroy_nodev_conns(void);
 struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *);
 void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev, struct rds_info_rdma_connection *iinfo);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
@@ -292,14 +310,16 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
 void rds_ib_sync_mr(void *trans_private, int dir);
 void rds_ib_free_mr(void *trans_private, int invalidate);
 void rds_ib_flush_mrs(void);
+int rds_ib_fmr_init(void);
+void rds_ib_fmr_exit(void);
 
 /* ib_recv.c */
-int __init rds_ib_recv_init(void);
+int rds_ib_recv_init(void);
 void rds_ib_recv_exit(void);
 int rds_ib_recv(struct rds_connection *conn);
-int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
-                       gfp_t page_gfp, int prefill);
-void rds_ib_inc_purge(struct rds_incoming *inc);
+int rds_ib_recv_alloc_caches(struct rds_ib_connection *ic);
+void rds_ib_recv_free_caches(struct rds_ib_connection *ic);
+void rds_ib_recv_refill(struct rds_connection *conn, int prefill);
 void rds_ib_inc_free(struct rds_incoming *inc);
 int rds_ib_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
                              size_t size);
@@ -325,17 +345,19 @@ u32 rds_ib_ring_completed(struct rds_ib_work_ring *ring, u32 wr_id, u32 oldest);
 extern wait_queue_head_t rds_ib_ring_empty_wait;
 
 /* ib_send.c */
+char *rds_ib_wc_status_str(enum ib_wc_status status);
 void rds_ib_xmit_complete(struct rds_connection *conn);
 int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                 unsigned int hdr_off, unsigned int sg, unsigned int off);
 void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context);
 void rds_ib_send_init_ring(struct rds_ib_connection *ic);
 void rds_ib_send_clear_ring(struct rds_ib_connection *ic);
-int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
+int rds_ib_xmit_rdma(struct rds_connection *conn, struct rm_rdma_op *op);
 void rds_ib_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_ib_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_ib_send_grab_credits(struct rds_ib_connection *ic, u32 wanted,
                              u32 *adv_credits, int need_posted, int max_posted);
+int rds_ib_xmit_atomic(struct rds_connection *conn, struct rm_atomic_op *op);
 
 /* ib_stats.c */
 DECLARE_PER_CPU(struct rds_ib_statistics, rds_ib_stats);
@@ -344,7 +366,7 @@ unsigned int rds_ib_stats_info_copy(struct rds_info_iterator *iter,
                                     unsigned int avail);
 
 /* ib_sysctl.c */
-int __init rds_ib_sysctl_init(void);
+int rds_ib_sysctl_init(void);
 void rds_ib_sysctl_exit(void);
 extern unsigned long rds_ib_sysctl_max_send_wr;
 extern unsigned long rds_ib_sysctl_max_recv_wr;
@@ -354,28 +376,4 @@ extern unsigned long rds_ib_sysctl_max_recv_allocation;
 extern unsigned int rds_ib_sysctl_flow_control;
 extern ctl_table rds_ib_sysctl_table[];
 
-/*
- * Helper functions for getting/setting the header and data SGEs in
- * RDS packets (not RDMA)
- *
- * From version 3.1 onwards, header is in front of data in the sge.
- */
-static inline struct ib_sge *
-rds_ib_header_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
-{
-        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
-                return &sge[0];
-        else
-                return &sge[1];
-}
-
-static inline struct ib_sge *
-rds_ib_data_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
-{
-        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
-                return &sge[1];
-        else
-                return &sge[0];
-}
-
 #endif
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index f68832798db2..ee369d201a65 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -38,6 +38,36 @@
 #include "rds.h"
 #include "ib.h"
 
+static char *rds_ib_event_type_strings[] = {
+#define RDS_IB_EVENT_STRING(foo) \
+                [IB_EVENT_##foo] = __stringify(IB_EVENT_##foo)
+        RDS_IB_EVENT_STRING(CQ_ERR),
+        RDS_IB_EVENT_STRING(QP_FATAL),
+        RDS_IB_EVENT_STRING(QP_REQ_ERR),
+        RDS_IB_EVENT_STRING(QP_ACCESS_ERR),
+        RDS_IB_EVENT_STRING(COMM_EST),
+        RDS_IB_EVENT_STRING(SQ_DRAINED),
+        RDS_IB_EVENT_STRING(PATH_MIG),
+        RDS_IB_EVENT_STRING(PATH_MIG_ERR),
+        RDS_IB_EVENT_STRING(DEVICE_FATAL),
+        RDS_IB_EVENT_STRING(PORT_ACTIVE),
+        RDS_IB_EVENT_STRING(PORT_ERR),
+        RDS_IB_EVENT_STRING(LID_CHANGE),
+        RDS_IB_EVENT_STRING(PKEY_CHANGE),
+        RDS_IB_EVENT_STRING(SM_CHANGE),
+        RDS_IB_EVENT_STRING(SRQ_ERR),
+        RDS_IB_EVENT_STRING(SRQ_LIMIT_REACHED),
+        RDS_IB_EVENT_STRING(QP_LAST_WQE_REACHED),
+        RDS_IB_EVENT_STRING(CLIENT_REREGISTER),
+#undef RDS_IB_EVENT_STRING
+};
+
+static char *rds_ib_event_str(enum ib_event_type type)
+{
+        return rds_str_array(rds_ib_event_type_strings,
+                             ARRAY_SIZE(rds_ib_event_type_strings), type);
+};
+
 /*
  * Set the selected protocol version
  */
@@ -95,7 +125,6 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
 {
         const struct rds_ib_connect_private *dp = NULL;
         struct rds_ib_connection *ic = conn->c_transport_data;
-        struct rds_ib_device *rds_ibdev;
         struct ib_qp_attr qp_attr;
         int err;
 
@@ -111,11 +140,21 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                 }
         }
 
-        printk(KERN_NOTICE "RDS/IB: connected to %pI4 version %u.%u%s\n",
-                        &conn->c_faddr,
-                        RDS_PROTOCOL_MAJOR(conn->c_version),
-                        RDS_PROTOCOL_MINOR(conn->c_version),
-                        ic->i_flowctl ? ", flow control" : "");
+        if (conn->c_version < RDS_PROTOCOL(3,1)) {
+                printk(KERN_NOTICE "RDS/IB: Connection to %pI4 version %u.%u failed,"
+                       " no longer supported\n",
+                       &conn->c_faddr,
+                       RDS_PROTOCOL_MAJOR(conn->c_version),
+                       RDS_PROTOCOL_MINOR(conn->c_version));
+                rds_conn_destroy(conn);
+                return;
+        } else {
+                printk(KERN_NOTICE "RDS/IB: connected to %pI4 version %u.%u%s\n",
+                       &conn->c_faddr,
+                       RDS_PROTOCOL_MAJOR(conn->c_version),
+                       RDS_PROTOCOL_MINOR(conn->c_version),
+                       ic->i_flowctl ? ", flow control" : "");
+        }
 
         /*
          * Init rings and fill recv. this needs to wait until protocol negotiation
@@ -125,7 +164,7 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         rds_ib_recv_init_ring(ic);
         /* Post receive buffers - as a side effect, this will update
          * the posted credit count. */
-        rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 1);
+        rds_ib_recv_refill(conn, 1);
 
         /* Tune RNR behavior */
         rds_ib_tune_rnr(ic, &qp_attr);
@@ -135,12 +174,11 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         if (err)
                 printk(KERN_NOTICE "ib_modify_qp(IB_QP_STATE, RTS): err=%d\n", err);
 
-        /* update ib_device with this local ipaddr & conn */
-        rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
-        err = rds_ib_update_ipaddr(rds_ibdev, conn->c_laddr);
+        /* update ib_device with this local ipaddr */
+        err = rds_ib_update_ipaddr(ic->rds_ibdev, conn->c_laddr);
         if (err)
-                printk(KERN_ERR "rds_ib_update_ipaddr failed (%d)\n", err);
-        rds_ib_add_conn(rds_ibdev, conn);
+                printk(KERN_ERR "rds_ib_update_ipaddr failed (%d)\n",
+                        err);
 
         /* If the peer gave us the last packet it saw, process this as if
          * we had received a regular ACK. */
@@ -153,18 +191,23 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
 static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
                         struct rdma_conn_param *conn_param,
                         struct rds_ib_connect_private *dp,
-                        u32 protocol_version)
+                        u32 protocol_version,
+                        u32 max_responder_resources,
+                        u32 max_initiator_depth)
 {
+        struct rds_ib_connection *ic = conn->c_transport_data;
+        struct rds_ib_device *rds_ibdev = ic->rds_ibdev;
+
         memset(conn_param, 0, sizeof(struct rdma_conn_param));
-        /* XXX tune these? */
-        conn_param->responder_resources = 1;
-        conn_param->initiator_depth = 1;
+
+        conn_param->responder_resources =
+                min_t(u32, rds_ibdev->max_responder_resources, max_responder_resources);
+        conn_param->initiator_depth =
+                min_t(u32, rds_ibdev->max_initiator_depth, max_initiator_depth);
         conn_param->retry_count = min_t(unsigned int, rds_ib_retry_count, 7);
         conn_param->rnr_retry_count = 7;
 
         if (dp) {
-                struct rds_ib_connection *ic = conn->c_transport_data;
-
                 memset(dp, 0, sizeof(*dp));
                 dp->dp_saddr = conn->c_laddr;
                 dp->dp_daddr = conn->c_faddr;
@@ -189,7 +232,8 @@ static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
 
 static void rds_ib_cq_event_handler(struct ib_event *event, void *data)
 {
-        rdsdebug("event %u data %p\n", event->event, data);
+        rdsdebug("event %u (%s) data %p\n",
+                 event->event, rds_ib_event_str(event->event), data);
 }
 
 static void rds_ib_qp_event_handler(struct ib_event *event, void *data)
@@ -197,16 +241,18 @@ static void rds_ib_qp_event_handler(struct ib_event *event, void *data)
         struct rds_connection *conn = data;
         struct rds_ib_connection *ic = conn->c_transport_data;
 
-        rdsdebug("conn %p ic %p event %u\n", conn, ic, event->event);
+        rdsdebug("conn %p ic %p event %u (%s)\n", conn, ic, event->event,
+                 rds_ib_event_str(event->event));
 
         switch (event->event) {
         case IB_EVENT_COMM_EST:
                 rdma_notify(ic->i_cm_id, IB_EVENT_COMM_EST);
                 break;
         default:
-                rdsdebug("Fatal QP Event %u "
+                rdsdebug("Fatal QP Event %u (%s) "
                         "- connection %pI4->%pI4, reconnecting\n",
-                        event->event, &conn->c_laddr, &conn->c_faddr);
+                        event->event, rds_ib_event_str(event->event),
+                        &conn->c_laddr, &conn->c_faddr);
                 rds_conn_drop(conn);
                 break;
         }
@@ -224,18 +270,16 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         struct rds_ib_device *rds_ibdev;
         int ret;
 
-        /* rds_ib_add_one creates a rds_ib_device object per IB device,
-         * and allocates a protection domain, memory range and FMR pool
-         * for each.  If that fails for any reason, it will not register
-         * the rds_ibdev at all.
+        /*
+         * It's normal to see a null device if an incoming connection races
+         * with device removal, so we don't print a warning.
          */
-        rds_ibdev = ib_get_client_data(dev, &rds_ib_client);
-        if (rds_ibdev == NULL) {
-                if (printk_ratelimit())
-                        printk(KERN_NOTICE "RDS/IB: No client_data for device %s\n",
-                                        dev->name);
+        rds_ibdev = rds_ib_get_client_data(dev);
+        if (!rds_ibdev)
                 return -EOPNOTSUPP;
-        }
+
+        /* add the conn now so that connection establishment has the dev */
+        rds_ib_add_conn(rds_ibdev, conn);
 
         if (rds_ibdev->max_wrs < ic->i_send_ring.w_nr + 1)
                 rds_ib_ring_resize(&ic->i_send_ring, rds_ibdev->max_wrs - 1);
@@ -306,7 +350,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                                            ic->i_send_ring.w_nr *
                                                 sizeof(struct rds_header),
                                            &ic->i_send_hdrs_dma, GFP_KERNEL);
-        if (ic->i_send_hdrs == NULL) {
+        if (!ic->i_send_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent send failed\n");
                 goto out;
@@ -316,7 +360,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                                            ic->i_recv_ring.w_nr *
                                                 sizeof(struct rds_header),
                                            &ic->i_recv_hdrs_dma, GFP_KERNEL);
-        if (ic->i_recv_hdrs == NULL) {
+        if (!ic->i_recv_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent recv failed\n");
                 goto out;
@@ -324,22 +368,24 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
 
         ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
                                        &ic->i_ack_dma, GFP_KERNEL);
-        if (ic->i_ack == NULL) {
+        if (!ic->i_ack) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent ack failed\n");
                 goto out;
         }
 
-        ic->i_sends = vmalloc(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work));
-        if (ic->i_sends == NULL) {
+        ic->i_sends = vmalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
+                                   ibdev_to_node(dev));
+        if (!ic->i_sends) {
                 ret = -ENOMEM;
                 rdsdebug("send allocation failed\n");
                 goto out;
         }
         memset(ic->i_sends, 0, ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work));
 
-        ic->i_recvs = vmalloc(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work));
-        if (ic->i_recvs == NULL) {
+        ic->i_recvs = vmalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
+                                   ibdev_to_node(dev));
+        if (!ic->i_recvs) {
                 ret = -ENOMEM;
                 rdsdebug("recv allocation failed\n");
                 goto out;
@@ -352,6 +398,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                  ic->i_send_cq, ic->i_recv_cq);
 
 out:
+        rds_ib_dev_put(rds_ibdev);
         return ret;
 }
 
@@ -409,7 +456,7 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
         struct rds_ib_connection *ic = NULL;
         struct rdma_conn_param conn_param;
         u32 version;
-        int err, destroy = 1;
+        int err = 1, destroy = 1;
 
         /* Check whether the remote protocol version matches ours. */
         version = rds_ib_protocol_compatible(event);
@@ -448,7 +495,6 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
                         /* Wait and see - our connect may still be succeeding */
                         rds_ib_stats_inc(s_ib_connect_raced);
                 }
-                mutex_unlock(&conn->c_cm_lock);
                 goto out;
         }
 
@@ -475,24 +521,23 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
         err = rds_ib_setup_qp(conn);
         if (err) {
                 rds_ib_conn_error(conn, "rds_ib_setup_qp failed (%d)\n", err);
-                mutex_unlock(&conn->c_cm_lock);
                 goto out;
         }
 
-        rds_ib_cm_fill_conn_param(conn, &conn_param, &dp_rep, version);
+        rds_ib_cm_fill_conn_param(conn, &conn_param, &dp_rep, version,
+                event->param.conn.responder_resources,
+                event->param.conn.initiator_depth);
 
         /* rdma_accept() calls rdma_reject() internally if it fails */
         err = rdma_accept(cm_id, &conn_param);
-        mutex_unlock(&conn->c_cm_lock);
-        if (err) {
+        if (err)
                 rds_ib_conn_error(conn, "rdma_accept failed (%d)\n", err);
-                goto out;
-        }
-
-        return 0;
 
 out:
-        rdma_reject(cm_id, NULL, 0);
+        if (conn)
+                mutex_unlock(&conn->c_cm_lock);
+        if (err)
+                rdma_reject(cm_id, NULL, 0);
         return destroy;
 }
 
@@ -516,8 +561,8 @@ int rds_ib_cm_initiate_connect(struct rdma_cm_id *cm_id)
                 goto out;
         }
 
-        rds_ib_cm_fill_conn_param(conn, &conn_param, &dp, RDS_PROTOCOL_VERSION);
-
+        rds_ib_cm_fill_conn_param(conn, &conn_param, &dp, RDS_PROTOCOL_VERSION,
+                UINT_MAX, UINT_MAX);
         ret = rdma_connect(cm_id, &conn_param);
         if (ret)
                 rds_ib_conn_error(conn, "rdma_connect failed (%d)\n", ret);
@@ -601,9 +646,19 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
                                 ic->i_cm_id, err);
                 }
 
+                /*
+                 * We want to wait for tx and rx completion to finish
+                 * before we tear down the connection, but we have to be
+                 * careful not to get stuck waiting on a send ring that
+                 * only has unsignaled sends in it.  We've shutdown new
+                 * sends before getting here so by waiting for signaled
+                 * sends to complete we're ensured that there will be no
+                 * more tx processing.
+                 */
                 wait_event(rds_ib_ring_empty_wait,
-                        rds_ib_ring_empty(&ic->i_send_ring) &&
-                        rds_ib_ring_empty(&ic->i_recv_ring));
+                           rds_ib_ring_empty(&ic->i_recv_ring) &&
+                           (atomic_read(&ic->i_signaled_sends) == 0));
+                tasklet_kill(&ic->i_recv_tasklet);
 
                 if (ic->i_send_hdrs)
                         ib_dma_free_coherent(dev,
@@ -654,9 +709,12 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
         BUG_ON(ic->rds_ibdev);
 
         /* Clear pending transmit */
-        if (ic->i_rm) {
-                rds_message_put(ic->i_rm);
-                ic->i_rm = NULL;
+        if (ic->i_data_op) {
+                struct rds_message *rm;
+
+                rm = container_of(ic->i_data_op, struct rds_message, data);
+                rds_message_put(rm);
+                ic->i_data_op = NULL;
         }
 
         /* Clear the ACK state */
@@ -690,12 +748,19 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 {
         struct rds_ib_connection *ic;
         unsigned long flags;
+        int ret;
 
         /* XXX too lazy? */
         ic = kzalloc(sizeof(struct rds_ib_connection), GFP_KERNEL);
-        if (ic == NULL)
+        if (!ic)
                 return -ENOMEM;
 
+        ret = rds_ib_recv_alloc_caches(ic);
+        if (ret) {
+                kfree(ic);
+                return ret;
+        }
+
         INIT_LIST_HEAD(&ic->ib_node);
         tasklet_init(&ic->i_recv_tasklet, rds_ib_recv_tasklet_fn,
                      (unsigned long) ic);
@@ -703,6 +768,7 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 #ifndef KERNEL_HAS_ATOMIC64
         spin_lock_init(&ic->i_ack_lock);
 #endif
+        atomic_set(&ic->i_signaled_sends, 0);
 
         /*
          * rds_ib_conn_shutdown() waits for these to be emptied so they
@@ -744,6 +810,8 @@ void rds_ib_conn_free(void *arg)
         list_del(&ic->ib_node);
         spin_unlock_irq(lock_ptr);
 
+        rds_ib_recv_free_caches(ic);
+
         kfree(ic);
 }
 
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index a54cd63f9e35..b5a88415a18e 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -32,11 +32,16 @@
  */
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/rculist.h>
 
 #include "rds.h"
-#include "rdma.h"
 #include "ib.h"
+#include "xlist.h"
 
+struct workqueue_struct *rds_ib_fmr_wq;
+
+static DEFINE_PER_CPU(unsigned long, clean_list_grace);
+#define CLEAN_LIST_BUSY_BIT 0
 
 /*
  * This is stored as mr->r_trans_private.
@@ -45,7 +50,11 @@ struct rds_ib_mr {
         struct rds_ib_device    *device;
         struct rds_ib_mr_pool   *pool;
         struct ib_fmr           *fmr;
-        struct list_head        list;
+
+        struct xlist_head       xlist;
+
+        /* unmap_list is for freeing */
+        struct list_head        unmap_list;
         unsigned int            remap_count;
 
         struct scatterlist      *sg;
@@ -59,14 +68,16 @@ struct rds_ib_mr {
  */
 struct rds_ib_mr_pool {
         struct mutex            flush_lock;             /* serialize fmr invalidate */
-        struct work_struct      flush_worker;           /* flush worker */
+        struct delayed_work     flush_worker;           /* flush worker */
 
-        spinlock_t              list_lock;              /* protect variables below */
         atomic_t                item_count;             /* total # of MRs */
         atomic_t                dirty_count;            /* # dirty of MRs */
-        struct list_head        drop_list;              /* MRs that have reached their max_maps limit */
-        struct list_head        free_list;              /* unused MRs */
-        struct list_head        clean_list;             /* unused & unamapped MRs */
+
+        struct xlist_head       drop_list;              /* MRs that have reached their max_maps limit */
+        struct xlist_head       free_list;              /* unused MRs */
+        struct xlist_head       clean_list;             /* global unused & unamapped MRs */
+        wait_queue_head_t       flush_wait;
+
         atomic_t                free_pinned;            /* memory pinned by free MRs */
         unsigned long           max_items;
         unsigned long           max_items_soft;
@@ -74,7 +85,7 @@ struct rds_ib_mr_pool {
         struct ib_fmr_attr      fmr_attr;
 };
 
-static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all);
+static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all, struct rds_ib_mr **);
 static void rds_ib_teardown_mr(struct rds_ib_mr *ibmr);
 static void rds_ib_mr_pool_flush_worker(struct work_struct *work);
 
@@ -83,16 +94,17 @@ static struct rds_ib_device *rds_ib_get_device(__be32 ipaddr)
         struct rds_ib_device *rds_ibdev;
         struct rds_ib_ipaddr *i_ipaddr;
 
-        list_for_each_entry(rds_ibdev, &rds_ib_devices, list) {
-                spin_lock_irq(&rds_ibdev->spinlock);
-                list_for_each_entry(i_ipaddr, &rds_ibdev->ipaddr_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(rds_ibdev, &rds_ib_devices, list) {
+                list_for_each_entry_rcu(i_ipaddr, &rds_ibdev->ipaddr_list, list) {
                         if (i_ipaddr->ipaddr == ipaddr) {
-                                spin_unlock_irq(&rds_ibdev->spinlock);
+                                atomic_inc(&rds_ibdev->refcount);
+                                rcu_read_unlock();
                                 return rds_ibdev;
                         }
                 }
-                spin_unlock_irq(&rds_ibdev->spinlock);
         }
+        rcu_read_unlock();
 
         return NULL;
 }
@@ -108,7 +120,7 @@ static int rds_ib_add_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
         i_ipaddr->ipaddr = ipaddr;
 
         spin_lock_irq(&rds_ibdev->spinlock);
-        list_add_tail(&i_ipaddr->list, &rds_ibdev->ipaddr_list);
+        list_add_tail_rcu(&i_ipaddr->list, &rds_ibdev->ipaddr_list);
         spin_unlock_irq(&rds_ibdev->spinlock);
 
         return 0;
@@ -116,17 +128,24 @@ static int rds_ib_add_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
 
 static void rds_ib_remove_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
 {
-        struct rds_ib_ipaddr *i_ipaddr, *next;
+        struct rds_ib_ipaddr *i_ipaddr;
+        struct rds_ib_ipaddr *to_free = NULL;
+
 
         spin_lock_irq(&rds_ibdev->spinlock);
-        list_for_each_entry_safe(i_ipaddr, next, &rds_ibdev->ipaddr_list, list) {
+        list_for_each_entry_rcu(i_ipaddr, &rds_ibdev->ipaddr_list, list) {
                 if (i_ipaddr->ipaddr == ipaddr) {
-                        list_del(&i_ipaddr->list);
-                        kfree(i_ipaddr);
+                        list_del_rcu(&i_ipaddr->list);
+                        to_free = i_ipaddr;
                         break;
                 }
         }
         spin_unlock_irq(&rds_ibdev->spinlock);
+
+        if (to_free) {
+                synchronize_rcu();
+                kfree(to_free);
+        }
 }
 
 int rds_ib_update_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
@@ -134,8 +153,10 @@ int rds_ib_update_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
         struct rds_ib_device *rds_ibdev_old;
 
         rds_ibdev_old = rds_ib_get_device(ipaddr);
-        if (rds_ibdev_old)
+        if (rds_ibdev_old) {
                 rds_ib_remove_ipaddr(rds_ibdev_old, ipaddr);
+                rds_ib_dev_put(rds_ibdev_old);
+        }
 
         return rds_ib_add_ipaddr(rds_ibdev, ipaddr);
 }
@@ -150,12 +171,13 @@ void rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *con
         BUG_ON(list_empty(&ic->ib_node));
         list_del(&ic->ib_node);
 
-        spin_lock_irq(&rds_ibdev->spinlock);
+        spin_lock(&rds_ibdev->spinlock);
         list_add_tail(&ic->ib_node, &rds_ibdev->conn_list);
-        spin_unlock_irq(&rds_ibdev->spinlock);
+        spin_unlock(&rds_ibdev->spinlock);
         spin_unlock_irq(&ib_nodev_conns_lock);
 
         ic->rds_ibdev = rds_ibdev;
+        atomic_inc(&rds_ibdev->refcount);
 }
 
 void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn)
@@ -175,18 +197,18 @@ void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *
         spin_unlock(&ib_nodev_conns_lock);
 
         ic->rds_ibdev = NULL;
+        rds_ib_dev_put(rds_ibdev);
 }
 
-void __rds_ib_destroy_conns(struct list_head *list, spinlock_t *list_lock)
+void rds_ib_destroy_nodev_conns(void)
 {
         struct rds_ib_connection *ic, *_ic;
         LIST_HEAD(tmp_list);
 
         /* avoid calling conn_destroy with irqs off */
-        spin_lock_irq(list_lock);
-        list_splice(list, &tmp_list);
-        INIT_LIST_HEAD(list);
-        spin_unlock_irq(list_lock);
+        spin_lock_irq(&ib_nodev_conns_lock);
+        list_splice(&ib_nodev_conns, &tmp_list);
+        spin_unlock_irq(&ib_nodev_conns_lock);
 
         list_for_each_entry_safe(ic, _ic, &tmp_list, ib_node)
                 rds_conn_destroy(ic->conn);
@@ -200,12 +222,12 @@ struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_ibdev)
         if (!pool)
                 return ERR_PTR(-ENOMEM);
 
-        INIT_LIST_HEAD(&pool->free_list);
-        INIT_LIST_HEAD(&pool->drop_list);
-        INIT_LIST_HEAD(&pool->clean_list);
+        INIT_XLIST_HEAD(&pool->free_list);
+        INIT_XLIST_HEAD(&pool->drop_list);
+        INIT_XLIST_HEAD(&pool->clean_list);
         mutex_init(&pool->flush_lock);
-        spin_lock_init(&pool->list_lock);
-        INIT_WORK(&pool->flush_worker, rds_ib_mr_pool_flush_worker);
+        init_waitqueue_head(&pool->flush_wait);
+        INIT_DELAYED_WORK(&pool->flush_worker, rds_ib_mr_pool_flush_worker);
 
         pool->fmr_attr.max_pages = fmr_message_size;
         pool->fmr_attr.max_maps = rds_ibdev->fmr_max_remaps;
@@ -233,34 +255,60 @@ void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev, struct rds_info_rdma_co
 
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *pool)
 {
-        flush_workqueue(rds_wq);
-        rds_ib_flush_mr_pool(pool, 1);
+        cancel_delayed_work_sync(&pool->flush_worker);
+        rds_ib_flush_mr_pool(pool, 1, NULL);
         WARN_ON(atomic_read(&pool->item_count));
         WARN_ON(atomic_read(&pool->free_pinned));
         kfree(pool);
 }
 
+static void refill_local(struct rds_ib_mr_pool *pool, struct xlist_head *xl,
+                         struct rds_ib_mr **ibmr_ret)
+{
+        struct xlist_head *ibmr_xl;
+        ibmr_xl = xlist_del_head_fast(xl);
+        *ibmr_ret = list_entry(ibmr_xl, struct rds_ib_mr, xlist);
+}
+
 static inline struct rds_ib_mr *rds_ib_reuse_fmr(struct rds_ib_mr_pool *pool)
 {
         struct rds_ib_mr *ibmr = NULL;
-        unsigned long flags;
+        struct xlist_head *ret;
+        unsigned long *flag;
 
-        spin_lock_irqsave(&pool->list_lock, flags);
-        if (!list_empty(&pool->clean_list)) {
-                ibmr = list_entry(pool->clean_list.next, struct rds_ib_mr, list);
-                list_del_init(&ibmr->list);
-        }
-        spin_unlock_irqrestore(&pool->list_lock, flags);
+        preempt_disable();
+        flag = &__get_cpu_var(clean_list_grace);
+        set_bit(CLEAN_LIST_BUSY_BIT, flag);
+        ret = xlist_del_head(&pool->clean_list);
+        if (ret)
+                ibmr = list_entry(ret, struct rds_ib_mr, xlist);
 
+        clear_bit(CLEAN_LIST_BUSY_BIT, flag);
+        preempt_enable();
         return ibmr;
 }
 
+static inline void wait_clean_list_grace(void)
+{
+        int cpu;
+        unsigned long *flag;
+
+        for_each_online_cpu(cpu) {
+                flag = &per_cpu(clean_list_grace, cpu);
+                while (test_bit(CLEAN_LIST_BUSY_BIT, flag))
+                        cpu_relax();
+        }
+}
+
 static struct rds_ib_mr *rds_ib_alloc_fmr(struct rds_ib_device *rds_ibdev)
 {
         struct rds_ib_mr_pool *pool = rds_ibdev->mr_pool;
         struct rds_ib_mr *ibmr = NULL;
         int err = 0, iter = 0;
 
+        if (atomic_read(&pool->dirty_count) >= pool->max_items / 10)
+                queue_delayed_work(rds_ib_fmr_wq, &pool->flush_worker, 10);
+
         while (1) {
                 ibmr = rds_ib_reuse_fmr(pool);
                 if (ibmr)
@@ -287,19 +335,24 @@ static struct rds_ib_mr *rds_ib_alloc_fmr(struct rds_ib_device *rds_ibdev)
 
                 /* We do have some empty MRs. Flush them out. */
                 rds_ib_stats_inc(s_ib_rdma_mr_pool_wait);
-                rds_ib_flush_mr_pool(pool, 0);
+                rds_ib_flush_mr_pool(pool, 0, &ibmr);
+                if (ibmr)
+                        return ibmr;
         }
 
-        ibmr = kzalloc(sizeof(*ibmr), GFP_KERNEL);
+        ibmr = kzalloc_node(sizeof(*ibmr), GFP_KERNEL, rdsibdev_to_node(rds_ibdev));
         if (!ibmr) {
                 err = -ENOMEM;
                 goto out_no_cigar;
         }
 
+        memset(ibmr, 0, sizeof(*ibmr));
+
         ibmr->fmr = ib_alloc_fmr(rds_ibdev->pd,
                         (IB_ACCESS_LOCAL_WRITE |
                          IB_ACCESS_REMOTE_READ |
-                         IB_ACCESS_REMOTE_WRITE),
+                         IB_ACCESS_REMOTE_WRITE|
+                         IB_ACCESS_REMOTE_ATOMIC),
                         &pool->fmr_attr);
         if (IS_ERR(ibmr->fmr)) {
                 err = PTR_ERR(ibmr->fmr);
@@ -367,7 +420,8 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
         if (page_cnt > fmr_message_size)
                 return -EINVAL;
 
-        dma_pages = kmalloc(sizeof(u64) * page_cnt, GFP_ATOMIC);
+        dma_pages = kmalloc_node(sizeof(u64) * page_cnt, GFP_ATOMIC,
+                                 rdsibdev_to_node(rds_ibdev));
         if (!dma_pages)
                 return -ENOMEM;
 
@@ -441,7 +495,7 @@ static void __rds_ib_teardown_mr(struct rds_ib_mr *ibmr)
 
                         /* FIXME we need a way to tell a r/w MR
                          * from a r/o MR */
-                        BUG_ON(in_interrupt());
+                        BUG_ON(irqs_disabled());
                         set_page_dirty(page);
                         put_page(page);
                 }
@@ -477,33 +531,109 @@ static inline unsigned int rds_ib_flush_goal(struct rds_ib_mr_pool *pool, int fr
 }
 
 /*
+ * given an xlist of mrs, put them all into the list_head for more processing
+ */
+static void xlist_append_to_list(struct xlist_head *xlist, struct list_head *list)
+{
+        struct rds_ib_mr *ibmr;
+        struct xlist_head splice;
+        struct xlist_head *cur;
+        struct xlist_head *next;
+
+        splice.next = NULL;
+        xlist_splice(xlist, &splice);
+        cur = splice.next;
+        while (cur) {
+                next = cur->next;
+                ibmr = list_entry(cur, struct rds_ib_mr, xlist);
+                list_add_tail(&ibmr->unmap_list, list);
+                cur = next;
+        }
+}
+
+/*
+ * this takes a list head of mrs and turns it into an xlist of clusters.
+ * each cluster has an xlist of MR_CLUSTER_SIZE mrs that are ready for
+ * reuse.
+ */
+static void list_append_to_xlist(struct rds_ib_mr_pool *pool,
+                                struct list_head *list, struct xlist_head *xlist,
+                                struct xlist_head **tail_ret)
+{
+        struct rds_ib_mr *ibmr;
+        struct xlist_head *cur_mr = xlist;
+        struct xlist_head *tail_mr = NULL;
+
+        list_for_each_entry(ibmr, list, unmap_list) {
+                tail_mr = &ibmr->xlist;
+                tail_mr->next = NULL;
+                cur_mr->next = tail_mr;
+                cur_mr = tail_mr;
+        }
+        *tail_ret = tail_mr;
+}
+
+/*
  * Flush our pool of MRs.
  * At a minimum, all currently unused MRs are unmapped.
  * If the number of MRs allocated exceeds the limit, we also try
  * to free as many MRs as needed to get back to this limit.
  */
-static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all)
+static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool,
+                                int free_all, struct rds_ib_mr **ibmr_ret)
 {
         struct rds_ib_mr *ibmr, *next;
+        struct xlist_head clean_xlist;
+        struct xlist_head *clean_tail;
         LIST_HEAD(unmap_list);
         LIST_HEAD(fmr_list);
         unsigned long unpinned = 0;
-        unsigned long flags;
         unsigned int nfreed = 0, ncleaned = 0, free_goal;
         int ret = 0;
 
         rds_ib_stats_inc(s_ib_rdma_mr_pool_flush);
 
-        mutex_lock(&pool->flush_lock);
+        if (ibmr_ret) {
+                DEFINE_WAIT(wait);
+                while(!mutex_trylock(&pool->flush_lock)) {
+                        ibmr = rds_ib_reuse_fmr(pool);
+                        if (ibmr) {
+                                *ibmr_ret = ibmr;
+                                finish_wait(&pool->flush_wait, &wait);
+                                goto out_nolock;
+                        }
+
+                        prepare_to_wait(&pool->flush_wait, &wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (xlist_empty(&pool->clean_list))
+                                schedule();
+
+                        ibmr = rds_ib_reuse_fmr(pool);
+                        if (ibmr) {
+                                *ibmr_ret = ibmr;
+                                finish_wait(&pool->flush_wait, &wait);
+                                goto out_nolock;
+                        }
+                }
+                finish_wait(&pool->flush_wait, &wait);
+        } else
+                mutex_lock(&pool->flush_lock);
+
+        if (ibmr_ret) {
+                ibmr = rds_ib_reuse_fmr(pool);
+                if (ibmr) {
+                        *ibmr_ret = ibmr;
+                        goto out;
+                }
+        }
 
-        spin_lock_irqsave(&pool->list_lock, flags);
         /* Get the list of all MRs to be dropped. Ordering matters -
-         * we want to put drop_list ahead of free_list. */
-        list_splice_init(&pool->free_list, &unmap_list);
-        list_splice_init(&pool->drop_list, &unmap_list);
+         * we want to put drop_list ahead of free_list.
+         */
+        xlist_append_to_list(&pool->drop_list, &unmap_list);
+        xlist_append_to_list(&pool->free_list, &unmap_list);
         if (free_all)
-                list_splice_init(&pool->clean_list, &unmap_list);
-        spin_unlock_irqrestore(&pool->list_lock, flags);
+                xlist_append_to_list(&pool->clean_list, &unmap_list);
 
         free_goal = rds_ib_flush_goal(pool, free_all);
 
@@ -511,19 +641,20 @@ static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all)
                 goto out;
 
         /* String all ib_mr's onto one list and hand them to ib_unmap_fmr */
-        list_for_each_entry(ibmr, &unmap_list, list)
+        list_for_each_entry(ibmr, &unmap_list, unmap_list)
                 list_add(&ibmr->fmr->list, &fmr_list);
+
         ret = ib_unmap_fmr(&fmr_list);
         if (ret)
                 printk(KERN_WARNING "RDS/IB: ib_unmap_fmr failed (err=%d)\n", ret);
 
         /* Now we can destroy the DMA mapping and unpin any pages */
-        list_for_each_entry_safe(ibmr, next, &unmap_list, list) {
+        list_for_each_entry_safe(ibmr, next, &unmap_list, unmap_list) {
                 unpinned += ibmr->sg_len;
                 __rds_ib_teardown_mr(ibmr);
                 if (nfreed < free_goal || ibmr->remap_count >= pool->fmr_attr.max_maps) {
                         rds_ib_stats_inc(s_ib_rdma_mr_free);
-                        list_del(&ibmr->list);
+                        list_del(&ibmr->unmap_list);
                         ib_dealloc_fmr(ibmr->fmr);
                         kfree(ibmr);
                         nfreed++;
@@ -531,9 +662,27 @@ static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all)
                 ncleaned++;
         }
 
-        spin_lock_irqsave(&pool->list_lock, flags);
-        list_splice(&unmap_list, &pool->clean_list);
-        spin_unlock_irqrestore(&pool->list_lock, flags);
+        if (!list_empty(&unmap_list)) {
+                /* we have to make sure that none of the things we're about
+                 * to put on the clean list would race with other cpus trying
+                 * to pull items off.  The xlist would explode if we managed to
+                 * remove something from the clean list and then add it back again
+                 * while another CPU was spinning on that same item in xlist_del_head.
+                 *
+                 * This is pretty unlikely, but just in case  wait for an xlist grace period
+                 * here before adding anything back into the clean list.
+                 */
+                wait_clean_list_grace();
+
+                list_append_to_xlist(pool, &unmap_list, &clean_xlist, &clean_tail);
+                if (ibmr_ret)
+                        refill_local(pool, &clean_xlist, ibmr_ret);
+
+                /* refill_local may have emptied our list */
+                if (!xlist_empty(&clean_xlist))
+                        xlist_add(clean_xlist.next, clean_tail, &pool->clean_list);
+
+        }
 
         atomic_sub(unpinned, &pool->free_pinned);
         atomic_sub(ncleaned, &pool->dirty_count);
@@ -541,14 +690,35 @@ static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, int free_all)
 
 out:
         mutex_unlock(&pool->flush_lock);
+        if (waitqueue_active(&pool->flush_wait))
+                wake_up(&pool->flush_wait);
+out_nolock:
         return ret;
 }
 
+int rds_ib_fmr_init(void)
+{
+        rds_ib_fmr_wq = create_workqueue("rds_fmr_flushd");
+        if (!rds_ib_fmr_wq)
+                return -ENOMEM;
+        return 0;
+}
+
+/*
+ * By the time this is called all the IB devices should have been torn down and
+ * had their pools freed.  As each pool is freed its work struct is waited on,
+ * so the pool flushing work queue should be idle by the time we get here.
+ */
+void rds_ib_fmr_exit(void)
+{
+        destroy_workqueue(rds_ib_fmr_wq);
+}
+
 static void rds_ib_mr_pool_flush_worker(struct work_struct *work)
 {
-        struct rds_ib_mr_pool *pool = container_of(work, struct rds_ib_mr_pool, flush_worker);
+        struct rds_ib_mr_pool *pool = container_of(work, struct rds_ib_mr_pool, flush_worker.work);
 
-        rds_ib_flush_mr_pool(pool, 0);
+        rds_ib_flush_mr_pool(pool, 0, NULL);
 }
 
 void rds_ib_free_mr(void *trans_private, int invalidate)
@@ -556,47 +726,49 @@ void rds_ib_free_mr(void *trans_private, int invalidate)
         struct rds_ib_mr *ibmr = trans_private;
         struct rds_ib_device *rds_ibdev = ibmr->device;
         struct rds_ib_mr_pool *pool = rds_ibdev->mr_pool;
-        unsigned long flags;
 
         rdsdebug("RDS/IB: free_mr nents %u\n", ibmr->sg_len);
 
         /* Return it to the pool's free list */
-        spin_lock_irqsave(&pool->list_lock, flags);
         if (ibmr->remap_count >= pool->fmr_attr.max_maps)
-                list_add(&ibmr->list, &pool->drop_list);
+                xlist_add(&ibmr->xlist, &ibmr->xlist, &pool->drop_list);
         else
-                list_add(&ibmr->list, &pool->free_list);
+                xlist_add(&ibmr->xlist, &ibmr->xlist, &pool->free_list);
 
         atomic_add(ibmr->sg_len, &pool->free_pinned);
         atomic_inc(&pool->dirty_count);
-        spin_unlock_irqrestore(&pool->list_lock, flags);
 
         /* If we've pinned too many pages, request a flush */
         if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned ||
             atomic_read(&pool->dirty_count) >= pool->max_items / 10)
-                queue_work(rds_wq, &pool->flush_worker);
+                queue_delayed_work(rds_ib_fmr_wq, &pool->flush_worker, 10);
 
         if (invalidate) {
                 if (likely(!in_interrupt())) {
-                        rds_ib_flush_mr_pool(pool, 0);
+                        rds_ib_flush_mr_pool(pool, 0, NULL);
                 } else {
                         /* We get here if the user created a MR marked
                          * as use_once and invalidate at the same time. */
-                        queue_work(rds_wq, &pool->flush_worker);
+                        queue_delayed_work(rds_ib_fmr_wq,
+                                           &pool->flush_worker, 10);
                 }
         }
+
+        rds_ib_dev_put(rds_ibdev);
 }
 
 void rds_ib_flush_mrs(void)
 {
         struct rds_ib_device *rds_ibdev;
 
+        down_read(&rds_ib_devices_lock);
         list_for_each_entry(rds_ibdev, &rds_ib_devices, list) {
                 struct rds_ib_mr_pool *pool = rds_ibdev->mr_pool;
 
                 if (pool)
-                        rds_ib_flush_mr_pool(pool, 0);
+                        rds_ib_flush_mr_pool(pool, 0, NULL);
         }
+        up_read(&rds_ib_devices_lock);
 }
 
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
@@ -628,6 +800,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 printk(KERN_WARNING "RDS/IB: map_fmr failed (errno=%d)\n", ret);
 
         ibmr->device = rds_ibdev;
+        rds_ibdev = NULL;
 
  out:
         if (ret) {
@@ -635,5 +808,8 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                         rds_ib_free_mr(ibmr, 0);
                 ibmr = ERR_PTR(ret);
         }
+        if (rds_ibdev)
+                rds_ib_dev_put(rds_ibdev);
         return ibmr;
 }
+
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index c74e9904a6b2..e29e0ca32f74 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -43,42 +43,6 @@ static struct kmem_cache *rds_ib_incoming_slab;
 static struct kmem_cache *rds_ib_frag_slab;
 static atomic_t rds_ib_allocation = ATOMIC_INIT(0);
 
-static void rds_ib_frag_drop_page(struct rds_page_frag *frag)
-{
-        rdsdebug("frag %p page %p\n", frag, frag->f_page);
-        __free_page(frag->f_page);
-        frag->f_page = NULL;
-}
-
-static void rds_ib_frag_free(struct rds_page_frag *frag)
-{
-        rdsdebug("frag %p page %p\n", frag, frag->f_page);
-        BUG_ON(frag->f_page != NULL);
-        kmem_cache_free(rds_ib_frag_slab, frag);
-}
-
-/*
- * We map a page at a time.  Its fragments are posted in order.  This
- * is called in fragment order as the fragments get send completion events.
- * Only the last frag in the page performs the unmapping.
- *
- * It's OK for ring cleanup to call this in whatever order it likes because
- * DMA is not in flight and so we can unmap while other ring entries still
- * hold page references in their frags.
- */
-static void rds_ib_recv_unmap_page(struct rds_ib_connection *ic,
-                                   struct rds_ib_recv_work *recv)
-{
-        struct rds_page_frag *frag = recv->r_frag;
-
-        rdsdebug("recv %p frag %p page %p\n", recv, frag, frag->f_page);
-        if (frag->f_mapped)
-                ib_dma_unmap_page(ic->i_cm_id->device,
-                               frag->f_mapped,
-                               RDS_FRAG_SIZE, DMA_FROM_DEVICE);
-        frag->f_mapped = 0;
-}
-
 void rds_ib_recv_init_ring(struct rds_ib_connection *ic)
 {
         struct rds_ib_recv_work *recv;
@@ -95,16 +59,161 @@ void rds_ib_recv_init_ring(struct rds_ib_connection *ic)
                 recv->r_wr.sg_list = recv->r_sge;
                 recv->r_wr.num_sge = RDS_IB_RECV_SGE;
 
-                sge = rds_ib_data_sge(ic, recv->r_sge);
+                sge = &recv->r_sge[0];
+                sge->addr = ic->i_recv_hdrs_dma + (i * sizeof(struct rds_header));
+                sge->length = sizeof(struct rds_header);
+                sge->lkey = ic->i_mr->lkey;
+
+                sge = &recv->r_sge[1];
                 sge->addr = 0;
                 sge->length = RDS_FRAG_SIZE;
                 sge->lkey = ic->i_mr->lkey;
+        }
+}
 
-                sge = rds_ib_header_sge(ic, recv->r_sge);
-                sge->addr = ic->i_recv_hdrs_dma + (i * sizeof(struct rds_header));
-                sge->length = sizeof(struct rds_header);
-                sge->lkey = ic->i_mr->lkey;
+/*
+ * The entire 'from' list, including the from element itself, is put on
+ * to the tail of the 'to' list.
+ */
+static void list_splice_entire_tail(struct list_head *from,
+                                    struct list_head *to)
+{
+        struct list_head *from_last = from->prev;
+
+        list_splice_tail(from_last, to);
+        list_add_tail(from_last, to);
+}
+
+static void rds_ib_cache_xfer_to_ready(struct rds_ib_refill_cache *cache)
+{
+        struct list_head *tmp;
+
+        tmp = xchg(&cache->xfer, NULL);
+        if (tmp) {
+                if (cache->ready)
+                        list_splice_entire_tail(tmp, cache->ready);
+                else
+                        cache->ready = tmp;
+        }
+}
+
+static int rds_ib_recv_alloc_cache(struct rds_ib_refill_cache *cache)
+{
+        struct rds_ib_cache_head *head;
+        int cpu;
+
+        cache->percpu = alloc_percpu(struct rds_ib_cache_head);
+        if (!cache->percpu)
+               return -ENOMEM;
+
+        for_each_possible_cpu(cpu) {
+                head = per_cpu_ptr(cache->percpu, cpu);
+                head->first = NULL;
+                head->count = 0;
+        }
+        cache->xfer = NULL;
+        cache->ready = NULL;
+
+        return 0;
+}
+
+int rds_ib_recv_alloc_caches(struct rds_ib_connection *ic)
+{
+        int ret;
+
+        ret = rds_ib_recv_alloc_cache(&ic->i_cache_incs);
+        if (!ret) {
+                ret = rds_ib_recv_alloc_cache(&ic->i_cache_frags);
+                if (ret)
+                        free_percpu(ic->i_cache_incs.percpu);
         }
+
+        return ret;
+}
+
+static void rds_ib_cache_splice_all_lists(struct rds_ib_refill_cache *cache,
+                                          struct list_head *caller_list)
+{
+        struct rds_ib_cache_head *head;
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                head = per_cpu_ptr(cache->percpu, cpu);
+                if (head->first) {
+                        list_splice_entire_tail(head->first, caller_list);
+                        head->first = NULL;
+                }
+        }
+
+        if (cache->ready) {
+                list_splice_entire_tail(cache->ready, caller_list);
+                cache->ready = NULL;
+        }
+}
+
+void rds_ib_recv_free_caches(struct rds_ib_connection *ic)
+{
+        struct rds_ib_incoming *inc;
+        struct rds_ib_incoming *inc_tmp;
+        struct rds_page_frag *frag;
+        struct rds_page_frag *frag_tmp;
+        LIST_HEAD(list);
+
+        rds_ib_cache_xfer_to_ready(&ic->i_cache_incs);
+        rds_ib_cache_splice_all_lists(&ic->i_cache_incs, &list);
+        free_percpu(ic->i_cache_incs.percpu);
+
+        list_for_each_entry_safe(inc, inc_tmp, &list, ii_cache_entry) {
+                list_del(&inc->ii_cache_entry);
+                WARN_ON(!list_empty(&inc->ii_frags));
+                kmem_cache_free(rds_ib_incoming_slab, inc);
+        }
+
+        rds_ib_cache_xfer_to_ready(&ic->i_cache_frags);
+        rds_ib_cache_splice_all_lists(&ic->i_cache_frags, &list);
+        free_percpu(ic->i_cache_frags.percpu);
+
+        list_for_each_entry_safe(frag, frag_tmp, &list, f_cache_entry) {
+                list_del(&frag->f_cache_entry);
+                WARN_ON(!list_empty(&frag->f_item));
+                kmem_cache_free(rds_ib_frag_slab, frag);
+        }
+}
+
+/* fwd decl */
+static void rds_ib_recv_cache_put(struct list_head *new_item,
+                                  struct rds_ib_refill_cache *cache);
+static struct list_head *rds_ib_recv_cache_get(struct rds_ib_refill_cache *cache);
+
+
+/* Recycle frag and attached recv buffer f_sg */
+static void rds_ib_frag_free(struct rds_ib_connection *ic,
+                             struct rds_page_frag *frag)
+{
+        rdsdebug("frag %p page %p\n", frag, sg_page(&frag->f_sg));
+
+        rds_ib_recv_cache_put(&frag->f_cache_entry, &ic->i_cache_frags);
+}
+
+/* Recycle inc after freeing attached frags */
+void rds_ib_inc_free(struct rds_incoming *inc)
+{
+        struct rds_ib_incoming *ibinc;
+        struct rds_page_frag *frag;
+        struct rds_page_frag *pos;
+        struct rds_ib_connection *ic = inc->i_conn->c_transport_data;
+
+        ibinc = container_of(inc, struct rds_ib_incoming, ii_inc);
+
+        /* Free attached frags */
+        list_for_each_entry_safe(frag, pos, &ibinc->ii_frags, f_item) {
+                list_del_init(&frag->f_item);
+                rds_ib_frag_free(ic, frag);
+        }
+        BUG_ON(!list_empty(&ibinc->ii_frags));
+
+        rdsdebug("freeing ibinc %p inc %p\n", ibinc, inc);
+        rds_ib_recv_cache_put(&ibinc->ii_cache_entry, &ic->i_cache_incs);
 }
 
 static void rds_ib_recv_clear_one(struct rds_ib_connection *ic,
@@ -115,10 +224,8 @@ static void rds_ib_recv_clear_one(struct rds_ib_connection *ic,
                 recv->r_ibinc = NULL;
         }
         if (recv->r_frag) {
-                rds_ib_recv_unmap_page(ic, recv);
-                if (recv->r_frag->f_page)
-                        rds_ib_frag_drop_page(recv->r_frag);
-                rds_ib_frag_free(recv->r_frag);
+                ib_dma_unmap_sg(ic->i_cm_id->device, &recv->r_frag->f_sg, 1, DMA_FROM_DEVICE);
+                rds_ib_frag_free(ic, recv->r_frag);
                 recv->r_frag = NULL;
         }
 }
@@ -129,84 +236,111 @@ void rds_ib_recv_clear_ring(struct rds_ib_connection *ic)
 
         for (i = 0; i < ic->i_recv_ring.w_nr; i++)
                 rds_ib_recv_clear_one(ic, &ic->i_recvs[i]);
-
-        if (ic->i_frag.f_page)
-                rds_ib_frag_drop_page(&ic->i_frag);
 }
 
-static int rds_ib_recv_refill_one(struct rds_connection *conn,
-                                  struct rds_ib_recv_work *recv,
-                                  gfp_t kptr_gfp, gfp_t page_gfp)
+static struct rds_ib_incoming *rds_ib_refill_one_inc(struct rds_ib_connection *ic,
+                                                     gfp_t slab_mask)
 {
-        struct rds_ib_connection *ic = conn->c_transport_data;
-        dma_addr_t dma_addr;
-        struct ib_sge *sge;
-        int ret = -ENOMEM;
+        struct rds_ib_incoming *ibinc;
+        struct list_head *cache_item;
+        int avail_allocs;
 
-        if (recv->r_ibinc == NULL) {
-                if (!atomic_add_unless(&rds_ib_allocation, 1, rds_ib_sysctl_max_recv_allocation)) {
+        cache_item = rds_ib_recv_cache_get(&ic->i_cache_incs);
+        if (cache_item) {
+                ibinc = container_of(cache_item, struct rds_ib_incoming, ii_cache_entry);
+        } else {
+                avail_allocs = atomic_add_unless(&rds_ib_allocation,
+                                                 1, rds_ib_sysctl_max_recv_allocation);
+                if (!avail_allocs) {
                         rds_ib_stats_inc(s_ib_rx_alloc_limit);
-                        goto out;
+                        return NULL;
                 }
-                recv->r_ibinc = kmem_cache_alloc(rds_ib_incoming_slab,
-                                                 kptr_gfp);
-                if (recv->r_ibinc == NULL) {
+                ibinc = kmem_cache_alloc(rds_ib_incoming_slab, slab_mask);
+                if (!ibinc) {
                         atomic_dec(&rds_ib_allocation);
-                        goto out;
+                        return NULL;
                 }
-                INIT_LIST_HEAD(&recv->r_ibinc->ii_frags);
-                rds_inc_init(&recv->r_ibinc->ii_inc, conn, conn->c_faddr);
         }
+        INIT_LIST_HEAD(&ibinc->ii_frags);
+        rds_inc_init(&ibinc->ii_inc, ic->conn, ic->conn->c_faddr);
 
-        if (recv->r_frag == NULL) {
-                recv->r_frag = kmem_cache_alloc(rds_ib_frag_slab, kptr_gfp);
-                if (recv->r_frag == NULL)
-                        goto out;
-                INIT_LIST_HEAD(&recv->r_frag->f_item);
-                recv->r_frag->f_page = NULL;
+        return ibinc;
+}
+
+static struct rds_page_frag *rds_ib_refill_one_frag(struct rds_ib_connection *ic,
+                                                    gfp_t slab_mask, gfp_t page_mask)
+{
+        struct rds_page_frag *frag;
+        struct list_head *cache_item;
+        int ret;
+
+        cache_item = rds_ib_recv_cache_get(&ic->i_cache_frags);
+        if (cache_item) {
+                frag = container_of(cache_item, struct rds_page_frag, f_cache_entry);
+        } else {
+                frag = kmem_cache_alloc(rds_ib_frag_slab, slab_mask);
+                if (!frag)
+                        return NULL;
+
+                sg_init_table(&frag->f_sg, 1);
+                ret = rds_page_remainder_alloc(&frag->f_sg,
+                                               RDS_FRAG_SIZE, page_mask);
+                if (ret) {
+                        kmem_cache_free(rds_ib_frag_slab, frag);
+                        return NULL;
+                }
         }
 
-        if (ic->i_frag.f_page == NULL) {
-                ic->i_frag.f_page = alloc_page(page_gfp);
-                if (ic->i_frag.f_page == NULL)
-                        goto out;
-                ic->i_frag.f_offset = 0;
+        INIT_LIST_HEAD(&frag->f_item);
+
+        return frag;
+}
+
+static int rds_ib_recv_refill_one(struct rds_connection *conn,
+                                  struct rds_ib_recv_work *recv, int prefill)
+{
+        struct rds_ib_connection *ic = conn->c_transport_data;
+        struct ib_sge *sge;
+        int ret = -ENOMEM;
+        gfp_t slab_mask = GFP_NOWAIT;
+        gfp_t page_mask = GFP_NOWAIT;
+
+        if (prefill) {
+                slab_mask = GFP_KERNEL;
+                page_mask = GFP_HIGHUSER;
         }
 
-        dma_addr = ib_dma_map_page(ic->i_cm_id->device,
-                                  ic->i_frag.f_page,
-                                  ic->i_frag.f_offset,
-                                  RDS_FRAG_SIZE,
-                                  DMA_FROM_DEVICE);
-        if (ib_dma_mapping_error(ic->i_cm_id->device, dma_addr))
-                goto out;
+        if (!ic->i_cache_incs.ready)
+                rds_ib_cache_xfer_to_ready(&ic->i_cache_incs);
+        if (!ic->i_cache_frags.ready)
+                rds_ib_cache_xfer_to_ready(&ic->i_cache_frags);
 
         /*
-         * Once we get the RDS_PAGE_LAST_OFF frag then rds_ib_frag_unmap()
-         * must be called on this recv.  This happens as completions hit
-         * in order or on connection shutdown.
+         * ibinc was taken from recv if recv contained the start of a message.
+         * recvs that were continuations will still have this allocated.
          */
-        recv->r_frag->f_page = ic->i_frag.f_page;
-        recv->r_frag->f_offset = ic->i_frag.f_offset;
-        recv->r_frag->f_mapped = dma_addr;
+        if (!recv->r_ibinc) {
+                recv->r_ibinc = rds_ib_refill_one_inc(ic, slab_mask);
+                if (!recv->r_ibinc)
+                        goto out;
+        }
 
-        sge = rds_ib_data_sge(ic, recv->r_sge);
-        sge->addr = dma_addr;
-        sge->length = RDS_FRAG_SIZE;
+        WARN_ON(recv->r_frag); /* leak! */
+        recv->r_frag = rds_ib_refill_one_frag(ic, slab_mask, page_mask);
+        if (!recv->r_frag)
+                goto out;
+
+        ret = ib_dma_map_sg(ic->i_cm_id->device, &recv->r_frag->f_sg,
+                            1, DMA_FROM_DEVICE);
+        WARN_ON(ret != 1);
 
-        sge = rds_ib_header_sge(ic, recv->r_sge);
+        sge = &recv->r_sge[0];
         sge->addr = ic->i_recv_hdrs_dma + (recv - ic->i_recvs) * sizeof(struct rds_header);
         sge->length = sizeof(struct rds_header);
 
-        get_page(recv->r_frag->f_page);
-
-        if (ic->i_frag.f_offset < RDS_PAGE_LAST_OFF) {
-                ic->i_frag.f_offset += RDS_FRAG_SIZE;
-        } else {
-                put_page(ic->i_frag.f_page);
-                ic->i_frag.f_page = NULL;
-                ic->i_frag.f_offset = 0;
-        }
+        sge = &recv->r_sge[1];
+        sge->addr = sg_dma_address(&recv->r_frag->f_sg);
+        sge->length = sg_dma_len(&recv->r_frag->f_sg);
 
         ret = 0;
 out:
@@ -216,13 +350,11 @@ out:
 /*
  * This tries to allocate and post unused work requests after making sure that
  * they have all the allocations they need to queue received fragments into
- * sockets.  The i_recv_mutex is held here so that ring_alloc and _unalloc
- * pairs don't go unmatched.
+ * sockets.
  *
  * -1 is returned if posting fails due to temporary resource exhaustion.
  */
-int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
-                       gfp_t page_gfp, int prefill)
+void rds_ib_recv_refill(struct rds_connection *conn, int prefill)
 {
         struct rds_ib_connection *ic = conn->c_transport_data;
         struct rds_ib_recv_work *recv;
@@ -236,28 +368,25 @@ int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
                 if (pos >= ic->i_recv_ring.w_nr) {
                         printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n",
                                         pos);
-                        ret = -EINVAL;
                         break;
                 }
 
                 recv = &ic->i_recvs[pos];
-                ret = rds_ib_recv_refill_one(conn, recv, kptr_gfp, page_gfp);
+                ret = rds_ib_recv_refill_one(conn, recv, prefill);
                 if (ret) {
-                        ret = -1;
                         break;
                 }
 
                 /* XXX when can this fail? */
                 ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
                 rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
-                         recv->r_ibinc, recv->r_frag->f_page,
-                         (long) recv->r_frag->f_mapped, ret);
+                         recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
+                         (long) sg_dma_address(&recv->r_frag->f_sg), ret);
                 if (ret) {
                         rds_ib_conn_error(conn, "recv post on "
                                "%pI4 returned %d, disconnecting and "
                                "reconnecting\n", &conn->c_faddr,
                                ret);
-                        ret = -1;
                         break;
                 }
 
@@ -270,37 +399,73 @@ int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
 
         if (ret)
                 rds_ib_ring_unalloc(&ic->i_recv_ring, 1);
-        return ret;
 }
 
-void rds_ib_inc_purge(struct rds_incoming *inc)
+/*
+ * We want to recycle several types of recv allocations, like incs and frags.
+ * To use this, the *_free() function passes in the ptr to a list_head within
+ * the recyclee, as well as the cache to put it on.
+ *
+ * First, we put the memory on a percpu list. When this reaches a certain size,
+ * We move it to an intermediate non-percpu list in a lockless manner, with some
+ * xchg/compxchg wizardry.
+ *
+ * N.B. Instead of a list_head as the anchor, we use a single pointer, which can
+ * be NULL and xchg'd. The list is actually empty when the pointer is NULL, and
+ * list_empty() will return true with one element is actually present.
+ */
+static void rds_ib_recv_cache_put(struct list_head *new_item,
+                                 struct rds_ib_refill_cache *cache)
 {
-        struct rds_ib_incoming *ibinc;
-        struct rds_page_frag *frag;
-        struct rds_page_frag *pos;
+        unsigned long flags;
+        struct rds_ib_cache_head *chp;
+        struct list_head *old;
 
-        ibinc = container_of(inc, struct rds_ib_incoming, ii_inc);
-        rdsdebug("purging ibinc %p inc %p\n", ibinc, inc);
+        local_irq_save(flags);
 
-        list_for_each_entry_safe(frag, pos, &ibinc->ii_frags, f_item) {
-                list_del_init(&frag->f_item);
-                rds_ib_frag_drop_page(frag);
-                rds_ib_frag_free(frag);
-        }
+        chp = per_cpu_ptr(cache->percpu, smp_processor_id());
+        if (!chp->first)
+                INIT_LIST_HEAD(new_item);
+        else /* put on front */
+                list_add_tail(new_item, chp->first);
+        chp->first = new_item;
+        chp->count++;
+
+        if (chp->count < RDS_IB_RECYCLE_BATCH_COUNT)
+                goto end;
+
+        /*
+         * Return our per-cpu first list to the cache's xfer by atomically
+         * grabbing the current xfer list, appending it to our per-cpu list,
+         * and then atomically returning that entire list back to the
+         * cache's xfer list as long as it's still empty.
+         */
+        do {
+                old = xchg(&cache->xfer, NULL);
+                if (old)
+                        list_splice_entire_tail(old, chp->first);
+                old = cmpxchg(&cache->xfer, NULL, chp->first);
+        } while (old);
+
+        chp->first = NULL;
+        chp->count = 0;
+end:
+        local_irq_restore(flags);
 }
 
-void rds_ib_inc_free(struct rds_incoming *inc)
+static struct list_head *rds_ib_recv_cache_get(struct rds_ib_refill_cache *cache)
 {
-        struct rds_ib_incoming *ibinc;
-
-        ibinc = container_of(inc, struct rds_ib_incoming, ii_inc);
+        struct list_head *head = cache->ready;
+
+        if (head) {
+                if (!list_empty(head)) {
+                        cache->ready = head->next;
+                        list_del_init(head);
+                } else
+                        cache->ready = NULL;
+        }
 
-        rds_ib_inc_purge(inc);
-        rdsdebug("freeing ibinc %p inc %p\n", ibinc, inc);
-        BUG_ON(!list_empty(&ibinc->ii_frags));
-        kmem_cache_free(rds_ib_incoming_slab, ibinc);
-        atomic_dec(&rds_ib_allocation);
-        BUG_ON(atomic_read(&rds_ib_allocation) < 0);
+        return head;
 }
 
 int rds_ib_inc_copy_to_user(struct rds_incoming *inc, struct iovec *first_iov,
@@ -336,13 +501,13 @@ int rds_ib_inc_copy_to_user(struct rds_incoming *inc, struct iovec *first_iov,
                 to_copy = min_t(unsigned long, to_copy, len - copied);
 
                 rdsdebug("%lu bytes to user [%p, %zu] + %lu from frag "
-                         "[%p, %lu] + %lu\n",
+                         "[%p, %u] + %lu\n",
                          to_copy, iov->iov_base, iov->iov_len, iov_off,
-                         frag->f_page, frag->f_offset, frag_off);
+                         sg_page(&frag->f_sg), frag->f_sg.offset, frag_off);
 
                 /* XXX needs + offset for multiple recvs per page */
-                ret = rds_page_copy_to_user(frag->f_page,
-                                            frag->f_offset + frag_off,
+                ret = rds_page_copy_to_user(sg_page(&frag->f_sg),
+                                            frag->f_sg.offset + frag_off,
                                             iov->iov_base + iov_off,
                                             to_copy);
                 if (ret) {
@@ -557,47 +722,6 @@ u64 rds_ib_piggyb_ack(struct rds_ib_connection *ic)
         return rds_ib_get_ack(ic);
 }
 
-static struct rds_header *rds_ib_get_header(struct rds_connection *conn,
-                                            struct rds_ib_recv_work *recv,
-                                            u32 data_len)
-{
-        struct rds_ib_connection *ic = conn->c_transport_data;
-        void *hdr_buff = &ic->i_recv_hdrs[recv - ic->i_recvs];
-        void *addr;
-        u32 misplaced_hdr_bytes;
-
-        /*
-         * Support header at the front (RDS 3.1+) as well as header-at-end.
-         *
-         * Cases:
-         * 1) header all in header buff (great!)
-         * 2) header all in data page (copy all to header buff)
-         * 3) header split across hdr buf + data page
-         *    (move bit in hdr buff to end before copying other bit from data page)
-         */
-        if (conn->c_version > RDS_PROTOCOL_3_0 || data_len == RDS_FRAG_SIZE)
-                return hdr_buff;
-
-        if (data_len <= (RDS_FRAG_SIZE - sizeof(struct rds_header))) {
-                addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
-                memcpy(hdr_buff,
-                       addr + recv->r_frag->f_offset + data_len,
-                       sizeof(struct rds_header));
-                kunmap_atomic(addr, KM_SOFTIRQ0);
-                return hdr_buff;
-        }
-
-        misplaced_hdr_bytes = (sizeof(struct rds_header) - (RDS_FRAG_SIZE - data_len));
-
-        memmove(hdr_buff + misplaced_hdr_bytes, hdr_buff, misplaced_hdr_bytes);
-
-        addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
-        memcpy(hdr_buff, addr + recv->r_frag->f_offset + data_len,
-               sizeof(struct rds_header) - misplaced_hdr_bytes);
-        kunmap_atomic(addr, KM_SOFTIRQ0);
-        return hdr_buff;
-}
-
 /*
  * It's kind of lame that we're copying from the posted receive pages into
  * long-lived bitmaps.  We could have posted the bitmaps and rdma written into
@@ -639,7 +763,7 @@ static void rds_ib_cong_recv(struct rds_connection *conn,
                 to_copy = min(RDS_FRAG_SIZE - frag_off, PAGE_SIZE - map_off);
                 BUG_ON(to_copy & 7); /* Must be 64bit aligned. */
 
-                addr = kmap_atomic(frag->f_page, KM_SOFTIRQ0);
+                addr = kmap_atomic(sg_page(&frag->f_sg), KM_SOFTIRQ0);
 
                 src = addr + frag_off;
                 dst = (void *)map->m_page_addrs[map_page] + map_off;
@@ -710,7 +834,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
         }
         data_len -= sizeof(struct rds_header);
 
-        ihdr = rds_ib_get_header(conn, recv, data_len);
+        ihdr = &ic->i_recv_hdrs[recv - ic->i_recvs];
 
         /* Validate the checksum. */
         if (!rds_message_verify_checksum(ihdr)) {
@@ -742,12 +866,12 @@ static void rds_ib_process_recv(struct rds_connection *conn,
                  * the inc is freed.  We don't go that route, so we have to drop the
                  * page ref ourselves.  We can't just leave the page on the recv
                  * because that confuses the dma mapping of pages and each recv's use
-                 * of a partial page.  We can leave the frag, though, it will be
-                 * reused.
+                 * of a partial page.
                  *
                  * FIXME: Fold this into the code path below.
                  */
-                rds_ib_frag_drop_page(recv->r_frag);
+                rds_ib_frag_free(ic, recv->r_frag);
+                recv->r_frag = NULL;
                 return;
         }
 
@@ -757,7 +881,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
          * into the inc and save the inc so we can hang upcoming fragments
          * off its list.
          */
-        if (ibinc == NULL) {
+        if (!ibinc) {
                 ibinc = recv->r_ibinc;
                 recv->r_ibinc = NULL;
                 ic->i_ibinc = ibinc;
@@ -842,32 +966,38 @@ static inline void rds_poll_cq(struct rds_ib_connection *ic,
         struct rds_ib_recv_work *recv;
 
         while (ib_poll_cq(ic->i_recv_cq, 1, &wc) > 0) {
-                rdsdebug("wc wr_id 0x%llx status %u byte_len %u imm_data %u\n",
-                         (unsigned long long)wc.wr_id, wc.status, wc.byte_len,
+                rdsdebug("wc wr_id 0x%llx status %u (%s) byte_len %u imm_data %u\n",
+                         (unsigned long long)wc.wr_id, wc.status,
+                         rds_ib_wc_status_str(wc.status), wc.byte_len,
                          be32_to_cpu(wc.ex.imm_data));
                 rds_ib_stats_inc(s_ib_rx_cq_event);
 
                 recv = &ic->i_recvs[rds_ib_ring_oldest(&ic->i_recv_ring)];
 
-                rds_ib_recv_unmap_page(ic, recv);
+                ib_dma_unmap_sg(ic->i_cm_id->device, &recv->r_frag->f_sg, 1, DMA_FROM_DEVICE);
 
                 /*
                  * Also process recvs in connecting state because it is possible
                  * to get a recv completion _before_ the rdmacm ESTABLISHED
                  * event is processed.
                  */
-                if (rds_conn_up(conn) || rds_conn_connecting(conn)) {
+                if (wc.status == IB_WC_SUCCESS) {
+                        rds_ib_process_recv(conn, recv, wc.byte_len, state);
+                } else {
                         /* We expect errors as the qp is drained during shutdown */
-                        if (wc.status == IB_WC_SUCCESS) {
-                                rds_ib_process_recv(conn, recv, wc.byte_len, state);
-                        } else {
-                                rds_ib_conn_error(conn, "recv completion on "
-                                       "%pI4 had status %u, disconnecting and "
-                                       "reconnecting\n", &conn->c_faddr,
-                                       wc.status);
-                        }
+                        if (rds_conn_up(conn) || rds_conn_connecting(conn))
+                                rds_ib_conn_error(conn, "recv completion on %pI4 had "
+                                                  "status %u (%s), disconnecting and "
+                                                  "reconnecting\n", &conn->c_faddr,
+                                                  wc.status,
+                                                  rds_ib_wc_status_str(wc.status));
                 }
 
+                /*
+                 * It's very important that we only free this ring entry if we've truly
+                 * freed the resources allocated to the entry.  The refilling path can
+                 * leak if we don't.
+                 */
                 rds_ib_ring_free(&ic->i_recv_ring, 1);
         }
 }
@@ -897,11 +1027,8 @@ void rds_ib_recv_tasklet_fn(unsigned long data)
         if (rds_ib_ring_empty(&ic->i_recv_ring))
                 rds_ib_stats_inc(s_ib_rx_ring_empty);
 
-        /*
-         * If the ring is running low, then schedule the thread to refill.
-         */
         if (rds_ib_ring_low(&ic->i_recv_ring))
-                queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
+                rds_ib_recv_refill(conn, 0);
 }
 
 int rds_ib_recv(struct rds_connection *conn)
@@ -910,25 +1037,13 @@ int rds_ib_recv(struct rds_connection *conn)
         int ret = 0;
 
         rdsdebug("conn %p\n", conn);
-
-        /*
-         * If we get a temporary posting failure in this context then
-         * we're really low and we want the caller to back off for a bit.
-         */
-        mutex_lock(&ic->i_recv_mutex);
-        if (rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 0))
-                ret = -ENOMEM;
-        else
-                rds_ib_stats_inc(s_ib_rx_refill_from_thread);
-        mutex_unlock(&ic->i_recv_mutex);
-
         if (rds_conn_up(conn))
                 rds_ib_attempt_ack(ic);
 
         return ret;
 }
 
-int __init rds_ib_recv_init(void)
+int rds_ib_recv_init(void)
 {
         struct sysinfo si;
         int ret = -ENOMEM;
@@ -939,14 +1054,14 @@ int __init rds_ib_recv_init(void)
 
         rds_ib_incoming_slab = kmem_cache_create("rds_ib_incoming",
                                         sizeof(struct rds_ib_incoming),
-                                        0, 0, NULL);
-        if (rds_ib_incoming_slab == NULL)
+                                        0, SLAB_HWCACHE_ALIGN, NULL);
+        if (!rds_ib_incoming_slab)
                 goto out;
 
         rds_ib_frag_slab = kmem_cache_create("rds_ib_frag",
                                         sizeof(struct rds_page_frag),
-                                        0, 0, NULL);
-        if (rds_ib_frag_slab == NULL)
+                                        0, SLAB_HWCACHE_ALIGN, NULL);
+        if (!rds_ib_frag_slab)
                 kmem_cache_destroy(rds_ib_incoming_slab);
         else
                 ret = 0;
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 17fa80803ab0..71f373c421bc 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -36,11 +36,49 @@
 #include <linux/dmapool.h>
 
 #include "rds.h"
-#include "rdma.h"
 #include "ib.h"
 
-static void rds_ib_send_rdma_complete(struct rds_message *rm,
-                                      int wc_status)
+static char *rds_ib_wc_status_strings[] = {
+#define RDS_IB_WC_STATUS_STR(foo) \
+                [IB_WC_##foo] = __stringify(IB_WC_##foo)
+        RDS_IB_WC_STATUS_STR(SUCCESS),
+        RDS_IB_WC_STATUS_STR(LOC_LEN_ERR),
+        RDS_IB_WC_STATUS_STR(LOC_QP_OP_ERR),
+        RDS_IB_WC_STATUS_STR(LOC_EEC_OP_ERR),
+        RDS_IB_WC_STATUS_STR(LOC_PROT_ERR),
+        RDS_IB_WC_STATUS_STR(WR_FLUSH_ERR),
+        RDS_IB_WC_STATUS_STR(MW_BIND_ERR),
+        RDS_IB_WC_STATUS_STR(BAD_RESP_ERR),
+        RDS_IB_WC_STATUS_STR(LOC_ACCESS_ERR),
+        RDS_IB_WC_STATUS_STR(REM_INV_REQ_ERR),
+        RDS_IB_WC_STATUS_STR(REM_ACCESS_ERR),
+        RDS_IB_WC_STATUS_STR(REM_OP_ERR),
+        RDS_IB_WC_STATUS_STR(RETRY_EXC_ERR),
+        RDS_IB_WC_STATUS_STR(RNR_RETRY_EXC_ERR),
+        RDS_IB_WC_STATUS_STR(LOC_RDD_VIOL_ERR),
+        RDS_IB_WC_STATUS_STR(REM_INV_RD_REQ_ERR),
+        RDS_IB_WC_STATUS_STR(REM_ABORT_ERR),
+        RDS_IB_WC_STATUS_STR(INV_EECN_ERR),
+        RDS_IB_WC_STATUS_STR(INV_EEC_STATE_ERR),
+        RDS_IB_WC_STATUS_STR(FATAL_ERR),
+        RDS_IB_WC_STATUS_STR(RESP_TIMEOUT_ERR),
+        RDS_IB_WC_STATUS_STR(GENERAL_ERR),
+#undef RDS_IB_WC_STATUS_STR
+};
+
+char *rds_ib_wc_status_str(enum ib_wc_status status)
+{
+        return rds_str_array(rds_ib_wc_status_strings,
+                             ARRAY_SIZE(rds_ib_wc_status_strings), status);
+}
+
+/*
+ * Convert IB-specific error message to RDS error message and call core
+ * completion handler.
+ */
+static void rds_ib_send_complete(struct rds_message *rm,
+                                 int wc_status,
+                                 void (*complete)(struct rds_message *rm, int status))
 {
         int notify_status;
 
@@ -60,69 +98,125 @@ static void rds_ib_send_rdma_complete(struct rds_message *rm,
                 notify_status = RDS_RDMA_OTHER_ERROR;
                 break;
         }
-        rds_rdma_send_complete(rm, notify_status);
+        complete(rm, notify_status);
+}
+
+static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
+                                   struct rm_data_op *op,
+                                   int wc_status)
+{
+        if (op->op_nents)
+                ib_dma_unmap_sg(ic->i_cm_id->device,
+                                op->op_sg, op->op_nents,
+                                DMA_TO_DEVICE);
 }
 
 static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic,
-                                   struct rds_rdma_op *op)
+                                   struct rm_rdma_op *op,
+                                   int wc_status)
 {
-        if (op->r_mapped) {
+        if (op->op_mapped) {
                 ib_dma_unmap_sg(ic->i_cm_id->device,
-                        op->r_sg, op->r_nents,
-                        op->r_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-                op->r_mapped = 0;
+                                op->op_sg, op->op_nents,
+                                op->op_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                op->op_mapped = 0;
         }
+
+        /* If the user asked for a completion notification on this
+         * message, we can implement three different semantics:
+         *  1.  Notify when we received the ACK on the RDS message
+         *      that was queued with the RDMA. This provides reliable
+         *      notification of RDMA status at the expense of a one-way
+         *      packet delay.
+         *  2.  Notify when the IB stack gives us the completion event for
+         *      the RDMA operation.
+         *  3.  Notify when the IB stack gives us the completion event for
+         *      the accompanying RDS messages.
+         * Here, we implement approach #3. To implement approach #2,
+         * we would need to take an event for the rdma WR. To implement #1,
+         * don't call rds_rdma_send_complete at all, and fall back to the notify
+         * handling in the ACK processing code.
+         *
+         * Note: There's no need to explicitly sync any RDMA buffers using
+         * ib_dma_sync_sg_for_cpu - the completion for the RDMA
+         * operation itself unmapped the RDMA buffers, which takes care
+         * of synching.
+         */
+        rds_ib_send_complete(container_of(op, struct rds_message, rdma),
+                             wc_status, rds_rdma_send_complete);
+
+        if (op->op_write)
+                rds_stats_add(s_send_rdma_bytes, op->op_bytes);
+        else
+                rds_stats_add(s_recv_rdma_bytes, op->op_bytes);
 }
 
-static void rds_ib_send_unmap_rm(struct rds_ib_connection *ic,
-                          struct rds_ib_send_work *send,
-                          int wc_status)
+static void rds_ib_send_unmap_atomic(struct rds_ib_connection *ic,
+                                     struct rm_atomic_op *op,
+                                     int wc_status)
 {
-        struct rds_message *rm = send->s_rm;
-
-        rdsdebug("ic %p send %p rm %p\n", ic, send, rm);
-
-        ib_dma_unmap_sg(ic->i_cm_id->device,
-                     rm->m_sg, rm->m_nents,
-                     DMA_TO_DEVICE);
-
-        if (rm->m_rdma_op != NULL) {
-                rds_ib_send_unmap_rdma(ic, rm->m_rdma_op);
-
-                /* If the user asked for a completion notification on this
-                 * message, we can implement three different semantics:
-                 *  1.  Notify when we received the ACK on the RDS message
-                 *      that was queued with the RDMA. This provides reliable
-                 *      notification of RDMA status at the expense of a one-way
-                 *      packet delay.
-                 *  2.  Notify when the IB stack gives us the completion event for
-                 *      the RDMA operation.
-                 *  3.  Notify when the IB stack gives us the completion event for
-                 *      the accompanying RDS messages.
-                 * Here, we implement approach #3. To implement approach #2,
-                 * call rds_rdma_send_complete from the cq_handler. To implement #1,
-                 * don't call rds_rdma_send_complete at all, and fall back to the notify
-                 * handling in the ACK processing code.
-                 *
-                 * Note: There's no need to explicitly sync any RDMA buffers using
-                 * ib_dma_sync_sg_for_cpu - the completion for the RDMA
-                 * operation itself unmapped the RDMA buffers, which takes care
-                 * of synching.
-                 */
-                rds_ib_send_rdma_complete(rm, wc_status);
+        /* unmap atomic recvbuf */
+        if (op->op_mapped) {
+                ib_dma_unmap_sg(ic->i_cm_id->device, op->op_sg, 1,
+                                DMA_FROM_DEVICE);
+                op->op_mapped = 0;
+        }
 
-                if (rm->m_rdma_op->r_write)
-                        rds_stats_add(s_send_rdma_bytes, rm->m_rdma_op->r_bytes);
-                else
-                        rds_stats_add(s_recv_rdma_bytes, rm->m_rdma_op->r_bytes);
+        rds_ib_send_complete(container_of(op, struct rds_message, atomic),
+                             wc_status, rds_atomic_send_complete);
+
+        if (op->op_type == RDS_ATOMIC_TYPE_CSWP)
+                rds_ib_stats_inc(s_ib_atomic_cswp);
+        else
+                rds_ib_stats_inc(s_ib_atomic_fadd);
+}
+
+/*
+ * Unmap the resources associated with a struct send_work.
+ *
+ * Returns the rm for no good reason other than it is unobtainable
+ * other than by switching on wr.opcode, currently, and the caller,
+ * the event handler, needs it.
+ */
+static struct rds_message *rds_ib_send_unmap_op(struct rds_ib_connection *ic,
+                                                struct rds_ib_send_work *send,
+                                                int wc_status)
+{
+        struct rds_message *rm = NULL;
+
+        /* In the error case, wc.opcode sometimes contains garbage */
+        switch (send->s_wr.opcode) {
+        case IB_WR_SEND:
+                if (send->s_op) {
+                        rm = container_of(send->s_op, struct rds_message, data);
+                        rds_ib_send_unmap_data(ic, send->s_op, wc_status);
+                }
+                break;
+        case IB_WR_RDMA_WRITE:
+        case IB_WR_RDMA_READ:
+                if (send->s_op) {
+                        rm = container_of(send->s_op, struct rds_message, rdma);
+                        rds_ib_send_unmap_rdma(ic, send->s_op, wc_status);
+                }
+                break;
+        case IB_WR_ATOMIC_FETCH_AND_ADD:
+        case IB_WR_ATOMIC_CMP_AND_SWP:
+                if (send->s_op) {
+                        rm = container_of(send->s_op, struct rds_message, atomic);
+                        rds_ib_send_unmap_atomic(ic, send->s_op, wc_status);
+                }
+                break;
+        default:
+                if (printk_ratelimit())
+                        printk(KERN_NOTICE
+                               "RDS/IB: %s: unexpected opcode 0x%x in WR!\n",
+                               __func__, send->s_wr.opcode);
+                break;
         }
 
-        /* If anyone waited for this message to get flushed out, wake
-         * them up now */
-        rds_message_unmapped(rm);
+        send->s_wr.opcode = 0xdead;
 
-        rds_message_put(rm);
-        send->s_rm = NULL;
+        return rm;
 }
 
 void rds_ib_send_init_ring(struct rds_ib_connection *ic)
@@ -133,23 +227,18 @@ void rds_ib_send_init_ring(struct rds_ib_connection *ic)
         for (i = 0, send = ic->i_sends; i < ic->i_send_ring.w_nr; i++, send++) {
                 struct ib_sge *sge;
 
-                send->s_rm = NULL;
                 send->s_op = NULL;
 
                 send->s_wr.wr_id = i;
                 send->s_wr.sg_list = send->s_sge;
-                send->s_wr.num_sge = 1;
-                send->s_wr.opcode = IB_WR_SEND;
-                send->s_wr.send_flags = 0;
                 send->s_wr.ex.imm_data = 0;
 
-                sge = rds_ib_data_sge(ic, send->s_sge);
-                sge->lkey = ic->i_mr->lkey;
-
-                sge = rds_ib_header_sge(ic, send->s_sge);
+                sge = &send->s_sge[0];
                 sge->addr = ic->i_send_hdrs_dma + (i * sizeof(struct rds_header));
                 sge->length = sizeof(struct rds_header);
                 sge->lkey = ic->i_mr->lkey;
+
+                send->s_sge[1].lkey = ic->i_mr->lkey;
         }
 }
 
@@ -159,16 +248,24 @@ void rds_ib_send_clear_ring(struct rds_ib_connection *ic)
         u32 i;
 
         for (i = 0, send = ic->i_sends; i < ic->i_send_ring.w_nr; i++, send++) {
-                if (send->s_wr.opcode == 0xdead)
-                        continue;
-                if (send->s_rm)
-                        rds_ib_send_unmap_rm(ic, send, IB_WC_WR_FLUSH_ERR);
-                if (send->s_op)
-                        rds_ib_send_unmap_rdma(ic, send->s_op);
+                if (send->s_op && send->s_wr.opcode != 0xdead)
+                        rds_ib_send_unmap_op(ic, send, IB_WC_WR_FLUSH_ERR);
         }
 }
 
 /*
+ * The only fast path caller always has a non-zero nr, so we don't
+ * bother testing nr before performing the atomic sub.
+ */
+static void rds_ib_sub_signaled(struct rds_ib_connection *ic, int nr)
+{
+        if ((atomic_sub_return(nr, &ic->i_signaled_sends) == 0) &&
+            waitqueue_active(&rds_ib_ring_empty_wait))
+                wake_up(&rds_ib_ring_empty_wait);
+        BUG_ON(atomic_read(&ic->i_signaled_sends) < 0);
+}
+
+/*
  * The _oldest/_free ring operations here race cleanly with the alloc/unalloc
  * operations performed in the send path.  As the sender allocs and potentially
  * unallocs the next free entry in the ring it doesn't alter which is
@@ -178,12 +275,14 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
 {
         struct rds_connection *conn = context;
         struct rds_ib_connection *ic = conn->c_transport_data;
+        struct rds_message *rm = NULL;
         struct ib_wc wc;
         struct rds_ib_send_work *send;
         u32 completed;
         u32 oldest;
         u32 i = 0;
         int ret;
+        int nr_sig = 0;
 
         rdsdebug("cq %p conn %p\n", cq, conn);
         rds_ib_stats_inc(s_ib_tx_cq_call);
@@ -192,8 +291,9 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
                 rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
 
         while (ib_poll_cq(cq, 1, &wc) > 0) {
-                rdsdebug("wc wr_id 0x%llx status %u byte_len %u imm_data %u\n",
-                         (unsigned long long)wc.wr_id, wc.status, wc.byte_len,
+                rdsdebug("wc wr_id 0x%llx status %u (%s) byte_len %u imm_data %u\n",
+                         (unsigned long long)wc.wr_id, wc.status,
+                         rds_ib_wc_status_str(wc.status), wc.byte_len,
                          be32_to_cpu(wc.ex.imm_data));
                 rds_ib_stats_inc(s_ib_tx_cq_event);
 
@@ -210,51 +310,30 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 for (i = 0; i < completed; i++) {
                         send = &ic->i_sends[oldest];
+                        if (send->s_wr.send_flags & IB_SEND_SIGNALED)
+                                nr_sig++;
 
-                        /* In the error case, wc.opcode sometimes contains garbage */
-                        switch (send->s_wr.opcode) {
-                        case IB_WR_SEND:
-                                if (send->s_rm)
-                                        rds_ib_send_unmap_rm(ic, send, wc.status);
-                                break;
-                        case IB_WR_RDMA_WRITE:
-                        case IB_WR_RDMA_READ:
-                                /* Nothing to be done - the SG list will be unmapped
-                                 * when the SEND completes. */
-                                break;
-                        default:
-                                if (printk_ratelimit())
-                                        printk(KERN_NOTICE
-                                                "RDS/IB: %s: unexpected opcode 0x%x in WR!\n",
-                                                __func__, send->s_wr.opcode);
-                                break;
-                        }
+                        rm = rds_ib_send_unmap_op(ic, send, wc.status);
 
-                        send->s_wr.opcode = 0xdead;
-                        send->s_wr.num_sge = 1;
                         if (send->s_queued + HZ/2 < jiffies)
                                 rds_ib_stats_inc(s_ib_tx_stalled);
 
-                        /* If a RDMA operation produced an error, signal this right
-                         * away. If we don't, the subsequent SEND that goes with this
-                         * RDMA will be canceled with ERR_WFLUSH, and the application
-                         * never learn that the RDMA failed. */
-                        if (unlikely(wc.status == IB_WC_REM_ACCESS_ERR && send->s_op)) {
-                                struct rds_message *rm;
-
-                                rm = rds_send_get_message(conn, send->s_op);
-                                if (rm) {
-                                        if (rm->m_rdma_op)
-                                                rds_ib_send_unmap_rdma(ic, rm->m_rdma_op);
-                                        rds_ib_send_rdma_complete(rm, wc.status);
-                                        rds_message_put(rm);
+                        if (send->s_op) {
+                                if (send->s_op == rm->m_final_op) {
+                                        /* If anyone waited for this message to get flushed out, wake
+                                         * them up now */
+                                        rds_message_unmapped(rm);
                                 }
+                                rds_message_put(rm);
+                                send->s_op = NULL;
                         }
 
                         oldest = (oldest + 1) % ic->i_send_ring.w_nr;
                 }
 
                 rds_ib_ring_free(&ic->i_send_ring, completed);
+                rds_ib_sub_signaled(ic, nr_sig);
+                nr_sig = 0;
 
                 if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) ||
                     test_bit(0, &conn->c_map_queued))
@@ -262,10 +341,10 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 /* We expect errors as the qp is drained during shutdown */
                 if (wc.status != IB_WC_SUCCESS && rds_conn_up(conn)) {
-                        rds_ib_conn_error(conn,
-                                "send completion on %pI4 "
-                                "had status %u, disconnecting and reconnecting\n",
-                                &conn->c_faddr, wc.status);
+                        rds_ib_conn_error(conn, "send completion on %pI4 had status "
+                                          "%u (%s), disconnecting and reconnecting\n",
+                                          &conn->c_faddr, wc.status,
+                                          rds_ib_wc_status_str(wc.status));
                 }
         }
 }
@@ -294,7 +373,7 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
  * credits (see rds_ib_send_add_credits below).
  *
  * The RDS send code is essentially single-threaded; rds_send_xmit
- * grabs c_send_lock to ensure exclusive access to the send ring.
+ * sets RDS_IN_XMIT to ensure exclusive access to the send ring.
  * However, the ACK sending code is independent and can race with
  * message SENDs.
  *
@@ -413,40 +492,21 @@ void rds_ib_advertise_credits(struct rds_connection *conn, unsigned int posted)
                 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
 }
 
-static inline void
-rds_ib_xmit_populate_wr(struct rds_ib_connection *ic,
-                struct rds_ib_send_work *send, unsigned int pos,
-                unsigned long buffer, unsigned int length,
-                int send_flags)
+static inline int rds_ib_set_wr_signal_state(struct rds_ib_connection *ic,
+                                             struct rds_ib_send_work *send,
+                                             bool notify)
 {
-        struct ib_sge *sge;
-
-        WARN_ON(pos != send - ic->i_sends);
-
-        send->s_wr.send_flags = send_flags;
-        send->s_wr.opcode = IB_WR_SEND;
-        send->s_wr.num_sge = 2;
-        send->s_wr.next = NULL;
-        send->s_queued = jiffies;
-        send->s_op = NULL;
-
-        if (length != 0) {
-                sge = rds_ib_data_sge(ic, send->s_sge);
-                sge->addr = buffer;
-                sge->length = length;
-                sge->lkey = ic->i_mr->lkey;
-
-                sge = rds_ib_header_sge(ic, send->s_sge);
-        } else {
-                /* We're sending a packet with no payload. There is only
-                 * one SGE */
-                send->s_wr.num_sge = 1;
-                sge = &send->s_sge[0];
+        /*
+         * We want to delay signaling completions just enough to get
+         * the batching benefits but not so much that we create dead time
+         * on the wire.
+         */
+        if (ic->i_unsignaled_wrs-- == 0 || notify) {
+                ic->i_unsignaled_wrs = rds_ib_sysctl_max_unsig_wrs;
+                send->s_wr.send_flags |= IB_SEND_SIGNALED;
+                return 1;
         }
-
-        sge->addr = ic->i_send_hdrs_dma + (pos * sizeof(struct rds_header));
-        sge->length = sizeof(struct rds_header);
-        sge->lkey = ic->i_mr->lkey;
+        return 0;
 }
 
 /*
@@ -475,13 +535,14 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
         u32 pos;
         u32 i;
         u32 work_alloc;
-        u32 credit_alloc;
+        u32 credit_alloc = 0;
         u32 posted;
         u32 adv_credits = 0;
         int send_flags = 0;
-        int sent;
+        int bytes_sent = 0;
         int ret;
         int flow_controlled = 0;
+        int nr_sig = 0;
 
         BUG_ON(off % RDS_FRAG_SIZE);
         BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header));
@@ -507,14 +568,13 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                 goto out;
         }
 
-        credit_alloc = work_alloc;
         if (ic->i_flowctl) {
                 credit_alloc = rds_ib_send_grab_credits(ic, work_alloc, &posted, 0, RDS_MAX_ADV_CREDIT);
                 adv_credits += posted;
                 if (credit_alloc < work_alloc) {
                         rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc - credit_alloc);
                         work_alloc = credit_alloc;
-                        flow_controlled++;
+                        flow_controlled = 1;
                 }
                 if (work_alloc == 0) {
                         set_bit(RDS_LL_SEND_FULL, &conn->c_flags);
@@ -525,31 +585,25 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
         }
 
         /* map the message the first time we see it */
-        if (ic->i_rm == NULL) {
-                /*
-                printk(KERN_NOTICE "rds_ib_xmit prep msg dport=%u flags=0x%x len=%d\n",
-                                be16_to_cpu(rm->m_inc.i_hdr.h_dport),
-                                rm->m_inc.i_hdr.h_flags,
-                                be32_to_cpu(rm->m_inc.i_hdr.h_len));
-                   */
-                if (rm->m_nents) {
-                        rm->m_count = ib_dma_map_sg(dev,
-                                         rm->m_sg, rm->m_nents, DMA_TO_DEVICE);
-                        rdsdebug("ic %p mapping rm %p: %d\n", ic, rm, rm->m_count);
-                        if (rm->m_count == 0) {
+        if (!ic->i_data_op) {
+                if (rm->data.op_nents) {
+                        rm->data.op_count = ib_dma_map_sg(dev,
+                                                          rm->data.op_sg,
+                                                          rm->data.op_nents,
+                                                          DMA_TO_DEVICE);
+                        rdsdebug("ic %p mapping rm %p: %d\n", ic, rm, rm->data.op_count);
+                        if (rm->data.op_count == 0) {
                                 rds_ib_stats_inc(s_ib_tx_sg_mapping_failure);
                                 rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
                                 ret = -ENOMEM; /* XXX ? */
                                 goto out;
                         }
                 } else {
-                        rm->m_count = 0;
+                        rm->data.op_count = 0;
                 }
 
-                ic->i_unsignaled_wrs = rds_ib_sysctl_max_unsig_wrs;
-                ic->i_unsignaled_bytes = rds_ib_sysctl_max_unsig_bytes;
                 rds_message_addref(rm);
-                ic->i_rm = rm;
+                ic->i_data_op = &rm->data;
 
                 /* Finalize the header */
                 if (test_bit(RDS_MSG_ACK_REQUIRED, &rm->m_flags))
@@ -559,10 +613,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
 
                 /* If it has a RDMA op, tell the peer we did it. This is
                  * used by the peer to release use-once RDMA MRs. */
-                if (rm->m_rdma_op) {
+                if (rm->rdma.op_active) {
                         struct rds_ext_header_rdma ext_hdr;
 
-                        ext_hdr.h_rdma_rkey = cpu_to_be32(rm->m_rdma_op->r_key);
+                        ext_hdr.h_rdma_rkey = cpu_to_be32(rm->rdma.op_rkey);
                         rds_message_add_extension(&rm->m_inc.i_hdr,
                                         RDS_EXTHDR_RDMA, &ext_hdr, sizeof(ext_hdr));
                 }
@@ -582,99 +636,77 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                 /*
                  * Update adv_credits since we reset the ACK_REQUIRED bit.
                  */
-                rds_ib_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
-                adv_credits += posted;
-                BUG_ON(adv_credits > 255);
+                if (ic->i_flowctl) {
+                        rds_ib_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
+                        adv_credits += posted;
+                        BUG_ON(adv_credits > 255);
+                }
         }
 
-        send = &ic->i_sends[pos];
-        first = send;
-        prev = NULL;
-        scat = &rm->m_sg[sg];
-        sent = 0;
-        i = 0;
-
         /* Sometimes you want to put a fence between an RDMA
          * READ and the following SEND.
          * We could either do this all the time
          * or when requested by the user. Right now, we let
          * the application choose.
          */
-        if (rm->m_rdma_op && rm->m_rdma_op->r_fence)
+        if (rm->rdma.op_active && rm->rdma.op_fence)
                 send_flags = IB_SEND_FENCE;
 
-        /*
-         * We could be copying the header into the unused tail of the page.
-         * That would need to be changed in the future when those pages might
-         * be mapped userspace pages or page cache pages.  So instead we always
-         * use a second sge and our long-lived ring of mapped headers.  We send
-         * the header after the data so that the data payload can be aligned on
-         * the receiver.
-         */
+        /* Each frag gets a header. Msgs may be 0 bytes */
+        send = &ic->i_sends[pos];
+        first = send;
+        prev = NULL;
+        scat = &ic->i_data_op->op_sg[sg];
+        i = 0;
+        do {
+                unsigned int len = 0;
 
-        /* handle a 0-len message */
-        if (be32_to_cpu(rm->m_inc.i_hdr.h_len) == 0) {
-                rds_ib_xmit_populate_wr(ic, send, pos, 0, 0, send_flags);
-                goto add_header;
-        }
+                /* Set up the header */
+                send->s_wr.send_flags = send_flags;
+                send->s_wr.opcode = IB_WR_SEND;
+                send->s_wr.num_sge = 1;
+                send->s_wr.next = NULL;
+                send->s_queued = jiffies;
+                send->s_op = NULL;
 
-        /* if there's data reference it with a chain of work reqs */
-        for (; i < work_alloc && scat != &rm->m_sg[rm->m_count]; i++) {
-                unsigned int len;
+                send->s_sge[0].addr = ic->i_send_hdrs_dma
+                        + (pos * sizeof(struct rds_header));
+                send->s_sge[0].length = sizeof(struct rds_header);
 
-                send = &ic->i_sends[pos];
+                memcpy(&ic->i_send_hdrs[pos], &rm->m_inc.i_hdr, sizeof(struct rds_header));
 
-                len = min(RDS_FRAG_SIZE, ib_sg_dma_len(dev, scat) - off);
-                rds_ib_xmit_populate_wr(ic, send, pos,
-                                ib_sg_dma_address(dev, scat) + off, len,
-                                send_flags);
+                /* Set up the data, if present */
+                if (i < work_alloc
+                    && scat != &rm->data.op_sg[rm->data.op_count]) {
+                        len = min(RDS_FRAG_SIZE, ib_sg_dma_len(dev, scat) - off);
+                        send->s_wr.num_sge = 2;
 
-                /*
-                 * We want to delay signaling completions just enough to get
-                 * the batching benefits but not so much that we create dead time
-                 * on the wire.
-                 */
-                if (ic->i_unsignaled_wrs-- == 0) {
-                        ic->i_unsignaled_wrs = rds_ib_sysctl_max_unsig_wrs;
-                        send->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
-                }
+                        send->s_sge[1].addr = ib_sg_dma_address(dev, scat) + off;
+                        send->s_sge[1].length = len;
 
-                ic->i_unsignaled_bytes -= len;
-                if (ic->i_unsignaled_bytes <= 0) {
-                        ic->i_unsignaled_bytes = rds_ib_sysctl_max_unsig_bytes;
-                        send->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
+                        bytes_sent += len;
+                        off += len;
+                        if (off == ib_sg_dma_len(dev, scat)) {
+                                scat++;
+                                off = 0;
+                        }
                 }
 
+                rds_ib_set_wr_signal_state(ic, send, 0);
+
                 /*
                  * Always signal the last one if we're stopping due to flow control.
                  */
-                if (flow_controlled && i == (work_alloc-1))
+                if (ic->i_flowctl && flow_controlled && i == (work_alloc-1))
                         send->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
 
+                if (send->s_wr.send_flags & IB_SEND_SIGNALED)
+                        nr_sig++;
+
                 rdsdebug("send %p wr %p num_sge %u next %p\n", send,
                          &send->s_wr, send->s_wr.num_sge, send->s_wr.next);
 
-                sent += len;
-                off += len;
-                if (off == ib_sg_dma_len(dev, scat)) {
-                        scat++;
-                        off = 0;
-                }
-
-add_header:
-                /* Tack on the header after the data. The header SGE should already
-                 * have been set up to point to the right header buffer. */
-                memcpy(&ic->i_send_hdrs[pos], &rm->m_inc.i_hdr, sizeof(struct rds_header));
-
-                if (0) {
-                        struct rds_header *hdr = &ic->i_send_hdrs[pos];
-
-                        printk(KERN_NOTICE "send WR dport=%u flags=0x%x len=%d\n",
-                                be16_to_cpu(hdr->h_dport),
-                                hdr->h_flags,
-                                be32_to_cpu(hdr->h_len));
-                }
-                if (adv_credits) {
+                if (ic->i_flowctl && adv_credits) {
                         struct rds_header *hdr = &ic->i_send_hdrs[pos];
 
                         /* add credit and redo the header checksum */
@@ -689,20 +721,25 @@ add_header:
                 prev = send;
 
                 pos = (pos + 1) % ic->i_send_ring.w_nr;
-        }
+                send = &ic->i_sends[pos];
+                i++;
+
+        } while (i < work_alloc
+                 && scat != &rm->data.op_sg[rm->data.op_count]);
 
         /* Account the RDS header in the number of bytes we sent, but just once.
          * The caller has no concept of fragmentation. */
         if (hdr_off == 0)
-                sent += sizeof(struct rds_header);
+                bytes_sent += sizeof(struct rds_header);
 
         /* if we finished the message then send completion owns it */
-        if (scat == &rm->m_sg[rm->m_count]) {
-                prev->s_rm = ic->i_rm;
-                prev->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
-                ic->i_rm = NULL;
+        if (scat == &rm->data.op_sg[rm->data.op_count]) {
+                prev->s_op = ic->i_data_op;
+                prev->s_wr.send_flags |= IB_SEND_SOLICITED;
+                ic->i_data_op = NULL;
         }
 
+        /* Put back wrs & credits we didn't use */
         if (i < work_alloc) {
                 rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc - i);
                 work_alloc = i;
@@ -710,6 +747,9 @@ add_header:
         if (ic->i_flowctl && i < credit_alloc)
                 rds_ib_send_add_credits(conn, credit_alloc - i);
 
+        if (nr_sig)
+                atomic_add(nr_sig, &ic->i_signaled_sends);
+
         /* XXX need to worry about failed_wr and partial sends. */
         failed_wr = &first->s_wr;
         ret = ib_post_send(ic->i_cm_id->qp, &first->s_wr, &failed_wr);
@@ -720,32 +760,127 @@ add_header:
                 printk(KERN_WARNING "RDS/IB: ib_post_send to %pI4 "
                        "returned %d\n", &conn->c_faddr, ret);
                 rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
-                if (prev->s_rm) {
-                        ic->i_rm = prev->s_rm;
-                        prev->s_rm = NULL;
+                rds_ib_sub_signaled(ic, nr_sig);
+                if (prev->s_op) {
+                        ic->i_data_op = prev->s_op;
+                        prev->s_op = NULL;
                 }
 
                 rds_ib_conn_error(ic->conn, "ib_post_send failed\n");
                 goto out;
         }
 
-        ret = sent;
+        ret = bytes_sent;
 out:
         BUG_ON(adv_credits);
         return ret;
 }
 
-int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
+/*
+ * Issue atomic operation.
+ * A simplified version of the rdma case, we always map 1 SG, and
+ * only 8 bytes, for the return value from the atomic operation.
+ */
+int rds_ib_xmit_atomic(struct rds_connection *conn, struct rm_atomic_op *op)
+{
+        struct rds_ib_connection *ic = conn->c_transport_data;
+        struct rds_ib_send_work *send = NULL;
+        struct ib_send_wr *failed_wr;
+        struct rds_ib_device *rds_ibdev;
+        u32 pos;
+        u32 work_alloc;
+        int ret;
+        int nr_sig = 0;
+
+        rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
+
+        work_alloc = rds_ib_ring_alloc(&ic->i_send_ring, 1, &pos);
+        if (work_alloc != 1) {
+                rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                rds_ib_stats_inc(s_ib_tx_ring_full);
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* address of send request in ring */
+        send = &ic->i_sends[pos];
+        send->s_queued = jiffies;
+
+        if (op->op_type == RDS_ATOMIC_TYPE_CSWP) {
+                send->s_wr.opcode = IB_WR_MASKED_ATOMIC_CMP_AND_SWP;
+                send->s_wr.wr.atomic.compare_add = op->op_m_cswp.compare;
+                send->s_wr.wr.atomic.swap = op->op_m_cswp.swap;
+                send->s_wr.wr.atomic.compare_add_mask = op->op_m_cswp.compare_mask;
+                send->s_wr.wr.atomic.swap_mask = op->op_m_cswp.swap_mask;
+        } else { /* FADD */
+                send->s_wr.opcode = IB_WR_MASKED_ATOMIC_FETCH_AND_ADD;
+                send->s_wr.wr.atomic.compare_add = op->op_m_fadd.add;
+                send->s_wr.wr.atomic.swap = 0;
+                send->s_wr.wr.atomic.compare_add_mask = op->op_m_fadd.nocarry_mask;
+                send->s_wr.wr.atomic.swap_mask = 0;
+        }
+        nr_sig = rds_ib_set_wr_signal_state(ic, send, op->op_notify);
+        send->s_wr.num_sge = 1;
+        send->s_wr.next = NULL;
+        send->s_wr.wr.atomic.remote_addr = op->op_remote_addr;
+        send->s_wr.wr.atomic.rkey = op->op_rkey;
+        send->s_op = op;
+        rds_message_addref(container_of(send->s_op, struct rds_message, atomic));
+
+        /* map 8 byte retval buffer to the device */
+        ret = ib_dma_map_sg(ic->i_cm_id->device, op->op_sg, 1, DMA_FROM_DEVICE);
+        rdsdebug("ic %p mapping atomic op %p. mapped %d pg\n", ic, op, ret);
+        if (ret != 1) {
+                rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                rds_ib_stats_inc(s_ib_tx_sg_mapping_failure);
+                ret = -ENOMEM; /* XXX ? */
+                goto out;
+        }
+
+        /* Convert our struct scatterlist to struct ib_sge */
+        send->s_sge[0].addr = ib_sg_dma_address(ic->i_cm_id->device, op->op_sg);
+        send->s_sge[0].length = ib_sg_dma_len(ic->i_cm_id->device, op->op_sg);
+        send->s_sge[0].lkey = ic->i_mr->lkey;
+
+        rdsdebug("rva %Lx rpa %Lx len %u\n", op->op_remote_addr,
+                 send->s_sge[0].addr, send->s_sge[0].length);
+
+        if (nr_sig)
+                atomic_add(nr_sig, &ic->i_signaled_sends);
+
+        failed_wr = &send->s_wr;
+        ret = ib_post_send(ic->i_cm_id->qp, &send->s_wr, &failed_wr);
+        rdsdebug("ic %p send %p (wr %p) ret %d wr %p\n", ic,
+                 send, &send->s_wr, ret, failed_wr);
+        BUG_ON(failed_wr != &send->s_wr);
+        if (ret) {
+                printk(KERN_WARNING "RDS/IB: atomic ib_post_send to %pI4 "
+                       "returned %d\n", &conn->c_faddr, ret);
+                rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                rds_ib_sub_signaled(ic, nr_sig);
+                goto out;
+        }
+
+        if (unlikely(failed_wr != &send->s_wr)) {
+                printk(KERN_WARNING "RDS/IB: atomic ib_post_send() rc=%d, but failed_wqe updated!\n", ret);
+                BUG_ON(failed_wr != &send->s_wr);
+        }
+
+out:
+        return ret;
+}
+
+int rds_ib_xmit_rdma(struct rds_connection *conn, struct rm_rdma_op *op)
 {
         struct rds_ib_connection *ic = conn->c_transport_data;
         struct rds_ib_send_work *send = NULL;
         struct rds_ib_send_work *first;
         struct rds_ib_send_work *prev;
         struct ib_send_wr *failed_wr;
-        struct rds_ib_device *rds_ibdev;
         struct scatterlist *scat;
         unsigned long len;
-        u64 remote_addr = op->r_remote_addr;
+        u64 remote_addr = op->op_remote_addr;
+        u32 max_sge = ic->rds_ibdev->max_sge;
         u32 pos;
         u32 work_alloc;
         u32 i;
@@ -753,29 +888,28 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         int sent;
         int ret;
         int num_sge;
-
-        rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
-
-        /* map the message the first time we see it */
-        if (!op->r_mapped) {
-                op->r_count = ib_dma_map_sg(ic->i_cm_id->device,
-                                        op->r_sg, op->r_nents, (op->r_write) ?
-                                        DMA_TO_DEVICE : DMA_FROM_DEVICE);
-                rdsdebug("ic %p mapping op %p: %d\n", ic, op, op->r_count);
-                if (op->r_count == 0) {
+        int nr_sig = 0;
+
+        /* map the op the first time we see it */
+        if (!op->op_mapped) {
+                op->op_count = ib_dma_map_sg(ic->i_cm_id->device,
+                                             op->op_sg, op->op_nents, (op->op_write) ?
+                                             DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                rdsdebug("ic %p mapping op %p: %d\n", ic, op, op->op_count);
+                if (op->op_count == 0) {
                         rds_ib_stats_inc(s_ib_tx_sg_mapping_failure);
                         ret = -ENOMEM; /* XXX ? */
                         goto out;
                 }
 
-                op->r_mapped = 1;
+                op->op_mapped = 1;
         }
 
         /*
          * Instead of knowing how to return a partial rdma read/write we insist that there
          * be enough work requests to send the entire message.
          */
-        i = ceil(op->r_count, rds_ibdev->max_sge);
+        i = ceil(op->op_count, max_sge);
 
         work_alloc = rds_ib_ring_alloc(&ic->i_send_ring, i, &pos);
         if (work_alloc != i) {
@@ -788,30 +922,24 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         send = &ic->i_sends[pos];
         first = send;
         prev = NULL;
-        scat = &op->r_sg[0];
+        scat = &op->op_sg[0];
         sent = 0;
-        num_sge = op->r_count;
+        num_sge = op->op_count;
 
-        for (i = 0; i < work_alloc && scat != &op->r_sg[op->r_count]; i++) {
+        for (i = 0; i < work_alloc && scat != &op->op_sg[op->op_count]; i++) {
                 send->s_wr.send_flags = 0;
                 send->s_queued = jiffies;
-                /*
-                 * We want to delay signaling completions just enough to get
-                 * the batching benefits but not so much that we create dead time on the wire.
-                 */
-                if (ic->i_unsignaled_wrs-- == 0) {
-                        ic->i_unsignaled_wrs = rds_ib_sysctl_max_unsig_wrs;
-                        send->s_wr.send_flags = IB_SEND_SIGNALED;
-                }
+                send->s_op = NULL;
+
+                nr_sig += rds_ib_set_wr_signal_state(ic, send, op->op_notify);
 
-                send->s_wr.opcode = op->r_write ? IB_WR_RDMA_WRITE : IB_WR_RDMA_READ;
+                send->s_wr.opcode = op->op_write ? IB_WR_RDMA_WRITE : IB_WR_RDMA_READ;
                 send->s_wr.wr.rdma.remote_addr = remote_addr;
-                send->s_wr.wr.rdma.rkey = op->r_key;
-                send->s_op = op;
+                send->s_wr.wr.rdma.rkey = op->op_rkey;
 
-                if (num_sge > rds_ibdev->max_sge) {
-                        send->s_wr.num_sge = rds_ibdev->max_sge;
-                        num_sge -= rds_ibdev->max_sge;
+                if (num_sge > max_sge) {
+                        send->s_wr.num_sge = max_sge;
+                        num_sge -= max_sge;
                 } else {
                         send->s_wr.num_sge = num_sge;
                 }
@@ -821,7 +949,7 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
                 if (prev)
                         prev->s_wr.next = &send->s_wr;
 
-                for (j = 0; j < send->s_wr.num_sge && scat != &op->r_sg[op->r_count]; j++) {
+                for (j = 0; j < send->s_wr.num_sge && scat != &op->op_sg[op->op_count]; j++) {
                         len = ib_sg_dma_len(ic->i_cm_id->device, scat);
                         send->s_sge[j].addr =
                                  ib_sg_dma_address(ic->i_cm_id->device, scat);
@@ -843,15 +971,20 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
                         send = ic->i_sends;
         }
 
-        /* if we finished the message then send completion owns it */
-        if (scat == &op->r_sg[op->r_count])
-                prev->s_wr.send_flags = IB_SEND_SIGNALED;
+        /* give a reference to the last op */
+        if (scat == &op->op_sg[op->op_count]) {
+                prev->s_op = op;
+                rds_message_addref(container_of(op, struct rds_message, rdma));
+        }
 
         if (i < work_alloc) {
                 rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc - i);
                 work_alloc = i;
         }
 
+        if (nr_sig)
+                atomic_add(nr_sig, &ic->i_signaled_sends);
+
         failed_wr = &first->s_wr;
         ret = ib_post_send(ic->i_cm_id->qp, &first->s_wr, &failed_wr);
         rdsdebug("ic %p first %p (wr %p) ret %d wr %p\n", ic,
@@ -861,6 +994,7 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
                 printk(KERN_WARNING "RDS/IB: rdma ib_post_send to %pI4 "
                        "returned %d\n", &conn->c_faddr, ret);
                 rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                rds_ib_sub_signaled(ic, nr_sig);
                 goto out;
         }
 
diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
index d2c904dd6fbc..2d5965d6e97c 100644
--- a/net/rds/ib_stats.c
+++ b/net/rds/ib_stats.c
@@ -67,6 +67,8 @@ static const char *const rds_ib_stat_names[] = {
         "ib_rdma_mr_pool_flush",
         "ib_rdma_mr_pool_wait",
         "ib_rdma_mr_pool_depleted",
+        "ib_atomic_cswp",
+        "ib_atomic_fadd",
 };
 
 unsigned int rds_ib_stats_info_copy(struct rds_info_iterator *iter,
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 03f01cb4e0fe..fc3da37220fd 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -49,10 +49,6 @@ unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
 static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
 static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
 
-unsigned long rds_ib_sysctl_max_unsig_bytes = (16 << 20);
-static unsigned long rds_ib_sysctl_max_unsig_bytes_min = 1;
-static unsigned long rds_ib_sysctl_max_unsig_bytes_max = ~0UL;
-
 /*
  * This sysctl does nothing.
  *
@@ -94,15 +90,6 @@ ctl_table rds_ib_sysctl_table[] = {
                 .extra2         = &rds_ib_sysctl_max_unsig_wr_max,
         },
         {
-                .procname       = "max_unsignaled_bytes",
-                .data           = &rds_ib_sysctl_max_unsig_bytes,
-                .maxlen         = sizeof(unsigned long),
-                .mode           = 0644,
-                .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &rds_ib_sysctl_max_unsig_bytes_min,
-                .extra2         = &rds_ib_sysctl_max_unsig_bytes_max,
-        },
-        {
                 .procname       = "max_recv_allocation",
                 .data           = &rds_ib_sysctl_max_recv_allocation,
                 .maxlen         = sizeof(unsigned long),
@@ -132,10 +119,10 @@ void rds_ib_sysctl_exit(void)
                 unregister_sysctl_table(rds_ib_sysctl_hdr);
 }
 
-int __init rds_ib_sysctl_init(void)
+int rds_ib_sysctl_init(void)
 {
         rds_ib_sysctl_hdr = register_sysctl_paths(rds_ib_sysctl_path, rds_ib_sysctl_table);
-        if (rds_ib_sysctl_hdr == NULL)
+        if (!rds_ib_sysctl_hdr)
                 return -ENOMEM;
         return 0;
 }
diff --git a/net/rds/info.c b/net/rds/info.c
index c45c4173a44d..4fdf1b6e84ff 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -76,7 +76,7 @@ void rds_info_register_func(int optname, rds_info_func func)
         BUG_ON(optname < RDS_INFO_FIRST || optname > RDS_INFO_LAST);
 
         spin_lock(&rds_info_lock);
-        BUG_ON(rds_info_funcs[offset] != NULL);
+        BUG_ON(rds_info_funcs[offset]);
         rds_info_funcs[offset] = func;
         spin_unlock(&rds_info_lock);
 }
@@ -102,7 +102,7 @@ EXPORT_SYMBOL_GPL(rds_info_deregister_func);
  */
 void rds_info_iter_unmap(struct rds_info_iterator *iter)
 {
-        if (iter->addr != NULL) {
+        if (iter->addr) {
                 kunmap_atomic(iter->addr, KM_USER0);
                 iter->addr = NULL;
         }
@@ -117,7 +117,7 @@ void rds_info_copy(struct rds_info_iterator *iter, void *data,
         unsigned long this;
 
         while (bytes) {
-                if (iter->addr == NULL)
+                if (!iter->addr)
                         iter->addr = kmap_atomic(*iter->pages, KM_USER0);
 
                 this = min(bytes, PAGE_SIZE - iter->offset);
@@ -188,7 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
                         >> PAGE_SHIFT;
 
         pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
-        if (pages == NULL) {
+        if (!pages) {
                 ret = -ENOMEM;
                 goto out;
         }
@@ -206,7 +206,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
 
 call_func:
         func = rds_info_funcs[optname - RDS_INFO_FIRST];
-        if (func == NULL) {
+        if (!func) {
                 ret = -ENOPROTOOPT;
                 goto out;
         }
@@ -234,7 +234,7 @@ call_func:
                 ret = -EFAULT;
 
 out:
-        for (i = 0; pages != NULL && i < nr_pages; i++)
+        for (i = 0; pages && i < nr_pages; i++)
                 put_page(pages[i]);
         kfree(pages);
 
diff --git a/net/rds/iw.c b/net/rds/iw.c
index c8f3d3525cb9..56808cac0fc7 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -264,7 +264,6 @@ struct rds_transport rds_iw_transport = {
         .laddr_check            = rds_iw_laddr_check,
         .xmit_complete          = rds_iw_xmit_complete,
         .xmit                   = rds_iw_xmit,
-        .xmit_cong_map          = NULL,
         .xmit_rdma              = rds_iw_xmit_rdma,
         .recv                   = rds_iw_recv,
         .conn_alloc             = rds_iw_conn_alloc,
@@ -272,7 +271,6 @@ struct rds_transport rds_iw_transport = {
         .conn_connect           = rds_iw_conn_connect,
         .conn_shutdown          = rds_iw_conn_shutdown,
         .inc_copy_to_user       = rds_iw_inc_copy_to_user,
-        .inc_purge              = rds_iw_inc_purge,
         .inc_free               = rds_iw_inc_free,
         .cm_initiate_connect    = rds_iw_cm_initiate_connect,
         .cm_handle_connect      = rds_iw_cm_handle_connect,
@@ -289,7 +287,7 @@ struct rds_transport rds_iw_transport = {
         .t_prefer_loopback      = 1,
 };
 
-int __init rds_iw_init(void)
+int rds_iw_init(void)
 {
         int ret;
 
diff --git a/net/rds/iw.h b/net/rds/iw.h
index eef2f0c28476..543e665fafe3 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -70,7 +70,7 @@ struct rds_iw_send_work {
         struct rds_message      *s_rm;
 
         /* We should really put these into a union: */
-        struct rds_rdma_op      *s_op;
+        struct rm_rdma_op       *s_op;
         struct rds_iw_mapping   *s_mapping;
         struct ib_mr            *s_mr;
         struct ib_fast_reg_page_list *s_page_list;
@@ -284,7 +284,7 @@ void rds_iw_conn_free(void *arg);
 int rds_iw_conn_connect(struct rds_connection *conn);
 void rds_iw_conn_shutdown(struct rds_connection *conn);
 void rds_iw_state_change(struct sock *sk);
-int __init rds_iw_listen_init(void);
+int rds_iw_listen_init(void);
 void rds_iw_listen_stop(void);
 void __rds_iw_conn_error(struct rds_connection *conn, const char *, ...);
 int rds_iw_cm_handle_connect(struct rdma_cm_id *cm_id,
@@ -321,12 +321,11 @@ void rds_iw_flush_mrs(void);
 void rds_iw_remove_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_id);
 
 /* ib_recv.c */
-int __init rds_iw_recv_init(void);
+int rds_iw_recv_init(void);
 void rds_iw_recv_exit(void);
 int rds_iw_recv(struct rds_connection *conn);
 int rds_iw_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
                        gfp_t page_gfp, int prefill);
-void rds_iw_inc_purge(struct rds_incoming *inc);
 void rds_iw_inc_free(struct rds_incoming *inc);
 int rds_iw_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
                              size_t size);
@@ -358,7 +357,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
 void rds_iw_send_cq_comp_handler(struct ib_cq *cq, void *context);
 void rds_iw_send_init_ring(struct rds_iw_connection *ic);
 void rds_iw_send_clear_ring(struct rds_iw_connection *ic);
-int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
+int rds_iw_xmit_rdma(struct rds_connection *conn, struct rm_rdma_op *op);
 void rds_iw_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_iw_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_iw_send_grab_credits(struct rds_iw_connection *ic, u32 wanted,
@@ -371,7 +370,7 @@ unsigned int rds_iw_stats_info_copy(struct rds_info_iterator *iter,
                                     unsigned int avail);
 
 /* ib_sysctl.c */
-int __init rds_iw_sysctl_init(void);
+int rds_iw_sysctl_init(void);
 void rds_iw_sysctl_exit(void);
 extern unsigned long rds_iw_sysctl_max_send_wr;
 extern unsigned long rds_iw_sysctl_max_recv_wr;
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index b5dd6ac39be8..712cf2d1f28e 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -257,7 +257,7 @@ static int rds_iw_setup_qp(struct rds_connection *conn)
          * the rds_iwdev at all.
          */
         rds_iwdev = ib_get_client_data(dev, &rds_iw_client);
-        if (rds_iwdev == NULL) {
+        if (!rds_iwdev) {
                 if (printk_ratelimit())
                         printk(KERN_NOTICE "RDS/IW: No client_data for device %s\n",
                                         dev->name);
@@ -292,7 +292,7 @@ static int rds_iw_setup_qp(struct rds_connection *conn)
                                            ic->i_send_ring.w_nr *
                                                 sizeof(struct rds_header),
                                            &ic->i_send_hdrs_dma, GFP_KERNEL);
-        if (ic->i_send_hdrs == NULL) {
+        if (!ic->i_send_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent send failed\n");
                 goto out;
@@ -302,7 +302,7 @@ static int rds_iw_setup_qp(struct rds_connection *conn)
                                            ic->i_recv_ring.w_nr *
                                                 sizeof(struct rds_header),
                                            &ic->i_recv_hdrs_dma, GFP_KERNEL);
-        if (ic->i_recv_hdrs == NULL) {
+        if (!ic->i_recv_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent recv failed\n");
                 goto out;
@@ -310,14 +310,14 @@ static int rds_iw_setup_qp(struct rds_connection *conn)
 
         ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
                                        &ic->i_ack_dma, GFP_KERNEL);
-        if (ic->i_ack == NULL) {
+        if (!ic->i_ack) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent ack failed\n");
                 goto out;
         }
 
         ic->i_sends = vmalloc(ic->i_send_ring.w_nr * sizeof(struct rds_iw_send_work));
-        if (ic->i_sends == NULL) {
+        if (!ic->i_sends) {
                 ret = -ENOMEM;
                 rdsdebug("send allocation failed\n");
                 goto out;
@@ -325,7 +325,7 @@ static int rds_iw_setup_qp(struct rds_connection *conn)
         rds_iw_send_init_ring(ic);
 
         ic->i_recvs = vmalloc(ic->i_recv_ring.w_nr * sizeof(struct rds_iw_recv_work));
-        if (ic->i_recvs == NULL) {
+        if (!ic->i_recvs) {
                 ret = -ENOMEM;
                 rdsdebug("recv allocation failed\n");
                 goto out;
@@ -696,7 +696,7 @@ int rds_iw_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 
         /* XXX too lazy? */
         ic = kzalloc(sizeof(struct rds_iw_connection), GFP_KERNEL);
-        if (ic == NULL)
+        if (!ic)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&ic->iw_node);
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 13dc1862d862..0e7accc23ee2 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -34,7 +34,6 @@
 #include <linux/slab.h>
 
 #include "rds.h"
-#include "rdma.h"
 #include "iw.h"
 
 
@@ -207,9 +206,9 @@ void rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *con
         BUG_ON(list_empty(&ic->iw_node));
         list_del(&ic->iw_node);
 
-        spin_lock_irq(&rds_iwdev->spinlock);
+        spin_lock(&rds_iwdev->spinlock);
         list_add_tail(&ic->iw_node, &rds_iwdev->conn_list);
-        spin_unlock_irq(&rds_iwdev->spinlock);
+        spin_unlock(&rds_iwdev->spinlock);
         spin_unlock_irq(&iw_nodev_conns_lock);
 
         ic->rds_iwdev = rds_iwdev;
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index 3d479067d54d..5e57347f49ff 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -53,7 +53,7 @@ static void rds_iw_frag_drop_page(struct rds_page_frag *frag)
 static void rds_iw_frag_free(struct rds_page_frag *frag)
 {
         rdsdebug("frag %p page %p\n", frag, frag->f_page);
-        BUG_ON(frag->f_page != NULL);
+        BUG_ON(frag->f_page);
         kmem_cache_free(rds_iw_frag_slab, frag);
 }
 
@@ -143,14 +143,14 @@ static int rds_iw_recv_refill_one(struct rds_connection *conn,
         struct ib_sge *sge;
         int ret = -ENOMEM;
 
-        if (recv->r_iwinc == NULL) {
+        if (!recv->r_iwinc) {
                 if (!atomic_add_unless(&rds_iw_allocation, 1, rds_iw_sysctl_max_recv_allocation)) {
                         rds_iw_stats_inc(s_iw_rx_alloc_limit);
                         goto out;
                 }
                 recv->r_iwinc = kmem_cache_alloc(rds_iw_incoming_slab,
                                                  kptr_gfp);
-                if (recv->r_iwinc == NULL) {
+                if (!recv->r_iwinc) {
                         atomic_dec(&rds_iw_allocation);
                         goto out;
                 }
@@ -158,17 +158,17 @@ static int rds_iw_recv_refill_one(struct rds_connection *conn,
                 rds_inc_init(&recv->r_iwinc->ii_inc, conn, conn->c_faddr);
         }
 
-        if (recv->r_frag == NULL) {
+        if (!recv->r_frag) {
                 recv->r_frag = kmem_cache_alloc(rds_iw_frag_slab, kptr_gfp);
-                if (recv->r_frag == NULL)
+                if (!recv->r_frag)
                         goto out;
                 INIT_LIST_HEAD(&recv->r_frag->f_item);
                 recv->r_frag->f_page = NULL;
         }
 
-        if (ic->i_frag.f_page == NULL) {
+        if (!ic->i_frag.f_page) {
                 ic->i_frag.f_page = alloc_page(page_gfp);
-                if (ic->i_frag.f_page == NULL)
+                if (!ic->i_frag.f_page)
                         goto out;
                 ic->i_frag.f_offset = 0;
         }
@@ -273,7 +273,7 @@ int rds_iw_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
         return ret;
 }
 
-void rds_iw_inc_purge(struct rds_incoming *inc)
+static void rds_iw_inc_purge(struct rds_incoming *inc)
 {
         struct rds_iw_incoming *iwinc;
         struct rds_page_frag *frag;
@@ -716,7 +716,7 @@ static void rds_iw_process_recv(struct rds_connection *conn,
          * into the inc and save the inc so we can hang upcoming fragments
          * off its list.
          */
-        if (iwinc == NULL) {
+        if (!iwinc) {
                 iwinc = recv->r_iwinc;
                 recv->r_iwinc = NULL;
                 ic->i_iwinc = iwinc;
@@ -887,7 +887,7 @@ int rds_iw_recv(struct rds_connection *conn)
         return ret;
 }
 
-int __init rds_iw_recv_init(void)
+int rds_iw_recv_init(void)
 {
         struct sysinfo si;
         int ret = -ENOMEM;
@@ -899,13 +899,13 @@ int __init rds_iw_recv_init(void)
         rds_iw_incoming_slab = kmem_cache_create("rds_iw_incoming",
                                         sizeof(struct rds_iw_incoming),
                                         0, 0, NULL);
-        if (rds_iw_incoming_slab == NULL)
+        if (!rds_iw_incoming_slab)
                 goto out;
 
         rds_iw_frag_slab = kmem_cache_create("rds_iw_frag",
                                         sizeof(struct rds_page_frag),
                                         0, 0, NULL);
-        if (rds_iw_frag_slab == NULL)
+        if (!rds_iw_frag_slab)
                 kmem_cache_destroy(rds_iw_incoming_slab);
         else
                 ret = 0;
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 52182ff7519e..6280ea020d4e 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -36,7 +36,6 @@
 #include <linux/dmapool.h>
 
 #include "rds.h"
-#include "rdma.h"
 #include "iw.h"
 
 static void rds_iw_send_rdma_complete(struct rds_message *rm,
@@ -64,13 +63,13 @@ static void rds_iw_send_rdma_complete(struct rds_message *rm,
 }
 
 static void rds_iw_send_unmap_rdma(struct rds_iw_connection *ic,
-                                   struct rds_rdma_op *op)
+                                   struct rm_rdma_op *op)
 {
-        if (op->r_mapped) {
+        if (op->op_mapped) {
                 ib_dma_unmap_sg(ic->i_cm_id->device,
-                        op->r_sg, op->r_nents,
-                        op->r_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-                op->r_mapped = 0;
+                        op->op_sg, op->op_nents,
+                        op->op_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                op->op_mapped = 0;
         }
 }
 
@@ -83,11 +82,11 @@ static void rds_iw_send_unmap_rm(struct rds_iw_connection *ic,
         rdsdebug("ic %p send %p rm %p\n", ic, send, rm);
 
         ib_dma_unmap_sg(ic->i_cm_id->device,
-                     rm->m_sg, rm->m_nents,
+                     rm->data.op_sg, rm->data.op_nents,
                      DMA_TO_DEVICE);
 
-        if (rm->m_rdma_op != NULL) {
-                rds_iw_send_unmap_rdma(ic, rm->m_rdma_op);
+        if (rm->rdma.op_active) {
+                rds_iw_send_unmap_rdma(ic, &rm->rdma);
 
                 /* If the user asked for a completion notification on this
                  * message, we can implement three different semantics:
@@ -111,10 +110,10 @@ static void rds_iw_send_unmap_rm(struct rds_iw_connection *ic,
                  */
                 rds_iw_send_rdma_complete(rm, wc_status);
 
-                if (rm->m_rdma_op->r_write)
-                        rds_stats_add(s_send_rdma_bytes, rm->m_rdma_op->r_bytes);
+                if (rm->rdma.op_write)
+                        rds_stats_add(s_send_rdma_bytes, rm->rdma.op_bytes);
                 else
-                        rds_stats_add(s_recv_rdma_bytes, rm->m_rdma_op->r_bytes);
+                        rds_stats_add(s_recv_rdma_bytes, rm->rdma.op_bytes);
         }
 
         /* If anyone waited for this message to get flushed out, wake
@@ -556,25 +555,27 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
         }
 
         /* map the message the first time we see it */
-        if (ic->i_rm == NULL) {
+        if (!ic->i_rm) {
                 /*
                 printk(KERN_NOTICE "rds_iw_xmit prep msg dport=%u flags=0x%x len=%d\n",
                                 be16_to_cpu(rm->m_inc.i_hdr.h_dport),
                                 rm->m_inc.i_hdr.h_flags,
                                 be32_to_cpu(rm->m_inc.i_hdr.h_len));
                    */
-                if (rm->m_nents) {
-                        rm->m_count = ib_dma_map_sg(dev,
-                                         rm->m_sg, rm->m_nents, DMA_TO_DEVICE);
-                        rdsdebug("ic %p mapping rm %p: %d\n", ic, rm, rm->m_count);
-                        if (rm->m_count == 0) {
+                if (rm->data.op_nents) {
+                        rm->data.op_count = ib_dma_map_sg(dev,
+                                                          rm->data.op_sg,
+                                                          rm->data.op_nents,
+                                                          DMA_TO_DEVICE);
+                        rdsdebug("ic %p mapping rm %p: %d\n", ic, rm, rm->data.op_count);
+                        if (rm->data.op_count == 0) {
                                 rds_iw_stats_inc(s_iw_tx_sg_mapping_failure);
                                 rds_iw_ring_unalloc(&ic->i_send_ring, work_alloc);
                                 ret = -ENOMEM; /* XXX ? */
                                 goto out;
                         }
                 } else {
-                        rm->m_count = 0;
+                        rm->data.op_count = 0;
                 }
 
                 ic->i_unsignaled_wrs = rds_iw_sysctl_max_unsig_wrs;
@@ -590,10 +591,10 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
 
                 /* If it has a RDMA op, tell the peer we did it. This is
                  * used by the peer to release use-once RDMA MRs. */
-                if (rm->m_rdma_op) {
+                if (rm->rdma.op_active) {
                         struct rds_ext_header_rdma ext_hdr;
 
-                        ext_hdr.h_rdma_rkey = cpu_to_be32(rm->m_rdma_op->r_key);
+                        ext_hdr.h_rdma_rkey = cpu_to_be32(rm->rdma.op_rkey);
                         rds_message_add_extension(&rm->m_inc.i_hdr,
                                         RDS_EXTHDR_RDMA, &ext_hdr, sizeof(ext_hdr));
                 }
@@ -621,7 +622,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
         send = &ic->i_sends[pos];
         first = send;
         prev = NULL;
-        scat = &rm->m_sg[sg];
+        scat = &rm->data.op_sg[sg];
         sent = 0;
         i = 0;
 
@@ -631,7 +632,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
          * or when requested by the user. Right now, we let
          * the application choose.
          */
-        if (rm->m_rdma_op && rm->m_rdma_op->r_fence)
+        if (rm->rdma.op_active && rm->rdma.op_fence)
                 send_flags = IB_SEND_FENCE;
 
         /*
@@ -650,7 +651,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
         }
 
         /* if there's data reference it with a chain of work reqs */
-        for (; i < work_alloc && scat != &rm->m_sg[rm->m_count]; i++) {
+        for (; i < work_alloc && scat != &rm->data.op_sg[rm->data.op_count]; i++) {
                 unsigned int len;
 
                 send = &ic->i_sends[pos];
@@ -728,7 +729,7 @@ add_header:
                 sent += sizeof(struct rds_header);
 
         /* if we finished the message then send completion owns it */
-        if (scat == &rm->m_sg[rm->m_count]) {
+        if (scat == &rm->data.op_sg[rm->data.op_count]) {
                 prev->s_rm = ic->i_rm;
                 prev->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
                 ic->i_rm = NULL;
@@ -784,7 +785,7 @@ static void rds_iw_build_send_fastreg(struct rds_iw_device *rds_iwdev, struct rd
         ib_update_fast_reg_key(send->s_mr, send->s_remap_count++);
 }
 
-int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
+int rds_iw_xmit_rdma(struct rds_connection *conn, struct rm_rdma_op *op)
 {
         struct rds_iw_connection *ic = conn->c_transport_data;
         struct rds_iw_send_work *send = NULL;
@@ -794,7 +795,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         struct rds_iw_device *rds_iwdev;
         struct scatterlist *scat;
         unsigned long len;
-        u64 remote_addr = op->r_remote_addr;
+        u64 remote_addr = op->op_remote_addr;
         u32 pos, fr_pos;
         u32 work_alloc;
         u32 i;
@@ -806,21 +807,21 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         rds_iwdev = ib_get_client_data(ic->i_cm_id->device, &rds_iw_client);
 
         /* map the message the first time we see it */
-        if (!op->r_mapped) {
-                op->r_count = ib_dma_map_sg(ic->i_cm_id->device,
-                                        op->r_sg, op->r_nents, (op->r_write) ?
-                                        DMA_TO_DEVICE : DMA_FROM_DEVICE);
-                rdsdebug("ic %p mapping op %p: %d\n", ic, op, op->r_count);
-                if (op->r_count == 0) {
+        if (!op->op_mapped) {
+                op->op_count = ib_dma_map_sg(ic->i_cm_id->device,
+                                             op->op_sg, op->op_nents, (op->op_write) ?
+                                             DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                rdsdebug("ic %p mapping op %p: %d\n", ic, op, op->op_count);
+                if (op->op_count == 0) {
                         rds_iw_stats_inc(s_iw_tx_sg_mapping_failure);
                         ret = -ENOMEM; /* XXX ? */
                         goto out;
                 }
 
-                op->r_mapped = 1;
+                op->op_mapped = 1;
         }
 
-        if (!op->r_write) {
+        if (!op->op_write) {
                 /* Alloc space on the send queue for the fastreg */
                 work_alloc = rds_iw_ring_alloc(&ic->i_send_ring, 1, &fr_pos);
                 if (work_alloc != 1) {
@@ -835,7 +836,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
          * Instead of knowing how to return a partial rdma read/write we insist that there
          * be enough work requests to send the entire message.
          */
-        i = ceil(op->r_count, rds_iwdev->max_sge);
+        i = ceil(op->op_count, rds_iwdev->max_sge);
 
         work_alloc = rds_iw_ring_alloc(&ic->i_send_ring, i, &pos);
         if (work_alloc != i) {
@@ -846,17 +847,17 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         }
 
         send = &ic->i_sends[pos];
-        if (!op->r_write) {
+        if (!op->op_write) {
                 first = prev = &ic->i_sends[fr_pos];
         } else {
                 first = send;
                 prev = NULL;
         }
-        scat = &op->r_sg[0];
+        scat = &op->op_sg[0];
         sent = 0;
-        num_sge = op->r_count;
+        num_sge = op->op_count;
 
-        for (i = 0; i < work_alloc && scat != &op->r_sg[op->r_count]; i++) {
+        for (i = 0; i < work_alloc && scat != &op->op_sg[op->op_count]; i++) {
                 send->s_wr.send_flags = 0;
                 send->s_queued = jiffies;
 
@@ -873,13 +874,13 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
                  * for local access after RDS is finished with it, using
                  * IB_WR_RDMA_READ_WITH_INV will invalidate it after the read has completed.
                  */
-                if (op->r_write)
+                if (op->op_write)
                         send->s_wr.opcode = IB_WR_RDMA_WRITE;
                 else
                         send->s_wr.opcode = IB_WR_RDMA_READ_WITH_INV;
 
                 send->s_wr.wr.rdma.remote_addr = remote_addr;
-                send->s_wr.wr.rdma.rkey = op->r_key;
+                send->s_wr.wr.rdma.rkey = op->op_rkey;
                 send->s_op = op;
 
                 if (num_sge > rds_iwdev->max_sge) {
@@ -893,7 +894,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
                 if (prev)
                         prev->s_wr.next = &send->s_wr;
 
-                for (j = 0; j < send->s_wr.num_sge && scat != &op->r_sg[op->r_count]; j++) {
+                for (j = 0; j < send->s_wr.num_sge && scat != &op->op_sg[op->op_count]; j++) {
                         len = ib_sg_dma_len(ic->i_cm_id->device, scat);
 
                         if (send->s_wr.opcode == IB_WR_RDMA_READ_WITH_INV)
@@ -927,7 +928,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
         }
 
         /* if we finished the message then send completion owns it */
-        if (scat == &op->r_sg[op->r_count])
+        if (scat == &op->op_sg[op->op_count])
                 first->s_wr.send_flags = IB_SEND_SIGNALED;
 
         if (i < work_alloc) {
@@ -941,9 +942,9 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op)
          * adapters do not allow using the lkey for this at all.  To bypass this use a
          * fastreg_mr (or possibly a dma_mr)
          */
-        if (!op->r_write) {
+        if (!op->op_write) {
                 rds_iw_build_send_fastreg(rds_iwdev, ic, &ic->i_sends[fr_pos],
-                        op->r_count, sent, conn->c_xmit_rm->m_rs->rs_user_addr);
+                        op->op_count, sent, conn->c_xmit_rm->m_rs->rs_user_addr);
                 work_alloc++;
         }
 
diff --git a/net/rds/iw_sysctl.c b/net/rds/iw_sysctl.c
index 1c4428a61a02..23e3a9a26aaf 100644
--- a/net/rds/iw_sysctl.c
+++ b/net/rds/iw_sysctl.c
@@ -122,10 +122,10 @@ void rds_iw_sysctl_exit(void)
                 unregister_sysctl_table(rds_iw_sysctl_hdr);
 }
 
-int __init rds_iw_sysctl_init(void)
+int rds_iw_sysctl_init(void)
 {
         rds_iw_sysctl_hdr = register_sysctl_paths(rds_iw_sysctl_path, rds_iw_sysctl_table);
-        if (rds_iw_sysctl_hdr == NULL)
+        if (!rds_iw_sysctl_hdr)
                 return -ENOMEM;
         return 0;
 }
diff --git a/net/rds/loop.c b/net/rds/loop.c
index dd9879379457..c390156b426f 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -61,10 +61,17 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
                          unsigned int hdr_off, unsigned int sg,
                          unsigned int off)
 {
+        /* Do not send cong updates to loopback */
+        if (rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
+                rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
+                return sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+        }
+
         BUG_ON(hdr_off || sg || off);
 
         rds_inc_init(&rm->m_inc, conn, conn->c_laddr);
-        rds_message_addref(rm); /* for the inc */
+        /* For the embedded inc. Matching put is in loop_inc_free() */
+        rds_message_addref(rm);
 
         rds_recv_incoming(conn, conn->c_laddr, conn->c_faddr, &rm->m_inc,
                           GFP_KERNEL, KM_USER0);
@@ -77,16 +84,14 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
         return sizeof(struct rds_header) + be32_to_cpu(rm->m_inc.i_hdr.h_len);
 }
 
-static int rds_loop_xmit_cong_map(struct rds_connection *conn,
-                                  struct rds_cong_map *map,
-                                  unsigned long offset)
+/*
+ * See rds_loop_xmit(). Since our inc is embedded in the rm, we
+ * make sure the rm lives at least until the inc is done.
+ */
+static void rds_loop_inc_free(struct rds_incoming *inc)
 {
-        BUG_ON(offset);
-        BUG_ON(map != conn->c_lcong);
-
-        rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
-
-        return sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
+        rds_message_put(rm);
 }
 
 /* we need to at least give the thread something to succeed */
@@ -112,7 +117,7 @@ static int rds_loop_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         unsigned long flags;
 
         lc = kzalloc(sizeof(struct rds_loop_connection), GFP_KERNEL);
-        if (lc == NULL)
+        if (!lc)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&lc->loop_node);
@@ -169,14 +174,12 @@ void rds_loop_exit(void)
  */
 struct rds_transport rds_loop_transport = {
         .xmit                   = rds_loop_xmit,
-        .xmit_cong_map          = rds_loop_xmit_cong_map,
         .recv                   = rds_loop_recv,
         .conn_alloc             = rds_loop_conn_alloc,
         .conn_free              = rds_loop_conn_free,
         .conn_connect           = rds_loop_conn_connect,
         .conn_shutdown          = rds_loop_conn_shutdown,
         .inc_copy_to_user       = rds_message_inc_copy_to_user,
-        .inc_purge              = rds_message_inc_purge,
-        .inc_free               = rds_message_inc_free,
+        .inc_free               = rds_loop_inc_free,
         .t_name                 = "loopback",
 };
diff --git a/net/rds/message.c b/net/rds/message.c
index 9a1d67e001ba..84f937f11d47 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -34,9 +34,6 @@
 #include <linux/slab.h>
 
 #include "rds.h"
-#include "rdma.h"
-
-static DECLARE_WAIT_QUEUE_HEAD(rds_message_flush_waitq);
 
 static unsigned int     rds_exthdr_size[__RDS_EXTHDR_MAX] = {
 [RDS_EXTHDR_NONE]       = 0,
@@ -63,29 +60,31 @@ static void rds_message_purge(struct rds_message *rm)
         if (unlikely(test_bit(RDS_MSG_PAGEVEC, &rm->m_flags)))
                 return;
 
-        for (i = 0; i < rm->m_nents; i++) {
-                rdsdebug("putting data page %p\n", (void *)sg_page(&rm->m_sg[i]));
+        for (i = 0; i < rm->data.op_nents; i++) {
+                rdsdebug("putting data page %p\n", (void *)sg_page(&rm->data.op_sg[i]));
                 /* XXX will have to put_page for page refs */
-                __free_page(sg_page(&rm->m_sg[i]));
+                __free_page(sg_page(&rm->data.op_sg[i]));
         }
-        rm->m_nents = 0;
+        rm->data.op_nents = 0;
 
-        if (rm->m_rdma_op)
-                rds_rdma_free_op(rm->m_rdma_op);
-        if (rm->m_rdma_mr)
-                rds_mr_put(rm->m_rdma_mr);
-}
+        if (rm->rdma.op_active)
+                rds_rdma_free_op(&rm->rdma);
+        if (rm->rdma.op_rdma_mr)
+                rds_mr_put(rm->rdma.op_rdma_mr);
 
-void rds_message_inc_purge(struct rds_incoming *inc)
-{
-        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
-        rds_message_purge(rm);
+        if (rm->atomic.op_active)
+                rds_atomic_free_op(&rm->atomic);
+        if (rm->atomic.op_rdma_mr)
+                rds_mr_put(rm->atomic.op_rdma_mr);
 }
 
 void rds_message_put(struct rds_message *rm)
 {
         rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-
+        if (atomic_read(&rm->m_refcount) == 0) {
+printk(KERN_CRIT "danger refcount zero on %p\n", rm);
+WARN_ON(1);
+        }
         if (atomic_dec_and_test(&rm->m_refcount)) {
                 BUG_ON(!list_empty(&rm->m_sock_item));
                 BUG_ON(!list_empty(&rm->m_conn_item));
@@ -96,12 +95,6 @@ void rds_message_put(struct rds_message *rm)
 }
 EXPORT_SYMBOL_GPL(rds_message_put);
 
-void rds_message_inc_free(struct rds_incoming *inc)
-{
-        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
-        rds_message_put(rm);
-}
-
 void rds_message_populate_header(struct rds_header *hdr, __be16 sport,
                                  __be16 dport, u64 seq)
 {
@@ -214,41 +207,68 @@ int rds_message_add_rdma_dest_extension(struct rds_header *hdr, u32 r_key, u32 o
 }
 EXPORT_SYMBOL_GPL(rds_message_add_rdma_dest_extension);
 
-struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp)
+/*
+ * Each rds_message is allocated with extra space for the scatterlist entries
+ * rds ops will need. This is to minimize memory allocation count. Then, each rds op
+ * can grab SGs when initializing its part of the rds_message.
+ */
+struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
         struct rds_message *rm;
 
-        rm = kzalloc(sizeof(struct rds_message) +
-                     (nents * sizeof(struct scatterlist)), gfp);
+        rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
         if (!rm)
                 goto out;
 
-        if (nents)
-                sg_init_table(rm->m_sg, nents);
+        rm->m_used_sgs = 0;
+        rm->m_total_sgs = extra_len / sizeof(struct scatterlist);
+
         atomic_set(&rm->m_refcount, 1);
         INIT_LIST_HEAD(&rm->m_sock_item);
         INIT_LIST_HEAD(&rm->m_conn_item);
         spin_lock_init(&rm->m_rs_lock);
+        init_waitqueue_head(&rm->m_flush_wait);
 
 out:
         return rm;
 }
 
+/*
+ * RDS ops use this to grab SG entries from the rm's sg pool.
+ */
+struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents)
+{
+        struct scatterlist *sg_first = (struct scatterlist *) &rm[1];
+        struct scatterlist *sg_ret;
+
+        WARN_ON(rm->m_used_sgs + nents > rm->m_total_sgs);
+        WARN_ON(!nents);
+
+        sg_ret = &sg_first[rm->m_used_sgs];
+        sg_init_table(sg_ret, nents);
+        rm->m_used_sgs += nents;
+
+        return sg_ret;
+}
+
 struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len)
 {
         struct rds_message *rm;
         unsigned int i;
+        int num_sgs = ceil(total_len, PAGE_SIZE);
+        int extra_bytes = num_sgs * sizeof(struct scatterlist);
 
-        rm = rds_message_alloc(ceil(total_len, PAGE_SIZE), GFP_KERNEL);
-        if (rm == NULL)
+        rm = rds_message_alloc(extra_bytes, GFP_NOWAIT);
+        if (!rm)
                 return ERR_PTR(-ENOMEM);
 
         set_bit(RDS_MSG_PAGEVEC, &rm->m_flags);
         rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
-        rm->m_nents = ceil(total_len, PAGE_SIZE);
+        rm->data.op_nents = ceil(total_len, PAGE_SIZE);
+        rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
 
-        for (i = 0; i < rm->m_nents; ++i) {
-                sg_set_page(&rm->m_sg[i],
+        for (i = 0; i < rm->data.op_nents; ++i) {
+                sg_set_page(&rm->data.op_sg[i],
                                 virt_to_page(page_addrs[i]),
                                 PAGE_SIZE, 0);
         }
@@ -256,40 +276,33 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
         return rm;
 }
 
-struct rds_message *rds_message_copy_from_user(struct iovec *first_iov,
+int rds_message_copy_from_user(struct rds_message *rm, struct iovec *first_iov,
                                                size_t total_len)
 {
         unsigned long to_copy;
         unsigned long iov_off;
         unsigned long sg_off;
-        struct rds_message *rm;
         struct iovec *iov;
         struct scatterlist *sg;
-        int ret;
-
-        rm = rds_message_alloc(ceil(total_len, PAGE_SIZE), GFP_KERNEL);
-        if (rm == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        int ret = 0;
 
         rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
 
         /*
          * now allocate and copy in the data payload.
          */
-        sg = rm->m_sg;
+        sg = rm->data.op_sg;
         iov = first_iov;
         iov_off = 0;
         sg_off = 0; /* Dear gcc, sg->page will be null from kzalloc. */
 
         while (total_len) {
-                if (sg_page(sg) == NULL) {
+                if (!sg_page(sg)) {
                         ret = rds_page_remainder_alloc(sg, total_len,
                                                        GFP_HIGHUSER);
                         if (ret)
                                 goto out;
-                        rm->m_nents++;
+                        rm->data.op_nents++;
                         sg_off = 0;
                 }
 
@@ -320,14 +333,8 @@ struct rds_message *rds_message_copy_from_user(struct iovec *first_iov,
                         sg++;
         }
 
-        ret = 0;
 out:
-        if (ret) {
-                if (rm)
-                        rds_message_put(rm);
-                rm = ERR_PTR(ret);
-        }
-        return rm;
+        return ret;
 }
 
 int rds_message_inc_copy_to_user(struct rds_incoming *inc,
@@ -348,7 +355,7 @@ int rds_message_inc_copy_to_user(struct rds_incoming *inc,
 
         iov = first_iov;
         iov_off = 0;
-        sg = rm->m_sg;
+        sg = rm->data.op_sg;
         vec_off = 0;
         copied = 0;
 
@@ -394,15 +401,14 @@ int rds_message_inc_copy_to_user(struct rds_incoming *inc,
  */
 void rds_message_wait(struct rds_message *rm)
 {
-        wait_event(rds_message_flush_waitq,
+        wait_event_interruptible(rm->m_flush_wait,
                         !test_bit(RDS_MSG_MAPPED, &rm->m_flags));
 }
 
 void rds_message_unmapped(struct rds_message *rm)
 {
         clear_bit(RDS_MSG_MAPPED, &rm->m_flags);
-        if (waitqueue_active(&rds_message_flush_waitq))
-                wake_up(&rds_message_flush_waitq);
+        wake_up_interruptible(&rm->m_flush_wait);
 }
 EXPORT_SYMBOL_GPL(rds_message_unmapped);
 
diff --git a/net/rds/page.c b/net/rds/page.c
index 595a952d4b17..5e44f5ae7898 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -116,7 +116,7 @@ int rds_page_remainder_alloc(struct scatterlist *scat, unsigned long bytes,
         /* jump straight to allocation if we're trying for a huge page */
         if (bytes >= PAGE_SIZE) {
                 page = alloc_page(gfp);
-                if (page == NULL) {
+                if (!page) {
                         ret = -ENOMEM;
                 } else {
                         sg_set_page(scat, page, PAGE_SIZE, 0);
@@ -162,7 +162,7 @@ int rds_page_remainder_alloc(struct scatterlist *scat, unsigned long bytes,
                 rem = &per_cpu(rds_page_remainders, get_cpu());
                 local_irq_save(flags);
 
-                if (page == NULL) {
+                if (!page) {
                         ret = -ENOMEM;
                         break;
                 }
@@ -186,6 +186,7 @@ out:
                  ret ? 0 : scat->length);
         return ret;
 }
+EXPORT_SYMBOL_GPL(rds_page_remainder_alloc);
 
 static int rds_page_remainder_cpu_notify(struct notifier_block *self,
                                          unsigned long action, void *hcpu)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 75fd13bb631b..1a41debca1ce 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -35,7 +35,7 @@
 #include <linux/rbtree.h>
 #include <linux/dma-mapping.h> /* for DMA_*_DEVICE */
 
-#include "rdma.h"
+#include "rds.h"
 
 /*
  * XXX
@@ -130,14 +130,22 @@ void rds_rdma_drop_keys(struct rds_sock *rs)
 {
         struct rds_mr *mr;
         struct rb_node *node;
+        unsigned long flags;
 
         /* Release any MRs associated with this socket */
+        spin_lock_irqsave(&rs->rs_rdma_lock, flags);
         while ((node = rb_first(&rs->rs_rdma_keys))) {
                 mr = container_of(node, struct rds_mr, r_rb_node);
                 if (mr->r_trans == rs->rs_transport)
                         mr->r_invalidate = 0;
+                rb_erase(&mr->r_rb_node, &rs->rs_rdma_keys);
+                RB_CLEAR_NODE(&mr->r_rb_node);
+                spin_unlock_irqrestore(&rs->rs_rdma_lock, flags);
+                rds_destroy_mr(mr);
                 rds_mr_put(mr);
+                spin_lock_irqsave(&rs->rs_rdma_lock, flags);
         }
+        spin_unlock_irqrestore(&rs->rs_rdma_lock, flags);
 
         if (rs->rs_transport && rs->rs_transport->flush_mrs)
                 rs->rs_transport->flush_mrs();
@@ -181,7 +189,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
                 goto out;
         }
 
-        if (rs->rs_transport->get_mr == NULL) {
+        if (!rs->rs_transport->get_mr) {
                 ret = -EOPNOTSUPP;
                 goto out;
         }
@@ -197,13 +205,13 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
 
         /* XXX clamp nr_pages to limit the size of this alloc? */
         pages = kcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL);
-        if (pages == NULL) {
+        if (!pages) {
                 ret = -ENOMEM;
                 goto out;
         }
 
         mr = kzalloc(sizeof(struct rds_mr), GFP_KERNEL);
-        if (mr == NULL) {
+        if (!mr) {
                 ret = -ENOMEM;
                 goto out;
         }
@@ -230,13 +238,13 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
          * r/o or r/w. We need to assume r/w, or we'll do a lot of RDMA to
          * the zero page.
          */
-        ret = rds_pin_pages(args->vec.addr & PAGE_MASK, nr_pages, pages, 1);
+        ret = rds_pin_pages(args->vec.addr, nr_pages, pages, 1);
         if (ret < 0)
                 goto out;
 
         nents = ret;
         sg = kcalloc(nents, sizeof(*sg), GFP_KERNEL);
-        if (sg == NULL) {
+        if (!sg) {
                 ret = -ENOMEM;
                 goto out;
         }
@@ -406,68 +414,127 @@ void rds_rdma_unuse(struct rds_sock *rs, u32 r_key, int force)
 
         spin_lock_irqsave(&rs->rs_rdma_lock, flags);
         mr = rds_mr_tree_walk(&rs->rs_rdma_keys, r_key, NULL);
-        if (mr && (mr->r_use_once || force)) {
+        if (!mr) {
+                printk(KERN_ERR "rds: trying to unuse MR with unknown r_key %u!\n", r_key);
+                spin_unlock_irqrestore(&rs->rs_rdma_lock, flags);
+                return;
+        }
+
+        if (mr->r_use_once || force) {
                 rb_erase(&mr->r_rb_node, &rs->rs_rdma_keys);
                 RB_CLEAR_NODE(&mr->r_rb_node);
                 zot_me = 1;
-        } else if (mr)
-                atomic_inc(&mr->r_refcount);
+        }
         spin_unlock_irqrestore(&rs->rs_rdma_lock, flags);
 
         /* May have to issue a dma_sync on this memory region.
          * Note we could avoid this if the operation was a RDMA READ,
          * but at this point we can't tell. */
-        if (mr != NULL) {
-                if (mr->r_trans->sync_mr)
-                        mr->r_trans->sync_mr(mr->r_trans_private, DMA_FROM_DEVICE);
-
-                /* If the MR was marked as invalidate, this will
-                 * trigger an async flush. */
-                if (zot_me)
-                        rds_destroy_mr(mr);
-                rds_mr_put(mr);
-        }
+        if (mr->r_trans->sync_mr)
+                mr->r_trans->sync_mr(mr->r_trans_private, DMA_FROM_DEVICE);
+
+        /* If the MR was marked as invalidate, this will
+         * trigger an async flush. */
+        if (zot_me)
+                rds_destroy_mr(mr);
+        rds_mr_put(mr);
 }
 
-void rds_rdma_free_op(struct rds_rdma_op *ro)
+void rds_rdma_free_op(struct rm_rdma_op *ro)
 {
         unsigned int i;
 
-        for (i = 0; i < ro->r_nents; i++) {
-                struct page *page = sg_page(&ro->r_sg[i]);
+        for (i = 0; i < ro->op_nents; i++) {
+                struct page *page = sg_page(&ro->op_sg[i]);
 
                 /* Mark page dirty if it was possibly modified, which
                  * is the case for a RDMA_READ which copies from remote
                  * to local memory */
-                if (!ro->r_write) {
-                        BUG_ON(in_interrupt());
+                if (!ro->op_write) {
+                        BUG_ON(irqs_disabled());
                         set_page_dirty(page);
                 }
                 put_page(page);
         }
 
-        kfree(ro->r_notifier);
-        kfree(ro);
+        kfree(ro->op_notifier);
+        ro->op_notifier = NULL;
+        ro->op_active = 0;
+}
+
+void rds_atomic_free_op(struct rm_atomic_op *ao)
+{
+        struct page *page = sg_page(ao->op_sg);
+
+        /* Mark page dirty if it was possibly modified, which
+         * is the case for a RDMA_READ which copies from remote
+         * to local memory */
+        set_page_dirty(page);
+        put_page(page);
+
+        kfree(ao->op_notifier);
+        ao->op_notifier = NULL;
+        ao->op_active = 0;
 }
 
+
 /*
- * args is a pointer to an in-kernel copy in the sendmsg cmsg.
+ * Count the number of pages needed to describe an incoming iovec.
  */
-static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
-                                            struct rds_rdma_args *args)
+static int rds_rdma_pages(struct rds_rdma_args *args)
 {
         struct rds_iovec vec;
-        struct rds_rdma_op *op = NULL;
+        struct rds_iovec __user *local_vec;
+        unsigned int tot_pages = 0;
         unsigned int nr_pages;
-        unsigned int max_pages;
+        unsigned int i;
+
+        local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
+
+        /* figure out the number of pages in the vector */
+        for (i = 0; i < args->nr_local; i++) {
+                if (copy_from_user(&vec, &local_vec[i],
+                                   sizeof(struct rds_iovec)))
+                        return -EFAULT;
+
+                nr_pages = rds_pages_in_vec(&vec);
+                if (nr_pages == 0)
+                        return -EINVAL;
+
+                tot_pages += nr_pages;
+        }
+
+        return tot_pages;
+}
+
+int rds_rdma_extra_size(struct rds_rdma_args *args)
+{
+        return rds_rdma_pages(args) * sizeof(struct scatterlist);
+}
+
+/*
+ * The application asks for a RDMA transfer.
+ * Extract all arguments and set up the rdma_op
+ */
+int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg)
+{
+        struct rds_rdma_args *args;
+        struct rds_iovec vec;
+        struct rm_rdma_op *op = &rm->rdma;
+        int nr_pages;
         unsigned int nr_bytes;
         struct page **pages = NULL;
         struct rds_iovec __user *local_vec;
-        struct scatterlist *sg;
         unsigned int nr;
         unsigned int i, j;
-        int ret;
+        int ret = 0;
 
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args))
+            || rm->rdma.op_active)
+                return -EINVAL;
+
+        args = CMSG_DATA(cmsg);
 
         if (rs->rs_bound_addr == 0) {
                 ret = -ENOTCONN; /* XXX not a great errno */
@@ -479,61 +546,38 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                 goto out;
         }
 
-        nr_pages = 0;
-        max_pages = 0;
-
-        local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
-
-        /* figure out the number of pages in the vector */
-        for (i = 0; i < args->nr_local; i++) {
-                if (copy_from_user(&vec, &local_vec[i],
-                                   sizeof(struct rds_iovec))) {
-                        ret = -EFAULT;
-                        goto out;
-                }
-
-                nr = rds_pages_in_vec(&vec);
-                if (nr == 0) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                max_pages = max(nr, max_pages);
-                nr_pages += nr;
-        }
-
-        pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);
-        if (pages == NULL) {
-                ret = -ENOMEM;
+        nr_pages = rds_rdma_pages(args);
+        if (nr_pages < 0)
                 goto out;
-        }
 
-        op = kzalloc(offsetof(struct rds_rdma_op, r_sg[nr_pages]), GFP_KERNEL);
-        if (op == NULL) {
+        pages = kcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL);
+        if (!pages) {
                 ret = -ENOMEM;
                 goto out;
         }
 
-        op->r_write = !!(args->flags & RDS_RDMA_READWRITE);
-        op->r_fence = !!(args->flags & RDS_RDMA_FENCE);
-        op->r_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME);
-        op->r_recverr = rs->rs_recverr;
+        op->op_write = !!(args->flags & RDS_RDMA_READWRITE);
+        op->op_fence = !!(args->flags & RDS_RDMA_FENCE);
+        op->op_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME);
+        op->op_silent = !!(args->flags & RDS_RDMA_SILENT);
+        op->op_active = 1;
+        op->op_recverr = rs->rs_recverr;
         WARN_ON(!nr_pages);
-        sg_init_table(op->r_sg, nr_pages);
+        op->op_sg = rds_message_alloc_sgs(rm, nr_pages);
 
-        if (op->r_notify || op->r_recverr) {
+        if (op->op_notify || op->op_recverr) {
                 /* We allocate an uninitialized notifier here, because
                  * we don't want to do that in the completion handler. We
                  * would have to use GFP_ATOMIC there, and don't want to deal
                  * with failed allocations.
                  */
-                op->r_notifier = kmalloc(sizeof(struct rds_notifier), GFP_KERNEL);
-                if (!op->r_notifier) {
+                op->op_notifier = kmalloc(sizeof(struct rds_notifier), GFP_KERNEL);
+                if (!op->op_notifier) {
                         ret = -ENOMEM;
                         goto out;
                 }
-                op->r_notifier->n_user_token = args->user_token;
-                op->r_notifier->n_status = RDS_RDMA_SUCCESS;
+                op->op_notifier->n_user_token = args->user_token;
+                op->op_notifier->n_status = RDS_RDMA_SUCCESS;
         }
 
         /* The cookie contains the R_Key of the remote memory region, and
@@ -543,15 +587,17 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
          * destination address (which is really an offset into the MR)
          * FIXME: We may want to move this into ib_rdma.c
          */
-        op->r_key = rds_rdma_cookie_key(args->cookie);
-        op->r_remote_addr = args->remote_vec.addr + rds_rdma_cookie_offset(args->cookie);
+        op->op_rkey = rds_rdma_cookie_key(args->cookie);
+        op->op_remote_addr = args->remote_vec.addr + rds_rdma_cookie_offset(args->cookie);
 
         nr_bytes = 0;
 
         rdsdebug("RDS: rdma prepare nr_local %llu rva %llx rkey %x\n",
                (unsigned long long)args->nr_local,
                (unsigned long long)args->remote_vec.addr,
-               op->r_key);
+               op->op_rkey);
+
+        local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
 
         for (i = 0; i < args->nr_local; i++) {
                 if (copy_from_user(&vec, &local_vec[i],
@@ -569,15 +615,10 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                 rs->rs_user_addr = vec.addr;
                 rs->rs_user_bytes = vec.bytes;
 
-                /* did the user change the vec under us? */
-                if (nr > max_pages || op->r_nents + nr > nr_pages) {
-                        ret = -EINVAL;
-                        goto out;
-                }
                 /* If it's a WRITE operation, we want to pin the pages for reading.
                  * If it's a READ operation, we need to pin the pages for writing.
                  */
-                ret = rds_pin_pages(vec.addr & PAGE_MASK, nr, pages, !op->r_write);
+                ret = rds_pin_pages(vec.addr, nr, pages, !op->op_write);
                 if (ret < 0)
                         goto out;
 
@@ -588,8 +629,9 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
 
                 for (j = 0; j < nr; j++) {
                         unsigned int offset = vec.addr & ~PAGE_MASK;
+                        struct scatterlist *sg;
 
-                        sg = &op->r_sg[op->r_nents + j];
+                        sg = &op->op_sg[op->op_nents + j];
                         sg_set_page(sg, pages[j],
                                         min_t(unsigned int, vec.bytes, PAGE_SIZE - offset),
                                         offset);
@@ -601,10 +643,9 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                         vec.bytes -= sg->length;
                 }
 
-                op->r_nents += nr;
+                op->op_nents += nr;
         }
 
-
         if (nr_bytes > args->remote_vec.bytes) {
                 rdsdebug("RDS nr_bytes %u remote_bytes %u do not match\n",
                                 nr_bytes,
@@ -612,38 +653,17 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                 ret = -EINVAL;
                 goto out;
         }
-        op->r_bytes = nr_bytes;
+        op->op_bytes = nr_bytes;
 
         ret = 0;
 out:
         kfree(pages);
-        if (ret) {
-                if (op)
-                        rds_rdma_free_op(op);
-                op = ERR_PTR(ret);
-        }
-        return op;
-}
-
-/*
- * The application asks for a RDMA transfer.
- * Extract all arguments and set up the rdma_op
- */
-int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
-                          struct cmsghdr *cmsg)
-{
-        struct rds_rdma_op *op;
-
-        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)) ||
-            rm->m_rdma_op != NULL)
-                return -EINVAL;
+        if (ret)
+                rds_rdma_free_op(op);
 
-        op = rds_rdma_prepare(rs, CMSG_DATA(cmsg));
-        if (IS_ERR(op))
-                return PTR_ERR(op);
         rds_stats_inc(s_send_rdma);
-        rm->m_rdma_op = op;
-        return 0;
+
+        return ret;
 }
 
 /*
@@ -673,7 +693,7 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
 
         spin_lock_irqsave(&rs->rs_rdma_lock, flags);
         mr = rds_mr_tree_walk(&rs->rs_rdma_keys, r_key, NULL);
-        if (mr == NULL)
+        if (!mr)
                 err = -EINVAL;  /* invalid r_key */
         else
                 atomic_inc(&mr->r_refcount);
@@ -681,7 +701,7 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
 
         if (mr) {
                 mr->r_trans->sync_mr(mr->r_trans_private, DMA_TO_DEVICE);
-                rm->m_rdma_mr = mr;
+                rm->rdma.op_rdma_mr = mr;
         }
         return err;
 }
@@ -699,5 +719,98 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
             rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
-        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->m_rdma_mr);
+        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->rdma.op_rdma_mr);
+}
+
+/*
+ * Fill in rds_message for an atomic request.
+ */
+int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
+                    struct cmsghdr *cmsg)
+{
+        struct page *page = NULL;
+        struct rds_atomic_args *args;
+        int ret = 0;
+
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_atomic_args))
+         || rm->atomic.op_active)
+                return -EINVAL;
+
+        args = CMSG_DATA(cmsg);
+
+        /* Nonmasked & masked cmsg ops converted to masked hw ops */
+        switch (cmsg->cmsg_type) {
+        case RDS_CMSG_ATOMIC_FADD:
+                rm->atomic.op_type = RDS_ATOMIC_TYPE_FADD;
+                rm->atomic.op_m_fadd.add = args->fadd.add;
+                rm->atomic.op_m_fadd.nocarry_mask = 0;
+                break;
+        case RDS_CMSG_MASKED_ATOMIC_FADD:
+                rm->atomic.op_type = RDS_ATOMIC_TYPE_FADD;
+                rm->atomic.op_m_fadd.add = args->m_fadd.add;
+                rm->atomic.op_m_fadd.nocarry_mask = args->m_fadd.nocarry_mask;
+                break;
+        case RDS_CMSG_ATOMIC_CSWP:
+                rm->atomic.op_type = RDS_ATOMIC_TYPE_CSWP;
+                rm->atomic.op_m_cswp.compare = args->cswp.compare;
+                rm->atomic.op_m_cswp.swap = args->cswp.swap;
+                rm->atomic.op_m_cswp.compare_mask = ~0;
+                rm->atomic.op_m_cswp.swap_mask = ~0;
+                break;
+        case RDS_CMSG_MASKED_ATOMIC_CSWP:
+                rm->atomic.op_type = RDS_ATOMIC_TYPE_CSWP;
+                rm->atomic.op_m_cswp.compare = args->m_cswp.compare;
+                rm->atomic.op_m_cswp.swap = args->m_cswp.swap;
+                rm->atomic.op_m_cswp.compare_mask = args->m_cswp.compare_mask;
+                rm->atomic.op_m_cswp.swap_mask = args->m_cswp.swap_mask;
+                break;
+        default:
+                BUG(); /* should never happen */
+        }
+
+        rm->atomic.op_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME);
+        rm->atomic.op_silent = !!(args->flags & RDS_RDMA_SILENT);
+        rm->atomic.op_active = 1;
+        rm->atomic.op_recverr = rs->rs_recverr;
+        rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1);
+
+        /* verify 8 byte-aligned */
+        if (args->local_addr & 0x7) {
+                ret = -EFAULT;
+                goto err;
+        }
+
+        ret = rds_pin_pages(args->local_addr, 1, &page, 1);
+        if (ret != 1)
+                goto err;
+        ret = 0;
+
+        sg_set_page(rm->atomic.op_sg, page, 8, offset_in_page(args->local_addr));
+
+        if (rm->atomic.op_notify || rm->atomic.op_recverr) {
+                /* We allocate an uninitialized notifier here, because
+                 * we don't want to do that in the completion handler. We
+                 * would have to use GFP_ATOMIC there, and don't want to deal
+                 * with failed allocations.
+                 */
+                rm->atomic.op_notifier = kmalloc(sizeof(*rm->atomic.op_notifier), GFP_KERNEL);
+                if (!rm->atomic.op_notifier) {
+                        ret = -ENOMEM;
+                        goto err;
+                }
+
+                rm->atomic.op_notifier->n_user_token = args->user_token;
+                rm->atomic.op_notifier->n_status = RDS_RDMA_SUCCESS;
+        }
+
+        rm->atomic.op_rkey = rds_rdma_cookie_key(args->cookie);
+        rm->atomic.op_remote_addr = args->remote_addr + rds_rdma_cookie_offset(args->cookie);
+
+        return ret;
+err:
+        if (page)
+                put_page(page);
+        kfree(rm->atomic.op_notifier);
+
+        return ret;
 }
diff --git a/net/rds/rdma.h b/net/rds/rdma.h
deleted file mode 100644
index 909c39835a5d..000000000000
--- a/net/rds/rdma.h
+++ /dev/null
@@ -1,85 +0,0 @@
-#ifndef _RDS_RDMA_H
-#define _RDS_RDMA_H
-
-#include <linux/rbtree.h>
-#include <linux/spinlock.h>
-#include <linux/scatterlist.h>
-
-#include "rds.h"
-
-struct rds_mr {
-        struct rb_node          r_rb_node;
-        atomic_t                r_refcount;
-        u32                     r_key;
-
-        /* A copy of the creation flags */
-        unsigned int            r_use_once:1;
-        unsigned int            r_invalidate:1;
-        unsigned int            r_write:1;
-
-        /* This is for RDS_MR_DEAD.
-         * It would be nice & consistent to make this part of the above
-         * bit field here, but we need to use test_and_set_bit.
-         */
-        unsigned long           r_state;
-        struct rds_sock         *r_sock; /* back pointer to the socket that owns us */
-        struct rds_transport    *r_trans;
-        void                    *r_trans_private;
-};
-
-/* Flags for mr->r_state */
-#define RDS_MR_DEAD             0
-
-struct rds_rdma_op {
-        u32                     r_key;
-        u64                     r_remote_addr;
-        unsigned int            r_write:1;
-        unsigned int            r_fence:1;
-        unsigned int            r_notify:1;
-        unsigned int            r_recverr:1;
-        unsigned int            r_mapped:1;
-        struct rds_notifier     *r_notifier;
-        unsigned int            r_bytes;
-        unsigned int            r_nents;
-        unsigned int            r_count;
-        struct scatterlist      r_sg[0];
-};
-
-static inline rds_rdma_cookie_t rds_rdma_make_cookie(u32 r_key, u32 offset)
-{
-        return r_key | (((u64) offset) << 32);
-}
-
-static inline u32 rds_rdma_cookie_key(rds_rdma_cookie_t cookie)
-{
-        return cookie;
-}
-
-static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t cookie)
-{
-        return cookie >> 32;
-}
-
-int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen);
-int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen);
-int rds_free_mr(struct rds_sock *rs, char __user *optval, int optlen);
-void rds_rdma_drop_keys(struct rds_sock *rs);
-int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
-                          struct cmsghdr *cmsg);
-int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
-                          struct cmsghdr *cmsg);
-int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
-                          struct cmsghdr *cmsg);
-int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
-                          struct cmsghdr *cmsg);
-void rds_rdma_free_op(struct rds_rdma_op *ro);
-void rds_rdma_send_complete(struct rds_message *rm, int);
-
-extern void __rds_put_mr_final(struct rds_mr *mr);
-static inline void rds_mr_put(struct rds_mr *mr)
-{
-        if (atomic_dec_and_test(&mr->r_refcount))
-                __rds_put_mr_final(mr);
-}
-
-#endif
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index e599ba2f950d..e6ed10aee190 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -36,6 +36,34 @@
 
 static struct rdma_cm_id *rds_rdma_listen_id;
 
+static char *rds_cm_event_strings[] = {
+#define RDS_CM_EVENT_STRING(foo) \
+                [RDMA_CM_EVENT_##foo] = __stringify(RDMA_CM_EVENT_##foo)
+        RDS_CM_EVENT_STRING(ADDR_RESOLVED),
+        RDS_CM_EVENT_STRING(ADDR_ERROR),
+        RDS_CM_EVENT_STRING(ROUTE_RESOLVED),
+        RDS_CM_EVENT_STRING(ROUTE_ERROR),
+        RDS_CM_EVENT_STRING(CONNECT_REQUEST),
+        RDS_CM_EVENT_STRING(CONNECT_RESPONSE),
+        RDS_CM_EVENT_STRING(CONNECT_ERROR),
+        RDS_CM_EVENT_STRING(UNREACHABLE),
+        RDS_CM_EVENT_STRING(REJECTED),
+        RDS_CM_EVENT_STRING(ESTABLISHED),
+        RDS_CM_EVENT_STRING(DISCONNECTED),
+        RDS_CM_EVENT_STRING(DEVICE_REMOVAL),
+        RDS_CM_EVENT_STRING(MULTICAST_JOIN),
+        RDS_CM_EVENT_STRING(MULTICAST_ERROR),
+        RDS_CM_EVENT_STRING(ADDR_CHANGE),
+        RDS_CM_EVENT_STRING(TIMEWAIT_EXIT),
+#undef RDS_CM_EVENT_STRING
+};
+
+static char *rds_cm_event_str(enum rdma_cm_event_type type)
+{
+        return rds_str_array(rds_cm_event_strings,
+                             ARRAY_SIZE(rds_cm_event_strings), type);
+};
+
 int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                               struct rdma_cm_event *event)
 {
@@ -44,8 +72,8 @@ int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
         struct rds_transport *trans;
         int ret = 0;
 
-        rdsdebug("conn %p id %p handling event %u\n", conn, cm_id,
-                 event->event);
+        rdsdebug("conn %p id %p handling event %u (%s)\n", conn, cm_id,
+                 event->event, rds_cm_event_str(event->event));
 
         if (cm_id->device->node_type == RDMA_NODE_RNIC)
                 trans = &rds_iw_transport;
@@ -109,7 +137,8 @@ int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
 
         default:
                 /* things like device disconnect? */
-                printk(KERN_ERR "RDS: unknown event %u!\n", event->event);
+                printk(KERN_ERR "RDS: unknown event %u (%s)!\n",
+                       event->event, rds_cm_event_str(event->event));
                 break;
         }
 
@@ -117,12 +146,13 @@ out:
         if (conn)
                 mutex_unlock(&conn->c_cm_lock);
 
-        rdsdebug("id %p event %u handling ret %d\n", cm_id, event->event, ret);
+        rdsdebug("id %p event %u (%s) handling ret %d\n", cm_id, event->event,
+                 rds_cm_event_str(event->event), ret);
 
         return ret;
 }
 
-static int __init rds_rdma_listen_init(void)
+static int rds_rdma_listen_init(void)
 {
         struct sockaddr_in sin;
         struct rdma_cm_id *cm_id;
@@ -177,7 +207,7 @@ static void rds_rdma_listen_stop(void)
         }
 }
 
-int __init rds_rdma_init(void)
+int rds_rdma_init(void)
 {
         int ret;
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index c224b5bb3ba9..8103dcf8b976 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -80,6 +80,7 @@ enum {
 /* Bits for c_flags */
 #define RDS_LL_SEND_FULL        0
 #define RDS_RECONNECT_PENDING   1
+#define RDS_IN_XMIT             2
 
 struct rds_connection {
         struct hlist_node       c_hash_node;
@@ -91,12 +92,13 @@ struct rds_connection {
         struct rds_cong_map     *c_lcong;
         struct rds_cong_map     *c_fcong;
 
-        struct mutex            c_send_lock;    /* protect send ring */
         struct rds_message      *c_xmit_rm;
         unsigned long           c_xmit_sg;
         unsigned int            c_xmit_hdr_off;
         unsigned int            c_xmit_data_off;
+        unsigned int            c_xmit_atomic_sent;
         unsigned int            c_xmit_rdma_sent;
+        unsigned int            c_xmit_data_sent;
 
         spinlock_t              c_lock;         /* protect msg queues */
         u64                     c_next_tx_seq;
@@ -116,11 +118,10 @@ struct rds_connection {
         struct delayed_work     c_conn_w;
         struct work_struct      c_down_w;
         struct mutex            c_cm_lock;      /* protect conn state & cm */
+        wait_queue_head_t       c_waitq;
 
         struct list_head        c_map_item;
         unsigned long           c_map_queued;
-        unsigned long           c_map_offset;
-        unsigned long           c_map_bytes;
 
         unsigned int            c_unacked_packets;
         unsigned int            c_unacked_bytes;
@@ -206,6 +207,48 @@ struct rds_incoming {
         rds_rdma_cookie_t       i_rdma_cookie;
 };
 
+struct rds_mr {
+        struct rb_node          r_rb_node;
+        atomic_t                r_refcount;
+        u32                     r_key;
+
+        /* A copy of the creation flags */
+        unsigned int            r_use_once:1;
+        unsigned int            r_invalidate:1;
+        unsigned int            r_write:1;
+
+        /* This is for RDS_MR_DEAD.
+         * It would be nice & consistent to make this part of the above
+         * bit field here, but we need to use test_and_set_bit.
+         */
+        unsigned long           r_state;
+        struct rds_sock         *r_sock; /* back pointer to the socket that owns us */
+        struct rds_transport    *r_trans;
+        void                    *r_trans_private;
+};
+
+/* Flags for mr->r_state */
+#define RDS_MR_DEAD             0
+
+static inline rds_rdma_cookie_t rds_rdma_make_cookie(u32 r_key, u32 offset)
+{
+        return r_key | (((u64) offset) << 32);
+}
+
+static inline u32 rds_rdma_cookie_key(rds_rdma_cookie_t cookie)
+{
+        return cookie;
+}
+
+static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t cookie)
+{
+        return cookie >> 32;
+}
+
+/* atomic operation types */
+#define RDS_ATOMIC_TYPE_CSWP            0
+#define RDS_ATOMIC_TYPE_FADD            1
+
 /*
  * m_sock_item and m_conn_item are on lists that are serialized under
  * conn->c_lock.  m_sock_item has additional meaning in that once it is empty
@@ -258,13 +301,71 @@ struct rds_message {
          *   -> rs->rs_lock
          */
         spinlock_t              m_rs_lock;
+        wait_queue_head_t       m_flush_wait;
+
         struct rds_sock         *m_rs;
-        struct rds_rdma_op      *m_rdma_op;
+
+        /* cookie to send to remote, in rds header */
         rds_rdma_cookie_t       m_rdma_cookie;
-        struct rds_mr           *m_rdma_mr;
-        unsigned int            m_nents;
-        unsigned int            m_count;
-        struct scatterlist      m_sg[0];
+
+        unsigned int            m_used_sgs;
+        unsigned int            m_total_sgs;
+
+        void                    *m_final_op;
+
+        struct {
+                struct rm_atomic_op {
+                        int                     op_type;
+                        union {
+                                struct {
+                                        uint64_t        compare;
+                                        uint64_t        swap;
+                                        uint64_t        compare_mask;
+                                        uint64_t        swap_mask;
+                                } op_m_cswp;
+                                struct {
+                                        uint64_t        add;
+                                        uint64_t        nocarry_mask;
+                                } op_m_fadd;
+                        };
+
+                        u32                     op_rkey;
+                        u64                     op_remote_addr;
+                        unsigned int            op_notify:1;
+                        unsigned int            op_recverr:1;
+                        unsigned int            op_mapped:1;
+                        unsigned int            op_silent:1;
+                        unsigned int            op_active:1;
+                        struct scatterlist      *op_sg;
+                        struct rds_notifier     *op_notifier;
+
+                        struct rds_mr           *op_rdma_mr;
+                } atomic;
+                struct rm_rdma_op {
+                        u32                     op_rkey;
+                        u64                     op_remote_addr;
+                        unsigned int            op_write:1;
+                        unsigned int            op_fence:1;
+                        unsigned int            op_notify:1;
+                        unsigned int            op_recverr:1;
+                        unsigned int            op_mapped:1;
+                        unsigned int            op_silent:1;
+                        unsigned int            op_active:1;
+                        unsigned int            op_bytes;
+                        unsigned int            op_nents;
+                        unsigned int            op_count;
+                        struct scatterlist      *op_sg;
+                        struct rds_notifier     *op_notifier;
+
+                        struct rds_mr           *op_rdma_mr;
+                } rdma;
+                struct rm_data_op {
+                        unsigned int            op_active:1;
+                        unsigned int            op_nents;
+                        unsigned int            op_count;
+                        struct scatterlist      *op_sg;
+                } data;
+        };
 };
 
 /*
@@ -305,10 +406,6 @@ struct rds_notifier {
  *                 transport is responsible for other serialization, including
  *                 rds_recv_incoming().  This is called in process context but
  *                 should try hard not to block.
- *
- * @xmit_cong_map: This asks the transport to send the local bitmap down the
- *                 given connection.  XXX get a better story about the bitmap
- *                 flag and header.
  */
 
 #define RDS_TRANS_IB    0
@@ -332,13 +429,11 @@ struct rds_transport {
         void (*xmit_complete)(struct rds_connection *conn);
         int (*xmit)(struct rds_connection *conn, struct rds_message *rm,
                     unsigned int hdr_off, unsigned int sg, unsigned int off);
-        int (*xmit_cong_map)(struct rds_connection *conn,
-                             struct rds_cong_map *map, unsigned long offset);
-        int (*xmit_rdma)(struct rds_connection *conn, struct rds_rdma_op *op);
+        int (*xmit_rdma)(struct rds_connection *conn, struct rm_rdma_op *op);
+        int (*xmit_atomic)(struct rds_connection *conn, struct rm_atomic_op *op);
         int (*recv)(struct rds_connection *conn);
         int (*inc_copy_to_user)(struct rds_incoming *inc, struct iovec *iov,
                                 size_t size);
-        void (*inc_purge)(struct rds_incoming *inc);
         void (*inc_free)(struct rds_incoming *inc);
 
         int (*cm_handle_connect)(struct rdma_cm_id *cm_id,
@@ -367,17 +462,11 @@ struct rds_sock {
          * bound_addr used for both incoming and outgoing, no INADDR_ANY
          * support.
          */
-        struct rb_node          rs_bound_node;
+        struct hlist_node       rs_bound_node;
         __be32                  rs_bound_addr;
         __be32                  rs_conn_addr;
         __be16                  rs_bound_port;
         __be16                  rs_conn_port;
-
-        /*
-         * This is only used to communicate the transport between bind and
-         * initiating connections.  All other trans use is referenced through
-         * the connection.
-         */
         struct rds_transport    *rs_transport;
 
         /*
@@ -466,8 +555,8 @@ struct rds_statistics {
         uint64_t        s_recv_ping;
         uint64_t        s_send_queue_empty;
         uint64_t        s_send_queue_full;
-        uint64_t        s_send_sem_contention;
-        uint64_t        s_send_sem_queue_raced;
+        uint64_t        s_send_lock_contention;
+        uint64_t        s_send_lock_queue_raced;
         uint64_t        s_send_immediate_retry;
         uint64_t        s_send_delayed_retry;
         uint64_t        s_send_drop_acked;
@@ -487,6 +576,7 @@ struct rds_statistics {
 };
 
 /* af_rds.c */
+char *rds_str_array(char **array, size_t elements, size_t index);
 void rds_sock_addref(struct rds_sock *rs);
 void rds_sock_put(struct rds_sock *rs);
 void rds_wake_sk_sleep(struct rds_sock *rs);
@@ -521,15 +611,17 @@ void rds_cong_exit(void);
 struct rds_message *rds_cong_update_alloc(struct rds_connection *conn);
 
 /* conn.c */
-int __init rds_conn_init(void);
+int rds_conn_init(void);
 void rds_conn_exit(void);
 struct rds_connection *rds_conn_create(__be32 laddr, __be32 faddr,
                                        struct rds_transport *trans, gfp_t gfp);
 struct rds_connection *rds_conn_create_outgoing(__be32 laddr, __be32 faddr,
                                struct rds_transport *trans, gfp_t gfp);
+void rds_conn_shutdown(struct rds_connection *conn);
 void rds_conn_destroy(struct rds_connection *conn);
 void rds_conn_reset(struct rds_connection *conn);
 void rds_conn_drop(struct rds_connection *conn);
+void rds_conn_connect_if_down(struct rds_connection *conn);
 void rds_for_each_conn_info(struct socket *sock, unsigned int len,
                           struct rds_info_iterator *iter,
                           struct rds_info_lengths *lens,
@@ -566,7 +658,8 @@ rds_conn_connecting(struct rds_connection *conn)
 
 /* message.c */
 struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp);
-struct rds_message *rds_message_copy_from_user(struct iovec *first_iov,
+struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents);
+int rds_message_copy_from_user(struct rds_message *rm, struct iovec *first_iov,
                                                size_t total_len);
 struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len);
 void rds_message_populate_header(struct rds_header *hdr, __be16 sport,
@@ -580,7 +673,6 @@ int rds_message_get_version_extension(struct rds_header *hdr, unsigned int *vers
 int rds_message_add_rdma_dest_extension(struct rds_header *hdr, u32 r_key, u32 offset);
 int rds_message_inc_copy_to_user(struct rds_incoming *inc,
                                  struct iovec *first_iov, size_t size);
-void rds_message_inc_purge(struct rds_incoming *inc);
 void rds_message_inc_free(struct rds_incoming *inc);
 void rds_message_addref(struct rds_message *rm);
 void rds_message_put(struct rds_message *rm);
@@ -636,14 +728,39 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest);
 typedef int (*is_acked_func)(struct rds_message *rm, uint64_t ack);
 void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
                          is_acked_func is_acked);
-int rds_send_acked_before(struct rds_connection *conn, u64 seq);
 void rds_send_remove_from_sock(struct list_head *messages, int status);
 int rds_send_pong(struct rds_connection *conn, __be16 dport);
 struct rds_message *rds_send_get_message(struct rds_connection *,
-                                         struct rds_rdma_op *);
+                                         struct rm_rdma_op *);
 
 /* rdma.c */
 void rds_rdma_unuse(struct rds_sock *rs, u32 r_key, int force);
+int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen);
+int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen);
+int rds_free_mr(struct rds_sock *rs, char __user *optval, int optlen);
+void rds_rdma_drop_keys(struct rds_sock *rs);
+int rds_rdma_extra_size(struct rds_rdma_args *args);
+int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg);
+int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg);
+int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg);
+int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg);
+void rds_rdma_free_op(struct rm_rdma_op *ro);
+void rds_atomic_free_op(struct rm_atomic_op *ao);
+void rds_rdma_send_complete(struct rds_message *rm, int wc_status);
+void rds_atomic_send_complete(struct rds_message *rm, int wc_status);
+int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
+                    struct cmsghdr *cmsg);
+
+extern void __rds_put_mr_final(struct rds_mr *mr);
+static inline void rds_mr_put(struct rds_mr *mr)
+{
+        if (atomic_dec_and_test(&mr->r_refcount))
+                __rds_put_mr_final(mr);
+}
 
 /* stats.c */
 DECLARE_PER_CPU_SHARED_ALIGNED(struct rds_statistics, rds_stats);
@@ -657,14 +774,14 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct rds_statistics, rds_stats);
         put_cpu();                                      \
 } while (0)
 #define rds_stats_add(member, count) rds_stats_add_which(rds_stats, member, count)
-int __init rds_stats_init(void);
+int rds_stats_init(void);
 void rds_stats_exit(void);
 void rds_stats_info_copy(struct rds_info_iterator *iter,
                          uint64_t *values, const char *const *names,
                          size_t nr);
 
 /* sysctl.c */
-int __init rds_sysctl_init(void);
+int rds_sysctl_init(void);
 void rds_sysctl_exit(void);
 extern unsigned long rds_sysctl_sndbuf_min;
 extern unsigned long rds_sysctl_sndbuf_default;
@@ -678,9 +795,10 @@ extern unsigned long rds_sysctl_trace_flags;
 extern unsigned int  rds_sysctl_trace_level;
 
 /* threads.c */
-int __init rds_threads_init(void);
+int rds_threads_init(void);
 void rds_threads_exit(void);
 extern struct workqueue_struct *rds_wq;
+void rds_queue_reconnect(struct rds_connection *conn);
 void rds_connect_worker(struct work_struct *);
 void rds_shutdown_worker(struct work_struct *);
 void rds_send_worker(struct work_struct *);
@@ -691,9 +809,10 @@ void rds_connect_complete(struct rds_connection *conn);
 int rds_trans_register(struct rds_transport *trans);
 void rds_trans_unregister(struct rds_transport *trans);
 struct rds_transport *rds_trans_get_preferred(__be32 addr);
+void rds_trans_put(struct rds_transport *trans);
 unsigned int rds_trans_stats_info_copy(struct rds_info_iterator *iter,
                                        unsigned int avail);
-int __init rds_trans_init(void);
+int rds_trans_init(void);
 void rds_trans_exit(void);
 
 #endif
diff --git a/net/rds/recv.c b/net/rds/recv.c
index c93588c2d553..68800f02aa30 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -36,7 +36,6 @@
 #include <linux/in.h>
 
 #include "rds.h"
-#include "rdma.h"
 
 void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
                   __be32 saddr)
@@ -210,7 +209,7 @@ void rds_recv_incoming(struct rds_connection *conn, __be32 saddr, __be32 daddr,
         }
 
         rs = rds_find_bound(daddr, inc->i_hdr.h_dport);
-        if (rs == NULL) {
+        if (!rs) {
                 rds_stats_inc(s_recv_drop_no_sock);
                 goto out;
         }
@@ -251,7 +250,7 @@ static int rds_next_incoming(struct rds_sock *rs, struct rds_incoming **inc)
 {
         unsigned long flags;
 
-        if (*inc == NULL) {
+        if (!*inc) {
                 read_lock_irqsave(&rs->rs_recv_lock, flags);
                 if (!list_empty(&rs->rs_recv_queue)) {
                         *inc = list_entry(rs->rs_recv_queue.next,
@@ -334,10 +333,10 @@ int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
 
                 if (msghdr) {
                         cmsg.user_token = notifier->n_user_token;
-                        cmsg.status  = notifier->n_status;
+                        cmsg.status = notifier->n_status;
 
                         err = put_cmsg(msghdr, SOL_RDS, RDS_CMSG_RDMA_STATUS,
-                                        sizeof(cmsg), &cmsg);
+                                       sizeof(cmsg), &cmsg);
                         if (err)
                                 break;
                 }
diff --git a/net/rds/send.c b/net/rds/send.c
index 9c1c6bcaa6c9..9b951a0ab6b7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -37,7 +37,6 @@
 #include <linux/list.h>
 
 #include "rds.h"
-#include "rdma.h"
 
 /* When transmitting messages in rds_send_xmit, we need to emerge from
  * time to time and briefly release the CPU. Otherwise the softlock watchdog
@@ -54,7 +53,8 @@ module_param(send_batch_count, int, 0444);
 MODULE_PARM_DESC(send_batch_count, " batch factor when working the send queue");
 
 /*
- * Reset the send state. Caller must hold c_send_lock when calling here.
+ * Reset the send state.  Callers must ensure that this doesn't race with
+ * rds_send_xmit().
  */
 void rds_send_reset(struct rds_connection *conn)
 {
@@ -62,18 +62,22 @@ void rds_send_reset(struct rds_connection *conn)
         unsigned long flags;
 
         if (conn->c_xmit_rm) {
+                rm = conn->c_xmit_rm;
+                conn->c_xmit_rm = NULL;
                 /* Tell the user the RDMA op is no longer mapped by the
                  * transport. This isn't entirely true (it's flushed out
                  * independently) but as the connection is down, there's
                  * no ongoing RDMA to/from that memory */
-                rds_message_unmapped(conn->c_xmit_rm);
-                rds_message_put(conn->c_xmit_rm);
-                conn->c_xmit_rm = NULL;
+                rds_message_unmapped(rm);
+                rds_message_put(rm);
         }
+
         conn->c_xmit_sg = 0;
         conn->c_xmit_hdr_off = 0;
         conn->c_xmit_data_off = 0;
+        conn->c_xmit_atomic_sent = 0;
         conn->c_xmit_rdma_sent = 0;
+        conn->c_xmit_data_sent = 0;
 
         conn->c_map_queued = 0;
 
@@ -90,6 +94,25 @@ void rds_send_reset(struct rds_connection *conn)
         spin_unlock_irqrestore(&conn->c_lock, flags);
 }
 
+static int acquire_in_xmit(struct rds_connection *conn)
+{
+        return test_and_set_bit(RDS_IN_XMIT, &conn->c_flags) == 0;
+}
+
+static void release_in_xmit(struct rds_connection *conn)
+{
+        clear_bit(RDS_IN_XMIT, &conn->c_flags);
+        smp_mb__after_clear_bit();
+        /*
+         * We don't use wait_on_bit()/wake_up_bit() because our waking is in a
+         * hot path and finding waiters is very rare.  We don't want to walk
+         * the system-wide hashed waitqueue buckets in the fast path only to
+         * almost never find waiters.
+         */
+        if (waitqueue_active(&conn->c_waitq))
+                wake_up_all(&conn->c_waitq);
+}
+
 /*
  * We're making the concious trade-off here to only send one message
  * down the connection at a time.
@@ -109,102 +132,69 @@ int rds_send_xmit(struct rds_connection *conn)
         struct rds_message *rm;
         unsigned long flags;
         unsigned int tmp;
-        unsigned int send_quota = send_batch_count;
         struct scatterlist *sg;
         int ret = 0;
-        int was_empty = 0;
         LIST_HEAD(to_be_dropped);
 
+restart:
+
         /*
          * sendmsg calls here after having queued its message on the send
          * queue.  We only have one task feeding the connection at a time.  If
          * another thread is already feeding the queue then we back off.  This
          * avoids blocking the caller and trading per-connection data between
          * caches per message.
-         *
-         * The sem holder will issue a retry if they notice that someone queued
-         * a message after they stopped walking the send queue but before they
-         * dropped the sem.
          */
-        if (!mutex_trylock(&conn->c_send_lock)) {
-                rds_stats_inc(s_send_sem_contention);
+        if (!acquire_in_xmit(conn)) {
+                rds_stats_inc(s_send_lock_contention);
                 ret = -ENOMEM;
                 goto out;
         }
 
+        /*
+         * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+         * we do the opposite to avoid races.
+         */
+        if (!rds_conn_up(conn)) {
+                release_in_xmit(conn);
+                ret = 0;
+                goto out;
+        }
+
         if (conn->c_trans->xmit_prepare)
                 conn->c_trans->xmit_prepare(conn);
 
         /*
          * spin trying to push headers and data down the connection until
-         * the connection doens't make forward progress.
+         * the connection doesn't make forward progress.
          */
-        while (--send_quota) {
-                /*
-                 * See if need to send a congestion map update if we're
-                 * between sending messages.  The send_sem protects our sole
-                 * use of c_map_offset and _bytes.
-                 * Note this is used only by transports that define a special
-                 * xmit_cong_map function. For all others, we create allocate
-                 * a cong_map message and treat it just like any other send.
-                 */
-                if (conn->c_map_bytes) {
-                        ret = conn->c_trans->xmit_cong_map(conn, conn->c_lcong,
-                                                conn->c_map_offset);
-                        if (ret <= 0)
-                                break;
+        while (1) {
 
-                        conn->c_map_offset += ret;
-                        conn->c_map_bytes -= ret;
-                        if (conn->c_map_bytes)
-                                continue;
-                }
-
-                /* If we're done sending the current message, clear the
-                 * offset and S/G temporaries.
-                 */
                 rm = conn->c_xmit_rm;
-                if (rm != NULL &&
-                    conn->c_xmit_hdr_off == sizeof(struct rds_header) &&
-                    conn->c_xmit_sg == rm->m_nents) {
-                        conn->c_xmit_rm = NULL;
-                        conn->c_xmit_sg = 0;
-                        conn->c_xmit_hdr_off = 0;
-                        conn->c_xmit_data_off = 0;
-                        conn->c_xmit_rdma_sent = 0;
 
-                        /* Release the reference to the previous message. */
-                        rds_message_put(rm);
-                        rm = NULL;
-                }
-
-                /* If we're asked to send a cong map update, do so.
+                /*
+                 * If between sending messages, we can send a pending congestion
+                 * map update.
                  */
-                if (rm == NULL && test_and_clear_bit(0, &conn->c_map_queued)) {
-                        if (conn->c_trans->xmit_cong_map != NULL) {
-                                conn->c_map_offset = 0;
-                                conn->c_map_bytes = sizeof(struct rds_header) +
-                                        RDS_CONG_MAP_BYTES;
-                                continue;
-                        }
-
+                if (!rm && test_and_clear_bit(0, &conn->c_map_queued)) {
                         rm = rds_cong_update_alloc(conn);
                         if (IS_ERR(rm)) {
                                 ret = PTR_ERR(rm);
                                 break;
                         }
+                        rm->data.op_active = 1;
 
                         conn->c_xmit_rm = rm;
                 }
 
                 /*
-                 * Grab the next message from the send queue, if there is one.
+                 * If not already working on one, grab the next message.
                  *
                  * c_xmit_rm holds a ref while we're sending this message down
                  * the connction.  We can use this ref while holding the
                  * send_sem.. rds_send_reset() is serialized with it.
                  */
-                if (rm == NULL) {
+                if (!rm) {
                         unsigned int len;
 
                         spin_lock_irqsave(&conn->c_lock, flags);
@@ -224,10 +214,8 @@ int rds_send_xmit(struct rds_connection *conn)
 
                         spin_unlock_irqrestore(&conn->c_lock, flags);
 
-                        if (rm == NULL) {
-                                was_empty = 1;
+                        if (!rm)
                                 break;
-                        }
 
                         /* Unfortunately, the way Infiniband deals with
                          * RDMA to a bad MR key is by moving the entire
@@ -236,13 +224,12 @@ int rds_send_xmit(struct rds_connection *conn)
                          * connection.
                          * Therefore, we never retransmit messages with RDMA ops.
                          */
-                        if (rm->m_rdma_op &&
+                        if (rm->rdma.op_active &&
                             test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags)) {
                                 spin_lock_irqsave(&conn->c_lock, flags);
                                 if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags))
                                         list_move(&rm->m_conn_item, &to_be_dropped);
                                 spin_unlock_irqrestore(&conn->c_lock, flags);
-                                rds_message_put(rm);
                                 continue;
                         }
 
@@ -263,23 +250,55 @@ int rds_send_xmit(struct rds_connection *conn)
                         conn->c_xmit_rm = rm;
                 }
 
-                /*
-                 * Try and send an rdma message.  Let's see if we can
-                 * keep this simple and require that the transport either
-                 * send the whole rdma or none of it.
-                 */
-                if (rm->m_rdma_op && !conn->c_xmit_rdma_sent) {
-                        ret = conn->c_trans->xmit_rdma(conn, rm->m_rdma_op);
+                /* The transport either sends the whole rdma or none of it */
+                if (rm->rdma.op_active && !conn->c_xmit_rdma_sent) {
+                        rm->m_final_op = &rm->rdma;
+                        ret = conn->c_trans->xmit_rdma(conn, &rm->rdma);
                         if (ret)
                                 break;
                         conn->c_xmit_rdma_sent = 1;
+
                         /* The transport owns the mapped memory for now.
                          * You can't unmap it while it's on the send queue */
                         set_bit(RDS_MSG_MAPPED, &rm->m_flags);
                 }
 
-                if (conn->c_xmit_hdr_off < sizeof(struct rds_header) ||
-                    conn->c_xmit_sg < rm->m_nents) {
+                if (rm->atomic.op_active && !conn->c_xmit_atomic_sent) {
+                        rm->m_final_op = &rm->atomic;
+                        ret = conn->c_trans->xmit_atomic(conn, &rm->atomic);
+                        if (ret)
+                                break;
+                        conn->c_xmit_atomic_sent = 1;
+
+                        /* The transport owns the mapped memory for now.
+                         * You can't unmap it while it's on the send queue */
+                        set_bit(RDS_MSG_MAPPED, &rm->m_flags);
+                }
+
+                /*
+                 * A number of cases require an RDS header to be sent
+                 * even if there is no data.
+                 * We permit 0-byte sends; rds-ping depends on this.
+                 * However, if there are exclusively attached silent ops,
+                 * we skip the hdr/data send, to enable silent operation.
+                 */
+                if (rm->data.op_nents == 0) {
+                        int ops_present;
+                        int all_ops_are_silent = 1;
+
+                        ops_present = (rm->atomic.op_active || rm->rdma.op_active);
+                        if (rm->atomic.op_active && !rm->atomic.op_silent)
+                                all_ops_are_silent = 0;
+                        if (rm->rdma.op_active && !rm->rdma.op_silent)
+                                all_ops_are_silent = 0;
+
+                        if (ops_present && all_ops_are_silent
+                            && !rm->m_rdma_cookie)
+                                rm->data.op_active = 0;
+                }
+
+                if (rm->data.op_active && !conn->c_xmit_data_sent) {
+                        rm->m_final_op = &rm->data;
                         ret = conn->c_trans->xmit(conn, rm,
                                                   conn->c_xmit_hdr_off,
                                                   conn->c_xmit_sg,
@@ -295,7 +314,7 @@ int rds_send_xmit(struct rds_connection *conn)
                                 ret -= tmp;
                         }
 
-                        sg = &rm->m_sg[conn->c_xmit_sg];
+                        sg = &rm->data.op_sg[conn->c_xmit_sg];
                         while (ret) {
                                 tmp = min_t(int, ret, sg->length -
                                                       conn->c_xmit_data_off);
@@ -306,49 +325,63 @@ int rds_send_xmit(struct rds_connection *conn)
                                         sg++;
                                         conn->c_xmit_sg++;
                                         BUG_ON(ret != 0 &&
-                                               conn->c_xmit_sg == rm->m_nents);
+                                               conn->c_xmit_sg == rm->data.op_nents);
                                 }
                         }
+
+                        if (conn->c_xmit_hdr_off == sizeof(struct rds_header) &&
+                            (conn->c_xmit_sg == rm->data.op_nents))
+                                conn->c_xmit_data_sent = 1;
                 }
-        }
 
-        /* Nuke any messages we decided not to retransmit. */
-        if (!list_empty(&to_be_dropped))
-                rds_send_remove_from_sock(&to_be_dropped, RDS_RDMA_DROPPED);
+                /*
+                 * A rm will only take multiple times through this loop
+                 * if there is a data op. Thus, if the data is sent (or there was
+                 * none), then we're done with the rm.
+                 */
+                if (!rm->data.op_active || conn->c_xmit_data_sent) {
+                        conn->c_xmit_rm = NULL;
+                        conn->c_xmit_sg = 0;
+                        conn->c_xmit_hdr_off = 0;
+                        conn->c_xmit_data_off = 0;
+                        conn->c_xmit_rdma_sent = 0;
+                        conn->c_xmit_atomic_sent = 0;
+                        conn->c_xmit_data_sent = 0;
+
+                        rds_message_put(rm);
+                }
+        }
 
         if (conn->c_trans->xmit_complete)
                 conn->c_trans->xmit_complete(conn);
 
-        /*
-         * We might be racing with another sender who queued a message but
-         * backed off on noticing that we held the c_send_lock.  If we check
-         * for queued messages after dropping the sem then either we'll
-         * see the queued message or the queuer will get the sem.  If we
-         * notice the queued message then we trigger an immediate retry.
-         *
-         * We need to be careful only to do this when we stopped processing
-         * the send queue because it was empty.  It's the only way we
-         * stop processing the loop when the transport hasn't taken
-         * responsibility for forward progress.
-         */
-        mutex_unlock(&conn->c_send_lock);
+        release_in_xmit(conn);
 
-        if (conn->c_map_bytes || (send_quota == 0 && !was_empty)) {
-                /* We exhausted the send quota, but there's work left to
-                 * do. Return and (re-)schedule the send worker.
-                 */
-                ret = -EAGAIN;
+        /* Nuke any messages we decided not to retransmit. */
+        if (!list_empty(&to_be_dropped)) {
+                /* irqs on here, so we can put(), unlike above */
+                list_for_each_entry(rm, &to_be_dropped, m_conn_item)
+                        rds_message_put(rm);
+                rds_send_remove_from_sock(&to_be_dropped, RDS_RDMA_DROPPED);
         }
 
-        if (ret == 0 && was_empty) {
-                /* A simple bit test would be way faster than taking the
-                 * spin lock */
-                spin_lock_irqsave(&conn->c_lock, flags);
+        /*
+         * Other senders can queue a message after we last test the send queue
+         * but before we clear RDS_IN_XMIT.  In that case they'd back off and
+         * not try and send their newly queued message.  We need to check the
+         * send queue after having cleared RDS_IN_XMIT so that their message
+         * doesn't get stuck on the send queue.
+         *
+         * If the transport cannot continue (i.e ret != 0), then it must
+         * call us when more room is available, such as from the tx
+         * completion handler.
+         */
+        if (ret == 0) {
+                smp_mb();
                 if (!list_empty(&conn->c_send_queue)) {
-                        rds_stats_inc(s_send_sem_queue_raced);
-                        ret = -EAGAIN;
+                        rds_stats_inc(s_send_lock_queue_raced);
+                        goto restart;
                 }
-                spin_unlock_irqrestore(&conn->c_lock, flags);
         }
 out:
         return ret;
@@ -376,52 +409,60 @@ static inline int rds_send_is_acked(struct rds_message *rm, u64 ack,
 }
 
 /*
- * Returns true if there are no messages on the send and retransmit queues
- * which have a sequence number greater than or equal to the given sequence
- * number.
+ * This is pretty similar to what happens below in the ACK
+ * handling code - except that we call here as soon as we get
+ * the IB send completion on the RDMA op and the accompanying
+ * message.
  */
-int rds_send_acked_before(struct rds_connection *conn, u64 seq)
+void rds_rdma_send_complete(struct rds_message *rm, int status)
 {
-        struct rds_message *rm, *tmp;
-        int ret = 1;
+        struct rds_sock *rs = NULL;
+        struct rm_rdma_op *ro;
+        struct rds_notifier *notifier;
+        unsigned long flags;
 
-        spin_lock(&conn->c_lock);
+        spin_lock_irqsave(&rm->m_rs_lock, flags);
 
-        list_for_each_entry_safe(rm, tmp, &conn->c_retrans, m_conn_item) {
-                if (be64_to_cpu(rm->m_inc.i_hdr.h_sequence) < seq)
-                        ret = 0;
-                break;
-        }
+        ro = &rm->rdma;
+        if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
+            ro->op_active && ro->op_notify && ro->op_notifier) {
+                notifier = ro->op_notifier;
+                rs = rm->m_rs;
+                sock_hold(rds_rs_to_sk(rs));
 
-        list_for_each_entry_safe(rm, tmp, &conn->c_send_queue, m_conn_item) {
-                if (be64_to_cpu(rm->m_inc.i_hdr.h_sequence) < seq)
-                        ret = 0;
-                break;
+                notifier->n_status = status;
+                spin_lock(&rs->rs_lock);
+                list_add_tail(&notifier->n_list, &rs->rs_notify_queue);
+                spin_unlock(&rs->rs_lock);
+
+                ro->op_notifier = NULL;
         }
 
-        spin_unlock(&conn->c_lock);
+        spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 
-        return ret;
+        if (rs) {
+                rds_wake_sk_sleep(rs);
+                sock_put(rds_rs_to_sk(rs));
+        }
 }
+EXPORT_SYMBOL_GPL(rds_rdma_send_complete);
 
 /*
- * This is pretty similar to what happens below in the ACK
- * handling code - except that we call here as soon as we get
- * the IB send completion on the RDMA op and the accompanying
- * message.
+ * Just like above, except looks at atomic op
  */
-void rds_rdma_send_complete(struct rds_message *rm, int status)
+void rds_atomic_send_complete(struct rds_message *rm, int status)
 {
         struct rds_sock *rs = NULL;
-        struct rds_rdma_op *ro;
+        struct rm_atomic_op *ao;
         struct rds_notifier *notifier;
+        unsigned long flags;
 
-        spin_lock(&rm->m_rs_lock);
+        spin_lock_irqsave(&rm->m_rs_lock, flags);
 
-        ro = rm->m_rdma_op;
-        if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
-            ro && ro->r_notify && ro->r_notifier) {
-                notifier = ro->r_notifier;
+        ao = &rm->atomic;
+        if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags)
+            && ao->op_active && ao->op_notify && ao->op_notifier) {
+                notifier = ao->op_notifier;
                 rs = rm->m_rs;
                 sock_hold(rds_rs_to_sk(rs));
 
@@ -430,17 +471,17 @@ void rds_rdma_send_complete(struct rds_message *rm, int status)
                 list_add_tail(&notifier->n_list, &rs->rs_notify_queue);
                 spin_unlock(&rs->rs_lock);
 
-                ro->r_notifier = NULL;
+                ao->op_notifier = NULL;
         }
 
-        spin_unlock(&rm->m_rs_lock);
+        spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 
         if (rs) {
                 rds_wake_sk_sleep(rs);
                 sock_put(rds_rs_to_sk(rs));
         }
 }
-EXPORT_SYMBOL_GPL(rds_rdma_send_complete);
+EXPORT_SYMBOL_GPL(rds_atomic_send_complete);
 
 /*
  * This is the same as rds_rdma_send_complete except we
@@ -448,15 +489,23 @@ EXPORT_SYMBOL_GPL(rds_rdma_send_complete);
  * socket, socket lock) and can just move the notifier.
  */
 static inline void
-__rds_rdma_send_complete(struct rds_sock *rs, struct rds_message *rm, int status)
+__rds_send_complete(struct rds_sock *rs, struct rds_message *rm, int status)
 {
-        struct rds_rdma_op *ro;
+        struct rm_rdma_op *ro;
+        struct rm_atomic_op *ao;
+
+        ro = &rm->rdma;
+        if (ro->op_active && ro->op_notify && ro->op_notifier) {
+                ro->op_notifier->n_status = status;
+                list_add_tail(&ro->op_notifier->n_list, &rs->rs_notify_queue);
+                ro->op_notifier = NULL;
+        }
 
-        ro = rm->m_rdma_op;
-        if (ro && ro->r_notify && ro->r_notifier) {
-                ro->r_notifier->n_status = status;
-                list_add_tail(&ro->r_notifier->n_list, &rs->rs_notify_queue);
-                ro->r_notifier = NULL;
+        ao = &rm->atomic;
+        if (ao->op_active && ao->op_notify && ao->op_notifier) {
+                ao->op_notifier->n_status = status;
+                list_add_tail(&ao->op_notifier->n_list, &rs->rs_notify_queue);
+                ao->op_notifier = NULL;
         }
 
         /* No need to wake the app - caller does this */
@@ -468,7 +517,7 @@ __rds_rdma_send_complete(struct rds_sock *rs, struct rds_message *rm, int status
  * So speed is not an issue here.
  */
 struct rds_message *rds_send_get_message(struct rds_connection *conn,
-                                         struct rds_rdma_op *op)
+                                         struct rm_rdma_op *op)
 {
         struct rds_message *rm, *tmp, *found = NULL;
         unsigned long flags;
@@ -476,7 +525,7 @@ struct rds_message *rds_send_get_message(struct rds_connection *conn,
         spin_lock_irqsave(&conn->c_lock, flags);
 
         list_for_each_entry_safe(rm, tmp, &conn->c_retrans, m_conn_item) {
-                if (rm->m_rdma_op == op) {
+                if (&rm->rdma == op) {
                         atomic_inc(&rm->m_refcount);
                         found = rm;
                         goto out;
@@ -484,7 +533,7 @@ struct rds_message *rds_send_get_message(struct rds_connection *conn,
         }
 
         list_for_each_entry_safe(rm, tmp, &conn->c_send_queue, m_conn_item) {
-                if (rm->m_rdma_op == op) {
+                if (&rm->rdma == op) {
                         atomic_inc(&rm->m_refcount);
                         found = rm;
                         break;
@@ -544,19 +593,20 @@ void rds_send_remove_from_sock(struct list_head *messages, int status)
                 spin_lock(&rs->rs_lock);
 
                 if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) {
-                        struct rds_rdma_op *ro = rm->m_rdma_op;
+                        struct rm_rdma_op *ro = &rm->rdma;
                         struct rds_notifier *notifier;
 
                         list_del_init(&rm->m_sock_item);
                         rds_send_sndbuf_remove(rs, rm);
 
-                        if (ro && ro->r_notifier && (status || ro->r_notify)) {
-                                notifier = ro->r_notifier;
+                        if (ro->op_active && ro->op_notifier &&
+                               (ro->op_notify || (ro->op_recverr && status))) {
+                                notifier = ro->op_notifier;
                                 list_add_tail(&notifier->n_list,
                                                 &rs->rs_notify_queue);
                                 if (!notifier->n_status)
                                         notifier->n_status = status;
-                                rm->m_rdma_op->r_notifier = NULL;
+                                rm->rdma.op_notifier = NULL;
                         }
                         was_on_sock = 1;
                         rm->m_rs = NULL;
@@ -619,9 +669,8 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
 {
         struct rds_message *rm, *tmp;
         struct rds_connection *conn;
-        unsigned long flags, flags2;
+        unsigned long flags;
         LIST_HEAD(list);
-        int wake = 0;
 
         /* get all the messages we're dropping under the rs lock */
         spin_lock_irqsave(&rs->rs_lock, flags);
@@ -631,59 +680,54 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
                              dest->sin_port != rm->m_inc.i_hdr.h_dport))
                         continue;
 
-                wake = 1;
                 list_move(&rm->m_sock_item, &list);
                 rds_send_sndbuf_remove(rs, rm);
                 clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags);
         }
 
         /* order flag updates with the rs lock */
-        if (wake)
-                smp_mb__after_clear_bit();
+        smp_mb__after_clear_bit();
 
         spin_unlock_irqrestore(&rs->rs_lock, flags);
 
-        conn = NULL;
+        if (list_empty(&list))
+                return;
 
-        /* now remove the messages from the conn list as needed */
+        /* Remove the messages from the conn */
         list_for_each_entry(rm, &list, m_sock_item) {
-                /* We do this here rather than in the loop above, so that
-                 * we don't have to nest m_rs_lock under rs->rs_lock */
-                spin_lock_irqsave(&rm->m_rs_lock, flags2);
-                /* If this is a RDMA operation, notify the app. */
-                spin_lock(&rs->rs_lock);
-                __rds_rdma_send_complete(rs, rm, RDS_RDMA_CANCELED);
-                spin_unlock(&rs->rs_lock);
-                rm->m_rs = NULL;
-                spin_unlock_irqrestore(&rm->m_rs_lock, flags2);
 
+                conn = rm->m_inc.i_conn;
+
+                spin_lock_irqsave(&conn->c_lock, flags);
                 /*
-                 * If we see this flag cleared then we're *sure* that someone
-                 * else beat us to removing it from the conn.  If we race
-                 * with their flag update we'll get the lock and then really
-                 * see that the flag has been cleared.
+                 * Maybe someone else beat us to removing rm from the conn.
+                 * If we race with their flag update we'll get the lock and
+                 * then really see that the flag has been cleared.
                  */
-                if (!test_bit(RDS_MSG_ON_CONN, &rm->m_flags))
+                if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
+                        spin_unlock_irqrestore(&conn->c_lock, flags);
                         continue;
-
-                if (conn != rm->m_inc.i_conn) {
-                        if (conn)
-                                spin_unlock_irqrestore(&conn->c_lock, flags);
-                        conn = rm->m_inc.i_conn;
-                        spin_lock_irqsave(&conn->c_lock, flags);
                 }
+                list_del_init(&rm->m_conn_item);
+                spin_unlock_irqrestore(&conn->c_lock, flags);
 
-                if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
-                        list_del_init(&rm->m_conn_item);
-                        rds_message_put(rm);
-                }
-        }
+                /*
+                 * Couldn't grab m_rs_lock in top loop (lock ordering),
+                 * but we can now.
+                 */
+                spin_lock_irqsave(&rm->m_rs_lock, flags);
 
-        if (conn)
-                spin_unlock_irqrestore(&conn->c_lock, flags);
+                spin_lock(&rs->rs_lock);
+                __rds_send_complete(rs, rm, RDS_RDMA_CANCELED);
+                spin_unlock(&rs->rs_lock);
 
-        if (wake)
-                rds_wake_sk_sleep(rs);
+                rm->m_rs = NULL;
+                spin_unlock_irqrestore(&rm->m_rs_lock, flags);
+
+                rds_message_put(rm);
+        }
+
+        rds_wake_sk_sleep(rs);
 
         while (!list_empty(&list)) {
                 rm = list_entry(list.next, struct rds_message, m_sock_item);
@@ -763,6 +807,63 @@ out:
         return *queued;
 }
 
+/*
+ * rds_message is getting to be quite complicated, and we'd like to allocate
+ * it all in one go. This figures out how big it needs to be up front.
+ */
+static int rds_rm_size(struct msghdr *msg, int data_len)
+{
+        struct cmsghdr *cmsg;
+        int size = 0;
+        int cmsg_groups = 0;
+        int retval;
+
+        for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+                if (!CMSG_OK(msg, cmsg))
+                        return -EINVAL;
+
+                if (cmsg->cmsg_level != SOL_RDS)
+                        continue;
+
+                switch (cmsg->cmsg_type) {
+                case RDS_CMSG_RDMA_ARGS:
+                        cmsg_groups |= 1;
+                        retval = rds_rdma_extra_size(CMSG_DATA(cmsg));
+                        if (retval < 0)
+                                return retval;
+                        size += retval;
+
+                        break;
+
+                case RDS_CMSG_RDMA_DEST:
+                case RDS_CMSG_RDMA_MAP:
+                        cmsg_groups |= 2;
+                        /* these are valid but do no add any size */
+                        break;
+
+                case RDS_CMSG_ATOMIC_CSWP:
+                case RDS_CMSG_ATOMIC_FADD:
+                case RDS_CMSG_MASKED_ATOMIC_CSWP:
+                case RDS_CMSG_MASKED_ATOMIC_FADD:
+                        cmsg_groups |= 1;
+                        size += sizeof(struct scatterlist);
+                        break;
+
+                default:
+                        return -EINVAL;
+                }
+
+        }
+
+        size += ceil(data_len, PAGE_SIZE) * sizeof(struct scatterlist);
+
+        /* Ensure (DEST, MAP) are never used with (ARGS, ATOMIC) */
+        if (cmsg_groups == 3)
+                return -EINVAL;
+
+        return size;
+}
+
 static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
                          struct msghdr *msg, int *allocated_mr)
 {
@@ -777,7 +878,7 @@ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
                         continue;
 
                 /* As a side effect, RDMA_DEST and RDMA_MAP will set
-                 * rm->m_rdma_cookie and rm->m_rdma_mr.
+                 * rm->rdma.m_rdma_cookie and rm->rdma.m_rdma_mr.
                  */
                 switch (cmsg->cmsg_type) {
                 case RDS_CMSG_RDMA_ARGS:
@@ -793,6 +894,12 @@ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
                         if (!ret)
                                 *allocated_mr = 1;
                         break;
+                case RDS_CMSG_ATOMIC_CSWP:
+                case RDS_CMSG_ATOMIC_FADD:
+                case RDS_CMSG_MASKED_ATOMIC_CSWP:
+                case RDS_CMSG_MASKED_ATOMIC_FADD:
+                        ret = rds_cmsg_atomic(rs, rm, cmsg);
+                        break;
 
                 default:
                         return -EINVAL;
@@ -850,13 +957,26 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 goto out;
         }
 
-        rm = rds_message_copy_from_user(msg->msg_iov, payload_len);
-        if (IS_ERR(rm)) {
-                ret = PTR_ERR(rm);
-                rm = NULL;
+        /* size of rm including all sgs */
+        ret = rds_rm_size(msg, payload_len);
+        if (ret < 0)
+                goto out;
+
+        rm = rds_message_alloc(ret, GFP_KERNEL);
+        if (!rm) {
+                ret = -ENOMEM;
                 goto out;
         }
 
+        /* Attach data to the rm */
+        if (payload_len) {
+                rm->data.op_sg = rds_message_alloc_sgs(rm, ceil(payload_len, PAGE_SIZE));
+                ret = rds_message_copy_from_user(rm, msg->msg_iov, payload_len);
+                if (ret)
+                        goto out;
+        }
+        rm->data.op_active = 1;
+
         rm->m_daddr = daddr;
 
         /* rds_conn_create has a spinlock that runs with IRQ off.
@@ -879,22 +999,23 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (ret)
                 goto out;
 
-        if ((rm->m_rdma_cookie || rm->m_rdma_op) &&
-            conn->c_trans->xmit_rdma == NULL) {
+        if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) {
                 if (printk_ratelimit())
                         printk(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
-                                rm->m_rdma_op, conn->c_trans->xmit_rdma);
+                               &rm->rdma, conn->c_trans->xmit_rdma);
                 ret = -EOPNOTSUPP;
                 goto out;
         }
 
-        /* If the connection is down, trigger a connect. We may
-         * have scheduled a delayed reconnect however - in this case
-         * we should not interfere.
-         */
-        if (rds_conn_state(conn) == RDS_CONN_DOWN &&
-            !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
-                queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
+        if (rm->atomic.op_active && !conn->c_trans->xmit_atomic) {
+                if (printk_ratelimit())
+                        printk(KERN_NOTICE "atomic_op %p conn xmit_atomic %p\n",
+                               &rm->atomic, conn->c_trans->xmit_atomic);
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        rds_conn_connect_if_down(conn);
 
         ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
         if (ret) {
@@ -938,7 +1059,7 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         rds_stats_inc(s_send_queued);
 
         if (!test_bit(RDS_LL_SEND_FULL, &conn->c_flags))
-                rds_send_worker(&conn->c_send_w.work);
+                rds_send_xmit(conn);
 
         rds_message_put(rm);
         return payload_len;
@@ -966,20 +1087,15 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
         int ret = 0;
 
         rm = rds_message_alloc(0, GFP_ATOMIC);
-        if (rm == NULL) {
+        if (!rm) {
                 ret = -ENOMEM;
                 goto out;
         }
 
         rm->m_daddr = conn->c_faddr;
+        rm->data.op_active = 1;
 
-        /* If the connection is down, trigger a connect. We may
-         * have scheduled a delayed reconnect however - in this case
-         * we should not interfere.
-         */
-        if (rds_conn_state(conn) == RDS_CONN_DOWN &&
-            !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
-                queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
+        rds_conn_connect_if_down(conn);
 
         ret = rds_cong_wait(conn->c_fcong, dport, 1, NULL);
         if (ret)
@@ -999,7 +1115,9 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
         rds_stats_inc(s_send_queued);
         rds_stats_inc(s_send_pong);
 
-        queue_delayed_work(rds_wq, &conn->c_send_w, 0);
+        if (!test_bit(RDS_LL_SEND_FULL, &conn->c_flags))
+                rds_send_xmit(conn);
+
         rds_message_put(rm);
         return 0;
 
diff --git a/net/rds/stats.c b/net/rds/stats.c
index 7598eb07cfb1..10c759ccac0c 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -57,8 +57,8 @@ static const char *const rds_stat_names[] = {
         "recv_ping",
         "send_queue_empty",
         "send_queue_full",
-        "send_sem_contention",
-        "send_sem_queue_raced",
+        "send_lock_contention",
+        "send_lock_queue_raced",
         "send_immediate_retry",
         "send_delayed_retry",
         "send_drop_acked",
@@ -143,7 +143,7 @@ void rds_stats_exit(void)
         rds_info_deregister_func(RDS_INFO_COUNTERS, rds_stats_info);
 }
 
-int __init rds_stats_init(void)
+int rds_stats_init(void)
 {
         rds_info_register_func(RDS_INFO_COUNTERS, rds_stats_info);
         return 0;
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 7829a20325d3..25ad0c77a26c 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -105,13 +105,13 @@ void rds_sysctl_exit(void)
                 unregister_sysctl_table(rds_sysctl_reg_table);
 }
 
-int __init rds_sysctl_init(void)
+int rds_sysctl_init(void)
 {
         rds_sysctl_reconnect_min = msecs_to_jiffies(1);
         rds_sysctl_reconnect_min_jiffies = rds_sysctl_reconnect_min;
 
         rds_sysctl_reg_table = register_sysctl_paths(rds_sysctl_path, rds_sysctl_rds_table);
-        if (rds_sysctl_reg_table == NULL)
+        if (!rds_sysctl_reg_table)
                 return -ENOMEM;
         return 0;
 }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index babf4577ff7d..eeb08e6ab96b 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -200,7 +200,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         struct rds_tcp_connection *tc;
 
         tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
-        if (tc == NULL)
+        if (!tc)
                 return -ENOMEM;
 
         tc->t_sock = NULL;
@@ -258,7 +258,6 @@ struct rds_transport rds_tcp_transport = {
         .laddr_check            = rds_tcp_laddr_check,
         .xmit_prepare           = rds_tcp_xmit_prepare,
         .xmit_complete          = rds_tcp_xmit_complete,
-        .xmit_cong_map          = rds_tcp_xmit_cong_map,
         .xmit                   = rds_tcp_xmit,
         .recv                   = rds_tcp_recv,
         .conn_alloc             = rds_tcp_conn_alloc,
@@ -266,7 +265,6 @@ struct rds_transport rds_tcp_transport = {
         .conn_connect           = rds_tcp_conn_connect,
         .conn_shutdown          = rds_tcp_conn_shutdown,
         .inc_copy_to_user       = rds_tcp_inc_copy_to_user,
-        .inc_purge              = rds_tcp_inc_purge,
         .inc_free               = rds_tcp_inc_free,
         .stats_info_copy        = rds_tcp_stats_info_copy,
         .exit                   = rds_tcp_exit,
@@ -276,14 +274,14 @@ struct rds_transport rds_tcp_transport = {
         .t_prefer_loopback      = 1,
 };
 
-int __init rds_tcp_init(void)
+int rds_tcp_init(void)
 {
         int ret;
 
         rds_tcp_conn_slab = kmem_cache_create("rds_tcp_connection",
                                               sizeof(struct rds_tcp_connection),
                                               0, 0, NULL);
-        if (rds_tcp_conn_slab == NULL) {
+        if (!rds_tcp_conn_slab) {
                 ret = -ENOMEM;
                 goto out;
         }
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 844fa6b9cf5a..f5e6f7bebb50 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -43,7 +43,7 @@ struct rds_tcp_statistics {
 };
 
 /* tcp.c */
-int __init rds_tcp_init(void);
+int rds_tcp_init(void);
 void rds_tcp_exit(void);
 void rds_tcp_tune(struct socket *sock);
 void rds_tcp_nonagle(struct socket *sock);
@@ -61,16 +61,15 @@ void rds_tcp_conn_shutdown(struct rds_connection *conn);
 void rds_tcp_state_change(struct sock *sk);
 
 /* tcp_listen.c */
-int __init rds_tcp_listen_init(void);
+int rds_tcp_listen_init(void);
 void rds_tcp_listen_stop(void);
 void rds_tcp_listen_data_ready(struct sock *sk, int bytes);
 
 /* tcp_recv.c */
-int __init rds_tcp_recv_init(void);
+int rds_tcp_recv_init(void);
 void rds_tcp_recv_exit(void);
 void rds_tcp_data_ready(struct sock *sk, int bytes);
 int rds_tcp_recv(struct rds_connection *conn);
-void rds_tcp_inc_purge(struct rds_incoming *inc);
 void rds_tcp_inc_free(struct rds_incoming *inc);
 int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
                              size_t size);
@@ -81,8 +80,6 @@ void rds_tcp_xmit_complete(struct rds_connection *conn);
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                  unsigned int hdr_off, unsigned int sg, unsigned int off);
 void rds_tcp_write_space(struct sock *sk);
-int rds_tcp_xmit_cong_map(struct rds_connection *conn,
-                          struct rds_cong_map *map, unsigned long offset);
 
 /* tcp_stats.c */
 DECLARE_PER_CPU(struct rds_tcp_statistics, rds_tcp_stats);
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index c519939e8da9..af95c8e058fc 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -45,7 +45,7 @@ void rds_tcp_state_change(struct sock *sk)
 
         read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
-        if (conn == NULL) {
+        if (!conn) {
                 state_change = sk->sk_state_change;
                 goto out;
         }
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 27844f231d10..8b5cc4aa8868 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -116,7 +116,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
 
         read_lock_bh(&sk->sk_callback_lock);
         ready = sk->sk_user_data;
-        if (ready == NULL) { /* check for teardown race */
+        if (!ready) { /* check for teardown race */
                 ready = sk->sk_data_ready;
                 goto out;
         }
@@ -135,7 +135,7 @@ out:
         ready(sk, bytes);
 }
 
-int __init rds_tcp_listen_init(void)
+int rds_tcp_listen_init(void)
 {
         struct sockaddr_in sin;
         struct socket *sock = NULL;
@@ -178,7 +178,7 @@ void rds_tcp_listen_stop(void)
         struct socket *sock = rds_tcp_listen_sock;
         struct sock *sk;
 
-        if (sock == NULL)
+        if (!sock)
                 return;
 
         sk = sock->sk;
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index e43797404102..67263fbee623 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -39,7 +39,7 @@
 
 static struct kmem_cache *rds_tcp_incoming_slab;
 
-void rds_tcp_inc_purge(struct rds_incoming *inc)
+static void rds_tcp_inc_purge(struct rds_incoming *inc)
 {
         struct rds_tcp_incoming *tinc;
         tinc = container_of(inc, struct rds_tcp_incoming, ti_inc);
@@ -190,10 +190,10 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
          * processing.
          */
         while (left) {
-                if (tinc == NULL) {
+                if (!tinc) {
                         tinc = kmem_cache_alloc(rds_tcp_incoming_slab,
                                                 arg->gfp);
-                        if (tinc == NULL) {
+                        if (!tinc) {
                                 desc->error = -ENOMEM;
                                 goto out;
                         }
@@ -229,7 +229,7 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
 
                 if (left && tc->t_tinc_data_rem) {
                         clone = skb_clone(skb, arg->gfp);
-                        if (clone == NULL) {
+                        if (!clone) {
                                 desc->error = -ENOMEM;
                                 goto out;
                         }
@@ -326,7 +326,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
 
         read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
-        if (conn == NULL) { /* check for teardown race */
+        if (!conn) { /* check for teardown race */
                 ready = sk->sk_data_ready;
                 goto out;
         }
@@ -342,12 +342,12 @@ out:
         ready(sk, bytes);
 }
 
-int __init rds_tcp_recv_init(void)
+int rds_tcp_recv_init(void)
 {
         rds_tcp_incoming_slab = kmem_cache_create("rds_tcp_incoming",
                                         sizeof(struct rds_tcp_incoming),
                                         0, 0, NULL);
-        if (rds_tcp_incoming_slab == NULL)
+        if (!rds_tcp_incoming_slab)
                 return -ENOMEM;
         return 0;
 }
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index 2f012a07d94d..aa16841afbdf 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -77,56 +77,6 @@ int rds_tcp_sendmsg(struct socket *sock, void *data, unsigned int len)
 }
 
 /* the core send_sem serializes this with other xmit and shutdown */
-int rds_tcp_xmit_cong_map(struct rds_connection *conn,
-                          struct rds_cong_map *map, unsigned long offset)
-{
-        static struct rds_header rds_tcp_map_header = {
-                .h_flags = RDS_FLAG_CONG_BITMAP,
-        };
-        struct rds_tcp_connection *tc = conn->c_transport_data;
-        unsigned long i;
-        int ret;
-        int copied = 0;
-
-        /* Some problem claims cpu_to_be32(constant) isn't a constant. */
-        rds_tcp_map_header.h_len = cpu_to_be32(RDS_CONG_MAP_BYTES);
-
-        if (offset < sizeof(struct rds_header)) {
-                ret = rds_tcp_sendmsg(tc->t_sock,
-                                      (void *)&rds_tcp_map_header + offset,
-                                      sizeof(struct rds_header) - offset);
-                if (ret <= 0)
-                        return ret;
-                offset += ret;
-                copied = ret;
-                if (offset < sizeof(struct rds_header))
-                        return ret;
-        }
-
-        offset -= sizeof(struct rds_header);
-        i = offset / PAGE_SIZE;
-        offset = offset % PAGE_SIZE;
-        BUG_ON(i >= RDS_CONG_MAP_PAGES);
-
-        do {
-                ret = tc->t_sock->ops->sendpage(tc->t_sock,
-                                        virt_to_page(map->m_page_addrs[i]),
-                                        offset, PAGE_SIZE - offset,
-                                        MSG_DONTWAIT);
-                if (ret <= 0)
-                        break;
-                copied += ret;
-                offset += ret;
-                if (offset == PAGE_SIZE) {
-                        offset = 0;
-                        i++;
-                }
-        } while (i < RDS_CONG_MAP_PAGES);
-
-        return copied ? copied : ret;
-}
-
-/* the core send_sem serializes this with other xmit and shutdown */
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                  unsigned int hdr_off, unsigned int sg, unsigned int off)
 {
@@ -166,21 +116,21 @@ int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                         goto out;
         }
 
-        while (sg < rm->m_nents) {
+        while (sg < rm->data.op_nents) {
                 ret = tc->t_sock->ops->sendpage(tc->t_sock,
-                                                sg_page(&rm->m_sg[sg]),
-                                                rm->m_sg[sg].offset + off,
-                                                rm->m_sg[sg].length - off,
+                                                sg_page(&rm->data.op_sg[sg]),
+                                                rm->data.op_sg[sg].offset + off,
+                                                rm->data.op_sg[sg].length - off,
                                                 MSG_DONTWAIT|MSG_NOSIGNAL);
-                rdsdebug("tcp sendpage %p:%u:%u ret %d\n", (void *)sg_page(&rm->m_sg[sg]),
-                         rm->m_sg[sg].offset + off, rm->m_sg[sg].length - off,
+                rdsdebug("tcp sendpage %p:%u:%u ret %d\n", (void *)sg_page(&rm->data.op_sg[sg]),
+                         rm->data.op_sg[sg].offset + off, rm->data.op_sg[sg].length - off,
                          ret);
                 if (ret <= 0)
                         break;
 
                 off += ret;
                 done += ret;
-                if (off == rm->m_sg[sg].length) {
+                if (off == rm->data.op_sg[sg].length) {
                         off = 0;
                         sg++;
                 }
@@ -226,7 +176,7 @@ void rds_tcp_write_space(struct sock *sk)
 
         read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
-        if (conn == NULL) {
+        if (!conn) {
                 write_space = sk->sk_write_space;
                 goto out;
         }
diff --git a/net/rds/threads.c b/net/rds/threads.c
index 786c20eaaf5e..0fd90f8c5f59 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -61,7 +61,7 @@
  *
  * Transition to state DISCONNECTING/DOWN:
  *  -   Inside the shutdown worker; synchronizes with xmit path
- *      through c_send_lock, and with connection management callbacks
+ *      through RDS_IN_XMIT, and with connection management callbacks
  *      via c_cm_lock.
  *
  *      For receive callbacks, we rely on the underlying transport
@@ -110,7 +110,7 @@ EXPORT_SYMBOL_GPL(rds_connect_complete);
  * We should *always* start with a random backoff; otherwise a broken connection
  * will always take several iterations to be re-established.
  */
-static void rds_queue_reconnect(struct rds_connection *conn)
+void rds_queue_reconnect(struct rds_connection *conn)
 {
         unsigned long rand;
 
@@ -156,58 +156,6 @@ void rds_connect_worker(struct work_struct *work)
         }
 }
 
-void rds_shutdown_worker(struct work_struct *work)
-{
-        struct rds_connection *conn = container_of(work, struct rds_connection, c_down_w);
-
-        /* shut it down unless it's down already */
-        if (!rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_DOWN)) {
-                /*
-                 * Quiesce the connection mgmt handlers before we start tearing
-                 * things down. We don't hold the mutex for the entire
-                 * duration of the shutdown operation, else we may be
-                 * deadlocking with the CM handler. Instead, the CM event
-                 * handler is supposed to check for state DISCONNECTING
-                 */
-                mutex_lock(&conn->c_cm_lock);
-                if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING) &&
-                    !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) {
-                        rds_conn_error(conn, "shutdown called in state %d\n",
-                                        atomic_read(&conn->c_state));
-                        mutex_unlock(&conn->c_cm_lock);
-                        return;
-                }
-                mutex_unlock(&conn->c_cm_lock);
-
-                mutex_lock(&conn->c_send_lock);
-                conn->c_trans->conn_shutdown(conn);
-                rds_conn_reset(conn);
-                mutex_unlock(&conn->c_send_lock);
-
-                if (!rds_conn_transition(conn, RDS_CONN_DISCONNECTING, RDS_CONN_DOWN)) {
-                        /* This can happen - eg when we're in the middle of tearing
-                         * down the connection, and someone unloads the rds module.
-                         * Quite reproduceable with loopback connections.
-                         * Mostly harmless.
-                         */
-                        rds_conn_error(conn,
-                                "%s: failed to transition to state DOWN, "
-                                "current state is %d\n",
-                                __func__,
-                                atomic_read(&conn->c_state));
-                        return;
-                }
-        }
-
-        /* Then reconnect if it's still live.
-         * The passive side of an IB loopback connection is never added
-         * to the conn hash, so we never trigger a reconnect on this
-         * conn - the reconnect is always triggered by the active peer. */
-        cancel_delayed_work(&conn->c_conn_w);
-        if (!hlist_unhashed(&conn->c_hash_node))
-                rds_queue_reconnect(conn);
-}
-
 void rds_send_worker(struct work_struct *work)
 {
         struct rds_connection *conn = container_of(work, struct rds_connection, c_send_w.work);
@@ -252,15 +200,22 @@ void rds_recv_worker(struct work_struct *work)
         }
 }
 
+void rds_shutdown_worker(struct work_struct *work)
+{
+        struct rds_connection *conn = container_of(work, struct rds_connection, c_down_w);
+
+        rds_conn_shutdown(conn);
+}
+
 void rds_threads_exit(void)
 {
         destroy_workqueue(rds_wq);
 }
 
-int __init rds_threads_init(void)
+int rds_threads_init(void)
 {
-        rds_wq = create_workqueue("krdsd");
-        if (rds_wq == NULL)
+        rds_wq = create_singlethread_workqueue("krdsd");
+        if (!rds_wq)
                 return -ENOMEM;
 
         return 0;
diff --git a/net/rds/transport.c b/net/rds/transport.c
index 7e1067901353..7f2ac4fec367 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -71,19 +71,28 @@ void rds_trans_unregister(struct rds_transport *trans)
 }
 EXPORT_SYMBOL_GPL(rds_trans_unregister);
 
+void rds_trans_put(struct rds_transport *trans)
+{
+        if (trans && trans->t_owner)
+                module_put(trans->t_owner);
+}
+
 struct rds_transport *rds_trans_get_preferred(__be32 addr)
 {
         struct rds_transport *ret = NULL;
-        int i;
+        struct rds_transport *trans;
+        unsigned int i;
 
         if (IN_LOOPBACK(ntohl(addr)))
                 return &rds_loop_transport;
 
         down_read(&rds_trans_sem);
-        for (i = 0; i < RDS_TRANS_COUNT; i++)
-        {
-                if (transports[i] && (transports[i]->laddr_check(addr) == 0)) {
-                        ret = transports[i];
+        for (i = 0; i < RDS_TRANS_COUNT; i++) {
+                trans = transports[i];
+
+                if (trans && (trans->laddr_check(addr) == 0) &&
+                    (!trans->t_owner || try_module_get(trans->t_owner))) {
+                        ret = trans;
                         break;
                 }
         }
diff --git a/net/rds/xlist.h b/net/rds/xlist.h
new file mode 100644
index 000000000000..e6b5190daddd
--- /dev/null
+++ b/net/rds/xlist.h
@@ -0,0 +1,80 @@
+#ifndef _LINUX_XLIST_H
+#define _LINUX_XLIST_H
+
+#include <linux/stddef.h>
+#include <linux/poison.h>
+#include <linux/prefetch.h>
+#include <asm/system.h>
+
+struct xlist_head {
+        struct xlist_head *next;
+};
+
+static inline void INIT_XLIST_HEAD(struct xlist_head *list)
+{
+        list->next = NULL;
+}
+
+static inline int xlist_empty(struct xlist_head *head)
+{
+        return head->next == NULL;
+}
+
+static inline void xlist_add(struct xlist_head *new, struct xlist_head *tail,
+                             struct xlist_head *head)
+{
+        struct xlist_head *cur;
+        struct xlist_head *check;
+
+        while (1) {
+                cur = head->next;
+                tail->next = cur;
+                check = cmpxchg(&head->next, cur, new);
+                if (check == cur)
+                        break;
+        }
+}
+
+static inline struct xlist_head *xlist_del_head(struct xlist_head *head)
+{
+        struct xlist_head *cur;
+        struct xlist_head *check;
+        struct xlist_head *next;
+
+        while (1) {
+                cur = head->next;
+                if (!cur)
+                        goto out;
+
+                next = cur->next;
+                check = cmpxchg(&head->next, cur, next);
+                if (check == cur)
+                        goto out;
+        }
+out:
+        return cur;
+}
+
+static inline struct xlist_head *xlist_del_head_fast(struct xlist_head *head)
+{
+        struct xlist_head *cur;
+
+        cur = head->next;
+        if (!cur)
+                return NULL;
+
+        head->next = cur->next;
+        return cur;
+}
+
+static inline void xlist_splice(struct xlist_head *list,
+                                struct xlist_head *head)
+{
+        struct xlist_head *cur;
+
+        WARN_ON(head->next);
+        cur = xchg(&list->next, NULL);
+        head->next = cur;
+}
+
+#endif
diff --git a/net/rfkill/input.c b/net/rfkill/input.c
index 3713d7ecab96..1bca6d49ec96 100644
--- a/net/rfkill/input.c
+++ b/net/rfkill/input.c
@@ -142,7 +142,7 @@ static unsigned long rfkill_last_scheduled;
 static unsigned long rfkill_ratelimit(const unsigned long last)
 {
         const unsigned long delay = msecs_to_jiffies(RFKILL_OPS_DELAY);
-        return (time_after(jiffies, last + delay)) ? 0 : delay;
+        return time_after(jiffies, last + delay) ? 0 : delay;
 }
 
 static void rfkill_schedule_ratelimited(void)
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index a750a28e0221..fa5f5641a2c2 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -114,7 +114,7 @@ static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
         if (ax25s)
                 ax25_cb_put(ax25s);
 
-        return (neigh->ax25 != NULL);
+        return neigh->ax25 != NULL;
 }
 
 /*
@@ -137,7 +137,7 @@ static int rose_link_up(struct rose_neigh *neigh)
         if (ax25s)
                 ax25_cb_put(ax25s);
 
-        return (neigh->ax25 != NULL);
+        return neigh->ax25 != NULL;
 }
 
 /*
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 2f691fb180d1..a36270a994d7 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -518,6 +518,16 @@ config NET_ACT_SKBEDIT
           To compile this code as a module, choose M here: the
           module will be called act_skbedit.
 
+config NET_ACT_CSUM
+        tristate "Checksum Updating"
+        depends on NET_CLS_ACT && INET
+        ---help---
+          Say Y here to update some common checksum after some direct
+          packet alterations.
+
+          To compile this code as a module, choose M here: the
+          module will be called act_csum.
+
 config NET_CLS_IND
         bool "Incoming device classification"
         depends on NET_CLS_U32 || NET_CLS_FW
diff --git a/net/sched/Makefile b/net/sched/Makefile
index f14e71bfa58f..960f5dba6304 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_NET_ACT_NAT)	+= act_nat.o
 obj-$(CONFIG_NET_ACT_PEDIT)     += act_pedit.o
 obj-$(CONFIG_NET_ACT_SIMP)      += act_simple.o
 obj-$(CONFIG_NET_ACT_SKBEDIT)   += act_skbedit.o
+obj-$(CONFIG_NET_ACT_CSUM)      += act_csum.o
 obj-$(CONFIG_NET_SCH_FIFO)      += sch_fifo.o
 obj-$(CONFIG_NET_SCH_CBQ)       += sch_cbq.o
 obj-$(CONFIG_NET_SCH_HTB)       += sch_htb.o
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
new file mode 100644
index 000000000000..67dc7ce9b63a
--- /dev/null
+++ b/net/sched/act_csum.c
@@ -0,0 +1,595 @@
+/*
+ * Checksum updating actions
+ *
+ * Copyright (c) 2010 Gregoire Baron <baronchon@n7mm.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+
+#include <linux/netlink.h>
+#include <net/netlink.h>
+#include <linux/rtnetlink.h>
+
+#include <linux/skbuff.h>
+
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/icmp.h>
+#include <linux/icmpv6.h>
+#include <linux/igmp.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+#include <net/ip6_checksum.h>
+
+#include <net/act_api.h>
+
+#include <linux/tc_act/tc_csum.h>
+#include <net/tc_act/tc_csum.h>
+
+#define CSUM_TAB_MASK 15
+static struct tcf_common *tcf_csum_ht[CSUM_TAB_MASK + 1];
+static u32 csum_idx_gen;
+static DEFINE_RWLOCK(csum_lock);
+
+static struct tcf_hashinfo csum_hash_info = {
+        .htab   = tcf_csum_ht,
+        .hmask  = CSUM_TAB_MASK,
+        .lock   = &csum_lock,
+};
+
+static const struct nla_policy csum_policy[TCA_CSUM_MAX + 1] = {
+        [TCA_CSUM_PARMS] = { .len = sizeof(struct tc_csum), },
+};
+
+static int tcf_csum_init(struct nlattr *nla, struct nlattr *est,
+                         struct tc_action *a, int ovr, int bind)
+{
+        struct nlattr *tb[TCA_CSUM_MAX + 1];
+        struct tc_csum *parm;
+        struct tcf_common *pc;
+        struct tcf_csum *p;
+        int ret = 0, err;
+
+        if (nla == NULL)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_CSUM_MAX, nla,csum_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[TCA_CSUM_PARMS] == NULL)
+                return -EINVAL;
+        parm = nla_data(tb[TCA_CSUM_PARMS]);
+
+        pc = tcf_hash_check(parm->index, a, bind, &csum_hash_info);
+        if (!pc) {
+                pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind,
+                                     &csum_idx_gen, &csum_hash_info);
+                if (IS_ERR(pc))
+                        return PTR_ERR(pc);
+                p = to_tcf_csum(pc);
+                ret = ACT_P_CREATED;
+        } else {
+                p = to_tcf_csum(pc);
+                if (!ovr) {
+                        tcf_hash_release(pc, bind, &csum_hash_info);
+                        return -EEXIST;
+                }
+        }
+
+        spin_lock_bh(&p->tcf_lock);
+        p->tcf_action = parm->action;
+        p->update_flags = parm->update_flags;
+        spin_unlock_bh(&p->tcf_lock);
+
+        if (ret == ACT_P_CREATED)
+                tcf_hash_insert(pc, &csum_hash_info);
+
+        return ret;
+}
+
+static int tcf_csum_cleanup(struct tc_action *a, int bind)
+{
+        struct tcf_csum *p = a->priv;
+        return tcf_hash_release(&p->common, bind, &csum_hash_info);
+}
+
+/**
+ * tcf_csum_skb_nextlayer - Get next layer pointer
+ * @skb: sk_buff to use
+ * @ihl: previous summed headers length
+ * @ipl: complete packet length
+ * @jhl: next header length
+ *
+ * Check the expected next layer availability in the specified sk_buff.
+ * Return the next layer pointer if pass, NULL otherwise.
+ */
+static void *tcf_csum_skb_nextlayer(struct sk_buff *skb,
+                                    unsigned int ihl, unsigned int ipl,
+                                    unsigned int jhl)
+{
+        int ntkoff = skb_network_offset(skb);
+        int hl = ihl + jhl;
+
+        if (!pskb_may_pull(skb, ipl + ntkoff) || (ipl < hl) ||
+            (skb_cloned(skb) &&
+             !skb_clone_writable(skb, hl + ntkoff) &&
+             pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+                return NULL;
+        else
+                return (void *)(skb_network_header(skb) + ihl);
+}
+
+static int tcf_csum_ipv4_icmp(struct sk_buff *skb,
+                              unsigned int ihl, unsigned int ipl)
+{
+        struct icmphdr *icmph;
+
+        icmph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*icmph));
+        if (icmph == NULL)
+                return 0;
+
+        icmph->checksum = 0;
+        skb->csum = csum_partial(icmph, ipl - ihl, 0);
+        icmph->checksum = csum_fold(skb->csum);
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return 1;
+}
+
+static int tcf_csum_ipv4_igmp(struct sk_buff *skb,
+                              unsigned int ihl, unsigned int ipl)
+{
+        struct igmphdr *igmph;
+
+        igmph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*igmph));
+        if (igmph == NULL)
+                return 0;
+
+        igmph->csum = 0;
+        skb->csum = csum_partial(igmph, ipl - ihl, 0);
+        igmph->csum = csum_fold(skb->csum);
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return 1;
+}
+
+static int tcf_csum_ipv6_icmp(struct sk_buff *skb, struct ipv6hdr *ip6h,
+                              unsigned int ihl, unsigned int ipl)
+{
+        struct icmp6hdr *icmp6h;
+
+        icmp6h = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*icmp6h));
+        if (icmp6h == NULL)
+                return 0;
+
+        icmp6h->icmp6_cksum = 0;
+        skb->csum = csum_partial(icmp6h, ipl - ihl, 0);
+        icmp6h->icmp6_cksum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                                              ipl - ihl, IPPROTO_ICMPV6,
+                                              skb->csum);
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return 1;
+}
+
+static int tcf_csum_ipv4_tcp(struct sk_buff *skb, struct iphdr *iph,
+                             unsigned int ihl, unsigned int ipl)
+{
+        struct tcphdr *tcph;
+
+        tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph));
+        if (tcph == NULL)
+                return 0;
+
+        tcph->check = 0;
+        skb->csum = csum_partial(tcph, ipl - ihl, 0);
+        tcph->check = tcp_v4_check(ipl - ihl,
+                                   iph->saddr, iph->daddr, skb->csum);
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return 1;
+}
+
+static int tcf_csum_ipv6_tcp(struct sk_buff *skb, struct ipv6hdr *ip6h,
+                             unsigned int ihl, unsigned int ipl)
+{
+        struct tcphdr *tcph;
+
+        tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph));
+        if (tcph == NULL)
+                return 0;
+
+        tcph->check = 0;
+        skb->csum = csum_partial(tcph, ipl - ihl, 0);
+        tcph->check = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                                      ipl - ihl, IPPROTO_TCP,
+                                      skb->csum);
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return 1;
+}
+
+static int tcf_csum_ipv4_udp(struct sk_buff *skb, struct iphdr *iph,
+                             unsigned int ihl, unsigned int ipl, int udplite)
+{
+        struct udphdr *udph;
+        u16 ul;
+
+        /*
+         * Support both UDP and UDPLITE checksum algorithms, Don't use
+         * udph->len to get the real length without any protocol check,
+         * UDPLITE uses udph->len for another thing,
+         * Use iph->tot_len, or just ipl.
+         */
+
+        udph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*udph));
+        if (udph == NULL)
+                return 0;
+
+        ul = ntohs(udph->len);
+
+        if (udplite || udph->check) {
+
+                udph->check = 0;
+
+                if (udplite) {
+                        if (ul == 0)
+                                skb->csum = csum_partial(udph, ipl - ihl, 0);
+                        else if ((ul >= sizeof(*udph)) && (ul <= ipl - ihl))
+                                skb->csum = csum_partial(udph, ul, 0);
+                        else
+                                goto ignore_obscure_skb;
+                } else {
+                        if (ul != ipl - ihl)
+                                goto ignore_obscure_skb;
+
+                        skb->csum = csum_partial(udph, ul, 0);
+                }
+
+                udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                ul, iph->protocol,
+                                                skb->csum);
+
+                if (!udph->check)
+                        udph->check = CSUM_MANGLED_0;
+        }
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+ignore_obscure_skb:
+        return 1;
+}
+
+static int tcf_csum_ipv6_udp(struct sk_buff *skb, struct ipv6hdr *ip6h,
+                             unsigned int ihl, unsigned int ipl, int udplite)
+{
+        struct udphdr *udph;
+        u16 ul;
+
+        /*
+         * Support both UDP and UDPLITE checksum algorithms, Don't use
+         * udph->len to get the real length without any protocol check,
+         * UDPLITE uses udph->len for another thing,
+         * Use ip6h->payload_len + sizeof(*ip6h) ... , or just ipl.
+         */
+
+        udph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*udph));
+        if (udph == NULL)
+                return 0;
+
+        ul = ntohs(udph->len);
+
+        udph->check = 0;
+
+        if (udplite) {
+                if (ul == 0)
+                        skb->csum = csum_partial(udph, ipl - ihl, 0);
+
+                else if ((ul >= sizeof(*udph)) && (ul <= ipl - ihl))
+                        skb->csum = csum_partial(udph, ul, 0);
+
+                else
+                        goto ignore_obscure_skb;
+        } else {
+                if (ul != ipl - ihl)
+                        goto ignore_obscure_skb;
+
+                skb->csum = csum_partial(udph, ul, 0);
+        }
+
+        udph->check = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, ul,
+                                      udplite ? IPPROTO_UDPLITE : IPPROTO_UDP,
+                                      skb->csum);
+
+        if (!udph->check)
+                udph->check = CSUM_MANGLED_0;
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+ignore_obscure_skb:
+        return 1;
+}
+
+static int tcf_csum_ipv4(struct sk_buff *skb, u32 update_flags)
+{
+        struct iphdr *iph;
+        int ntkoff;
+
+        ntkoff = skb_network_offset(skb);
+
+        if (!pskb_may_pull(skb, sizeof(*iph) + ntkoff))
+                goto fail;
+
+        iph = ip_hdr(skb);
+
+        switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
+        case IPPROTO_ICMP:
+                if (update_flags & TCA_CSUM_UPDATE_FLAG_ICMP)
+                        if (!tcf_csum_ipv4_icmp(skb, iph->ihl * 4,
+                                                ntohs(iph->tot_len)))
+                                goto fail;
+                break;
+        case IPPROTO_IGMP:
+                if (update_flags & TCA_CSUM_UPDATE_FLAG_IGMP)
+                        if (!tcf_csum_ipv4_igmp(skb, iph->ihl * 4,
+                                                ntohs(iph->tot_len)))
+                                goto fail;
+                break;
+        case IPPROTO_TCP:
+                if (update_flags & TCA_CSUM_UPDATE_FLAG_TCP)
+                        if (!tcf_csum_ipv4_tcp(skb, iph, iph->ihl * 4,
+                                               ntohs(iph->tot_len)))
+                                goto fail;
+                break;
+        case IPPROTO_UDP:
+                if (update_flags & TCA_CSUM_UPDATE_FLAG_UDP)
+                        if (!tcf_csum_ipv4_udp(skb, iph, iph->ihl * 4,
+                                               ntohs(iph->tot_len), 0))
+                                goto fail;
+                break;
+        case IPPROTO_UDPLITE:
+                if (update_flags & TCA_CSUM_UPDATE_FLAG_UDPLITE)
+                        if (!tcf_csum_ipv4_udp(skb, iph, iph->ihl * 4,
+                                               ntohs(iph->tot_len), 1))
+                                goto fail;
+                break;
+        }
+
+        if (update_flags & TCA_CSUM_UPDATE_FLAG_IPV4HDR) {
+                if (skb_cloned(skb) &&
+                    !skb_clone_writable(skb, sizeof(*iph) + ntkoff) &&
+                    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+                        goto fail;
+
+                ip_send_check(iph);
+        }
+
+        return 1;
+
+fail:
+        return 0;
+}
+
+static int tcf_csum_ipv6_hopopts(struct ipv6_opt_hdr *ip6xh,
+                                 unsigned int ixhl, unsigned int *pl)
+{
+        int off, len, optlen;
+        unsigned char *xh = (void *)ip6xh;
+
+        off = sizeof(*ip6xh);
+        len = ixhl - off;
+
+        while (len > 1) {
+                switch (xh[off]) {
+                case IPV6_TLV_PAD0:
+                        optlen = 1;
+                        break;
+                case IPV6_TLV_JUMBO:
+                        optlen = xh[off + 1] + 2;
+                        if (optlen != 6 || len < 6 || (off & 3) != 2)
+                                /* wrong jumbo option length/alignment */
+                                return 0;
+                        *pl = ntohl(*(__be32 *)(xh + off + 2));
+                        goto done;
+                default:
+                        optlen = xh[off + 1] + 2;
+                        if (optlen > len)
+                                /* ignore obscure options */
+                                goto done;
+                        break;
+                }
+                off += optlen;
+                len -= optlen;
+        }
+
+done:
+        return 1;
+}
+
+static int tcf_csum_ipv6(struct sk_buff *skb, u32 update_flags)
+{
+        struct ipv6hdr *ip6h;
+        struct ipv6_opt_hdr *ip6xh;
+        unsigned int hl, ixhl;
+        unsigned int pl;
+        int ntkoff;
+        u8 nexthdr;
+
+        ntkoff = skb_network_offset(skb);
+
+        hl = sizeof(*ip6h);
+
+        if (!pskb_may_pull(skb, hl + ntkoff))
+                goto fail;
+
+        ip6h = ipv6_hdr(skb);
+
+        pl = ntohs(ip6h->payload_len);
+        nexthdr = ip6h->nexthdr;
+
+        do {
+                switch (nexthdr) {
+                case NEXTHDR_FRAGMENT:
+                        goto ignore_skb;
+                case NEXTHDR_ROUTING:
+                case NEXTHDR_HOP:
+                case NEXTHDR_DEST:
+                        if (!pskb_may_pull(skb, hl + sizeof(*ip6xh) + ntkoff))
+                                goto fail;
+                        ip6xh = (void *)(skb_network_header(skb) + hl);
+                        ixhl = ipv6_optlen(ip6xh);
+                        if (!pskb_may_pull(skb, hl + ixhl + ntkoff))
+                                goto fail;
+                        if ((nexthdr == NEXTHDR_HOP) &&
+                            !(tcf_csum_ipv6_hopopts(ip6xh, ixhl, &pl)))
+                                goto fail;
+                        nexthdr = ip6xh->nexthdr;
+                        hl += ixhl;
+                        break;
+                case IPPROTO_ICMPV6:
+                        if (update_flags & TCA_CSUM_UPDATE_FLAG_ICMP)
+                                if (!tcf_csum_ipv6_icmp(skb, ip6h,
+                                                        hl, pl + sizeof(*ip6h)))
+                                        goto fail;
+                        goto done;
+                case IPPROTO_TCP:
+                        if (update_flags & TCA_CSUM_UPDATE_FLAG_TCP)
+                                if (!tcf_csum_ipv6_tcp(skb, ip6h,
+                                                       hl, pl + sizeof(*ip6h)))
+                                        goto fail;
+                        goto done;
+                case IPPROTO_UDP:
+                        if (update_flags & TCA_CSUM_UPDATE_FLAG_UDP)
+                                if (!tcf_csum_ipv6_udp(skb, ip6h, hl,
+                                                       pl + sizeof(*ip6h), 0))
+                                        goto fail;
+                        goto done;
+                case IPPROTO_UDPLITE:
+                        if (update_flags & TCA_CSUM_UPDATE_FLAG_UDPLITE)
+                                if (!tcf_csum_ipv6_udp(skb, ip6h, hl,
+                                                       pl + sizeof(*ip6h), 1))
+                                        goto fail;
+                        goto done;
+                default:
+                        goto ignore_skb;
+                }
+        } while (pskb_may_pull(skb, hl + 1 + ntkoff));
+
+done:
+ignore_skb:
+        return 1;
+
+fail:
+        return 0;
+}
+
+static int tcf_csum(struct sk_buff *skb,
+                    struct tc_action *a, struct tcf_result *res)
+{
+        struct tcf_csum *p = a->priv;
+        int action;
+        u32 update_flags;
+
+        spin_lock(&p->tcf_lock);
+        p->tcf_tm.lastuse = jiffies;
+        p->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        p->tcf_bstats.packets++;
+        action = p->tcf_action;
+        update_flags = p->update_flags;
+        spin_unlock(&p->tcf_lock);
+
+        if (unlikely(action == TC_ACT_SHOT))
+                goto drop;
+
+        switch (skb->protocol) {
+        case cpu_to_be16(ETH_P_IP):
+                if (!tcf_csum_ipv4(skb, update_flags))
+                        goto drop;
+                break;
+        case cpu_to_be16(ETH_P_IPV6):
+                if (!tcf_csum_ipv6(skb, update_flags))
+                        goto drop;
+                break;
+        }
+
+        return action;
+
+drop:
+        spin_lock(&p->tcf_lock);
+        p->tcf_qstats.drops++;
+        spin_unlock(&p->tcf_lock);
+        return TC_ACT_SHOT;
+}
+
+static int tcf_csum_dump(struct sk_buff *skb,
+                         struct tc_action *a, int bind, int ref)
+{
+        unsigned char *b = skb_tail_pointer(skb);
+        struct tcf_csum *p = a->priv;
+        struct tc_csum opt = {
+                .update_flags = p->update_flags,
+                .index   = p->tcf_index,
+                .action  = p->tcf_action,
+                .refcnt  = p->tcf_refcnt - ref,
+                .bindcnt = p->tcf_bindcnt - bind,
+        };
+        struct tcf_t t;
+
+        NLA_PUT(skb, TCA_CSUM_PARMS, sizeof(opt), &opt);
+        t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
+        t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
+        t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
+        NLA_PUT(skb, TCA_CSUM_TM, sizeof(t), &t);
+
+        return skb->len;
+
+nla_put_failure:
+        nlmsg_trim(skb, b);
+        return -1;
+}
+
+static struct tc_action_ops act_csum_ops = {
+        .kind           = "csum",
+        .hinfo          = &csum_hash_info,
+        .type           = TCA_ACT_CSUM,
+        .capab          = TCA_CAP_NONE,
+        .owner          = THIS_MODULE,
+        .act            = tcf_csum,
+        .dump           = tcf_csum_dump,
+        .cleanup        = tcf_csum_cleanup,
+        .lookup         = tcf_hash_search,
+        .init           = tcf_csum_init,
+        .walk           = tcf_generic_walker
+};
+
+MODULE_DESCRIPTION("Checksum updating actions");
+MODULE_LICENSE("GPL");
+
+static int __init csum_init_module(void)
+{
+        return tcf_register_action(&act_csum_ops);
+}
+
+static void __exit csum_cleanup_module(void)
+{
+        tcf_unregister_action(&act_csum_ops);
+}
+
+module_init(csum_init_module);
+module_exit(csum_cleanup_module);
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index e17096e3913c..5b271a18bc3a 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -111,44 +111,41 @@ static u32 flow_get_proto(struct sk_buff *skb)
         }
 }
 
-static int has_ports(u8 protocol)
-{
-        switch (protocol) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE:
-        case IPPROTO_SCTP:
-        case IPPROTO_DCCP:
-        case IPPROTO_ESP:
-                return 1;
-        default:
-                return 0;
-        }
-}
-
 static u32 flow_get_proto_src(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP): {
                 struct iphdr *iph;
+                int poff;
 
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ip_hdr(skb);
-                if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
-                    has_ports(iph->protocol) &&
-                    pskb_network_may_pull(skb, iph->ihl * 4 + 2))
-                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
+                if (iph->frag_off & htons(IP_MF|IP_OFFSET))
+                        break;
+                poff = proto_ports_offset(iph->protocol);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, iph->ihl * 4 + 2 + poff)) {
+                        iph = ip_hdr(skb);
+                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 +
+                                                 poff));
+                }
                 break;
         }
         case htons(ETH_P_IPV6): {
                 struct ipv6hdr *iph;
+                int poff;
 
-                if (!pskb_network_may_pull(skb, sizeof(*iph) + 2))
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ipv6_hdr(skb);
-                if (has_ports(iph->nexthdr))
-                        return ntohs(*(__be16 *)&iph[1]);
+                poff = proto_ports_offset(iph->nexthdr);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, sizeof(*iph) + poff + 2)) {
+                        iph = ipv6_hdr(skb);
+                        return ntohs(*(__be16 *)((void *)iph + sizeof(*iph) +
+                                                 poff));
+                }
                 break;
         }
         }
@@ -161,24 +158,36 @@ static u32 flow_get_proto_dst(struct sk_buff *skb)
         switch (skb->protocol) {
         case htons(ETH_P_IP): {
                 struct iphdr *iph;
+                int poff;
 
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ip_hdr(skb);
-                if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
-                    has_ports(iph->protocol) &&
-                    pskb_network_may_pull(skb, iph->ihl * 4 + 4))
-                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
+                if (iph->frag_off & htons(IP_MF|IP_OFFSET))
+                        break;
+                poff = proto_ports_offset(iph->protocol);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, iph->ihl * 4 + 4 + poff)) {
+                        iph = ip_hdr(skb);
+                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 +
+                                                 2 + poff));
+                }
                 break;
         }
         case htons(ETH_P_IPV6): {
                 struct ipv6hdr *iph;
+                int poff;
 
-                if (!pskb_network_may_pull(skb, sizeof(*iph) + 4))
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ipv6_hdr(skb);
-                if (has_ports(iph->nexthdr))
-                        return ntohs(*(__be16 *)((void *)&iph[1] + 2));
+                poff = proto_ports_offset(iph->nexthdr);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, sizeof(*iph) + poff + 4)) {
+                        iph = ipv6_hdr(skb);
+                        return ntohs(*(__be16 *)((void *)iph + sizeof(*iph) +
+                                                 poff + 2));
+                }
                 break;
         }
         }
@@ -297,6 +306,11 @@ static u32 flow_get_vlan_tag(const struct sk_buff *skb)
         return tag & VLAN_VID_MASK;
 }
 
+static u32 flow_get_rxhash(struct sk_buff *skb)
+{
+        return skb_get_rxhash(skb);
+}
+
 static u32 flow_key_get(struct sk_buff *skb, int key)
 {
         switch (key) {
@@ -334,6 +348,8 @@ static u32 flow_key_get(struct sk_buff *skb, int key)
                 return flow_get_skgid(skb);
         case FLOW_KEY_VLAN_TAG:
                 return flow_get_vlan_tag(skb);
+        case FLOW_KEY_RXHASH:
+                return flow_get_rxhash(skb);
         default:
                 WARN_ON(1);
                 return 0;
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 3bcac8aa333c..34da5e29ea1a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -223,6 +223,11 @@ META_COLLECTOR(int_maclen)
         dst->value = skb->mac_len;
 }
 
+META_COLLECTOR(int_rxhash)
+{
+        dst->value = skb_get_rxhash(skb);
+}
+
 /**************************************************************************
  * Netfilter
  **************************************************************************/
@@ -541,6 +546,7 @@ static struct meta_ops __meta_ops[TCF_META_TYPE_MAX+1][TCF_META_ID_MAX+1] = {
                 [META_ID(SK_SENDMSG_OFF)]       = META_FUNC(int_sk_sendmsg_off),
                 [META_ID(SK_WRITE_PENDING)]     = META_FUNC(int_sk_write_pend),
                 [META_ID(VLAN_TAG)]             = META_FUNC(int_vlan_tag),
+                [META_ID(RXHASH)]               = META_FUNC(int_rxhash),
         }
 };
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 408eea7086aa..6fb3d41c0e41 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -360,7 +360,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
                 tsize = nla_len(tb[TCA_STAB_DATA]) / sizeof(u16);
         }
 
-        if (!s || tsize != s->tsize || (!tab && tsize > 0))
+        if (tsize != s->tsize || (!tab && tsize > 0))
                 return ERR_PTR(-EINVAL);
 
         spin_lock(&qdisc_stab_lock);
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 201cbac2b32c..3cf478d012dd 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -123,40 +123,39 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         case htons(ETH_P_IP):
         {
                 const struct iphdr *iph;
+                int poff;
 
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         goto err;
                 iph = ip_hdr(skb);
                 h = (__force u32)iph->daddr;
                 h2 = (__force u32)iph->saddr ^ iph->protocol;
-                if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
-                    (iph->protocol == IPPROTO_TCP ||
-                     iph->protocol == IPPROTO_UDP ||
-                     iph->protocol == IPPROTO_UDPLITE ||
-                     iph->protocol == IPPROTO_SCTP ||
-                     iph->protocol == IPPROTO_DCCP ||
-                     iph->protocol == IPPROTO_ESP) &&
-                     pskb_network_may_pull(skb, iph->ihl * 4 + 4))
-                        h2 ^= *(((u32*)iph) + iph->ihl);
+                if (iph->frag_off & htons(IP_MF|IP_OFFSET))
+                        break;
+                poff = proto_ports_offset(iph->protocol);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, iph->ihl * 4 + 4 + poff)) {
+                        iph = ip_hdr(skb);
+                        h2 ^= *(u32*)((void *)iph + iph->ihl * 4 + poff);
+                }
                 break;
         }
         case htons(ETH_P_IPV6):
         {
                 struct ipv6hdr *iph;
+                int poff;
 
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         goto err;
                 iph = ipv6_hdr(skb);
                 h = (__force u32)iph->daddr.s6_addr32[3];
                 h2 = (__force u32)iph->saddr.s6_addr32[3] ^ iph->nexthdr;
-                if ((iph->nexthdr == IPPROTO_TCP ||
-                     iph->nexthdr == IPPROTO_UDP ||
-                     iph->nexthdr == IPPROTO_UDPLITE ||
-                     iph->nexthdr == IPPROTO_SCTP ||
-                     iph->nexthdr == IPPROTO_DCCP ||
-                     iph->nexthdr == IPPROTO_ESP) &&
-                    pskb_network_may_pull(skb, sizeof(*iph) + 4))
-                        h2 ^= *(u32*)&iph[1];
+                poff = proto_ports_offset(iph->nexthdr);
+                if (poff >= 0 &&
+                    pskb_network_may_pull(skb, sizeof(*iph) + 4 + poff)) {
+                        iph = ipv6_hdr(skb);
+                        h2 ^= *(u32*)((void *)iph + sizeof(*iph) + poff);
+                }
                 break;
         }
         default:
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 0b85e5256434..5f1fb8bd862d 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -48,6 +48,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/poll.h>
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 476caaf100ed..6c8556459a75 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -37,6 +37,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/net.h>
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index ccb6dc48d15b..397296fb156f 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -43,6 +43,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 #include <linux/interrupt.h>
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 732689140fb8..95e0c8eda1a0 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -47,6 +47,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -336,7 +338,7 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
                 memcpy(saddr, baddr, sizeof(union sctp_addr));
                 SCTP_DEBUG_PRINTK("saddr: %pI6\n", &saddr->v6.sin6_addr);
         } else {
-                printk(KERN_ERR "%s: asoc:%p Could not find a valid source "
+                pr_err("%s: asoc:%p Could not find a valid source "
                        "address for the dest:%pI6\n",
                        __func__, asoc, &daddr->v6.sin6_addr);
         }
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index f73ec0ea93ba..8ef8e7d9eb61 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -38,6 +38,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <net/sctp/sctp.h>
 
@@ -134,8 +136,7 @@ void sctp_dbg_objcnt_init(void)
         ent = proc_create("sctp_dbg_objcnt", 0,
                           proc_net_sctp, &sctp_objcnt_ops);
         if (!ent)
-                printk(KERN_WARNING
-                        "sctp_dbg_objcnt: Unable to create /proc entry.\n");
+                pr_warn("sctp_dbg_objcnt: Unable to create /proc entry.\n");
 }
 
 /* Cleanup the objcount entry in the proc filesystem.  */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index bcc4590ccaf2..60600d337a3a 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -41,6 +41,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/wait.h>
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index c04b2eb59186..8c6d379b4bb6 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -46,6 +46,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/list.h>   /* For struct list_head */
 #include <linux/socket.h>
@@ -1463,23 +1465,23 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                         /* Display the end of the
                                          * current range.
                                          */
-                                        SCTP_DEBUG_PRINTK("-%08x",
-                                                          dbg_last_ack_tsn);
+                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
+                                                               dbg_last_ack_tsn);
                                 }
 
                                 /* Start a new range.  */
-                                SCTP_DEBUG_PRINTK(",%08x", tsn);
+                                SCTP_DEBUG_PRINTK_CONT(",%08x", tsn);
                                 dbg_ack_tsn = tsn;
                                 break;
 
                         case 1: /* The last TSN was NOT ACKed. */
                                 if (dbg_last_kept_tsn != dbg_kept_tsn) {
                                         /* Display the end of current range. */
-                                        SCTP_DEBUG_PRINTK("-%08x",
-                                                          dbg_last_kept_tsn);
+                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
+                                                               dbg_last_kept_tsn);
                                 }
 
-                                SCTP_DEBUG_PRINTK("\n");
+                                SCTP_DEBUG_PRINTK_CONT("\n");
 
                                 /* FALL THROUGH... */
                         default:
@@ -1526,18 +1528,18 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                         break;
 
                                 if (dbg_last_kept_tsn != dbg_kept_tsn)
-                                        SCTP_DEBUG_PRINTK("-%08x",
-                                                          dbg_last_kept_tsn);
+                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
+                                                               dbg_last_kept_tsn);
 
-                                SCTP_DEBUG_PRINTK(",%08x", tsn);
+                                SCTP_DEBUG_PRINTK_CONT(",%08x", tsn);
                                 dbg_kept_tsn = tsn;
                                 break;
 
                         case 0:
                                 if (dbg_last_ack_tsn != dbg_ack_tsn)
-                                        SCTP_DEBUG_PRINTK("-%08x",
-                                                          dbg_last_ack_tsn);
-                                SCTP_DEBUG_PRINTK("\n");
+                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
+                                                               dbg_last_ack_tsn);
+                                SCTP_DEBUG_PRINTK_CONT("\n");
 
                                 /* FALL THROUGH... */
                         default:
@@ -1556,17 +1558,17 @@ static void sctp_check_transmitted(struct sctp_outq *q,
         switch (dbg_prt_state) {
         case 0:
                 if (dbg_last_ack_tsn != dbg_ack_tsn) {
-                        SCTP_DEBUG_PRINTK("-%08x\n", dbg_last_ack_tsn);
+                        SCTP_DEBUG_PRINTK_CONT("-%08x\n", dbg_last_ack_tsn);
                 } else {
-                        SCTP_DEBUG_PRINTK("\n");
+                        SCTP_DEBUG_PRINTK_CONT("\n");
                 }
         break;
 
         case 1:
                 if (dbg_last_kept_tsn != dbg_kept_tsn) {
-                        SCTP_DEBUG_PRINTK("-%08x\n", dbg_last_kept_tsn);
+                        SCTP_DEBUG_PRINTK_CONT("-%08x\n", dbg_last_kept_tsn);
                 } else {
-                        SCTP_DEBUG_PRINTK("\n");
+                        SCTP_DEBUG_PRINTK_CONT("\n");
                 }
         }
 #endif /* SCTP_DEBUG */
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index db3a42b8b349..2e63e9dc010e 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -22,6 +22,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/kprobes.h>
 #include <linux/socket.h>
@@ -192,7 +194,7 @@ static __init int sctpprobe_init(void)
         if (ret)
                 goto remove_proc;
 
-        pr_info("SCTP probe registered (port=%d)\n", port);
+        pr_info("probe registered (port=%d)\n", port);
 
         return 0;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5027b83f1cc0..1ef29c74d85e 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -46,6 +46,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
@@ -707,8 +709,7 @@ static int sctp_ctl_sock_init(void)
                                            &init_net);
 
         if (err < 0) {
-                printk(KERN_ERR
-                       "SCTP: Failed to create the SCTP control socket.\n");
+                pr_err("Failed to create the SCTP control socket\n");
                 return err;
         }
         return 0;
@@ -798,7 +799,7 @@ static void sctp_inet_skb_msgname(struct sk_buff *skb, char *msgname, int *len)
 static int sctp_inet_af_supported(sa_family_t family, struct sctp_sock *sp)
 {
         /* PF_INET only supports AF_INET addresses. */
-        return (AF_INET == family);
+        return AF_INET == family;
 }
 
 /* Address matching with wildcards allowed. */
@@ -1206,7 +1207,7 @@ SCTP_STATIC __init int sctp_init(void)
                                         __get_free_pages(GFP_ATOMIC, order);
         } while (!sctp_assoc_hashtable && --order > 0);
         if (!sctp_assoc_hashtable) {
-                printk(KERN_ERR "SCTP: Failed association hash alloc.\n");
+                pr_err("Failed association hash alloc\n");
                 status = -ENOMEM;
                 goto err_ahash_alloc;
         }
@@ -1220,7 +1221,7 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_ep_hashtable = (struct sctp_hashbucket *)
                 kmalloc(64 * sizeof(struct sctp_hashbucket), GFP_KERNEL);
         if (!sctp_ep_hashtable) {
-                printk(KERN_ERR "SCTP: Failed endpoint_hash alloc.\n");
+                pr_err("Failed endpoint_hash alloc\n");
                 status = -ENOMEM;
                 goto err_ehash_alloc;
         }
@@ -1239,7 +1240,7 @@ SCTP_STATIC __init int sctp_init(void)
                                         __get_free_pages(GFP_ATOMIC, order);
         } while (!sctp_port_hashtable && --order > 0);
         if (!sctp_port_hashtable) {
-                printk(KERN_ERR "SCTP: Failed bind hash alloc.");
+                pr_err("Failed bind hash alloc\n");
                 status = -ENOMEM;
                 goto err_bhash_alloc;
         }
@@ -1248,8 +1249,7 @@ SCTP_STATIC __init int sctp_init(void)
                 INIT_HLIST_HEAD(&sctp_port_hashtable[i].chain);
         }
 
-        printk(KERN_INFO "SCTP: Hash tables configured "
-                         "(established %d bind %d)\n",
+        pr_info("Hash tables configured (established %d bind %d)\n",
                 sctp_assoc_hashsize, sctp_port_hashsize);
 
         /* Disable ADDIP by default. */
@@ -1290,8 +1290,7 @@ SCTP_STATIC __init int sctp_init(void)
 
         /* Initialize the control inode/socket for handling OOTB packets.  */
         if ((status = sctp_ctl_sock_init())) {
-                printk (KERN_ERR
-                        "SCTP: Failed to initialize the SCTP control sock.\n");
+                pr_err("Failed to initialize the SCTP control sock\n");
                 goto err_ctl_sock_init;
         }
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 246f92924658..2cc46f0962ca 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -50,6 +50,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/ip.h>
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index f5e5e27cac5e..b21b218d564f 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -47,6 +47,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -1146,26 +1148,23 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
 
         case SCTP_DISPOSITION_VIOLATION:
                 if (net_ratelimit())
-                        printk(KERN_ERR "sctp protocol violation state %d "
-                               "chunkid %d\n", state, subtype.chunk);
+                        pr_err("protocol violation state %d chunkid %d\n",
+                               state, subtype.chunk);
                 break;
 
         case SCTP_DISPOSITION_NOT_IMPL:
-                printk(KERN_WARNING "sctp unimplemented feature in state %d, "
-                       "event_type %d, event_id %d\n",
-                       state, event_type, subtype.chunk);
+                pr_warn("unimplemented feature in state %d, event_type %d, event_id %d\n",
+                        state, event_type, subtype.chunk);
                 break;
 
         case SCTP_DISPOSITION_BUG:
-                printk(KERN_ERR "sctp bug in state %d, "
-                       "event_type %d, event_id %d\n",
+                pr_err("bug in state %d, event_type %d, event_id %d\n",
                        state, event_type, subtype.chunk);
                 BUG();
                 break;
 
         default:
-                printk(KERN_ERR "sctp impossible disposition %d "
-                       "in state %d, event_type %d, event_id %d\n",
+                pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
                        status, state, event_type, subtype.chunk);
                 BUG();
                 break;
@@ -1679,8 +1678,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         sctp_cmd_send_asconf(asoc);
                         break;
                 default:
-                        printk(KERN_WARNING "Impossible command: %u, %p\n",
-                               cmd->verb, cmd->obj.ptr);
+                        pr_warn("Impossible command: %u, %p\n",
+                                cmd->verb, cmd->obj.ptr);
                         break;
                 }
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d344dc481ccc..4b4eb7c96bbd 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -50,6 +50,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/ip.h>
@@ -1138,18 +1140,16 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
         if (unlikely(!link)) {
                 if (from_addr.sa.sa_family == AF_INET6) {
                         if (net_ratelimit())
-                                printk(KERN_WARNING
-                                    "%s association %p could not find address %pI6\n",
-                                    __func__,
-                                    asoc,
-                                    &from_addr.v6.sin6_addr);
+                                pr_warn("%s association %p could not find address %pI6\n",
+                                        __func__,
+                                        asoc,
+                                        &from_addr.v6.sin6_addr);
                 } else {
                         if (net_ratelimit())
-                                printk(KERN_WARNING
-                                    "%s association %p could not find address %pI4\n",
-                                    __func__,
-                                    asoc,
-                                    &from_addr.v4.sin_addr.s_addr);
+                                pr_warn("%s association %p could not find address %pI4\n",
+                                        __func__,
+                                        asoc,
+                                        &from_addr.v4.sin_addr.s_addr);
                 }
                 return SCTP_DISPOSITION_DISCARD;
         }
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 6d9b3aafcc5d..546d4387fb3c 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -46,6 +46,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
@@ -66,15 +68,19 @@ static const sctp_sm_table_entry_t bug = {
         .name = "sctp_sf_bug"
 };
 
-#define DO_LOOKUP(_max, _type, _table) \
-        if ((event_subtype._type > (_max))) { \
-                printk(KERN_WARNING \
-                       "sctp table %p possible attack:" \
-                       " event %d exceeds max %d\n", \
-                       _table, event_subtype._type, _max); \
-                return &bug; \
-        } \
-        return &_table[event_subtype._type][(int)state];
+#define DO_LOOKUP(_max, _type, _table)                                  \
+({                                                                      \
+        const sctp_sm_table_entry_t *rtn;                               \
+                                                                        \
+        if ((event_subtype._type > (_max))) {                           \
+                pr_warn("table %p possible attack: event %d exceeds max %d\n", \
+                        _table, event_subtype._type, _max);             \
+                rtn = &bug;                                             \
+        } else                                                          \
+                rtn = &_table[event_subtype._type][(int)state];         \
+                                                                        \
+        rtn;                                                            \
+})
 
 const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
                                                   sctp_state_t state,
@@ -83,21 +89,15 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
         switch (event_type) {
         case SCTP_EVENT_T_CHUNK:
                 return sctp_chunk_event_lookup(event_subtype.chunk, state);
-                break;
         case SCTP_EVENT_T_TIMEOUT:
-                DO_LOOKUP(SCTP_EVENT_TIMEOUT_MAX, timeout,
-                          timeout_event_table);
-                break;
-
+                return DO_LOOKUP(SCTP_EVENT_TIMEOUT_MAX, timeout,
+                                 timeout_event_table);
         case SCTP_EVENT_T_OTHER:
-                DO_LOOKUP(SCTP_EVENT_OTHER_MAX, other, other_event_table);
-                break;
-
+                return DO_LOOKUP(SCTP_EVENT_OTHER_MAX, other,
+                                 other_event_table);
         case SCTP_EVENT_T_PRIMITIVE:
-                DO_LOOKUP(SCTP_EVENT_PRIMITIVE_MAX, primitive,
-                          primitive_event_table);
-                break;
-
+                return DO_LOOKUP(SCTP_EVENT_PRIMITIVE_MAX, primitive,
+                                 primitive_event_table);
         default:
                 /* Yikes!  We got an illegal event type.  */
                 return &bug;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ca44917872d2..535659fdbaa1 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -57,6 +57,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/wait.h>
@@ -2458,9 +2460,8 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
                 if (params.sack_delay == 0 && params.sack_freq == 0)
                         return 0;
         } else if (optlen == sizeof(struct sctp_assoc_value)) {
-                printk(KERN_WARNING "SCTP: Use of struct sctp_assoc_value "
-                       "in delayed_ack socket option deprecated\n");
-                printk(KERN_WARNING "SCTP: Use struct sctp_sack_info instead\n");
+                pr_warn("Use of struct sctp_assoc_value in delayed_ack socket option deprecated\n");
+                pr_warn("Use struct sctp_sack_info instead\n");
                 if (copy_from_user(&params, optval, optlen))
                         return -EFAULT;
 
@@ -2868,10 +2869,8 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
         int val;
 
         if (optlen == sizeof(int)) {
-                printk(KERN_WARNING
-                   "SCTP: Use of int in maxseg socket option deprecated\n");
-                printk(KERN_WARNING
-                   "SCTP: Use struct sctp_assoc_value instead\n");
+                pr_warn("Use of int in maxseg socket option deprecated\n");
+                pr_warn("Use struct sctp_assoc_value instead\n");
                 if (copy_from_user(&val, optval, optlen))
                         return -EFAULT;
                 params.assoc_id = 0;
@@ -3121,10 +3120,8 @@ static int sctp_setsockopt_maxburst(struct sock *sk,
         int assoc_id = 0;
 
         if (optlen == sizeof(int)) {
-                printk(KERN_WARNING
-                   "SCTP: Use of int in max_burst socket option deprecated\n");
-                printk(KERN_WARNING
-                   "SCTP: Use struct sctp_assoc_value instead\n");
+                pr_warn("Use of int in max_burst socket option deprecated\n");
+                pr_warn("Use struct sctp_assoc_value instead\n");
                 if (copy_from_user(&val, optval, optlen))
                         return -EFAULT;
         } else if (optlen == sizeof(struct sctp_assoc_value)) {
@@ -3595,7 +3592,40 @@ out:
 /* The SCTP ioctl handler. */
 SCTP_STATIC int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
-        return -ENOIOCTLCMD;
+        int rc = -ENOTCONN;
+
+        sctp_lock_sock(sk);
+
+        /*
+         * SEQPACKET-style sockets in LISTENING state are valid, for
+         * SCTP, so only discard TCP-style sockets in LISTENING state.
+         */
+        if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
+                goto out;
+
+        switch (cmd) {
+        case SIOCINQ: {
+                struct sk_buff *skb;
+                unsigned int amount = 0;
+
+                skb = skb_peek(&sk->sk_receive_queue);
+                if (skb != NULL) {
+                        /*
+                         * We will only return the amount of this packet since
+                         * that is all that will be read.
+                         */
+                        amount = skb->len;
+                }
+                rc = put_user(amount, (int __user *)arg);
+        }
+                break;
+        default:
+                rc = -ENOIOCTLCMD;
+                break;
+        }
+out:
+        sctp_release_sock(sk);
+        return rc;
 }
 
 /* This is the function which gets called during socket creation to
@@ -3854,7 +3884,7 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
         }
 
 out:
-        return (retval);
+        return retval;
 }
 
 
@@ -3910,7 +3940,7 @@ static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
         }
 
 out:
-        return (retval);
+        return retval;
 }
 
 /* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
@@ -4281,9 +4311,8 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
                 if (copy_from_user(&params, optval, len))
                         return -EFAULT;
         } else if (len == sizeof(struct sctp_assoc_value)) {
-                printk(KERN_WARNING "SCTP: Use of struct sctp_assoc_value "
-                       "in delayed_ack socket option deprecated\n");
-                printk(KERN_WARNING "SCTP: Use struct sctp_sack_info instead\n");
+                pr_warn("Use of struct sctp_assoc_value in delayed_ack socket option deprecated\n");
+                pr_warn("Use struct sctp_sack_info instead\n");
                 if (copy_from_user(&params, optval, len))
                         return -EFAULT;
         } else
@@ -4929,10 +4958,8 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len,
         struct sctp_association *asoc;
 
         if (len == sizeof(int)) {
-                printk(KERN_WARNING
-                   "SCTP: Use of int in maxseg socket option deprecated\n");
-                printk(KERN_WARNING
-                   "SCTP: Use struct sctp_assoc_value instead\n");
+                pr_warn("Use of int in maxseg socket option deprecated\n");
+                pr_warn("Use struct sctp_assoc_value instead\n");
                 params.assoc_id = 0;
         } else if (len >= sizeof(struct sctp_assoc_value)) {
                 len = sizeof(struct sctp_assoc_value);
@@ -5023,10 +5050,8 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
         struct sctp_association *asoc;
 
         if (len == sizeof(int)) {
-                printk(KERN_WARNING
-                   "SCTP: Use of int in max_burst socket option deprecated\n");
-                printk(KERN_WARNING
-                   "SCTP: Use struct sctp_assoc_value instead\n");
+                pr_warn("Use of int in max_burst socket option deprecated\n");
+                pr_warn("Use struct sctp_assoc_value instead\n");
                 params.assoc_id = 0;
         } else if (len >= sizeof(struct sctp_assoc_value)) {
                 len = sizeof(struct sctp_assoc_value);
@@ -5569,7 +5594,7 @@ static int sctp_get_port(struct sock *sk, unsigned short snum)
         /* Note: sk->sk_num gets filled in if ephemeral port request. */
         ret = sctp_get_port_local(sk, &addr);
 
-        return (ret ? 1 : 0);
+        return ret ? 1 : 0;
 }
 
 /*
@@ -5586,8 +5611,7 @@ SCTP_STATIC int sctp_listen_start(struct sock *sk, int backlog)
                 tfm = crypto_alloc_hash(sctp_hmac_alg, 0, CRYPTO_ALG_ASYNC);
                 if (IS_ERR(tfm)) {
                         if (net_ratelimit()) {
-                                printk(KERN_INFO
-                                       "SCTP: failed to load transform for %s: %ld\n",
+                                pr_info("failed to load transform for %s: %ld\n",
                                         sctp_hmac_alg, PTR_ERR(tfm));
                         }
                         return -ENOSYS;
@@ -5716,13 +5740,12 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
         /* Is it readable?  Reconsider this code with TCP-style support.  */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* The association is either gone or not ready.  */
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 132046cb82fc..d3ae493d234a 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -48,6 +48,8 @@
  * be incorporated into the next SCTP release.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/random.h>
@@ -244,10 +246,9 @@ void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
         struct dst_entry *dst;
 
         if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
-                printk(KERN_WARNING "%s: Reported pmtu %d too low, "
-                       "using default minimum of %d\n",
-                       __func__, pmtu,
-                       SCTP_DEFAULT_MINSEGMENT);
+                pr_warn("%s: Reported pmtu %d too low, using default minimum of %d\n",
+                        __func__, pmtu,
+                        SCTP_DEFAULT_MINSEGMENT);
                 /* Use default minimum segment size and disable
                  * pmtu discovery on this transport.
                  */
diff --git a/net/socket.c b/net/socket.c
index 2270b941bcc7..717a5f1c8792 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -535,14 +535,13 @@ void sock_release(struct socket *sock)
 }
 EXPORT_SYMBOL(sock_release);
 
-int sock_tx_timestamp(struct msghdr *msg, struct sock *sk,
-                      union skb_shared_tx *shtx)
+int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
 {
-        shtx->flags = 0;
+        *tx_flags = 0;
         if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
-                shtx->hardware = 1;
+                *tx_flags |= SKBTX_HW_TSTAMP;
         if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
-                shtx->software = 1;
+                *tx_flags |= SKBTX_SW_TSTAMP;
         return 0;
 }
 EXPORT_SYMBOL(sock_tx_timestamp);
@@ -1919,7 +1918,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
                  * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
                  * checking falls down on this.
                  */
-                if (copy_from_user(ctl_buf, (void __user *)msg_sys.msg_control,
+                if (copy_from_user(ctl_buf,
+                                   (void __user __force *)msg_sys.msg_control,
                                    ctl_len))
                         goto out_freectl;
                 msg_sys.msg_control = ctl_buf;
@@ -3054,14 +3054,19 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
                         char *optval, int *optlen)
 {
         mm_segment_t oldfs = get_fs();
+        char __user *uoptval;
+        int __user *uoptlen;
         int err;
 
+        uoptval = (char __user __force *) optval;
+        uoptlen = (int __user __force *) optlen;
+
         set_fs(KERNEL_DS);
         if (level == SOL_SOCKET)
-                err = sock_getsockopt(sock, level, optname, optval, optlen);
+                err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
         else
-                err = sock->ops->getsockopt(sock, level, optname, optval,
-                                            optlen);
+                err = sock->ops->getsockopt(sock, level, optname, uoptval,
+                                            uoptlen);
         set_fs(oldfs);
         return err;
 }
@@ -3071,13 +3076,16 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
                         char *optval, unsigned int optlen)
 {
         mm_segment_t oldfs = get_fs();
+        char __user *uoptval;
         int err;
 
+        uoptval = (char __user __force *) optval;
+
         set_fs(KERNEL_DS);
         if (level == SOL_SOCKET)
-                err = sock_setsockopt(sock, level, optname, optval, optlen);
+                err = sock_setsockopt(sock, level, optname, uoptval, optlen);
         else
-                err = sock->ops->setsockopt(sock, level, optname, optval,
+                err = sock->ops->setsockopt(sock, level, optname, uoptval,
                                             optlen);
         set_fs(oldfs);
         return err;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dcfc66bab2bb..597c493392ad 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1049,7 +1049,7 @@ gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
 out:
         if (acred->machine_cred != gss_cred->gc_machine_cred)
                 return 0;
-        return (rc->cr_uid == acred->uid);
+        return rc->cr_uid == acred->uid;
 }
 
 /*
diff --git a/net/sunrpc/auth_gss/gss_generic_token.c b/net/sunrpc/auth_gss/gss_generic_token.c
index 310b78e99456..c586e92bcf76 100644
--- a/net/sunrpc/auth_gss/gss_generic_token.c
+++ b/net/sunrpc/auth_gss/gss_generic_token.c
@@ -76,19 +76,19 @@ static int
 der_length_size( int length)
 {
         if (length < (1<<7))
-                return(1);
+                return 1;
         else if (length < (1<<8))
-                return(2);
+                return 2;
 #if (SIZEOF_INT == 2)
         else
-                return(3);
+                return 3;
 #else
         else if (length < (1<<16))
-                return(3);
+                return 3;
         else if (length < (1<<24))
-                return(4);
+                return 4;
         else
-                return(5);
+                return 5;
 #endif
 }
 
@@ -121,14 +121,14 @@ der_read_length(unsigned char **buf, int *bufsize)
         int ret;
 
         if (*bufsize < 1)
-                return(-1);
+                return -1;
         sf = *(*buf)++;
         (*bufsize)--;
         if (sf & 0x80) {
                 if ((sf &= 0x7f) > ((*bufsize)-1))
-                        return(-1);
+                        return -1;
                 if (sf > SIZEOF_INT)
-                        return (-1);
+                        return -1;
                 ret = 0;
                 for (; sf; sf--) {
                         ret = (ret<<8) + (*(*buf)++);
@@ -138,7 +138,7 @@ der_read_length(unsigned char **buf, int *bufsize)
                 ret = sf;
         }
 
-        return(ret);
+        return ret;
 }
 
 /* returns the length of a token, given the mech oid and the body size */
@@ -148,7 +148,7 @@ g_token_size(struct xdr_netobj *mech, unsigned int body_size)
 {
         /* set body_size to sequence contents size */
         body_size += 2 + (int) mech->len;         /* NEED overflow check */
-        return(1 + der_length_size(body_size) + body_size);
+        return 1 + der_length_size(body_size) + body_size;
 }
 
 EXPORT_SYMBOL_GPL(g_token_size);
@@ -186,27 +186,27 @@ g_verify_token_header(struct xdr_netobj *mech, int *body_size,
         int ret = 0;
 
         if ((toksize-=1) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
         if (*buf++ != 0x60)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
 
         if ((seqsize = der_read_length(&buf, &toksize)) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
 
         if (seqsize != toksize)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
 
         if ((toksize-=1) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
         if (*buf++ != 0x06)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
 
         if ((toksize-=1) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
         toid.len = *buf++;
 
         if ((toksize-=toid.len) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
         toid.data = buf;
         buf+=toid.len;
 
@@ -217,17 +217,17 @@ g_verify_token_header(struct xdr_netobj *mech, int *body_size,
       to return G_BAD_TOK_HEADER if the token header is in fact bad */
 
         if ((toksize-=2) < 0)
-                return(G_BAD_TOK_HEADER);
+                return G_BAD_TOK_HEADER;
 
         if (ret)
-                return(ret);
+                return ret;
 
         if (!ret) {
                 *buf_in = buf;
                 *body_size = toksize;
         }
 
-        return(ret);
+        return ret;
 }
 
 EXPORT_SYMBOL_GPL(g_verify_token_header);
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index 415c013ba382..62ac90c62cb1 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -162,5 +162,5 @@ krb5_get_seq_num(struct krb5_ctx *kctx,
         *seqnum = ((plain[0]) |
                    (plain[1] << 8) | (plain[2] << 16) | (plain[3] << 24));
 
-        return (0);
+        return 0;
 }
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 2689de39dc78..8b4061049d76 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -331,7 +331,7 @@ gss_delete_sec_context(struct gss_ctx	**context_handle)
                         *context_handle);
 
         if (!*context_handle)
-                return(GSS_S_NO_CONTEXT);
+                return GSS_S_NO_CONTEXT;
         if ((*context_handle)->internal_ctx_id)
                 (*context_handle)->mech_type->gm_ops
                         ->gss_delete_sec_context((*context_handle)
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index cace6049e4a5..aa5dbda6608c 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -376,7 +376,7 @@ int rpc_queue_empty(struct rpc_wait_queue *queue)
         spin_lock_bh(&queue->lock);
         res = queue->qlen;
         spin_unlock_bh(&queue->lock);
-        return (res == 0);
+        return res == 0;
 }
 EXPORT_SYMBOL_GPL(rpc_queue_empty);
 
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index c048543ffbeb..2ddc351b3be9 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -89,7 +89,7 @@ int tipc_addr_domain_valid(u32 addr)
 
 int tipc_addr_node_valid(u32 addr)
 {
-        return (tipc_addr_domain_valid(addr) && tipc_node(addr));
+        return tipc_addr_domain_valid(addr) && tipc_node(addr);
 }
 
 int tipc_in_scope(u32 domain, u32 addr)
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index a008c6689305..ecfaac10d0b4 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -143,6 +143,19 @@ static void bcbuf_decr_acks(struct sk_buff *buf)
 }
 
 
+static void bclink_set_last_sent(void)
+{
+        if (bcl->next_out)
+                bcl->fsm_msg_cnt = mod(buf_seqno(bcl->next_out) - 1);
+        else
+                bcl->fsm_msg_cnt = mod(bcl->next_out_no - 1);
+}
+
+u32 tipc_bclink_get_last_sent(void)
+{
+        return bcl->fsm_msg_cnt;
+}
+
 /**
  * bclink_set_gap - set gap according to contents of current deferred pkt queue
  *
@@ -171,7 +184,7 @@ static void bclink_set_gap(struct tipc_node *n_ptr)
 
 static int bclink_ack_allowed(u32 n)
 {
-        return((n % TIPC_MIN_LINK_WIN) == tipc_own_tag);
+        return (n % TIPC_MIN_LINK_WIN) == tipc_own_tag;
 }
 
 
@@ -237,8 +250,10 @@ void tipc_bclink_acknowledge(struct tipc_node *n_ptr, u32 acked)
 
         /* Try resolving broadcast link congestion, if necessary */
 
-        if (unlikely(bcl->next_out))
+        if (unlikely(bcl->next_out)) {
                 tipc_link_push_queue(bcl);
+                bclink_set_last_sent();
+        }
         if (unlikely(released && !list_empty(&bcl->waiting_ports)))
                 tipc_link_wakeup_ports(bcl, 0);
         spin_unlock_bh(&bc_lock);
@@ -395,7 +410,7 @@ int tipc_bclink_send_msg(struct sk_buff *buf)
         if (unlikely(res == -ELINKCONG))
                 buf_discard(buf);
         else
-                bcl->stats.sent_info++;
+                bclink_set_last_sent();
 
         if (bcl->out_queue_size > bcl->stats.max_queue_sz)
                 bcl->stats.max_queue_sz = bcl->out_queue_size;
@@ -529,15 +544,6 @@ receive:
         tipc_node_unlock(node);
 }
 
-u32 tipc_bclink_get_last_sent(void)
-{
-        u32 last_sent = mod(bcl->next_out_no - 1);
-
-        if (bcl->next_out)
-                last_sent = mod(buf_seqno(bcl->next_out) - 1);
-        return last_sent;
-}
-
 u32 tipc_bclink_acks_missing(struct tipc_node *n_ptr)
 {
         return (n_ptr->bclink.supported &&
@@ -570,6 +576,7 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
                 msg = buf_msg(buf);
                 msg_set_non_seq(msg, 1);
                 msg_set_mc_netid(msg, tipc_net_id);
+                bcl->stats.sent_info++;
         }
 
         /* Send buffer over bearers until all targets reached */
@@ -609,11 +616,13 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
                 bcbearer->remains = bcbearer->remains_new;
         }
 
-        /* Unable to reach all targets */
+        /*
+         * Unable to reach all targets (indicate success, since currently
+         * there isn't code in place to properly block & unblock the
+         * pseudo-bearer used by the broadcast link)
+         */
 
-        bcbearer->bearer.publ.blocked = 1;
-        bcl->stats.bearer_congs++;
-        return 1;
+        return TIPC_OK;
 }
 
 /**
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 52ae17b2583e..9c10c6b7c12b 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -63,7 +63,7 @@ static int media_name_valid(const char *name)
         len = strlen(name);
         if ((len + 1) > TIPC_MAX_MEDIA_NAME)
                 return 0;
-        return (strspn(name, tipc_alphabet) == len);
+        return strspn(name, tipc_alphabet) == len;
 }
 
 /**
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 696468117985..466b861dab91 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -169,6 +169,7 @@ void tipc_core_stop(void)
         tipc_nametbl_stop();
         tipc_ref_table_stop();
         tipc_socket_stop();
+        tipc_log_resize(0);
 }
 
 /**
@@ -203,7 +204,9 @@ static int __init tipc_init(void)
 {
         int res;
 
-        tipc_log_resize(CONFIG_TIPC_LOG);
+        if (tipc_log_resize(CONFIG_TIPC_LOG) != 0)
+                warn("Unable to create log buffer\n");
+
         info("Activated (version " TIPC_MOD_VER
              " compiled " __DATE__ " " __TIME__ ")\n");
 
@@ -230,7 +233,6 @@ static void __exit tipc_exit(void)
         tipc_core_stop_net();
         tipc_core_stop();
         info("Deactivated\n");
-        tipc_log_resize(0);
 }
 
 module_init(tipc_init);
diff --git a/net/tipc/dbg.c b/net/tipc/dbg.c
index 1885a7edb0c8..6569d45bfb9a 100644
--- a/net/tipc/dbg.c
+++ b/net/tipc/dbg.c
@@ -134,7 +134,7 @@ void tipc_printbuf_reset(struct print_buf *pb)
 
 int tipc_printbuf_empty(struct print_buf *pb)
 {
-        return (!pb->buf || (pb->crs == pb->buf));
+        return !pb->buf || (pb->crs == pb->buf);
 }
 
 /**
@@ -169,7 +169,7 @@ int tipc_printbuf_validate(struct print_buf *pb)
                         tipc_printf(pb, err);
                 }
         }
-        return (pb->crs - pb->buf + 1);
+        return pb->crs - pb->buf + 1;
 }
 
 /**
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index fc1fcf5e6b53..f28d1ae93125 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -203,6 +203,14 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct bearer *b_ptr)
                                 return;
                 }
                 spin_lock_bh(&n_ptr->lock);
+
+                /* Don't talk to neighbor during cleanup after last session */
+
+                if (n_ptr->cleanup_required) {
+                        spin_unlock_bh(&n_ptr->lock);
+                        return;
+                }
+
                 link = n_ptr->links[b_ptr->identity];
                 if (!link) {
                         dbg("creating link\n");
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 6230d16020c4..6e988ba485fd 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -72,17 +72,26 @@ static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
 {
         struct sk_buff *clone;
         struct net_device *dev;
+        int delta;
 
         clone = skb_clone(buf, GFP_ATOMIC);
-        if (clone) {
-                skb_reset_network_header(clone);
-                dev = ((struct eth_bearer *)(tb_ptr->usr_handle))->dev;
-                clone->dev = dev;
-                dev_hard_header(clone, dev, ETH_P_TIPC,
-                                 &dest->dev_addr.eth_addr,
-                                 dev->dev_addr, clone->len);
-                dev_queue_xmit(clone);
+        if (!clone)
+                return 0;
+
+        dev = ((struct eth_bearer *)(tb_ptr->usr_handle))->dev;
+        delta = dev->hard_header_len - skb_headroom(buf);
+
+        if ((delta > 0) &&
+            pskb_expand_head(clone, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {
+                kfree_skb(clone);
+                return 0;
         }
+
+        skb_reset_network_header(clone);
+        clone->dev = dev;
+        dev_hard_header(clone, dev, ETH_P_TIPC, &dest->dev_addr.eth_addr,
+                        dev->dev_addr, clone->len);
+        dev_queue_xmit(clone);
         return 0;
 }
 
@@ -92,15 +101,12 @@ static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
  * Accept only packets explicitly sent to this node, or broadcast packets;
  * ignores packets sent using Ethernet multicast, and traffic sent to other
  * nodes (which can happen if interface is running in promiscuous mode).
- * Routine truncates any Ethernet padding/CRC appended to the message,
- * and ensures message size matches actual length
  */
 
 static int recv_msg(struct sk_buff *buf, struct net_device *dev,
                     struct packet_type *pt, struct net_device *orig_dev)
 {
         struct eth_bearer *eb_ptr = (struct eth_bearer *)pt->af_packet_priv;
-        u32 size;
 
         if (!net_eq(dev_net(dev), &init_net)) {
                 kfree_skb(buf);
@@ -109,13 +115,9 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 
         if (likely(eb_ptr->bearer)) {
                 if (likely(buf->pkt_type <= PACKET_BROADCAST)) {
-                        size = msg_size((struct tipc_msg *)buf->data);
-                        skb_trim(buf, size);
-                        if (likely(buf->len == size)) {
-                                buf->next = NULL;
-                                tipc_recv_msg(buf, eb_ptr->bearer);
-                                return 0;
-                        }
+                        buf->next = NULL;
+                        tipc_recv_msg(buf, eb_ptr->bearer);
+                        return 0;
                 }
         }
         kfree_skb(buf);
@@ -133,6 +135,16 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         struct eth_bearer *eb_ptr = &eth_bearers[0];
         struct eth_bearer *stop = &eth_bearers[MAX_ETH_BEARERS];
         char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
+        int pending_dev = 0;
+
+        /* Find unused Ethernet bearer structure */
+
+        while (eb_ptr->dev) {
+                if (!eb_ptr->bearer)
+                        pending_dev++;
+                if (++eb_ptr == stop)
+                        return pending_dev ? -EAGAIN : -EDQUOT;
+        }
 
         /* Find device with specified name */
 
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a3616b99529b..b8cf1e9d0b86 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -239,13 +239,13 @@ int tipc_link_is_up(struct link *l_ptr)
 {
         if (!l_ptr)
                 return 0;
-        return (link_working_working(l_ptr) || link_working_unknown(l_ptr));
+        return link_working_working(l_ptr) || link_working_unknown(l_ptr);
 }
 
 int tipc_link_is_active(struct link *l_ptr)
 {
-        return ((l_ptr->owner->active_links[0] == l_ptr) ||
-                (l_ptr->owner->active_links[1] == l_ptr));
+        return  (l_ptr->owner->active_links[0] == l_ptr) ||
+                (l_ptr->owner->active_links[1] == l_ptr);
 }
 
 /**
@@ -1802,6 +1802,15 @@ static int link_recv_buf_validate(struct sk_buff *buf)
         return pskb_may_pull(buf, hdr_size);
 }
 
+/**
+ * tipc_recv_msg - process TIPC messages arriving from off-node
+ * @head: pointer to message buffer chain
+ * @tb_ptr: pointer to bearer message arrived on
+ *
+ * Invoked with no locks held.  Bearer pointer must point to a valid bearer
+ * structure (i.e. cannot be NULL), but bearer can be inactive.
+ */
+
 void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
 {
         read_lock_bh(&tipc_net_lock);
@@ -1819,6 +1828,11 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
 
                 head = head->next;
 
+                /* Ensure bearer is still enabled */
+
+                if (unlikely(!b_ptr->active))
+                        goto cont;
+
                 /* Ensure message is well-formed */
 
                 if (unlikely(!link_recv_buf_validate(buf)))
@@ -1855,13 +1869,22 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
                                 goto cont;
                 }
 
-                /* Locate unicast link endpoint that should handle message */
+                /* Locate neighboring node that sent message */
 
                 n_ptr = tipc_node_find(msg_prevnode(msg));
                 if (unlikely(!n_ptr))
                         goto cont;
                 tipc_node_lock(n_ptr);
 
+                /* Don't talk to neighbor during cleanup after last session */
+
+                if (n_ptr->cleanup_required) {
+                        tipc_node_unlock(n_ptr);
+                        goto cont;
+                }
+
+                /* Locate unicast link endpoint that should handle message */
+
                 l_ptr = n_ptr->links[b_ptr->identity];
                 if (unlikely(!l_ptr)) {
                         tipc_node_unlock(n_ptr);
diff --git a/net/tipc/link.h b/net/tipc/link.h
index 2e5385c47d30..26151d30589d 100644
--- a/net/tipc/link.h
+++ b/net/tipc/link.h
@@ -279,12 +279,12 @@ static inline int between(u32 lower, u32 upper, u32 n)
 
 static inline int less_eq(u32 left, u32 right)
 {
-        return (mod(right - left) < 32768u);
+        return mod(right - left) < 32768u;
 }
 
 static inline int less(u32 left, u32 right)
 {
-        return (less_eq(left, right) && (mod(right) != mod(left)));
+        return less_eq(left, right) && (mod(right) != mod(left));
 }
 
 static inline u32 lesser(u32 left, u32 right)
@@ -299,32 +299,32 @@ static inline u32 lesser(u32 left, u32 right)
 
 static inline int link_working_working(struct link *l_ptr)
 {
-        return (l_ptr->state == WORKING_WORKING);
+        return l_ptr->state == WORKING_WORKING;
 }
 
 static inline int link_working_unknown(struct link *l_ptr)
 {
-        return (l_ptr->state == WORKING_UNKNOWN);
+        return l_ptr->state == WORKING_UNKNOWN;
 }
 
 static inline int link_reset_unknown(struct link *l_ptr)
 {
-        return (l_ptr->state == RESET_UNKNOWN);
+        return l_ptr->state == RESET_UNKNOWN;
 }
 
 static inline int link_reset_reset(struct link *l_ptr)
 {
-        return (l_ptr->state == RESET_RESET);
+        return l_ptr->state == RESET_RESET;
 }
 
 static inline int link_blocked(struct link *l_ptr)
 {
-        return (l_ptr->exp_msg_count || l_ptr->blocked);
+        return l_ptr->exp_msg_count || l_ptr->blocked;
 }
 
 static inline int link_congested(struct link *l_ptr)
 {
-        return (l_ptr->out_queue_size >= l_ptr->queue_limit[0]);
+        return l_ptr->out_queue_size >= l_ptr->queue_limit[0];
 }
 
 #endif
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 995d2da35b01..031aad18efce 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -104,7 +104,7 @@ static inline u32 msg_user(struct tipc_msg *m)
 
 static inline u32 msg_isdata(struct tipc_msg *m)
 {
-        return (msg_user(m) <= TIPC_CRITICAL_IMPORTANCE);
+        return msg_user(m) <= TIPC_CRITICAL_IMPORTANCE;
 }
 
 static inline void msg_set_user(struct tipc_msg *m, u32 n)
@@ -289,7 +289,7 @@ static inline void msg_set_destnode(struct tipc_msg *m, u32 a)
 
 static inline int msg_is_dest(struct tipc_msg *m, u32 d)
 {
-        return(msg_short(m) || (msg_destnode(m) == d));
+        return msg_short(m) || (msg_destnode(m) == d);
 }
 
 static inline u32 msg_routed(struct tipc_msg *m)
@@ -632,7 +632,7 @@ static inline void msg_set_bcast_tag(struct tipc_msg *m, u32 n)
 
 static inline u32 msg_max_pkt(struct tipc_msg *m)
 {
-        return (msg_bits(m, 9, 16, 0xffff) * 4);
+        return msg_bits(m, 9, 16, 0xffff) * 4;
 }
 
 static inline void msg_set_max_pkt(struct tipc_msg *m, u32 n)
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 8ba79620db3f..9ca4b0689237 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -116,7 +116,7 @@ DEFINE_RWLOCK(tipc_nametbl_lock);
 
 static int hash(int x)
 {
-        return(x & (tipc_nametbl_size - 1));
+        return x & (tipc_nametbl_size - 1);
 }
 
 /**
@@ -613,8 +613,7 @@ struct publication *tipc_nametbl_remove_publ(u32 type, u32 lower,
 }
 
 /*
- * tipc_nametbl_translate(): Translate tipc_name -> tipc_portid.
- *                      Very time-critical.
+ * tipc_nametbl_translate - translate name to port id
  *
  * Note: on entry 'destnode' is the search domain used during translation;
  *       on exit it passes back the node address of the matching port (if any)
@@ -685,7 +684,6 @@ found:
         }
         spin_unlock_bh(&seq->lock);
 not_found:
-        *destnode = 0;
         read_unlock_bh(&tipc_nametbl_lock);
         return 0;
 }
@@ -877,7 +875,7 @@ static void subseq_list(struct sub_seq *sseq, struct print_buf *buf, u32 depth,
                         u32 index)
 {
         char portIdStr[27];
-        char *scopeStr;
+        const char *scope_str[] = {"", " zone", " cluster", " node"};
         struct publication *publ = sseq->zone_list;
 
         tipc_printf(buf, "%-10u %-10u ", sseq->lower, sseq->upper);
@@ -893,15 +891,8 @@ static void subseq_list(struct sub_seq *sseq, struct print_buf *buf, u32 depth,
                          tipc_node(publ->node), publ->ref);
                 tipc_printf(buf, "%-26s ", portIdStr);
                 if (depth > 3) {
-                        if (publ->node != tipc_own_addr)
-                                scopeStr = "";
-                        else if (publ->scope == TIPC_NODE_SCOPE)
-                                scopeStr = "node";
-                        else if (publ->scope == TIPC_CLUSTER_SCOPE)
-                                scopeStr = "cluster";
-                        else
-                                scopeStr = "zone";
-                        tipc_printf(buf, "%-10u %s", publ->key, scopeStr);
+                        tipc_printf(buf, "%-10u %s", publ->key,
+                                    scope_str[publ->scope]);
                 }
 
                 publ = publ->zone_list_next;
@@ -951,24 +942,19 @@ static void nameseq_list(struct name_seq *seq, struct print_buf *buf, u32 depth,
 
 static void nametbl_header(struct print_buf *buf, u32 depth)
 {
-        tipc_printf(buf, "Type       ");
-
-        if (depth > 1)
-                tipc_printf(buf, "Lower      Upper      ");
-        if (depth > 2)
-                tipc_printf(buf, "Port Identity              ");
-        if (depth > 3)
-                tipc_printf(buf, "Publication");
-
-        tipc_printf(buf, "\n-----------");
-
-        if (depth > 1)
-                tipc_printf(buf, "--------------------- ");
-        if (depth > 2)
-                tipc_printf(buf, "-------------------------- ");
-        if (depth > 3)
-                tipc_printf(buf, "------------------");
-
+        const char *header[] = {
+                "Type       ",
+                "Lower      Upper      ",
+                "Port Identity              ",
+                "Publication Scope"
+        };
+
+        int i;
+
+        if (depth > 4)
+                depth = 4;
+        for (i = 0; i < depth; i++)
+                tipc_printf(buf, header[i]);
         tipc_printf(buf, "\n");
 }
 
diff --git a/net/tipc/net.c b/net/tipc/net.c
index f61b7694138b..7e05af47a196 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -248,6 +248,7 @@ void tipc_net_route_msg(struct sk_buff *buf)
 
         /* Handle message for another node */
         msg_dbg(msg, "NET>SEND>: ");
+        skb_trim(buf, msg_size(msg));
         tipc_link_send(buf, dnode, msg_link_selector(msg));
 }
 
diff --git a/net/tipc/node.c b/net/tipc/node.c
index b634942caba5..7c49cd056df7 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -237,23 +237,22 @@ void tipc_node_link_down(struct tipc_node *n_ptr, struct link *l_ptr)
 
 int tipc_node_has_active_links(struct tipc_node *n_ptr)
 {
-        return (n_ptr &&
-                ((n_ptr->active_links[0]) || (n_ptr->active_links[1])));
+        return n_ptr->active_links[0] != NULL;
 }
 
 int tipc_node_has_redundant_links(struct tipc_node *n_ptr)
 {
-        return (n_ptr->working_links > 1);
+        return n_ptr->working_links > 1;
 }
 
 static int tipc_node_has_active_routes(struct tipc_node *n_ptr)
 {
-        return (n_ptr && (n_ptr->last_router >= 0));
+        return n_ptr && (n_ptr->last_router >= 0);
 }
 
 int tipc_node_is_up(struct tipc_node *n_ptr)
 {
-        return (tipc_node_has_active_links(n_ptr) || tipc_node_has_active_routes(n_ptr));
+        return tipc_node_has_active_links(n_ptr) || tipc_node_has_active_routes(n_ptr);
 }
 
 struct tipc_node *tipc_node_attach_link(struct link *l_ptr)
@@ -384,6 +383,20 @@ static void node_established_contact(struct tipc_node *n_ptr)
                                   tipc_highest_allowed_slave);
 }
 
+static void node_cleanup_finished(unsigned long node_addr)
+{
+        struct tipc_node *n_ptr;
+
+        read_lock_bh(&tipc_net_lock);
+        n_ptr = tipc_node_find(node_addr);
+        if (n_ptr) {
+                tipc_node_lock(n_ptr);
+                n_ptr->cleanup_required = 0;
+                tipc_node_unlock(n_ptr);
+        }
+        read_unlock_bh(&tipc_net_lock);
+}
+
 static void node_lost_contact(struct tipc_node *n_ptr)
 {
         struct cluster *c_ptr;
@@ -458,6 +471,11 @@ static void node_lost_contact(struct tipc_node *n_ptr)
                 tipc_k_signal((Handler)ns->handle_node_down,
                               (unsigned long)ns->usr_handle);
         }
+
+        /* Prevent re-contact with node until all cleanup is done */
+
+        n_ptr->cleanup_required = 1;
+        tipc_k_signal((Handler)node_cleanup_finished, n_ptr->addr);
 }
 
 /**
diff --git a/net/tipc/node.h b/net/tipc/node.h
index 6f990da5d143..45f3db3a595d 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -52,6 +52,7 @@
  * @active_links: pointers to active links to node
  * @links: pointers to all links to node
  * @working_links: number of working links to node (both active and standby)
+ * @cleanup_required: non-zero if cleaning up after a prior loss of contact
  * @link_cnt: number of links to node
  * @permit_changeover: non-zero if node has redundant links to this system
  * @routers: bitmap (used for multicluster communication)
@@ -78,6 +79,7 @@ struct tipc_node {
         struct link *links[MAX_BEARERS];
         int link_cnt;
         int working_links;
+        int cleanup_required;
         int permit_changeover;
         u32 routers[512/32];
         int last_router;
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 0737680e9266..d760336f2ca8 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -588,19 +588,10 @@ void tipc_port_recv_proto_msg(struct sk_buff *buf)
         if (!p_ptr) {
                 err = TIPC_ERR_NO_PORT;
         } else if (p_ptr->publ.connected) {
-                if (port_peernode(p_ptr) != msg_orignode(msg))
+                if ((port_peernode(p_ptr) != msg_orignode(msg)) ||
+                    (port_peerport(p_ptr) != msg_origport(msg))) {
                         err = TIPC_ERR_NO_PORT;
-                if (port_peerport(p_ptr) != msg_origport(msg))
-                        err = TIPC_ERR_NO_PORT;
-                if (!err && msg_routed(msg)) {
-                        u32 seqno = msg_transp_seqno(msg);
-                        u32 myno =  ++p_ptr->last_in_seqno;
-                        if (seqno != myno) {
-                                err = TIPC_ERR_NO_PORT;
-                                abort_buf = port_build_self_abort_msg(p_ptr, err);
-                        }
-                }
-                if (msg_type(msg) == CONN_ACK) {
+                } else if (msg_type(msg) == CONN_ACK) {
                         int wakeup = tipc_port_congested(p_ptr) &&
                                      p_ptr->publ.congested &&
                                      p_ptr->wakeup;
@@ -1473,7 +1464,7 @@ int tipc_forward2name(u32 ref,
         msg_set_destnode(msg, destnode);
         msg_set_destport(msg, destport);
 
-        if (likely(destport || destnode)) {
+        if (likely(destport)) {
                 p_ptr->sent++;
                 if (likely(destnode == tipc_own_addr))
                         return tipc_port_recv_sections(p_ptr, num_sect, msg_sect);
@@ -1551,7 +1542,7 @@ int tipc_forward_buf2name(u32 ref,
         skb_push(buf, LONG_H_SIZE);
         skb_copy_to_linear_data(buf, msg, LONG_H_SIZE);
         msg_dbg(buf_msg(buf),"PREP:");
-        if (likely(destport || destnode)) {
+        if (likely(destport)) {
                 p_ptr->sent++;
                 if (destnode == tipc_own_addr)
                         return tipc_port_recv_msg(buf);
diff --git a/net/tipc/port.h b/net/tipc/port.h
index 8d1652aab298..e74bd9563739 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -157,7 +157,7 @@ static inline u32 tipc_peer_node(struct port *p_ptr)
 
 static inline int tipc_port_congested(struct port *p_ptr)
 {
-        return((p_ptr->sent - p_ptr->acked) >= (TIPC_FLOW_CONTROL_WIN * 2));
+        return (p_ptr->sent - p_ptr->acked) >= (TIPC_FLOW_CONTROL_WIN * 2);
 }
 
 /**
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 66e889ba48fd..33217fc3d697 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -64,6 +64,7 @@ struct tipc_sock {
         struct sock sk;
         struct tipc_port *p;
         struct tipc_portid peer_name;
+        long conn_timeout;
 };
 
 #define tipc_sk(sk) ((struct tipc_sock *)(sk))
@@ -240,9 +241,9 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
         sock->state = state;
 
         sock_init_data(sock, sk);
-        sk->sk_rcvtimeo = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
         sk->sk_backlog_rcv = backlog_rcv;
         tipc_sk(sk)->p = tp_ptr;
+        tipc_sk(sk)->conn_timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
 
         spin_unlock_bh(tp_ptr->lock);
 
@@ -429,36 +430,55 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
  * to handle any preventable race conditions, so TIPC will do the same ...
  *
  * TIPC sets the returned events as follows:
- * a) POLLRDNORM and POLLIN are set if the socket's receive queue is non-empty
- *    or if a connection-oriented socket is does not have an active connection
- *    (i.e. a read operation will not block).
- * b) POLLOUT is set except when a socket's connection has been terminated
- *    (i.e. a write operation will not block).
- * c) POLLHUP is set when a socket's connection has been terminated.
- *
- * IMPORTANT: The fact that a read or write operation will not block does NOT
- * imply that the operation will succeed!
+ *
+ * socket state         flags set
+ * ------------         ---------
+ * unconnected          no read flags
+ *                      no write flags
+ *
+ * connecting           POLLIN/POLLRDNORM if ACK/NACK in rx queue
+ *                      no write flags
+ *
+ * connected            POLLIN/POLLRDNORM if data in rx queue
+ *                      POLLOUT if port is not congested
+ *
+ * disconnecting        POLLIN/POLLRDNORM/POLLHUP
+ *                      no write flags
+ *
+ * listening            POLLIN if SYN in rx queue
+ *                      no write flags
+ *
+ * ready                POLLIN/POLLRDNORM if data in rx queue
+ * [connectionless]     POLLOUT (since port cannot be congested)
+ *
+ * IMPORTANT: The fact that a read or write operation is indicated does NOT
+ * imply that the operation will succeed, merely that it should be performed
+ * and will not block.
  */
 
 static unsigned int poll(struct file *file, struct socket *sock,
                          poll_table *wait)
 {
         struct sock *sk = sock->sk;
-        u32 mask;
+        u32 mask = 0;
 
         poll_wait(file, sk_sleep(sk), wait);
 
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sock->state == SS_UNCONNECTED) ||
-            (sock->state == SS_DISCONNECTING))
-                mask = (POLLRDNORM | POLLIN);
-        else
-                mask = 0;
-
-        if (sock->state == SS_DISCONNECTING)
-                mask |= POLLHUP;
-        else
-                mask |= POLLOUT;
+        switch ((int)sock->state) {
+        case SS_READY:
+        case SS_CONNECTED:
+                if (!tipc_sk_port(sk)->congested)
+                        mask |= POLLOUT;
+                /* fall thru' */
+        case SS_CONNECTING:
+        case SS_LISTENING:
+                if (!skb_queue_empty(&sk->sk_receive_queue))
+                        mask |= (POLLIN | POLLRDNORM);
+                break;
+        case SS_DISCONNECTING:
+                mask = (POLLIN | POLLRDNORM | POLLHUP);
+                break;
+        }
 
         return mask;
 }
@@ -1026,9 +1046,8 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *buf;
         struct tipc_msg *msg;
         unsigned int sz;
-        int sz_to_copy;
+        int sz_to_copy, target, needed;
         int sz_copied = 0;
-        int needed;
         char __user *crs = m->msg_iov->iov_base;
         unsigned char *buf_crs;
         u32 err;
@@ -1050,6 +1069,8 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
+
 restart:
 
         /* Look for a message in receive queue; wait if necessary */
@@ -1138,7 +1159,7 @@ restart:
 
         if ((sz_copied < buf_len) &&    /* didn't get all requested data */
             (!skb_queue_empty(&sk->sk_receive_queue) ||
-             (flags & MSG_WAITALL)) &&  /* and more is ready or required */
+            (sz_copied < target)) &&    /* and more is ready or required */
             (!(flags & MSG_PEEK)) &&    /* and aren't just peeking at data */
             (!err))                     /* and haven't reached a FIN */
                 goto restart;
@@ -1174,7 +1195,7 @@ static int rx_queue_full(struct tipc_msg *msg, u32 queue_size, u32 base)
         if (msg_connected(msg))
                 threshold *= 4;
 
-        return (queue_size >= threshold);
+        return queue_size >= threshold;
 }
 
 /**
@@ -1365,6 +1386,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
         struct msghdr m = {NULL,};
         struct sk_buff *buf;
         struct tipc_msg *msg;
+        long timeout;
         int res;
 
         lock_sock(sk);
@@ -1379,7 +1401,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
         /* For now, TIPC does not support the non-blocking form of connect() */
 
         if (flags & O_NONBLOCK) {
-                res = -EWOULDBLOCK;
+                res = -EOPNOTSUPP;
                 goto exit;
         }
 
@@ -1425,11 +1447,12 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
 
         /* Wait until an 'ACK' or 'RST' arrives, or a timeout occurs */
 
+        timeout = tipc_sk(sk)->conn_timeout;
         release_sock(sk);
         res = wait_event_interruptible_timeout(*sk_sleep(sk),
                         (!skb_queue_empty(&sk->sk_receive_queue) ||
                         (sock->state != SS_CONNECTING)),
-                        sk->sk_rcvtimeo);
+                        timeout ? timeout : MAX_SCHEDULE_TIMEOUT);
         lock_sock(sk);
 
         if (res > 0) {
@@ -1692,7 +1715,7 @@ static int setsockopt(struct socket *sock,
                 res = tipc_set_portunreturnable(tport->ref, value);
                 break;
         case TIPC_CONN_TIMEOUT:
-                sk->sk_rcvtimeo = msecs_to_jiffies(value);
+                tipc_sk(sk)->conn_timeout = msecs_to_jiffies(value);
                 /* no need to set "res", since already 0 at this point */
                 break;
         default:
@@ -1747,7 +1770,7 @@ static int getsockopt(struct socket *sock,
                 res = tipc_portunreturnable(tport->ref, &value);
                 break;
         case TIPC_CONN_TIMEOUT:
-                value = jiffies_to_msecs(sk->sk_rcvtimeo);
+                value = jiffies_to_msecs(tipc_sk(sk)->conn_timeout);
                 /* no need to set "res", since already 0 at this point */
                 break;
          case TIPC_NODE_RECVQ_DEPTH:
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index ab6eab4c45e2..1a5b9a6bd128 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -604,6 +604,6 @@ int tipc_ispublished(struct tipc_name const *name)
 {
         u32 domain = 0;
 
-        return(tipc_nametbl_translate(name->type, name->instance,&domain) != 0);
+        return tipc_nametbl_translate(name->type, name->instance, &domain) != 0;
 }
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0b39b2451ea5..c586da3f4f18 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2033,11 +2033,10 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d6d046b9f6f2..9c21ebf9780e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -253,11 +253,16 @@ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
                         WARN_ON(err);
                         wdev->netdev->features |= NETIF_F_NETNS_LOCAL;
                 }
+
+                return err;
         }
 
         wiphy_net_set(&rdev->wiphy, net);
 
-        return err;
+        err = device_rename(&rdev->wiphy.dev, dev_name(&rdev->wiphy.dev));
+        WARN_ON(err);
+
+        return 0;
 }
 
 static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
@@ -428,7 +433,7 @@ int wiphy_register(struct wiphy *wiphy)
 
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
-        ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
+        ifmodes &= ((1 << NUM_NL80211_IFTYPES) - 1) & ~1;
         if (WARN_ON(ifmodes != wiphy->interface_modes))
                 wiphy->interface_modes = ifmodes;
 
@@ -683,8 +688,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
-                INIT_LIST_HEAD(&wdev->action_registrations);
-                spin_lock_init(&wdev->action_registrations_lock);
+                INIT_LIST_HEAD(&wdev->mgmt_registrations);
+                spin_lock_init(&wdev->mgmt_registrations_lock);
 
                 mutex_lock(&rdev->devlist_mtx);
                 list_add_rcu(&wdev->list, &rdev->netdev_list);
@@ -724,6 +729,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         dev->ethtool_ops = &cfg80211_ethtool_ops;
 
                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
                      wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
                         dev->priv_flags |= IFF_DONT_BRIDGE;
                 break;
@@ -732,6 +738,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 case NL80211_IFTYPE_ADHOC:
                         cfg80211_leave_ibss(rdev, dev, true);
                         break;
+                case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_STATION:
                         wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
@@ -804,7 +811,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
                         list_del_rcu(&wdev->list);
                         rdev->devlist_generation++;
-                        cfg80211_mlme_purge_actions(wdev);
+                        cfg80211_mlme_purge_registrations(wdev);
 #ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.keys);
 #endif
@@ -910,52 +917,3 @@ static void __exit cfg80211_exit(void)
         destroy_workqueue(cfg80211_wq);
 }
 module_exit(cfg80211_exit);
-
-static int ___wiphy_printk(const char *level, const struct wiphy *wiphy,
-                           struct va_format *vaf)
-{
-        if (!wiphy)
-                return printk("%s(NULL wiphy *): %pV", level, vaf);
-
-        return printk("%s%s: %pV", level, wiphy_name(wiphy), vaf);
-}
-
-int __wiphy_printk(const char *level, const struct wiphy *wiphy,
-                   const char *fmt, ...)
-{
-        struct va_format vaf;
-        va_list args;
-        int r;
-
-        va_start(args, fmt);
-
-        vaf.fmt = fmt;
-        vaf.va = &args;
-
-        r = ___wiphy_printk(level, wiphy, &vaf);
-        va_end(args);
-
-        return r;
-}
-EXPORT_SYMBOL(__wiphy_printk);
-
-#define define_wiphy_printk_level(func, kern_level)             \
-int func(const struct wiphy *wiphy, const char *fmt, ...)       \
-{                                                               \
-        struct va_format vaf;                                   \
-        va_list args;                                           \
-        int r;                                                  \
-                                                                \
-        va_start(args, fmt);                                    \
-                                                                \
-        vaf.fmt = fmt;                                          \
-        vaf.va = &args;                                         \
-                                                                \
-        r = ___wiphy_printk(kern_level, wiphy, &vaf);           \
-        va_end(args);                                           \
-                                                                \
-        return r;                                               \
-}                                                               \
-EXPORT_SYMBOL(func);
-
-define_wiphy_printk_level(wiphy_debug, KERN_DEBUG);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 63d57ae399c3..5d89310b3587 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -86,7 +86,7 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
 static inline
 bool wiphy_idx_valid(int wiphy_idx)
 {
-        return (wiphy_idx >= 0);
+        return wiphy_idx >= 0;
 }
 
 
@@ -95,7 +95,10 @@ extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
 extern int cfg80211_rdev_list_generation;
 
-#define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
+static inline void assert_cfg80211_lock(void)
+{
+        lockdep_assert_held(&cfg80211_mutex);
+}
 
 /*
  * You can use this to mark a wiphy_idx as not having an associated wiphy.
@@ -202,8 +205,8 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
         mutex_unlock(&wdev->mtx);
 }
 
-#define ASSERT_RDEV_LOCK(rdev) WARN_ON(!mutex_is_locked(&(rdev)->mtx));
-#define ASSERT_WDEV_LOCK(wdev) WARN_ON(!mutex_is_locked(&(wdev)->mtx));
+#define ASSERT_RDEV_LOCK(rdev) lockdep_assert_held(&(rdev)->mtx)
+#define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
 
 enum cfg80211_event_type {
         EVENT_CONNECT_RESULT,
@@ -331,16 +334,17 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *resp_ie, size_t resp_ie_len,
                                u16 status, bool wextev,
                                struct cfg80211_bss *bss);
-int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
-                                  const u8 *match_data, int match_len);
-void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid);
-void cfg80211_mlme_purge_actions(struct wireless_dev *wdev);
-int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_channel_type channel_type,
-                         bool channel_type_valid,
-                         const u8 *buf, size_t len, u64 *cookie);
+int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
+                                u16 frame_type, const u8 *match_data,
+                                int match_len);
+void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid);
+void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev);
+int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          enum nl80211_channel_type channel_type,
+                          bool channel_type_valid,
+                          const u8 *buf, size_t len, u64 *cookie);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index d1a3fb99fdf2..46f371160896 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -149,7 +149,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         int i;
-        bool found = false;
+        bool found = false, was_current = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -159,6 +159,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
                 found = true;
+                was_current = true;
         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
                 if (wdev->auth_bsses[i] &&
                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
@@ -183,7 +184,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
 
         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 
-        if (wdev->sme_state == CFG80211_SME_CONNECTED) {
+        if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
                 u16 reason_code;
                 bool from_ap;
 
@@ -747,31 +748,51 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 }
 EXPORT_SYMBOL(cfg80211_new_sta);
 
-struct cfg80211_action_registration {
+struct cfg80211_mgmt_registration {
         struct list_head list;
 
         u32 nlpid;
 
         int match_len;
 
+        __le16 frame_type;
+
         u8 match[];
 };
 
-int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
-                                  const u8 *match_data, int match_len)
+int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
+                                u16 frame_type, const u8 *match_data,
+                                int match_len)
 {
-        struct cfg80211_action_registration *reg, *nreg;
+        struct cfg80211_mgmt_registration *reg, *nreg;
         int err = 0;
+        u16 mgmt_type;
+
+        if (!wdev->wiphy->mgmt_stypes)
+                return -EOPNOTSUPP;
+
+        if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
+                return -EINVAL;
+
+        if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
+                return -EINVAL;
+
+        mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
+        if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
+                return -EINVAL;
 
         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
         if (!nreg)
                 return -ENOMEM;
 
-        spin_lock_bh(&wdev->action_registrations_lock);
+        spin_lock_bh(&wdev->mgmt_registrations_lock);
 
-        list_for_each_entry(reg, &wdev->action_registrations, list) {
+        list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
                 int mlen = min(match_len, reg->match_len);
 
+                if (frame_type != le16_to_cpu(reg->frame_type))
+                        continue;
+
                 if (memcmp(reg->match, match_data, mlen) == 0) {
                         err = -EALREADY;
                         break;
@@ -786,69 +807,83 @@ int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
         memcpy(nreg->match, match_data, match_len);
         nreg->match_len = match_len;
         nreg->nlpid = snd_pid;
-        list_add(&nreg->list, &wdev->action_registrations);
+        nreg->frame_type = cpu_to_le16(frame_type);
+        list_add(&nreg->list, &wdev->mgmt_registrations);
 
  out:
-        spin_unlock_bh(&wdev->action_registrations_lock);
+        spin_unlock_bh(&wdev->mgmt_registrations_lock);
         return err;
 }
 
-void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid)
+void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
 {
-        struct cfg80211_action_registration *reg, *tmp;
+        struct cfg80211_mgmt_registration *reg, *tmp;
 
-        spin_lock_bh(&wdev->action_registrations_lock);
+        spin_lock_bh(&wdev->mgmt_registrations_lock);
 
-        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+        list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
                 if (reg->nlpid == nlpid) {
                         list_del(&reg->list);
                         kfree(reg);
                 }
         }
 
-        spin_unlock_bh(&wdev->action_registrations_lock);
+        spin_unlock_bh(&wdev->mgmt_registrations_lock);
 }
 
-void cfg80211_mlme_purge_actions(struct wireless_dev *wdev)
+void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 {
-        struct cfg80211_action_registration *reg, *tmp;
+        struct cfg80211_mgmt_registration *reg, *tmp;
 
-        spin_lock_bh(&wdev->action_registrations_lock);
+        spin_lock_bh(&wdev->mgmt_registrations_lock);
 
-        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+        list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
                 list_del(&reg->list);
                 kfree(reg);
         }
 
-        spin_unlock_bh(&wdev->action_registrations_lock);
+        spin_unlock_bh(&wdev->mgmt_registrations_lock);
 }
 
-int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_channel_type channel_type,
-                         bool channel_type_valid,
-                         const u8 *buf, size_t len, u64 *cookie)
+int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          enum nl80211_channel_type channel_type,
+                          bool channel_type_valid,
+                          const u8 *buf, size_t len, u64 *cookie)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         const struct ieee80211_mgmt *mgmt;
+        u16 stype;
+
+        if (!wdev->wiphy->mgmt_stypes)
+                return -EOPNOTSUPP;
 
-        if (rdev->ops->action == NULL)
+        if (!rdev->ops->mgmt_tx)
                 return -EOPNOTSUPP;
+
         if (len < 24 + 1)
                 return -EINVAL;
 
         mgmt = (const struct ieee80211_mgmt *) buf;
-        if (!ieee80211_is_action(mgmt->frame_control))
+
+        if (!ieee80211_is_mgmt(mgmt->frame_control))
                 return -EINVAL;
-        if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
+
+        stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
+        if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
+                return -EINVAL;
+
+        if (ieee80211_is_action(mgmt->frame_control) &&
+            mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
                 /* Verify that we are associated with the destination AP */
                 wdev_lock(wdev);
 
                 if (!wdev->current_bss ||
                     memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
                            ETH_ALEN) != 0 ||
-                    (wdev->iftype == NL80211_IFTYPE_STATION &&
+                    ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
                      memcmp(wdev->current_bss->pub.bssid, mgmt->da,
                             ETH_ALEN) != 0)) {
                         wdev_unlock(wdev);
@@ -862,64 +897,75 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         /* Transmit the Action frame as requested by user space */
-        return rdev->ops->action(&rdev->wiphy, dev, chan, channel_type,
-                                 channel_type_valid, buf, len, cookie);
+        return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, channel_type,
+                                  channel_type_valid, buf, len, cookie);
 }
 
-bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
-                        size_t len, gfp_t gfp)
+bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
+                      size_t len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        struct cfg80211_action_registration *reg;
-        const u8 *action_data;
-        int action_data_len;
+        struct cfg80211_mgmt_registration *reg;
+        const struct ieee80211_txrx_stypes *stypes =
+                &wiphy->mgmt_stypes[wdev->iftype];
+        struct ieee80211_mgmt *mgmt = (void *)buf;
+        const u8 *data;
+        int data_len;
         bool result = false;
+        __le16 ftype = mgmt->frame_control &
+                cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
+        u16 stype;
 
-        /* frame length - min size excluding category */
-        action_data_len = len - (IEEE80211_MIN_ACTION_SIZE - 1);
+        stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 
-        /* action data starts with category */
-        action_data = buf + IEEE80211_MIN_ACTION_SIZE - 1;
+        if (!(stypes->rx & BIT(stype)))
+                return false;
 
-        spin_lock_bh(&wdev->action_registrations_lock);
+        data = buf + ieee80211_hdrlen(mgmt->frame_control);
+        data_len = len - ieee80211_hdrlen(mgmt->frame_control);
+
+        spin_lock_bh(&wdev->mgmt_registrations_lock);
+
+        list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
+                if (reg->frame_type != ftype)
+                        continue;
 
-        list_for_each_entry(reg, &wdev->action_registrations, list) {
-                if (reg->match_len > action_data_len)
+                if (reg->match_len > data_len)
                         continue;
 
-                if (memcmp(reg->match, action_data, reg->match_len))
+                if (memcmp(reg->match, data, reg->match_len))
                         continue;
 
                 /* found match! */
 
                 /* Indicate the received Action frame to user space */
-                if (nl80211_send_action(rdev, dev, reg->nlpid, freq,
-                                        buf, len, gfp))
+                if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
+                                      buf, len, gfp))
                         continue;
 
                 result = true;
                 break;
         }
 
-        spin_unlock_bh(&wdev->action_registrations_lock);
+        spin_unlock_bh(&wdev->mgmt_registrations_lock);
 
         return result;
 }
-EXPORT_SYMBOL(cfg80211_rx_action);
+EXPORT_SYMBOL(cfg80211_rx_mgmt);
 
-void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
-                               const u8 *buf, size_t len, bool ack, gfp_t gfp)
+void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+                             const u8 *buf, size_t len, bool ack, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
         /* Indicate TX status of the Action frame to user space */
-        nl80211_send_action_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
+        nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
 }
-EXPORT_SYMBOL(cfg80211_action_tx_status);
+EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
 
 void cfg80211_cqm_rssi_notify(struct net_device *dev,
                               enum nl80211_cqm_rssi_threshold_event rssi_event,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 37902a54e9c1..f15b1af2c768 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -136,6 +136,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
                 .len = sizeof(struct nl80211_sta_flag_update),
         },
         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
+        [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
@@ -156,6 +158,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 
         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
+        [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 };
 
 /* policy for the attributes */
@@ -407,12 +410,14 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
         switch (wdev->iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_P2P_GO:
                 break;
         case NL80211_IFTYPE_ADHOC:
                 if (!wdev->current_bss)
                         return -ENOLINK;
                 break;
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
                         return -ENOLINK;
                 break;
@@ -437,6 +442,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         struct ieee80211_rate *rate;
         int i;
         u16 ifmodes = dev->wiphy.interface_modes;
+        const struct ieee80211_txrx_stypes *mgmt_stypes =
+                                dev->wiphy.mgmt_stypes;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
@@ -471,6 +478,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
                    dev->wiphy.max_num_pmkids);
 
+        if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
+
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
                 goto nla_put_failure;
@@ -587,7 +597,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(flush_pmksa, FLUSH_PMKSA);
         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
-        CMD(action, ACTION);
+        CMD(mgmt_tx, FRAME);
         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
@@ -608,6 +618,55 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         nla_nest_end(msg, nl_cmds);
 
+        if (mgmt_stypes) {
+                u16 stypes;
+                struct nlattr *nl_ftypes, *nl_ifs;
+                enum nl80211_iftype ift;
+
+                nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
+                if (!nl_ifs)
+                        goto nla_put_failure;
+
+                for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
+                        nl_ftypes = nla_nest_start(msg, ift);
+                        if (!nl_ftypes)
+                                goto nla_put_failure;
+                        i = 0;
+                        stypes = mgmt_stypes[ift].tx;
+                        while (stypes) {
+                                if (stypes & 1)
+                                        NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
+                                                    (i << 4) | IEEE80211_FTYPE_MGMT);
+                                stypes >>= 1;
+                                i++;
+                        }
+                        nla_nest_end(msg, nl_ftypes);
+                }
+
+                nla_nest_end(msg, nl_ifs);
+
+                nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
+                if (!nl_ifs)
+                        goto nla_put_failure;
+
+                for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
+                        nl_ftypes = nla_nest_start(msg, ift);
+                        if (!nl_ftypes)
+                                goto nla_put_failure;
+                        i = 0;
+                        stypes = mgmt_stypes[ift].rx;
+                        while (stypes) {
+                                if (stypes & 1)
+                                        NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
+                                                    (i << 4) | IEEE80211_FTYPE_MGMT);
+                                stypes >>= 1;
+                                i++;
+                        }
+                        nla_nest_end(msg, nl_ftypes);
+                }
+                nla_nest_end(msg, nl_ifs);
+        }
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -709,7 +768,8 @@ static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
                 wdev->iftype == NL80211_IFTYPE_AP ||
                 wdev->iftype == NL80211_IFTYPE_WDS ||
                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
-                wdev->iftype == NL80211_IFTYPE_MONITOR;
+                wdev->iftype == NL80211_IFTYPE_MONITOR ||
+                wdev->iftype == NL80211_IFTYPE_P2P_GO;
 }
 
 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
@@ -776,7 +836,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev;
         struct net_device *netdev = NULL;
         struct wireless_dev *wdev;
-        int result, rem_txq_params = 0;
+        int result = 0, rem_txq_params = 0;
         struct nlattr *nl_txq_params;
         u32 changed;
         u8 retry_short = 0, retry_long = 0;
@@ -1636,7 +1696,8 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto unlock_rtnl;
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1728,7 +1789,8 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2071,10 +2133,12 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         switch (dev->ieee80211_ptr->iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_P2P_GO:
                 /* disallow mesh-specific things */
                 if (params.plink_action)
                         err = -EINVAL;
                 break;
+        case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
                 /* disallow everything but AUTHORIZED flag */
                 if (params.plink_action)
@@ -2176,7 +2240,8 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 goto out_rtnl;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
                 err = -EINVAL;
                 goto out;
         }
@@ -2229,7 +2294,8 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
                 err = -EINVAL;
                 goto out;
         }
@@ -2603,7 +2669,8 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3306,6 +3373,7 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         }
 
         switch (wdev->iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
                 if (intbss == wdev->current_bss)
                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
@@ -3572,12 +3640,28 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto unlock_rtnl;
 
+        if (key.idx >= 0) {
+                int i;
+                bool ok = false;
+                for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
+                        if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
+                                ok = true;
+                                break;
+                        }
+                }
+                if (!ok) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
+
         if (!rdev->ops->auth) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3624,7 +3708,8 @@ unlock_rtnl:
         return err;
 }
 
-static int nl80211_crypto_settings(struct genl_info *info,
+static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
+                                   struct genl_info *info,
                                    struct cfg80211_crypto_settings *settings,
                                    int cipher_limit)
 {
@@ -3632,6 +3717,19 @@ static int nl80211_crypto_settings(struct genl_info *info,
 
         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
 
+        if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
+                u16 proto;
+                proto = nla_get_u16(
+                        info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
+                settings->control_port_ethertype = cpu_to_be16(proto);
+                if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
+                    proto != ETH_P_PAE)
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
+                        settings->control_port_no_encrypt = true;
+        } else
+                settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
+
         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
                 void *data;
                 int len, i;
@@ -3718,7 +3816,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3759,7 +3858,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_PREV_BSSID])
                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
 
-        err = nl80211_crypto_settings(info, &crypto, 1);
+        err = nl80211_crypto_settings(rdev, info, &crypto, 1);
         if (!err)
                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
                                           ssid, ssid_len, ie, ie_len, use_mfp,
@@ -3802,7 +3901,8 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3868,7 +3968,8 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4236,7 +4337,7 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
 
         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
 
-        err = nl80211_crypto_settings(info, &connect.crypto,
+        err = nl80211_crypto_settings(rdev, info, &connect.crypto,
                                       NL80211_MAX_NR_CIPHER_SUITES);
         if (err)
                 return err;
@@ -4246,7 +4347,8 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto unlock_rtnl;
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4322,7 +4424,8 @@ static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto unlock_rtnl;
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4410,7 +4513,8 @@ static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4455,7 +4559,8 @@ static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4717,17 +4822,18 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
         return err;
 }
 
-static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
+static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
+        u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
         int err;
 
         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
                 return -EINVAL;
 
-        if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
-                return -EINVAL;
+        if (info->attrs[NL80211_ATTR_FRAME_TYPE])
+                frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
 
         rtnl_lock();
 
@@ -4736,18 +4842,20 @@ static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
                 goto unlock_rtnl;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
         /* not much point in registering if we can't reply */
-        if (!rdev->ops->action) {
+        if (!rdev->ops->mgmt_tx) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
+        err = cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
+                        frame_type,
                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
  out:
@@ -4758,7 +4866,7 @@ static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
+static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
@@ -4781,13 +4889,14 @@ static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto unlock_rtnl;
 
-        if (!rdev->ops->action) {
+        if (!rdev->ops->mgmt_tx) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -4824,17 +4933,17 @@ static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
         }
 
         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
-                             NL80211_CMD_ACTION);
+                             NL80211_CMD_FRAME);
 
         if (IS_ERR(hdr)) {
                 err = PTR_ERR(hdr);
                 goto free_msg;
         }
-        err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
-                                   channel_type_valid,
-                                   nla_data(info->attrs[NL80211_ATTR_FRAME]),
-                                   nla_len(info->attrs[NL80211_ATTR_FRAME]),
-                                   &cookie);
+        err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, channel_type,
+                                    channel_type_valid,
+                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
+                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
+                                    &cookie);
         if (err)
                 goto free_msg;
 
@@ -5005,7 +5114,8 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
                 goto unlock_rdev;
         }
 
-        if (wdev->iftype != NL80211_IFTYPE_STATION) {
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) {
                 err = -EOPNOTSUPP;
                 goto unlock_rdev;
         }
@@ -5333,14 +5443,14 @@ static struct genl_ops nl80211_ops[] = {
                 .flags = GENL_ADMIN_PERM,
         },
         {
-                .cmd = NL80211_CMD_REGISTER_ACTION,
-                .doit = nl80211_register_action,
+                .cmd = NL80211_CMD_REGISTER_FRAME,
+                .doit = nl80211_register_mgmt,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
         {
-                .cmd = NL80211_CMD_ACTION,
-                .doit = nl80211_action,
+                .cmd = NL80211_CMD_FRAME,
+                .doit = nl80211_tx_mgmt,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
@@ -6040,9 +6150,9 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
                                 nl80211_mlme_mcgrp.id, gfp);
 }
 
-int nl80211_send_action(struct cfg80211_registered_device *rdev,
-                        struct net_device *netdev, u32 nlpid,
-                        int freq, const u8 *buf, size_t len, gfp_t gfp)
+int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
+                      struct net_device *netdev, u32 nlpid,
+                      int freq, const u8 *buf, size_t len, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -6052,7 +6162,7 @@ int nl80211_send_action(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return -ENOMEM;
 
-        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
         if (!hdr) {
                 nlmsg_free(msg);
                 return -ENOMEM;
@@ -6080,10 +6190,10 @@ int nl80211_send_action(struct cfg80211_registered_device *rdev,
         return -ENOBUFS;
 }
 
-void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev, u64 cookie,
-                                   const u8 *buf, size_t len, bool ack,
-                                   gfp_t gfp)
+void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, u64 cookie,
+                                 const u8 *buf, size_t len, bool ack,
+                                 gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -6092,7 +6202,7 @@ void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
         if (!hdr) {
                 nlmsg_free(msg);
                 return;
@@ -6179,7 +6289,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
 
         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
-                        cfg80211_mlme_unregister_actions(wdev, notify->pid);
+                        cfg80211_mlme_unregister_socket(wdev, notify->pid);
 
         rcu_read_unlock();
 
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 2ad7fbc7d9f1..30d2f939150d 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -74,13 +74,13 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
                             struct net_device *dev, const u8 *mac_addr,
                             struct station_info *sinfo, gfp_t gfp);
 
-int nl80211_send_action(struct cfg80211_registered_device *rdev,
-                        struct net_device *netdev, u32 nlpid, int freq,
-                        const u8 *buf, size_t len, gfp_t gfp);
-void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev, u64 cookie,
-                                   const u8 *buf, size_t len, bool ack,
-                                   gfp_t gfp);
+int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
+                      struct net_device *netdev, u32 nlpid, int freq,
+                      const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, u64 cookie,
+                                 const u8 *buf, size_t len, bool ack,
+                                 gfp_t gfp);
 
 void
 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 1332c445d1c7..c774bc0f155e 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -14,6 +14,7 @@
  * See COPYING for more details.
  */
 
+#include <linux/kernel.h>
 #include <net/cfg80211.h>
 #include <net/ieee80211_radiotap.h>
 #include <asm/unaligned.h>
@@ -45,7 +46,7 @@ static const struct radiotap_align_size rtap_namespace_sizes[] = {
 };
 
 static const struct ieee80211_radiotap_namespace radiotap_ns = {
-        .n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
+        .n_bits = ARRAY_SIZE(rtap_namespace_sizes),
         .align_size = rtap_namespace_sizes,
 };
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f180db0de66c..d14bbf960c18 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -36,6 +36,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/random.h>
+#include <linux/ctype.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
 #include <net/cfg80211.h>
@@ -73,7 +74,11 @@ const struct ieee80211_regdomain *cfg80211_regdomain;
  *     - last_request
  */
 static DEFINE_MUTEX(reg_mutex);
-#define assert_reg_lock() WARN_ON(!mutex_is_locked(&reg_mutex))
+
+static inline void assert_reg_lock(void)
+{
+        lockdep_assert_held(&reg_mutex);
+}
 
 /* Used to queue up regulatory hints */
 static LIST_HEAD(reg_requests_list);
@@ -181,14 +186,6 @@ static bool is_alpha2_set(const char *alpha2)
         return false;
 }
 
-static bool is_alpha_upper(char letter)
-{
-        /* ASCII A - Z */
-        if (letter >= 65 && letter <= 90)
-                return true;
-        return false;
-}
-
 static bool is_unknown_alpha2(const char *alpha2)
 {
         if (!alpha2)
@@ -220,7 +217,7 @@ static bool is_an_alpha2(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        if (is_alpha_upper(alpha2[0]) && is_alpha_upper(alpha2[1]))
+        if (isalpha(alpha2[0]) && isalpha(alpha2[1]))
                 return true;
         return false;
 }
@@ -1399,6 +1396,11 @@ static DECLARE_WORK(reg_work, reg_todo);
 
 static void queue_regulatory_request(struct regulatory_request *request)
 {
+        if (isalpha(request->alpha2[0]))
+                request->alpha2[0] = toupper(request->alpha2[0]);
+        if (isalpha(request->alpha2[1]))
+                request->alpha2[1] = toupper(request->alpha2[1]);
+
         spin_lock(&reg_requests_lock);
         list_add_tail(&request->list, &reg_requests_list);
         spin_unlock(&reg_requests_lock);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index a8c2d6b877ae..f161b9844542 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -411,7 +411,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
         if (wdev->sme_state != CFG80211_SME_CONNECTING)
@@ -548,7 +549,8 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
@@ -644,7 +646,8 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 9f2cef3e0ca0..74a9e3cce452 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -110,6 +110,13 @@ static int wiphy_resume(struct device *dev)
         return ret;
 }
 
+static const void *wiphy_namespace(struct device *d)
+{
+        struct wiphy *wiphy = container_of(d, struct wiphy, dev);
+
+        return wiphy_net(wiphy);
+}
+
 struct class ieee80211_class = {
         .name = "ieee80211",
         .owner = THIS_MODULE,
@@ -120,6 +127,8 @@ struct class ieee80211_class = {
 #endif
         .suspend = wiphy_suspend,
         .resume = wiphy_resume,
+        .ns_type = &net_ns_type_operations,
+        .namespace = wiphy_namespace,
 };
 
 int wiphy_sysfs_init(void)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 0c8a1e8b7690..fb5448f7d55a 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -183,7 +183,14 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
                 break;
         default:
-                return -EINVAL;
+                /*
+                 * We don't know anything about this algorithm,
+                 * allow using it -- but the driver must check
+                 * all parameters! We still check below whether
+                 * or not the driver supports this algorithm,
+                 * of course.
+                 */
+                break;
         }
 
         if (params->seq) {
@@ -221,7 +228,7 @@ const unsigned char bridge_tunnel_header[] __aligned(2) =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 EXPORT_SYMBOL(bridge_tunnel_header);
 
-unsigned int ieee80211_hdrlen(__le16 fc)
+unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
 {
         unsigned int hdrlen = 24;
 
@@ -319,7 +326,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
         case cpu_to_le16(IEEE80211_FCTL_TODS):
                 if (unlikely(iftype != NL80211_IFTYPE_AP &&
-                             iftype != NL80211_IFTYPE_AP_VLAN))
+                             iftype != NL80211_IFTYPE_AP_VLAN &&
+                             iftype != NL80211_IFTYPE_P2P_GO))
                         return -1;
                 break;
         case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
@@ -347,7 +355,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
                 if ((iftype != NL80211_IFTYPE_STATION &&
-                    iftype != NL80211_IFTYPE_MESH_POINT) ||
+                     iftype != NL80211_IFTYPE_P2P_CLIENT &&
+                     iftype != NL80211_IFTYPE_MESH_POINT) ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, addr)))
                         return -1;
@@ -424,6 +433,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_P2P_GO:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -432,6 +442,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                 hdrlen = 24;
                 break;
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
                 memcpy(hdr.addr1, bssid, ETH_ALEN);
@@ -771,7 +782,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
         /* if it's part of a bridge, reject changing type to station/ibss */
         if ((dev->priv_flags & IFF_BRIDGE_PORT) &&
-            (ntype == NL80211_IFTYPE_ADHOC || ntype == NL80211_IFTYPE_STATION))
+            (ntype == NL80211_IFTYPE_ADHOC ||
+             ntype == NL80211_IFTYPE_STATION ||
+             ntype == NL80211_IFTYPE_P2P_CLIENT))
                 return -EBUSY;
 
         if (ntype != otype) {
@@ -782,6 +795,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         cfg80211_leave_ibss(rdev, dev, false);
                         break;
                 case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_P2P_CLIENT:
                         cfg80211_disconnect(rdev, dev,
                                             WLAN_REASON_DEAUTH_LEAVING, true);
                         break;
@@ -810,9 +824,11 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         if (dev->ieee80211_ptr->use_4addr)
                                 break;
                         /* fall through */
+                case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_ADHOC:
                         dev->priv_flags |= IFF_DONT_BRIDGE;
                         break;
+                case NL80211_IFTYPE_P2P_GO:
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_WDS:
@@ -823,7 +839,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         /* monitor can't bridge anyway */
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
-                case __NL80211_IFTYPE_AFTER_LAST:
+                case NUM_NL80211_IFTYPES:
                         /* not happening */
                         break;
                 }
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 8f5116f5af19..dc675a3daa3d 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -611,7 +611,7 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)
 #endif
 
 #ifdef CONFIG_CFG80211_WEXT
-        if (dev->ieee80211_ptr && dev->ieee80211_ptr &&
+        if (dev->ieee80211_ptr &&
             dev->ieee80211_ptr->wiphy &&
             dev->ieee80211_ptr->wiphy->wext &&
             dev->ieee80211_ptr->wiphy->wext->get_wireless_stats)
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 9818198add8a..6fffe62d7c25 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -197,6 +197,8 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         wdev->wext.connect.ssid_len = len;
 
         wdev->wext.connect.crypto.control_port = false;
+        wdev->wext.connect.crypto.control_port_ethertype =
+                                        cpu_to_be16(ETH_P_PAE);
 
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 5e86d4e97dce..f7af98dff409 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -507,14 +507,14 @@ static int x25_listen(struct socket *sock, int backlog)
         struct sock *sk = sock->sk;
         int rc = -EOPNOTSUPP;
 
-        lock_kernel();
+        lock_sock(sk);
         if (sk->sk_state != TCP_LISTEN) {
                 memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
                 sk->sk_max_ack_backlog = backlog;
                 sk->sk_state           = TCP_LISTEN;
                 rc = 0;
         }
-        unlock_kernel();
+        release_sock(sk);
 
         return rc;
 }
@@ -688,7 +688,6 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
         int len, i, rc = 0;
 
-        lock_kernel();
         if (!sock_flag(sk, SOCK_ZAPPED) ||
             addr_len != sizeof(struct sockaddr_x25) ||
             addr->sx25_family != AF_X25) {
@@ -704,12 +703,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 }
         }
 
+        lock_sock(sk);
         x25_sk(sk)->source_addr = addr->sx25_addr;
         x25_insert_socket(sk);
         sock_reset_flag(sk, SOCK_ZAPPED);
+        release_sock(sk);
         SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
 out:
-        unlock_kernel();
         return rc;
 }
 
@@ -751,7 +751,6 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
         struct x25_route *rt;
         int rc = 0;
 
-        lock_kernel();
         lock_sock(sk);
         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
                 sock->state = SS_CONNECTED;
@@ -829,7 +828,6 @@ out_put_route:
         x25_route_put(rt);
 out:
         release_sock(sk);
-        unlock_kernel();
         return rc;
 }
 
@@ -869,8 +867,7 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sk_buff *skb;
         int rc = -EINVAL;
 
-        lock_kernel();
-        if (!sk || sk->sk_state != TCP_LISTEN)
+        if (!sk)
                 goto out;
 
         rc = -EOPNOTSUPP;
@@ -878,6 +875,10 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
                 goto out;
 
         lock_sock(sk);
+        rc = -EINVAL;
+        if (sk->sk_state != TCP_LISTEN)
+                goto out2;
+
         rc = x25_wait_for_data(sk, sk->sk_rcvtimeo);
         if (rc)
                 goto out2;
@@ -897,7 +898,6 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
 out2:
         release_sock(sk);
 out:
-        unlock_kernel();
         return rc;
 }
 
@@ -909,7 +909,6 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         struct x25_sock *x25 = x25_sk(sk);
         int rc = 0;
 
-        lock_kernel();
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED) {
                         rc = -ENOTCONN;
@@ -923,19 +922,6 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         *uaddr_len = sizeof(*sx25);
 
 out:
-        unlock_kernel();
-        return rc;
-}
-
-static unsigned int x25_datagram_poll(struct file *file, struct socket *sock,
-                           poll_table *wait)
-{
-        int rc;
-
-        lock_kernel();
-        rc = datagram_poll(file, sock, wait);
-        unlock_kernel();
-
         return rc;
 }
 
@@ -1746,7 +1732,7 @@ static const struct proto_ops x25_proto_ops = {
         .socketpair =   sock_no_socketpair,
         .accept =       x25_accept,
         .getname =      x25_getname,
-        .poll =         x25_datagram_poll,
+        .poll =         datagram_poll,
         .ioctl =        x25_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = compat_x25_ioctl,